HUD’s mission is to increase home ownership, support community development, and increase access to affordable housing free from discrimination. To these ends, it has established six strategic goals: (1) increasing home ownership opportunities; (2) promoting decent affordable housing; (3) strengthening communities; (4) ensuring equal opportunity in housing; (5) embracing high standards of ethics, management, and accountability; and (6) promoting participation of faith- based and community organizations. HUD works with other federal agencies and branches of government, as well as with local governments, faith-based and community organizations, and the private sector to achieve these goals. To carry out its mission, HUD is organized into five main program areas: Housing, Community Planning and Development, Fair Housing and Equal Opportunity, Public and Indian Housing, and the Government National Mortgage Association. Office of Housing: This office oversees the Federal Housing Administration (FHA) and regulates certain aspects of the housing industry. Among other things, its mission is to contribute to building and preserving healthy neighborhoods and communities; maintain and expand home ownership, rental housing, and health care opportunities; and stabilize credit markets in times of economic disruption. The office is composed of two mission areas: single-family housing and multifamily housing. Single-family housing programs provide mortgage insurance on loans to purchase homes. Multifamily programs provide mortgage insurance to lenders on loans for the development of housing projects and health care facilities. Office of Community Planning and Development: The office’s mission is to provide decent housing, a suitable living environment, and economic opportunities for people of low and moderate income. To accomplish this, it engages in partnerships with all levels of government, the private sector, and nonprofit organizations. Office of Fair Housing and Equal Opportunity: The office’s mission is to administer and enforce federal laws that prohibit discrimination in housing, such as the Fair Housing Act and the Civil Rights Act of 1964. To accomplish this, it establishes and enforces policies intended to ensu that all Americans have equal access to housing of their choice. Office of Public and Indian Housing: The office’s mission is to ensure safe, decent, and affordable housing and create opportunities for residents’ self-sufficiency and economic independence. Among other things, this office administers and manages programs authorized by the Housing Act of 1937 to provide housing to over 1.3 million households. Government National Mortgage Association (Ginnie Mae): This HUD- owned corporation’s mission is to expand affordable housing by linking global capital markets to the nation’s housing markets. While Ginnie Mae does not issue loans or mortgage-backed securities, it guarantees investors timely payment and interest on mortgage-backed securities backed by federally insured or guaranteed loans. HUD also consists of a number of mission support offices, such as the Office of Healthy Homes and Lead Hazard Control and the Office of Faith- Based and Community Initiatives, as well as administrative offices, such as the Office of the Chief Procurement Officer and the Office of the Chief Information Officer (OCIO). Figure 1 provides a simplified view of the department’s organizational structure. HUD’s fiscal year 2008 appropriation was about $37.6 billion, while its fiscal year 2009 appropriation is about $41.5 billion. HUD’s budget request for fiscal year 2010 is about $46.3 billion. The department has approximately 8,500 employees in 81 field offices that are resident in all 50 states, the District of Columbia, and Puerto Rico. During the past year, legislation has been enacted to stimulate our nation’s economy, in part through strengthening the housing market. Under this legislation, HUD was given new responsibilities and additional funding to help meet these new responsibilities. Specifically, the Housing and Economic Recovery Act of 2008 established a program at FHA intended to help families avoid home foreclosure by refinancing them into FHA- insured mortgages. The act also authorized $25 million for each of fiscal years 2009 through 2013 for improvements to FHA’s IT, among other things. In addition, the American Recovery and Reinvestment Act of 2009 provided roughly $11.6 billion to HUD across a range of programs, and authorized HUD to, depending on the program, use either up to 1/2 percent or up to 1 percent of the funds for IT and other administrative costs related to most of these programs. As such, the act recognizes that HUD’s ability to effectively implement these programs depends in part on its simultaneous delivery of enhanced IT support. According to OCIO officials, of the approximately $61 million made available for IT under this act, about 2.5 percent or $1.5 million will be spent on the development of a new system supporting reporting requirements mandated by the act, while the remainder is planned to be used to maintain or enhance existing systems. IT plays a critical role in HUD’s ability to carry out its missions, supporting data collection and dissemination throughout the department and to external partners. For instance, the department reports that its business areas rely on IT to process over 50,000 loan requests per week, over 12,000 service calls per month, and more than 7,000 grant requests annually for each of its major grant programs. Further, the department’s increased responsibilities under the Housing and Economic Recovery Act of 2008 will introduce greater processing requirements for FHA loan applications and new budget reporting requirements, and thus further increase its reliance on IT. OCIO is responsible for supporting HUD programs, services, and management processes by providing high-quality IT solutions and services. To this end, OCIO has established four IT strategic goals: (1) rapidly modernizing IT to support key HUD business initiatives; (2) transforming the IT infrastructure to adapt to and adopt emerging technologies; (3) developing a cadre of highly capable IT professionals with mission critical competencies; and (4) providing secure, rapid, and reliable data and information to customers, citizens, and business partners. OCIO consists of the Chief Information Officer (CIO), two Deputy Chief Information Officers, and eight offices. These offices are responsible for systems integration and efficiency; policy and E-government; IT governance and investment; IT operations; enterprise architecture (EA); IT strategic planning and communication; administrative services; and IT security. (See fig. 2 for an OCIO organizational chart depicting key positions; see table 1 for a summary of each office’s roles and responsibilities.) HUD’s current IT environment does not effectively support its ongoing business operations. According to the department’s recent operating plans and budget submissions to Congress, its information systems are overlapping and duplicative, are not integrated, necessitate manual workloads, and employ antiquated technologies that are costly to maintain. More specifically: It consists of over 200 information systems, many of which perform the same functions and thus are duplicative. For example, it has at least 16 financial management systems that it plans to consolidate. It consists of stove-piped, nonintegrated systems. For example, multiple systems support grants management and cannot share related data. It provides insufficient support for key business processes, such as grants management, thus necessitating reliance on manual processing. Specifically, four of its offices perform most of their own grants management operations manually, about $7 billion in annual low-income, housing, project-based contracts are renewed using a paper intensive process, and about $16 billion per year is managed using a spreadsheet application. It consists of antiquated and complex systems that are costly to maintain. For example, HUD relies on several different operating systems and 35 different programming languages, each of which requires specialized skills to operate and maintain. In addition, a 2007 study of HUD’s IT environment found that the average age of its information systems was nearly 15 years, which is more than twice that of other agencies (6 years). HUD funds its IT operations through its working capital fund (WCF). The WCF is funded through both direct appropriations and program transfers from HUD mission-focused programs. As illustrated in figure 3, the majority of WCF funding has consistently been through direct appropriations, although funding from program transfers has increased steadily. As also illustrated, until fiscal year 2009, the level of total IT funding had declined. Funding for HUD’s IT environment can be split into two categories: maintenance and development. Maintenance of its existing IT environment includes application operations support for approximately 200 existing systems; infrastructure costs for shared IT services across the department and regional locations, such as hardware support, disaster recovery, and facilities management; and salaries and indirect expenses for 255 full-time equivalent OCIO positions, as well as certain staff who provide management support to IT services from the Office of the Chief Procurement Officer and the Office of the Chief Financial Officer. Development includes modernizing systems to better support HUD’s mission and business priorities. As illustrated in figure 4, the percentage of funds obligated for new development (i.e., modernization) has consistently been a small percentage of total IT obligations, particularly in fiscal year 2008 when only about 2 percent of IT obligations was for development. HUD’s fiscal year 2010 budget request provides for increases in IT funding under what it refers to as its “Transformation Initiative.” This initiative consists of four related components, one of which focuses on modernizing IT systems in order to decrease HUD’s reliance on its legacy environment. According to the budget request, the initiative’s funding is to be 1 percent of HUD’s total budget, or approximately $434 million. HUD officials stated that the potential exists for as much as one-half of this amount (or about $217 million) to be used for modernization of its IT systems. A federal agency’s ability to effectively and efficiently maintain and modernize its existing IT environment depends in large part on how well it employs certain IT management controls that are embodied in statutory requirements, federal guidance, and best practices. Among other things, these controls include strategic planning and performance measurement, portfolio-based investment management, human capital management, enterprise architecture (and supporting segment architecture) development and use, and establishing responsibility and accountability for modernization management. The purpose of each of these controls is as follows: Strategic planning and performance measurement are intended to ensure that an organization’s IT strategic goals are aligned with its overall mission goals and outcomes and that these IT goals are supported by clearly defined (1) activities aimed at accomplishing the goals and (2) measures for determining performance in accomplishing these activities and goals. These principles are reinforced through statutory requirements. By establishing such activities and measures and then monitoring actual- versus-expected performance, an organization can better understand progress, and thus the need for corrective action, in achieving its IT strategic goals. Investment management is aimed at selecting, controlling, and evaluating investments in IT in a manner that better ensures that they produce business value, reduce investment-related risks, and increase accountability and transparency in the investment decision-making process. In 2004, we issued a framework for assessing federal agencies’ investment management practices that consists of five progressive stages of maturity, with Stage 1 representing immature and undisciplined investment management structures and processes, and Stage 5 representing optimized maturity focused on continuous improvement. Stage 3—our focus in this report—is where an organization moves from project-centric to portfolio-based investment processes. Through a portfolio-based approach, the organization can consider new investment proposals, along with previously funded investments, and identify the appropriate mix and synergies of these investments to best meet mission needs, technology needs, and priorities for improvement. Organizations that have implemented Stage 3 practices have capabilities in place that assist in the establishment of selection, control, and evaluation structures, policies, procedures, and practices that are consistent with the investment management provisions of the Clinger-Cohen Act. Human capital management is intended to ensure that an organization has the employees with the appropriate knowledge and skills to effectively execute critical IT functions. It involves assessing IT workforce needs, inventorying existing staff’s knowledge and skills and identifying any gaps between needs and existing capabilities, and developing strategies and plans to fill any gaps. EA development and use is aimed at establishing a corporate blueprint for investing that connects strategic plans with individual programs and system solutions. As such, this blueprint provides the information details needed to guide and constrain investments in a consistent, coordinated, and integrated fashion—thereby improving interoperability, reducing duplicative efforts, and optimizing mission operations. In brief, an EA includes descriptions of an organization’s current or “as is” environment and its target or “to be” environment. The architecture also includes a transition or sequencing plan, which is based on an analysis of the gaps between the “as is” and “to be” environments. In 2003, we issued a framework for assessing and improving an organization’s EA management that includes five stages of maturity for developing, maintaining, and implementing an architecture. One approach to providing the EA information details needed to adequately inform, and thus guide and direct, program and system solution implementations is to divide the architecture into segments and to develop more detailed architectures for each segment. As such, segment architectures can be used to provide a bridge between the corporate frame of reference captured in the EA and each individual program and system investment. The Office of Management and Budget (OMB) has issued guidance related to segment architectures. As part of its guidance, agencies are to group their segments into three categories: core mission areas (e.g., single-family housing), business services (e.g., financial management), and enterprise services (e.g., records management). Effective modernization management includes having clearly defined and assigned responsibilities. This often involves a modernization program office that is accountable for planning, evaluating, executing, and tracking an enterprise’s modernization efforts. The department has, to varying degrees, established certain key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. HUD officials are aware of the need to strengthen each of these controls, but they stated that a combination of turnover in OCIO senior leaders and a pre-2009 decline in IT resources constrained their efforts to do so. Because these controls are critical to managing an organization’s existing IT environment and to modernizing it, and given HUD’s recent and planned increases in modernization-related activities, it is important for the department to fully establish each control. Until it does, the performance of HUD’s existing IT environment, as well as its efforts to modernize this environment, will be at risk. Effective IT strategic planning and performance measurement can help an organization effectively and efficiently leverage IT in meeting mission goals and achieving performance outcomes. To this end, executive agencies are to establish goals for improving the efficiency and effectiveness of their operations through the effective use of IT, annually submit to Congress a report on their progress in achieving these goals, and establish and apply performance measures to determine how well IT supports their programs. In addition, HUD guidance emphasizes the importance of regularly assessing progress in implementing its IT strategic plan and provides for quarterly and annual CIO reporting on progress against its strategic goals. To its credit, HUD established goals and performance measures, as required. Specifically, it developed an IT strategic plan in January 2006 that defines four strategic goals that are intended to improve IT’s contribution to program productivity, efficiency, and effectiveness. These goals are to (1) rapidly modernize IT to support key HUD business initiatives; (2) transform the IT infrastructure to adapt to and adopt emerging technologies; (3) develop a cadre of highly capable IT professionals with mission critical competencies; and (4) provide secure, rapid, and reliable data and information to customers, citizens, and business partners. In addition, the plan identifies a range of activities necessary to achieve each of these goals. For example, to transform the IT infrastructure to adapt to and adopt emerging technologies, HUD intends to increase the reuse of its components, improve program management, identify infrastructure requirements, and perform customer training for new technologies. The plan also includes performance measures for each strategic goal, which according to HUD, are to serve as indicators of the extent to which the IT goals are being met and how well IT is supporting the department’s mission. For example, for this same strategic goal, two of its performance measures are “100 percent of contract actions are completed on time” and “infrastructure collaborates with 100 percent of program areas/project managers and developers to ensure project plans and architectures are agreed upon.” However, HUD did not assess and report on performance against its four IT strategic goals in fiscal year 2008, as required. Moreover, while HUD assessed and reported on its IT performance in fiscal year 2007, this assessment showed that it was either behind schedule or not making progress in 46 percent of the activities it defined as needed to achieve its IT strategic goals. At the same time, the basis for those assessments is not clear. For example, for its strategic goal to develop a cadre of highly capable IT professionals with mission critical competencies, HUD only reported that it was “not progressing in establishing a team to support customer service management,” and thus did not relate the specific status of this activity to measurable commitments. In addition, the fiscal year 2007 assessment did not address how well IT supports the department’s mission outcomes, and it did not measure performance against any of the indicators in the IT strategic plan. OCIO officials attributed the agency’s performance measurement weaknesses to, among other things, turnover in OCIO senior leaders. According to these officials, efforts are under way to redefine HUD’s process for measuring the performance and progress of IT operations, and this new process is to be implemented by the end of fiscal year 2010. In the meantime, HUD reports that it has commenced efforts to assess performance during fiscal year 2009. However, no plan exists that defines how performance in fiscal year 2009 will be assessed or how this new process is to be developed and implemented, including a schedule of activities and resource needs. Until HUD regularly assesses and reports progress against its strategic IT performance measures and activities, it will not be in compliance with a statutory requirement and will not know how well it is achieving its IT strategic goals and where it needs to improve. Thus, its ability to effectively and efficiently support HUD mission operations may be impaired. If managed effectively, IT investments can have a dramatic impact on an organization’s performance and accountability. If mismanaged, they can result in wasteful spending and lost opportunities for achieving mission goals and improving mission performance. According to our Information Technology Investment Management (ITIM) framework, an organization that has reached Stage 3 of maturity manages projects as a portfolio of investments, treating them as integrated packages of competing investment options and thereby pursuing those that best meet the organization’s strategic goals and mission. Managing IT investments as portfolios also allows an organization to make more informed decisions about which projects to begin funding and continue funding based on analyses of the relative organizational value and risks of all projects, including those that are proposed, under development, and in operation. Our prior work has shown that the absence of a portfolio-based approach to IT investment management can contribute to duplication in programs and equipment that do not operate effectively together. Stage 3 maturity involves implementation of four critical processes: (1) defining the portfolio criteria; (2) creating the portfolio; (3) evaluating (i.e., controlling) the portfolio; and (4) conducting postimplementation reviews. Table 2 summarizes the purpose of each of these processes. To effectively manage a portfolio of investments, an organization should establish policies and procedures to address each of these critical processes, as well as the key practices needed to evaluate its portfolio. To HUD’s credit, it has established the range of necessary policies and procedures needed to execute three of the four critical processes associated with developing a complete investment portfolio—defining the portfolio, creating the portfolio, and conducting postimplementation reviews. However, it has not established policies and procedures and is not executing five of the six key practices needed to satisfy the fourth— evaluating the portfolio. For defining portfolio criteria, HUD’s ITIM process guide identifies an annual time frame and responsibilities for creating and modifying investment selection criteria. Specifically, the OCIO is to develop proposed criteria, the Technology Investment Board Working Group (TIBWG) is responsible for reviewing and commenting on the criteria, and the Technology Investment Board Executive Committee (TIBEC) approves the final criteria. The process guide also states that the criteria are to reflect HUD strategies, modernization goals, and OMB exhibit 300 criteria. For creating the portfolio, the TIBWG is to annually analyze and compare IT projects to be included in the portfolio using, among other things, IT portfolio selection criteria, funding requests, and departmental priorities identified by the TIBEC. The group’s recommendations for the portfolio, including recommended project priorities, are to be provided to the TIBEC for an approval decision. This decision is to be guided by HUD’s policy that identifies a series of questions, such as “Does the portfolio reflect HUD’s strategic priorities?” and “Have potential funding constraints been considered?” To maintain the portfolio, HUD’s guidance states that, as a result of ongoing control reviews, recommendations can be made to the TIBEC to maintain or adjust the IT portfolio, including the cancellation of a project. For conducting postimplementation reviews, HUD has developed detailed guidance. For example, these reviews are to be conducted within 6 to 18 months after the implementation of a project to validate actual investment results and extract lessons learned for ITIM process improvement. These reviews are to be conducted by designated teams that are selected annually by ITIM staff using identified criteria and represent a cross section of representatives from various disciplines, such as EA and IT operations. The guide also provides a step-by-step process for conducting the reviews, as well as detailed evaluation criteria to be applied to help formulate findings. The results of this review process are to be provided to the reviewed project’s sponsors, managers, and other stakeholders, and a summary of the results is to be provided to the TIBWG. For evaluating the portfolio, HUD does not have policies and procedures for reviewing, evaluating, and improving the performance of its portfolio. Specifically, while the TIBEC charter establishes that it is responsible for conducting regular reviews to assess and improve the performance of HUD’s investment portfolio, policies and procedures that address this responsibility have not been established. (See table 3 for a summary of our analysis relative to HUD’s policies and procedures for each Stage 3 critical process.) Moreover, the department is not executing five of the six additional key practices associated with evaluating its portfolio. Specifically, the department does not evaluate performance of its overall investment portfolio on a continuing basis and has not established criteria for assessing overall portfolio performance. (See table 4 for a summary of our analysis of the practices related to the evaluating the portfolio critical process, with the exception of the establishment of policies and procedures, which is addressed in table 3.) The OCIO’s Director of ITIM attributed these portfolio management weaknesses to limitations in resources. The Director of ITIM also stated that the department recognizes the need to improve IT portfolio investment management, adding that a plan will be developed within the next 12 months to address the key practice weaknesses that we identified. Without having defined and implemented practices for evaluating the performance of its IT investment portfolios, HUD will be limited in its ability to control the risks and achieve the benefits associated with the mix of legacy system and modernization investments that it selects. Effective human capital management requires a strategic and proactive approach to meeting current and future human capital needs. By employing such an approach, organizations can be better positioned to have the people with the right knowledge, skills, and abilities to support mission operations both today and in the future. The success or failure of federal programs depends, in large part, on having the right number of people with the right mix of knowledge and skills. Since 2001, we have designated the strategic management of human capital as a governmentwide high-risk area. We have previously reported on principles for strategic workforce planning, which outline guidance for human capital management. Strategic workforce planning involves (1) determining the critical skills and competencies needed to achieve current and future program results, (2) analyzing the gaps between current skills and future needs, and (3) developing strategies for filling gaps. If performed effectively, these activities can collectively create a strategic and proactive approach to human capital management. OCIO has not adequately performed most of these activities: The office assessed its needed IT workforce skills and competencies (requirements) in fiscal year 2008, based on interviews with most, but not all, OCIO managers. The office performed an analysis of the gaps between its IT workforce requirements and skills (inventory) in fiscal year 2008 using an outdated inventory of human capital skills, thus rendering the identified gaps unreliable. Specifically, OCIO’s IT workforce skills inventory was based on a 2006 governmentwide survey conducted by the Office of Personnel Management and the Federal Chief Information Officer’s Council. However, this inventory only covered about 48 percent of HUD’s IT workforce. Moreover, since then, HUD has reduced its IT workforce by about 26 percent, and this reduction, according to the Acting CIO, mostly affected persons with specialized skills who operate and maintain existing systems and are difficult to replace. According to OCIO officials, they plan to conduct an inventory of IT workforce skills, as well as to participate in a follow-up to the 2006 governmentwide survey that is to begin in early 2010. However, they did not have a plan or time frame for completing their own inventory. The office developed a strategy for closing the gaps, including steps, activities, and related milestones. However, the strategy is based on the aforementioned unreliable gap analysis, and it has yet to be implemented. OCIO officials did not know when implementation of this strategy would begin or be completed. Aspects of this strategy not yet implemented include developing and implementing performance metrics for gauging HUD’s IT project management capability by December 2008 and a training plan for building its IT investment management capability by January 2009. OCIO officials cited various reasons for these weaknesses in its IT human capital management, including the expense of conducting an inventory of current IT workforce skills and limitations in resources available to implement its strategy for closing its human capital gaps. Without effective IT human capital management, it is unlikely that HUD will have the people it needs to effectively operate and maintain existing systems and to deliver modernized systems, thus impairing its ability to provide the department’s mission operations with effective and efficient IT support. A key aspect of HUD’s approach to modernizing its IT environment is to extend its EA to include what are referred to as segment architectures, which are to provide the modernization details needed to develop and implement system solutions for portions, or segments, of a department or agency. Such a “divide and conquer” approach to modernizing is advocated by OMB. To this end, HUD has established a departmentwide EA that largely satisfies relevant federal guidance, and it has identified and prioritized 37 segments, as provided for in federal guidance. However, it has only developed architectures for 8 of its segments, and not all of these 8 are its highest priority segments. Moreover, the majority of the segment architectures developed thus far are out of date and do not fully address key aspects of federal guidance, such as provisions for performance goals and measurement. At the same time, HUD is investing in modernization projects in at least 3 of these segments in fiscal year 2009. Unless HUD develops well-defined segment architectures to guide and constrain modernization projects, it risks investing time and resources in systems that do not reflect department priorities, are not well integrated, are potentially duplicative, and do not optimally support mission operations and performance. In August 2006, we reported that HUD had largely established an EA program but was nevertheless missing two key aspects. Since then, HUD has taken steps to address these aspects and additional steps are planned. As noted earlier, our EA Management Maturity Framework provides a five-stage approach to managing the development, maintenance, and implementation of an architecture and understanding the extent to which effective architecture management practices are being performed and where an organization is progressing toward having a well-managed architecture program. In short, the framework consists of 31 core elements that relate to architecture governance, content, use, and measurement. These elements reflect research by us and others showing that architecture programs should be founded upon institutional architecture commitment and capabilities, and on measured and verified products and results. Satisfying the framework’s core elements helps organizations reduce the risk of investing in IT assets that are duplicative, are not well-integrated, and do not optimally support mission operations. To HUD’s credit, it had satisfied the vast majority of the core elements described in our framework as of August 2006, as the following examples illustrate: HUD established a committee or group representing the enterprise and responsible for directing, overseeing, and approving the EA, and thereby demonstrating the organization’s commitment to obtaining buy-in for the EA from across the organization, and providing vested ownership and accountability for the EA and its use as a transformational tool at the most senior levels of the organization. The department developed EA plans that called for describing the enterprise in terms of business, performance, information/data, application/service, technology, and security. Having such descriptions is consistent with recognized frameworks governing EA content, including OMB’s EA “reference models.” In short, these models collectively provide for defining an enterprise’s operations in both business terms (e.g., business processes, business rules, information needs and flows, shared business services, and work locations and users) as well as technical terms (e.g., hardware, software, data, and security attributes and standards). It measured and reported on the quality of its EA products, which is important for informing senior leadership about EA progress and thus providing a means for timely and appropriate actions to address deviations from established goals. It established the EA as an integral part of the IT investment management process, thus ensuring that the organization approves those investments that move it toward the target architecture, as defined in the sequencing plan. It developed the EA using a framework, methodology, and automated tool, thereby helping to ensure that its architecture was developed according to a defined structure and nomenclature, as well as explicit and consistent steps, and that the architecture is captured in a repository that is accessible and can be updated. Nevertheless, we also reported that HUD had not addressed two important elements. First, HUD had yet to adequately incorporate information security into its EA. Since that time, HUD issued an Enterprise Security Architecture in April 2007 that provides a target conceptual framework for information protection. For example, it contains the architecture’s goals and objectives and generally (1) discusses security drivers (e.g., external threats such as hackers and cyber terrorists); (2) describes security governance (e.g., roles and responsibilities of key players with references to HUD security policy, standards, and guidelines); (3) identifies the purpose of the HUD security concept of operations, planning, and risk management, noting that each is resident in other HUD procedural and process guidance; and (4) describes a target security environment (e.g., types of security services and the security impact levels for categories of data). In addition, HUD’s Enterprise Security Architecture states that segment architectures are to be the primary means of implementing its security architecture, and thus the details surrounding how target concepts will be implemented and achieved will be specified in these segment architectures. Of the 8 HUD segment architectures developed to date, each of which are discussed later in this report, only its single-family housing segment architecture addresses information security, while the others do not. According to HUD’s Director of EA, security will be addressed in the remaining segment architectures, as new ones are developed and existing ones are updated. However, no schedule exists defining when this will occur. Adequately incorporating security into the EA and related segment architectures is important because security is an integral aspect of an architecture’s performance, business, information/data, application/service, and technical models, and needs to be reflected thoroughly and consistently across each of them to ensure that new and existing investments meet the department’s information assurance needs. Second, we also reported that HUD had yet to submit its EA products and management processes to independent verification and validation. Since that time, HUD developed an independent verification and validation plan, and a HUD OCIO organization has reviewed three EA products, including the Enterprise Security Architecture document. However, OCIO officials told us independent verification and validation activities were discontinued in 2007 because of resource limitations. As a result, HUD continues to lack important information about the quality of its architecture products and management processes that are needed to have a mature EA program. HUD is approaching its business modernization efforts through the development of segment architectures, which can be viewed as subsets of an EA or a bridge between the EA and IT investments. According to OMB guidance, agencies should (1) define enterprise segments as components of their EA planning activities and (2) prioritize segments by focusing first on those that will help the agency perform its mission most effectively. Further, it identifies three segment types: core mission areas, business services (e.g., financial management), and enterprise services (e.g., information sharing). It also states that agencies (1) must have a structured process to determine high-priority segments that is based on such factors as statutory requirements, the agency’s strategic plan and its IT strategic plan, impact on mission performance, and cost efficiency opportunities and (2) should initiate development of architectures for high-priority segments after the CIO has approved segment priorities. HUD’s 2005 EA transition plan, which was approved by the TIBEC, identifies, classifies, and prioritizes 37 segments. According to the plan, the priorities were based on the following considerations: business transformation impact, financial impact, impact on execution of other high-priority transition activities, resource availability, opportunities for early success, and the ability to leverage work in progress. Further, the priorities were determined using a scale of 1 to 5, with 5 as the highest priority. (See table 5 for these priorities and app. II for descriptions of each segment.) To date, HUD has developed 8 segment architectures. However, the 8 segments are not the department’s 8 highest priorities (see table 6). Specifically, HUD has developed an architecture for its highest priority segment, financial management, but its next 4 highest segment priorities (controls and oversight, tracking and workflow, integrated enterprise data management, and identity management), each with priority scores of 4.0 or above, do not yet have architectures. Moreover, HUD has developed architectures for only 4 of the next 10 highest priority segments, each with scores between 3.5 and 4. At the same time, it has developed architectures for 3 segments with priority scores of less than 3. OCIO’s Director of EA stated that because IT funding has not been available to develop segment architectures according to the established priorities, HUD’s development of segment architectures has been driven by whether individual business units make funds available for their respective segments. For example, even though acquisition management ranks as 24th out of 37 in priority, it is one of the eight developed architectures because the Office of the Chief Procurement Officer provided funding for its development. According to the Director of EA, HUD is currently developing a structured methodology for prioritizing segments, and once this process is approved by the TIBWG and TIBEC, the department will begin implementing it. Until the department begins developing segment architectures in accordance with defined priorities, it will increase the risk of investing limited IT resources in a manner that does not reflect the department’s priorities. The development and maintenance of the eight segment architectures do not reflect key aspects of relevant federal guidance. According to relevant guidance, a segment architecture is to be developed and maintained by an integrated project team (IPT) that consists of key stakeholders, such as a program manager, business subject matter experts, and enterprise architects. In this regard, the guidance states that this team is critical to successful segment architecture development and should be involved in each step of development process and responsible for making decisions relative to defining business and technology requirements and achieving these requirements. In addition to requiring an IPT, this guidance also specifies the following key activities relative to analyzing and developing each segment architecture: Prioritized opportunities—The IPT is to consider current change drivers, such as key strategic, legislative, and management requirements, to identify and prioritize opportunities to achieve performance improvements within the context of the current operating environment. These prioritized opportunities are to be used to define the scope of the segment architecture and help the IPT make informed decisions about the potential reuse of common or shared business processes, data, and services. Performance goals—The IPT is to establish performance goals that include target measures and time frames for achieving them. The performance goals are to provide the basis for developing the performance layer of the target segment architecture, and they are to be reconciled with the agency EA and agency strategic plan to ensure consistency. They are also to be used to determine the segment performance gaps that need to be closed. Target architecture—The IPT is to develop a target segment architecture that establishes the business, data, services, and technology architecture layers to support the performance layer of the architecture. The target architecture should, among other things, describe the systems that are required, including those to be consolidated. These targets are to be used by the IPT to develop the segment transition strategy. Segment transition strategy—The IPT is to use the target segment architecture to define the specific projects needed to close identified performance gaps and achieve the target state. Among other things, the strategy is to include project priorities, project dependencies, and project sequencing. The IPT and the agency’s Chief Architect are to jointly reconcile the segment architecture and transition strategy with the agency’s EA to ensure consistency. The transition strategy is to be used to prepare project funding strategies and business cases. None of the eight segment architectures that HUD has developed incorporates all of these key activities, with only one (acquisition management) fully addressing most of the elements. The remaining seven segment architectures fully address no more than two elements and either partially address or did not address the others. (See table 7 for a summary of the extent to which the eight segment architectures reflect OMB guidance.) The extent to which the eight reflect each of the key activities is discussed in detail following the table. OCIO’s Director of EA stated that all eight segment architectures were developed by IPTs. However, two of the segment architectures (financial management and human resources management) did not have charters or any other form of documentation demonstrating that key stakeholders were involved in developing the architectures. One of the segment architectures (acquisition management) identifies and prioritizes opportunities for improvement, while four (financial management, grants management, human resources management, and multifamily housing) identify opportunities for improvement but do not prioritize these opportunities. The remaining three do not identify opportunities for improvement. None of the segment architectures identify performance goals and time frames. While four (acquisition management, electronic records and documents management, human resources management, and rental housing assistance) have performance goals, none of the four include time frames to achieve these goals. The remaining four do not establish performance goals or time frames. Two of the segment architectures (acquisition management and single- family housing) define their respective target states to be achieved, while five others (electronic records and documents management, financial management, grants management, human resources management, and multifamily housing) partially define these targets. For example, the grants management segment architecture identifies the systems required in the target environment but does not address any impact to existing systems. The rental housing assistance segment architecture does not define any aspects of its target architecture in support of the performance goals it identified. One segment architecture (acquisition management) has a complete transition strategy, while three others (financial management, grants management, and multifamily housing) have partial strategies. For example, the financial management and grants management architectures identify, prioritize, and sequence projects, and the multifamily housing architecture identifies projects to be completed; however, none of the three identify dependencies among projects. The remaining four segment architectures do not identify any aspects of a transition strategy. The extent to which the majority of the eight segment architectures reflect relevant federal guidance is attributable to the fact that the architectures were developed prior to the issuance of federal guidance (only the acquisition management architecture was developed after this guidance was issued). Accordingly, in a June 2008 strategic portfolio review, HUD recognized the need to update the segment architectures to reflect relevant guidance. Moreover, this review recognized that seven of the eight segment architectures (all except acquisition management) were not current. For example, 4 of the segment architectures are 4 or more years old (see table 8). According to federal guidance, regular maintenance of segment architectures is important to ensuring that they reflect the current direction of the agency. The Director of EA said that, since June 2008, efforts have been initiated to update one of the segment architectures—human resources management. Specifically, the Director of EA said that an IPT is being formed and will begin to update this segment architecture this summer. However, the department did not have a plan to update the remaining segment architectures. The need to develop segment architectures that are complete and current is significant because HUD currently has three major investments under way in its financial management, rental housing assistance, and grants management segments. In fiscal year 2009, these investments total about $50 million in development as follows: Financial management—Approximately $27 million is being used to develop a single core financial system that integrates the programmatic and financial information of four existing financial systems. Rental housing assistance—Approximately $16 million is being used to develop a system for HUD’s rental housing assistance program to support management of public housing assets. Grants management—Approximately $7 million is being used to develop a system for HUD’s grants programs to support the administration of grants and the automation of redundant processes. Until HUD’s segment architectures are defined in accordance with applicable federal guidance and kept current, they will not provide a sufficient basis for guiding and directing segment projects in a manner to ensure that both system enhancements and new development efforts are, among other things, properly sequenced, well integrated, and not duplicative. Effective systems modernization requires a structured management approach, to include clearly defined and assigned responsibility and accountability for enterprisewide modernization management. Our experience in reviewing large-scale system modernization programs in other federal departments and agencies, such as the Internal Revenue Service and Department of Defense, shows that this often involves, among other things, establishing a modernization program management office. In addition, independent research recommends establishing a modernization management office before attempting an enterprisewide modernization effort. According to this research, this type of office brings structure and support to evaluating, justifying, defining, planning, tracking, and executing an IT modernization effort, and it facilitates interaction among senior leaders, program managers, and project managers. To HUD’s credit, its EA transition plan identifies the need for an Enterprise Program Management Office (EPMO) to manage its modernization projects, calling this office a critical success factor to delivering modernized systems. Specifically, the plan states that the size and complexity of the department’s modernization efforts will introduce a paradigm shift and that this office is a “foundational enabler” to these efforts and would, among other things, ensure that independent segments are pursued in an integrated manner. To date, the department has not established its EPMO and thus has not assigned responsibility and authority for management of its modernization efforts. While OCIO has identified a range of functions that this office would need to perform, such as establishing a systematic, standardized, repeatable process for management of IT projects across the enterprise, and included these responsibilities as a contract task in an existing contract awarded in August 2007, OCIO officials told us that this EPMO task was not executed due to funding constraints. These officials also stated that alternative contract solutions to meeting the department’s EPMO needs will be examined. However, they did not have a plan defining how and when this would occur, stating that it is dependent on funding available in fiscal year 2010. Without an EPMO, HUD will be challenged in its ability to successfully deliver modernized systems. HUD’s ability to effectively and efficiently perform mission-critical operations, including those integral to our nation’s economic recovery and reinvestment activities, is constrained by its current IT environment. To overcome these limitations and maximize IT support to HUD programs, such as those that involve home mortgages and provide rental assistance, it is essential for the department to have the capability and capacity to manage both its existing IT environment and its ongoing and future IT modernization efforts. Currently, it does not, as evidenced by limitations in a number of core IT controls that are instrumental to managing both an organization’s existing IT environment and its IT modernization efforts. In particular, HUD is not effectively measuring whether it is meeting its IT goals and, as a result, is not in compliance with a statutory requirement. HUD is also not adequately controlling its IT investment portfolios to ensure that they optimally deliver mission capabilities and value and is not taking key steps to ensure that it has an adequate workforce to both operate and maintain its existing systems and to deliver modernized systems. Moreover, it has not ensured that modernization projects are governed by well-defined segment architectures and that responsibility and accountability for enterprisewide modernization management has been assigned. To HUD’s credit, it is aware of the need to improve many of these IT management controls, but its IT resources have in recent years been almost exclusively directed to sustaining its existing IT environment, and it has yet to develop specific plans for strengthening each of these management controls. Given the recent increase in modernization resources available this year and, with further increases envisioned for future years, it is important that building this capability and capacity be treated as a department priority. Until HUD establishes effective and mature structures, processes, practices, and tools for managing IT, it will be challenged in its ability to effectively modernize its IT environment and thus provide IT support to critical mission operations. To ensure that HUD has an IT environment that effectively and efficiently supports its mission operations, we recommend that the Secretary of Housing and Urban Development ensure that recent and anticipated increases in IT resources be allocated to strengthening each of the IT management controls discussed in this report. To these ends, we further recommend that the Secretary take the following five actions: 1. Direct the CIO to develop a plan for developing and implementing the department’s new performance management framework, including an implementation schedule of key activities and related resource needs, and to ensure that this plan provides for complying with the statutory requirement for annual reporting of progress in achieving IT strategic goals. 2. Direct the Deputy Secretary, as the TIBEC chairperson, to develop and implement a plan to address the IT portfolio investment management weaknesses that we identified. This plan should address the following: a. instituting policies and procedures for reviewing, evaluating, and improving the performance of the department’s portfolio of investments; b. establishing resources for reviewing the investment portfolio, including people, funding, and tools and ensuring board members are familiar with the process for evaluating and improving portfolio performance; c. developing criteria for assessing portfolio performance and reviewing and modifying them at regular intervals to reflect current performance expectations; d. defining and collecting IT portfolio performance measurement data consistent with the portfolio performance criteria; and e. executing adjustments to the IT investment portfolio in response to actual portfolio performance. 3. Direct the CIO to establish and execute IT human capital gap closure strategies that are based on a complete and current inventory of its existing IT workforce skills. 4. Direct the Deputy Secretary, as the TIBEC chairperson, to a. report to the Secretary on actions planned to address our prior EA recommendations on defining a security architecture and performing independent verification and validation, and b. develop a plan for reexamining segment priorities and updating and developing segment architectures in accordance with these priorities and relevant guidance. 5. Direct the CIO to establish an enterprisewide program office with the responsibility and authority for managing the department’s modernization efforts. In written comments on a draft of our report signed by the Deputy Chief Information Officer, the department agreed with our recommendations, adding that it will dedicate resources to implementing each of them. In addition, it provided largely technical comments to clarify, correct, or update information in the report, which we have incorporated in the report as appropriate, and address more specifically in appendix III. However, it also offered a comment relative to our finding that HUD’s segment architectures do not include performance goals, stating that such segment performance goals are updated each year in HUD’s performance architecture, and major investment performance goals are provided in its annual budget submissions. We agree with this comment. However, the point of our finding is that the segment architectures themselves do not include performance goals and related time frames, as required by OMB guidance. As a result, we have not modified our report to reflect this comment. We are sending copies of this report to interested congressional committees; and the Secretary of Housing and Urban Development. The report also is available at no charge on the GAO Web site at http://www.gao.gov. If you or your offices have questions on matters discussed int his report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Our objective was to determine if the Department of Housing and Urban Development (HUD) has adequately established institutional information technology (IT) management controls needed to manage and modernize its existing IT environment. To meet this objective, we focused on the following management controls: IT strategic planning and performance measurement; portfolio-based IT investment management; IT human capital management; architecture development and use; and responsibility and accountability for modernization management. To evaluate HUD’s IT strategic planning and performance measurement, we reviewed HUD’s agencywide strategic plan and its IT strategic plans, its IT strategic implementation plan, and available assessments of its progress in achieving IT strategic goals. We also interviewed HUD officials including the Office of the Chief Information Officer’s (OCIO) Strategic Planner. We assessed this information against provisions in the Clinger- Cohen Act and Paperwork Reduction Act related to defining IT strategic goals and plans, assessing progress toward achieving IT strategic goals, and measuring performance of IT operations. To evaluate HUD’s IT investment management (ITIM) practices associated with portfolio management, we used GAO’s ITIM framework and assessed the extent to which HUD had established the policies and procedures needed to effectively manage its investments as a portfolio, as well as the key practices needed to control its portfolio (practices spec ific to the evaluating the portfolio critical process of Stage 3). To conduc t our assessment, we reviewed relevant HUD policies, procedures, guidance, and documentation—including HUD’s investment management guide, related process guides, such as its ITIM select guide, postimplementation review guide, investment board charters, budget documents, and project reviews and presentations. We also interviewed HUD’s Director of ITIM and the Associate Deputy Chief Information Officer for Business and Information Technology Modernization. We then compared this information with the selected key practices in the ITIM framework to determine the extent to which the department was employing effective IT investment portfolio management practices. We rated ITIM key practices as “executed” on the basis of whether the agency demonstrated (by providing evidence of performance) that it had fully met the criteria of the key practice. A key practice was rated as “not executed” when we found insufficient evidence of a practice during the review or when we determined that there were significant weaknesses in HUD’s execution of the key practices. We provided HUD an opportunity to produce evidence for the key practices that we rated as “not executed.” To evaluate HUD’s IT human capital management, we reviewed IT human capital management plans and related documentation, such as a workforce needs assessment, gap analyses, and gap closure strategies. We also interviewed HUD officials, including the Office of CIO’s Director of Administrative Services. We assessed this information against strategic workforce planning principles established in prior GAO work. To evaluate HUD’s enterprise architecture (EA) development and use, we relied on our previous report on HUD’s EA, updating this report relative to two weaknesses that we reported—security in its EA and independent verification and validation of EA products and management processes. To do so, we reviewed HUD EA work products, including security and independent verification and validation plans and products. In addition, we reviewed EA transition plans, segment architectures, performance architecture, and segment architecture development guidance, and interviewed officials. We assessed this information against relevant criteria in federal guidance, such as the Office of Management and Budget’s (OMB) Federal Enterprise Architecture Practice Guidance and its EA assessment framework, and best practices in GAO’s EA Framework. Specific to segment architecture development, we assessed the extent to which HUD’s segment architectures addressed elements of segment development guidance in OMB’s Federal Enterprise Architecture Practice Guidance. Specifically, we determined the extent to which segment architectures addressed the element (addresses all aspects of the element); partially addressed the element (addresses some, but not all aspects of the element); or did not address the element (does not address any aspect of the element). To evaluate HUD’s modernization management office, we reviewed published reports and research on having such an office and HUD plans for establishing this office, including EA transition plans and an acquisition contract for program management support. We also interviewed the Associate Deputy CIO for Business and Information Technology Modernization, the Director of Enterprise Architecture, and the Director of Information Technology Systems Integration and Efficiency. We assessed this information to determine the extent to which HUD had established responsibility and accountability for modernization management. We conducted this performance audit from July 2008 to July 2009, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 9 provides descriptions of segment architectures as identified by HUD. The following are GAO’s comments on the Department of Housing and Urban Development dated July 22, 2009. 1. We revised our report to reflect this comment. 2. We revised our report to reflect HUD’s current OCIO organizational structure. 3. We clarified our report by explicitly identifying the HUD reports that cite the limitations in HUD’s IT environment. 4. We clarified our report to reflect this comment. 5. We clarified our report to reflect this comment. 6. We agree that performance goals are identified in HUD’s performance architecture relative to segments and are included in budget submissions to OMB for HUD’s major investments. However, our point is that the performance goals and related time frames are not included in the segment architectures. According to federal guidance, the establishment of performance goals and time frames for achieving these goals is to occur during the development of a segment architecture, and thereby provide the basis for the goals in the performance architecture and budget submissions. Therefore, we have not modified our report in response to this comment. 7. See comment 6. In addition to the individual named above, key contributions were made to this report by James Sweetman, Assistant Director; Jamey Collins; Eric Costello; Kristin English; Michael Holland; Lowell Labaro; Anh Le; Lee McCracken; Sabine Paul; and Glenn Spiegel.

Summary: Information technology (IT) plays a critical role in the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission, which was recently expanded under the Housing and Economic Recovery Act of 2008. Pursuant to a congressional mandate to study HUD's IT environment, GAO reviewed the adequacy of key IT management and modernization controls within the department, including strategic planning and performance measurement, investment management, human capital management, enterprise architecture development and use, and modernization program office establishment. To do so, GAO compared HUD policies, guidance, plans, reports, and other products and actions to relevant aspects of statutory requirements, federal guidance, and related best practices. The department has to varying degrees established key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. Specifically, HUD has (1) developed an IT strategic plan, with strategic goals and related activities and performance targets, but it has not assessed its IT performance since fiscal year 2007, and its assessment at that time showed performance shortfalls. For example, it reported that it was behind schedule or not making progress on about one-half of the activities needed to achieve its IT strategic goals. (2) established policies and procedures for creating portfolios of IT investments, but it lacks related practices to effectively control them. For example, criteria to evaluate the performance of its portfolio do not exist. (3) analyzed gaps in its IT workforce and developed a strategy for addressing them, but the analysis was based on an incomplete and outdated inventory of human capital skill levels, thus rendering its strategy unreliable. (4) established an enterprise architecture program--to connect strategic plans with individual programs and system solutions--that meets key aspects of related best practices, but its efforts to extend its architecture by adding the level of detail needed to implement modernization projects, referred to as segment architectures, are not sufficient. For example, while HUD has identified and prioritized segments to be modernized, it has not adhered to these priorities, and the segments developed do not reflect important elements of federal guidance, and most are out of date. (5) identified the need for a modernization program office with the responsibility for managing its modernization efforts but has not established this office. Department officials acknowledged these shortcomings and stated that efforts to address them have been constrained by such factors as turnover in IT leadership and, until recently, limited modernization resources and initiatives. Until it strengthens these IT management controls, the performance of its existing IT environment and the success of its recent and future efforts to modernize this environment will be at risk.