In e-mail comments on a draft of this report, the Acting CIO stated that the report reflects both Treasury’s shortcomings as well as progress to date and recognized the need to take proactive steps to strengthen its investment board operations and oversight of information technology resources and programs. Treasury also agreed with the need for an executive investment review board that is actively engaged in the investment management process and noted that nonmajor investments have not been a priority because the major investments the department has chosen to devote its resources to represent the more significant portion of the portfolio in terms of dollar value, visibility to OMB and Congress, and importance to Treasury’s mission. Treasury also commented on the department’s authority to redirect funding from one Treasury bureau to another. We incorporated these comments into our report where appropriate. The Department of the Treasury is the primary federal agency responsible for the economic and financial prosperity and security of the United States, and as such is responsible for a wide range of activities, including advising the President on economic and financial issues, promoting the President’s growth agenda, and enhancing corporate governance in financial institutions. To accomplish its mission, Treasury is organized into departmental offices and operating bureaus. The departmental offices are primarily responsible for the formulation of policy and management of the department as a whole, while the nine operating bureaus—including the Internal Revenue Service and the Bureau of Engraving and Printing—carry out the specific functions assigned to Treasury. Figure 1 shows the organizational structure of the department. Information technology plays a critical role in helping Treasury meet its mission. For example, the Internal Revenue Service relies on information systems to process tax returns, account for tax revenues collected, send bills for taxes owed, issue refunds, assist in the selection of tax returns for audit, and provide telecommunications services for business activities, including the public’s toll-free access to tax information. To modernize the systems it relies on to carry out these functions, Treasury is engaged in a Business Systems Modernization program. Treasury requested $11.4 billion in the President’s fiscal year 2007 budget. Of this amount, the department estimates it will spend approximately $2.8 billion for 235 IT investments—some $2.3 billion (about 80 percent) for 75 major investments and some $480 million (about 20 percent) for 160 nonmajor investments. Since mid-1999, we have been reviewing the Internal Revenue Service’s (IRS) progress in implementing its Business Systems Modernization program as part of our reviews of the service’s associated expenditure plans. Our reviews have identified a number of weaknesses in IRS’s modernization management controls and capabilities and, over the years, we have made numerous recommendations to address these weaknesses. IRS has addressed many of our recommendations; however, several weaknesses remain. In January 2004, we reported as part of a governmentwide review, that Treasury had significant weaknesses in investment management. We noted, for example, that the department had neither developed a capital planning and investment control guide nor developed work processes and procedures for the agency’s IT investment management board. In addition, Treasury had not documented the alignment and coordination of responsibilities of its various boards for decision making related to investments, including the criteria for which investments—including crosscutting investments—were to be reviewed by the executive investment review board. We also reported that Treasury did not have a department-level control process; instead, each bureau could conduct its own reviews that address the performance of its IT investments and corrective actions for underperforming projects. We made several recommendations to address the weaknesses we identified. Treasury concurred with our recommendations, stating that it recognized its shortcomings and was working to correct them. In July 2006, we reported on Treasury’s Financial Crimes Enforcement Network’s (FinCEN) BSA Direct Retrieval and Sharing project, a nonmajor investment, noting that FinCEN did not always apply effective investment management processes to oversee this project. We recommended that the director of FinCEN direct its CIO to develop a plan for improving the agency’s capabilities for overseeing this project. FinCEN officials concurred with our findings and recommendation. In January 2007, in an update to our high-risk series report on the Internal Revenue Service’s Business Systems Modernization, which we first designated as high-risk in 1995, we reported that while the Internal Revenue Service had made progress in reducing risk with systems modernization and financial management, improvements made have not been sustained long enough to provide confidence that the program is fully stable. We also reported that many challenges remain, including improving processes for designing, developing, and delivering modernized IT systems. Several of Treasury’s projects have been deemed to be poorly planned and managed by the Office of Management and Budget (OMB) and have warranted inclusion on OMB’s Management Watch and High Risk Lists. The Clinger-Cohen Act of 1996 requires agency heads to designate the CIO to lead reforms to help control system development risks; better manage technology spending; and achieve real, measurable improvements in agency performance through better management of information resources. The agency head, through the department-level CIO, is responsible for providing leadership and oversight for foundational critical processes by ensuring that written policies and procedures are established, repositories of information are created that support investment decision making, resources are allocated, responsibilities are assigned, and all of the activities are properly carried out where they may be most effectively executed. Treasury’s IT investment management process is to provide the framework for decision making and accountability required to ensure IT investments meet the strategic and business objectives of the department in an efficient and effective manner. In carrying out this process, the department makes a distinction between its major and nonmajor investments, to determine the extent and scope of the department’s investment management oversight and the level of reporting requirements. An IT investment is classified as major if it meets at least one of the following criteria:requires special management attention because of its importance to the mission or function of the agency, a component of the agency or another organization; is for financial management and obligations of more than $500,000 annually; has significant program or policy implications; has high executive visibility; has high development, operating, or maintenance costs; has total life-cycle costs exceeding $50 million; has an annual budget of $5 million or more; or significantly impacts more than one bureau. Investments that do not meet at least one of these criteria are considered to be nonmajor investments. Several groups and individuals play a role in the department’s process to manage its IT investments at the department and bureau levels. They are involved in all aspects of the process, including reviewing and approving proposed investments, monitoring the investments through implementation, and evaluating the investments once they become operational. Table 1 identifies the groups and individuals that have a role in this process and shows their composition and responsibilities. Reviews by TIRB and the department’s executive investment review board focus on IT investments that are defined as major strategic investments for the department. To support this process, Treasury uses an automated portfolio management tool for collecting and maintaining data during the four phases of the process. Various forms in the tool are available for staff to enter new and updated data on Treasury’s IT investments. In September 2005, the department issued a Capital Planning and Investment Control Policy Guide defining a four-phase process for managing its IT investments. These phases consist of preselect, select, control, and evaluate. Completing the requirements of one phase is necessary before moving on to the subsequent phase. Each phase is to be overseen by Treasury’s executive investment review board, which ultimately approves or rejects an investment’s advancement to the next phase. Preselect phase is the annual process by which potential new major investments seeking funding in the upcoming budget year are approved to move into the select phase and are considered for inclusion in the department’s budget request. Only major IT investments are promoted through the preselect process and reviewed at the departmental level. During this phase, an investment’s business owner is to document the business need for the investment and describe its anticipated alignment with bureau, Treasury, and e-government initiatives, and the President’s Management Agenda strategic goals. The CPIC team is then expected to review and validate the preselect data and pass on its assessment and recommendation to TIRB, which is to provide recommendations to the department’s executive investment review board. Once a major investment is approved by the executive investment review board, it moves forward to the select phase. The department’s bureaus have the exclusive responsibility for the preselection of nonmajor investments within their respective bureaus, and the bureaus’ executive leadership must approve a nonmajor investment in order for it to enter the select phase. Select phase is the process by which new and existing major IT investments seeking funding in the upcoming budget year are annually screened, scored, and selected for inclusion in Treasury’s IT investment portfolio. In this phase, Treasury is to ensure that only IT investments that best support its mission, investment principles, and approach to EA are chosen and that the investment owners have taken steps to be successful, such as having a qualified project manager and analyzing risks. As in the preselect phase, the CPIC team is expected to review and validate that all data is complete, score each investment based on Treasury’s investment principles, and submit its findings and recommendations to TIRB. TIRB, in turn, is to review the scoring results and provide its recommendations to Treasury’s executive investment review board, which is then to select which investments will be included in the department’s IT investment portfolio that is ultimately submitted to OMB for funding considerations. Investments do not technically exit the select phase until they are terminated, since they must be reviewed annually for reselection. The bureaus are responsible for conducting their own select process for nonmajor investments. Control Phase ensures, through timely oversight, quality control, and executive review, that IT investments are managed in a disciplined and consistent manner. This phase is characterized by Treasury’s Office of the CIO initiating quarterly control reviews, which focus on ensuring that an investment’s projected benefits are being realized; that cost, schedule, and performance goals are being met; that risks are minimized and managed; and that the investment continues to meet strategic goals. Through Office of the CIO quarterly data calls, bureau project managers are to update data as of the end of the previous quarter for cost and schedule, performance measures, and risk assessments for both major and nonmajor investments. This updated data is to be entered into the department’s automated IT portfolio management tool, which the bureau project managers and the bureau CIOs are to certify for accuracy using a certification form within the tool. Next, Treasury’s CPIC team is to evaluate the data and provide feedback to the bureaus through the bureaus’ CPIC coordinators, giving the bureaus an opportunity to remediate missing or erroneous data. For major investments, the CPIC team is then expected to summarize the results, including identifying corrective actions planned, for presentation to TIRB. TIRB is to review the results for potential risk factors, such as schedule or cost slippages or major technical problems, before forwarding its recommendation to Treasury’s executive investment review board. The executive investment review board is to review TIRB’s recommendations before making a decision to continue, accelerate, modify, suspend, or terminate investments. While control data are captured for nonmajor investments, the department leaves it to the bureaus to conduct their own oversight process for these investments. However, TIRB and the executive investment review board may choose to review these investments on a random sample basis. In July 2006, Treasury adopted procedures for establishing an Internal Watch List of major investments at risk of not meeting established goals. The criteria for placement on this list include 1. cost or schedule variances greater than plus or minus 10 percent for 2. lack of validation of project manager’s qualifications by the bureau CIO; 3. lack of a current certification and accreditation; or 4. duplication of another investment within the department or with any of the President’s e-government initiatives or lines of business. Treasury’s Office of the CIO is to make this determination, and investments on this list are subject to additional reporting requirements, including development of an action plan to remediate the noncompliant conditions. Bureau CIOs are to report monthly to the Treasury CIO on the status of these investments. Once all requirements have been met and the Treasury CIO concurs, the investment can be removed from the list. Evaluation phase involves an annual process to determine how well major investments are performing once they become operational. This process is to occur in the first quarter of the fiscal year and is composed of two subprocesses—the postimplementation review (PIR) and the operational analysis (OA). The age and the life cycle stage of the investment determine which of these two subprocesses is conducted on an investment. The purpose of the PIR is to assess the performance of an investment that has been fully developed and has moved into the operational and maintenance stage of its life cycle. An investment’s project manager is to initiate a PIR 6 to 18 months after an investment has moved into its operational and maintenance stage. During a PIR, an investment’s actual performance is compared to its expected performance to identify lessons learned for improving both the investment and Treasury’s CPIC process. The PIR is also intended to measure the strategic impact, user satisfaction, and whether the investment is meeting cost, schedule, and performance metrics. The results of the PIR are to be documented in Treasury’s portfolio management tool. Once the PIR is completed, Treasury’s CPIC team is to evaluate the results, provide feedback to the project manager and the respective bureau management, and provide summary information to TIRB. TIRB, in turn, is to report lessons learned from the PIRs conducted and any recommendations it may have to the department’s executive investment review board in order to promote the lessons learned across the department’s IT investment portfolio. The purpose of the OA is to identify those investments in operations and maintenance for which PIRs have been conducted that are likely to require modification, acceleration, replacement, or retirement, and to help determine the remaining useful life of an investment. However, because of the newness of Treasury’s PIR requirement and the age of certain investments that have been in the operations and maintenance stage of their life cycle, a PIR may not have been performed on these investments prior to the required OA. Similar to a PIR, in conducting the OA, Treasury focuses on two key areas: (1) program objectives, looking at alignment to cost, schedule, and strategic goals; and (2) meeting user needs. In determining how well the investment aligns to program objectives, data are to be captured on an annual basis---most likely from established sources, such as the quarterly control reviews and annual select phase process. To determine whether user needs are still being met by the investment, the investment’s project manager, in coordination with the investment’s business owner, is to solicit user input, using such means as a survey, focus groups, or regular user group meetings. The results of the OA are to be documented in Treasury’s portfolio management tool and can entail recommending the investment continue operations as is, be modified, or be terminated. Based on further analysis by the CPIC team, a review meeting may be scheduled to discuss the results and the recommendations. The results of these meetings are to be shared with TIRB and the executive investment review board, as appropriate. Prior to exiting the evaluation phase, the executive investment review board must approve the disposal, retirement, or replacement of major investments. Figure 2 shows the schedule of select, control, and evaluate activities that take place throughout the year. (Oct. - Dec.) (Jan. - Mar.) (Apr. - June) (July - Sept.) Bdget ye Exhiit 00/5ll nd initisubmission to Treasury (Apr. - Jne) Preliminry elect review for budget yer plnning (Mr.) Hold finelect review for budget yer (Jly) Hold control review Q1 (Mrch) Hold control review Q2 (Jne) Hold control review Q (Jly) Evuation review on tedy te invetment for budget yer; et pend pl (Decemer) To provide a method for evaluating and assessing how well an agency is selecting and managing its IT resources, GAO developed the Information Technology Investment Management framework (ITIM). The ITIM is a maturity model composed of five progressive stages of maturity that an agency can achieve in its investment management capabilities. It was developed on the basis of our research into the IT investment management practices of leading private- and public-sector organizations. In each of the five stages, the framework identifies critical processes for making successful IT investments. The maturity stages are cumulative; that is, in order to attain a higher stage, the agency must have institutionalized all of the critical processes at the lower stages in addition to the higher stage critical processes. The framework can be used to assess the maturity of an agency’s investment management processes and as a tool for organizational improvement. The overriding purpose of the framework is to encourage investment processes that increase business value and mission performance, reduce risk, and increase accountability and transparency in the decision process. We have used the framework in several of our evaluations, and a number of agencies have adopted it. These agencies have used ITIM for purposes ranging from self-assessment to redesign of their IT investment management processes. ITIM’s five maturity stages represent the steps toward achieving stable and mature processes for managing IT investments. Each stage builds on the lower stages, and the successful attainment of each stage leads to improvement in the organization’s ability to manage its investments. With the exception of Stage 1, each maturity stage is composed of critical processes that must be implemented and institutionalized in order for the organization to achieve that stage. These critical processes are further broken down into key practices that describe the types of activities an organization should be performing to successfully implement each critical process. It is not unusual for an organization to be performing key practices from more than one maturity stage at the same time, but efforts to improve investment management capabilities should focus on implementing all lower stage practices before addressing higher stage practices. In the ITIM, Stage 2 critical processes lay the foundation for sound IT investment processes by helping the agency to attain successful, predictable, and repeatable investment control processes at the project level. Specifically, Stage 2 encompasses building a sound investment management foundation by establishing basic capabilities for selecting new IT projects. It involves developing the capability to control projects so that they finish predictably within established cost and schedule expectations and have the capability to identify potential exposures to risk and put in place strategies to mitigate that risk. It also involves instituting an IT investment board, which includes defining its membership, guidance policies, operations, roles, responsibilities, and authorities for one or, if applicable, more IT investment boards within the organization, and, if appropriate, each board’s support staff. The basic selection processes established in Stage 2 lay the foundation for more mature selection capabilities in Stage 3, which represents a major step forward in maturity. In this stage, the agency moves from project-centric processes to a portfolio approach, evaluating potential investments by how well they support the agency’s mission, strategies, and goals. Stage 3 requires that an organization continually assess both proposed and ongoing projects as parts of a complete investment portfolio—an integrated and competing set of investment options. It focuses on establishing a consistent, well-defined perspective on the IT investment portfolio and maintaining mature, integrated selection (and reselection), control, and evaluation processes, which are to be evaluated during PIRs. This portfolio perspective allows decision makers to consider the interaction among investments and the contributions to organizational mission goals and strategies that could be made by alternative portfolio selections, rather than focusing exclusively on the balance between the costs and benefits of individual investments. Stages 4 and 5 require the use of evaluation techniques to continuously improve both the investment portfolio and the investment processes in order to better achieve strategic outcomes. At Stage 4 maturity, an organization has the capacity to conduct IT succession activities and, therefore, can plan and implement the deselection of obsolete, high-risk, or low-value IT investments. An organization with Stage 5 maturity conducts proactive monitoring for breakthrough information technologies that will enable it to change and improve its business performance. Organizations that have implemented Stages 2 and 3 have in place capabilities that assist in establishing the selection, control, and evaluation processes that are required by the Clinger-Cohen Act of 1996. Stages 4 and 5 define key attributes that are associated with the most capable organizations. Figure 3 shows the five ITIM stages of maturity and the critical processes associated with each stage. As defined by the model, each critical process consists of key practices that must be executed to implement the critical process. In order to have the capabilities to effectively manage IT investments, an agency, at a minimum, should (1) build an investment foundation by putting basic, project-level control and selection practices in place (Stage 2 capabilities) and (2) manage its projects as a portfolio of investments, treating them as an integrated package of competing investment options and pursuing those that best meet the strategic goals, objectives, and mission of the agency (Stage 3 capabilities). These practices may be executed at various organizational levels of the agency, including at the component level. However, overall responsibility for their success remains at the department level. Therefore, at a minimum, the department should effectively oversee component agencies’ IT investment management processes. While Treasury has established many of the capabilities needed to select, control, and evaluate its IT investments, the department has significant weaknesses that hamper its ability to effectively manage its investments. Specifically, the department has executed 19 of the 38 key practices that the ITIM requires to build a foundation for IT investment management (Stage 2), including practices needed to ensure that projects support business needs and that a disciplined process exists for capturing investment information. In addition, the department has executed 11 of the 27 key practices required to manage investments as a portfolio (Stage 3), including documenting policies and procedures for conducting postimplementation reviews. However, Treasury does not have an executive investment review board— a group of executives from IT and business units that is intended to be the final decision-making authority—that is actively engaged in the investment management process. According to the Associate CIO for Capital Planning and Information Management, while efforts to establish an executive investment review board have been initiated, these efforts have been stymied by changes in executive leadership. In addition, the department does not have any processes in place for managing its nonmajor investments, although they represent about 70 percent of the total number of investments. According to officials, nonmajor investments have not been a priority because the department has instead chosen to devote its resources to major investments, which represent about 80 percent of its IT expenditures. While it is reasonable to focus attention on major investments, nonmajor investments represent a significant amount of funding (about $480 million) and constitute the bulk of most bureaus’ investment portfolio and therefore also require a certain level of oversight. Until the department addresses these weaknesses, it will not have the investment management structure needed to effectively assess and manage the risks associated with its multibillion-dollar portfolio. In addition, until the department addresses these weaknesses, it will not have assurance that key investment management decisions are benefiting from the contribution of executives who are in the best position to make the full range of decisions needed to enable the agency to meet its mission most effectively. In addition, the department will not be able to ensure that it is effectively assessing and managing the risks associated with nonmajor investments costing hundreds of millions of dollars. At the ITIM Stage 2 level of maturity, an organization has attained repeatable, successful IT project-level investment control and basic selection processes. Through these processes, the organization can identify expectation gaps early and take the appropriate steps to address them. According to ITIM, critical processes at Stage 2 include (1) defining IT investment board operations, (2) identifying the business needs for each IT investment, (3) developing a basic process for selecting new IT proposals and reselecting ongoing investments, (4) developing project- level investment control processes, and (5) collecting information about existing investments to inform investment management decisions. Table 2 describes the purpose of each of these Stage 2 critical processes. Because of management attention that has recently been given to IT investment management, Treasury has put in place half of the key practices needed to establish the investment foundation. These include all of the key practices associated with identifying and collecting information to support investment decisions and some of the key practices for ensuring that projects and systems support organizational needs and meet users’ needs as well as for selecting new proposals and reselecting ongoing investments. However, because no executive investment review board currently exists (see details in next section), the department has not executed many of the key practices for instituting the investment board. In addition, because of its limited involvement in managing nonmajor investments, the department has not executed many of the key practices related to providing investment oversight. Treasury officials stated that the management turnover present a challenge to establishing an executive investment review board. They also acknowledged the need for a process to oversee nonmajor investments, particularly in light of the recent failure of the BSA Direct project. Table 3 summarizes the status of Treasury’s Stage 2 critical processes, showing how many associated key practices the department has executed. The establishment of decision-making bodies or boards is a key component of the IT investment management process. At the Stage 2 level of maturity, organizations define one or more boards, provide resources to support the boards’ operations, and appoint members who have expertise in both operational and technical aspects of proposed investments. The boards should operate according to a written IT investment process guide that is tailored to the organization’s unique characteristics, thus ensuring that consistent and effective management practices are implemented across the organization. The organization selects board members to ensure they are knowledgeable about policies and procedures for managing investments. Organizations at the Stage 2 level of maturity also take steps to ensure that executives and line managers support and carry out the decisions of the investment board. According to ITIM, organizations should (1) establish an enterprisewide IT investment board composed of senior executives from IT and business units, (2) have a documented IT investment process directing each investment board’s operations, and (3) ensure that the enterprisewide investment board has oversight responsibilities for the development and maintenance of the organization’s documented IT investment process. (The complete list of key practices is provided in table 4.) Treasury has executed three of the eight key practices for this critical process. For example, the department has documented an IT investment process that directs investment board operations. In addition, adequate resources are provided to support board operations. However, Treasury currently does not have an executive investment review board composed of senior executives from IT and business units that is actively engaged in the investment management process. According to officials, such a board was established in 2005 but stopped functioning at the prompting of the assistant secretary for management because it was considered inefficient. In 2006, another executive investment review board structure was proposed under a new assistant secretary for management, but, according to the Associate CIO for Capital Planning and Information Management, it was not implemented, due to yet another change in executive leadership. Officials told us that one of the challenges in establishing the board has been the constant turnover in Treasury’s management. They noted that many of the management positions, including the assistant secretary for management position, are currently being filled by temporary or “acting” officials, who may be replaced soon. Until the department establishes an executive investment review board with senior executives from IT and business units, its investment management process will not benefit from the contribution of those executives who are in the best position to make the full range of decisions needed for the department to meet its mission most effectively. Table 4 shows the rating for each key practice required to implement the critical process for instituting the investment board at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. Defining business needs for each IT project helps to ensure that projects and systems support an organization’s business needs and meet users’ needs. This critical process ensures that an organization’s business objectives and its IT management strategy are linked. According to ITIM, effectively meeting business needs requires, among other things, (1) documenting business needs with stated goals and objectives, (2) identifying specific users and other beneficiaries of IT projects and systems, (3) providing adequate resources to ensure that projects and systems support the organization’s business needs and meet users’ needs, and (4) periodically evaluating the alignment of IT projects and systems with the organization’s strategic goals and objectives. (The complete list of key practices is provided in table 5.) Treasury has executed two of the seven key practices for ensuring business needs are met. Specifically, Treasury has a documented business mission, with stated goals and objectives in its Treasury Strategic Plan for fiscal years 2003 through 2008. In addition, resources are devoted to ensuring that IT projects and systems support the organization’s business needs and meet users’ needs, including Treasury’s portfolio management tool, several subcouncils, an Exhibit 300 scoring guide to help develop major IT investments business cases, and training manuals on the use of the portfolio management tool contained in an online resource called the CPICResource Link. Treasury’s weaknesses in this area stem mostly from the fact that, while the department has delegated the management of nonmajors to the bureaus, it has no mechanism for ensuring that bureaus are effectively carrying out associated activities. In addition, while Treasury’s system development life-cycle methodology requires user involvement in projects’ life cycle, the investment management process does not have any steps for ensuring this is done. By not ensuring that bureaus are effectively aligning nonmajor investments with business needs, Treasury is incurring the risk that investments that make up approximately 20 percent of their IT budget and represent the majority of their investments may not be supporting the department’s priorities. In addition, without an executive investment review board actively involved in the process, Treasury cannot be assured it is making the best decisions regarding investments’ ability to support ongoing and future business needs. Table 5 shows the rating for each key practice required to implement the critical process for meeting business needs at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. Selecting new IT proposals and reselecting ongoing investments requires a well-defined and disciplined process to provide the agency’s investment boards, business units, and developers with a common understanding of the process and the cost, benefit, schedule, and risk criteria that will be used both to select new projects and to reselect ongoing projects for continued funding. According to ITIM, this critical process requires, among other things, (1) providing adequate resources for investment selection activities; (2) making funding decisions for new proposals according to an established process; and (3) using a defined selection process to select new investments and reselect ongoing investments. (The complete list of key practices is provided in table 6.) Treasury has executed 6 of the 10 key practices associated with selecting an investment. Treasury’s portfolio management tool contains a form for entering select data and provides staff, such as project managers and CPIC desk officers, with information to help manage the select process. We verified that three of the systems we reviewed—TFIN, CADE, and SaBRe—did, in fact, use the select form in the portfolio management tool for entering select data. The department has aligned funding decisions with the budget process for new and ongoing investments through the department’s budget formulation process, which is used to select both enterprisewide and bureau investments. Treasury has also documented criteria for analyzing, prioritizing, selecting, and reselecting new and ongoing major investments that address its strategic goals and its IT strategic goals, value, and risk. The criteria are incorporated into the department’s portfolio management tool and adjusted within the tool to reflect organizational objectives. However, the executive investment review board that is supposed to make final selection and reselection decisions does not exist. Treasury officials state that, as part of the budget formulation process, the results of the select process are approved by executives and that the results of the fiscal year 2008 select process were approved by a group of executives, including the Treasury Assistant Secretary for Management and other department and bureau executives, prior to being forwarded to OMB. The officials recognized, however, that this group was convened only for that purpose and did not include business (i.e., mission) representation from the bureaus. In addition, Treasury has delegated the selection and reselection of the nonmajor systems to the bureaus; however, as previously noted, Treasury does not have a mechanism for ensuring that the bureaus are effectively carrying out these activities. Without such a mechanism, Treasury cannot have assurance that investments that make up approximately 20 percent of its budget and represent the majority of investments are being consistently and objectively selected and reselected. Table 6 shows the rating for each key practice required to implement the critical process for selecting an investment at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. An organization should effectively oversee its IT projects throughout all phases of their life cycles. An investment board should observe each project’s performance and progress toward predefined cost and schedule expectations as well as each project’s anticipated benefits and risk exposure. This does not mean that a departmental board should micromanage each project to provide effective oversight; rather, it means that the departmental board should be actively involved in all IT investments and proposals that are high cost or high risk or have significant scope and duration and, at a minimum, should have a mechanism for maintaining visibility of all investments. The board should also use early warning systems that enable it to take corrective actions at the first sign of cost, schedule, and performance slippages. According to ITIM, effect project oversight requires, among other things, (1) having written policies and procedures for management oversight; (2) developing and maintaining an approved management plan for each IT project; (3) making up-to-date cost and schedule data for each project available to the oversight boards; (4) having regular reviews by each investment board of each project’s performance against stated expectations; and (5) ensuring that corrective actions for each underperforming project are documented, agreed to, implemented, and tracked until the desired outcome is achieved. (The complete list of key practices is provided in table 7.) Treasury has executed two of the seven key practices associated with effective project oversight. Treasury has adequate resources to support the executive investment review board for this critical process. The TIRB conducts quarterly control reviews of IT investments and can make recommendations to the executive investment review board based on these reviews. The department uses an automated portfolio management tool for the collection and maintenance of information to support the department’s quarterly control reviews. Treasury’s CPIC team, composed of Office of the Chief Information Officer (OCIO) personnel, assists the bureaus in compiling data on their respective IT portfolios, reviewing the data for accuracy and completeness prior to submission to TIRB for its quarterly control reviews. In addition, the bureaus have CPIC coordinators, each of which serve as a single point of quality control for their respective bureaus before information is released to OCIO’s CPIC team and provide assistance in addressing CPIC team comments received during the department’s quarterly control reviews. In addition, we verified that cost, schedule, benefits, and risk expectations were documented for the four projects we reviewed: CADE, SaBRe, TFIN, and TRACS. All four projects maintained project management plans or other documents that captured this information. However, although the department has written policies and procedures for management oversight of its investments, including its Capital Planning and Investment Control Policy Guide and its Earned Value Management Policy Guide, these policies and procedures are centered on the department’s major investments. Treasury leaves oversight of its nonmajor investments to the bureaus. According to Treasury officials, the department has thus far focused on the major investments because they represent about 80 percent of its IT expenditures. Until the department develops a mechanism for TIRB and its executive investment review board to periodically conduct nonmajor portfolio reviews, as indicated in its CPIC guide, or develops a mechanism for ensuring that the bureaus are doing so, the department risks not being able to identify investment problems when it is easier and less costly to resolve them. In addition, because the executive investment review board does not exist, Treasury is not executing any of the activities associated with providing investment oversight. Specifically, there is no executive investment review board to receive actual investment performance data, review the performance of projects and systems against expectations, and ensure that appropriate actions are taken to correct or terminate underperforming projects. The TIRB is currently carrying out these activities. However, without the involvement of an executive investment review board, these reviews are being performed without the corporate perspective that is useful in determining the impact individual project decisions may have on other projects and on the attainment of organizational goals and objectives. Table 7 shows the rating for each key practice required to provide investment oversight and summarizes the evidence that supports these ratings. To make good IT investment decisions, an organization must be able to acquire pertinent information about each investment and store that information in a retrievable format. During this critical process, an organization identifies its IT assets and creates a comprehensive repository of investment information. This repository provides information to investment decision makers to help them evaluate the potential impacts and opportunities created by proposed or continuing investments. It can provide insights into major IT cost and management drivers and trends. The repository can take many forms and need not be centrally located, but the collection method should, at a minimum, identify each IT investment and its associated components. This critical process may be satisfied by the information contained in the organization’s current enterprise architecture (EA), augmented by additional information—such as financial information and information on risk and benefits—that the investment board may require to ensure that informed decisions are being made. According to ITIM, effectively managing this repository requires, among other things, (1) developing written policies and procedures for identifying and collecting the information; (2) assigning responsibilities for ensuring that the information being collected meets the needs of the investment management process; (3) identifying IT projects and systems and collecting relevant information to support decisions about them; and (4) making the information easily accessible to decision makers and others. (The complete list of key practices is provided in table 8.) Treasury has in place all six key practices associated with capturing investment information. For example, the department’s Capital Planning and Investment Control Policy Guide and Earned Value Management Policy Guide define the policies and procedures for identifying and collecting information to support its investment management process and, according to Treasury officials, the Associate CIO for Capital Planning and Information Management is assigned responsibility for ensuring that the information collected meets the needs of the investment management process. Also, the department has adequate resources for supporting the process, including the Office of the CIO’s CPIC team, which is responsible for reviewing the information for accuracy and completeness before it is presented to TIRB for review prior to making its recommendations to the executive investment review board for final decisions. It also maintains an automated portfolio management tool for collecting and maintaining information on its IT investments. This tool is used by department and bureau components for updating information on their projects in response to data calls for the information required by TIRB to conduct its quarterly reviews. Table 8 shows the rating for each key practice required to implement this Stage 2 critical process and summarizes the evidence that supports these ratings. Once an agency has attained Stage 2 maturity, it needs to implement critical processes for managing its investments as a portfolio (Stage 3). An IT investment portfolio is an integrated, agencywide collection of investments that are assessed and managed collectively based on common criteria. Managing investments as a portfolio is a conscious, continuous, and proactive approach to allocating limited resources among an organization’s competing initiatives in light of the relative benefits expected from these investments. Taking an agencywide perspective enables an organization to consider its investments comprehensively, so that collectively the investments optimally address the organization’s mission, strategic goals, and objectives. Managing IT investments as a portfolio also allows an organization to determine its priorities and make decisions about which projects to fund and continue to fund based on analyses of the relative organizational value and risks of all projects, including projects that are proposed, under development, and in operation. Although investments may initially be organized into subordinate portfolios—based on, for example, business lines or life cycle stages—and managed by subordinate investment boards, they should ultimately be aggregated into this enterprise-level portfolio. According to the ITIM, Stage 3 maturity includes (1) defining the portfolio criteria, (2) creating the portfolio, (3) evaluating the portfolio, and (4) conducting postimplementation reviews. Table 9 summarizes the purpose of each critical process in Stage 3. Treasury has executed 11 of the 27 key practices required by Stage 3. For example, the department has a working group in place that is responsible for managing the development and modification of the department’s IT portfolio selection criteria. In addition, it has documented criteria to regularly assess its portfolio performance expectations through its portfolio tool. However, many key practices still need to be executed before Treasury can effectively manage its IT investments from a portfolio perspective. For example, the department has only addressed 3 of the 7 practices for evaluating the portfolio and 2 of the 6 practices for conducting PIRs. Until Treasury fully implements the critical processes associated with managing its investments as a complete portfolio, it will not have the data it needs to make informed decisions about competing investments. Table 10 summarizes the status of Treasury’s Stage 3 critical processes and shows how many associated key practices the department has executed. To manage IT investments effectively, an organization needs to establish rules or portfolio selection criteria for determining how to allocate scarce funding to existing and proposed investments. Thus, developing an IT investment portfolio requires defining appropriate cost, benefit, schedule, and risk criteria with which to evaluate individual investments in the context of all other investments. To ensure that the organization’s strategic goals, objectives, and mission will be satisfied by its investments, the criteria should have an enterprisewide perspective. Further, if an organization’s mission or business needs and strategies change, criteria for selecting investments should be re-examined and modified as appropriate. Portfolio selection criteria should be disseminated throughout the organization to ensure that decisions concerning investments are made in a consistent manner and that this critical process is institutionalized. To achieve this result, project management personnel and others should be aware of the criteria and address the criteria in funding submissions for projects. Resources required for this critical process typically include the time and attention of executives involved in the process, adequate funding, and supporting tools. (The complete list of key practices is provided in table 11.) Treasury has executed four of the seven key practices associated with defining the portfolio selection criteria. For example, according to Treasury officials, the department has adequate resources for portfolio selection activities, including the Associate CIO for Capital Planning and Information Management, the CPIC team, the CPIC subcouncil, which is responsible for managing the development and modification of the IT portfolio selection criteria, as well as a portfolio management tool. In addition, project management personnel and other stakeholders are made aware of the portfolio selection criteria through Treasury’s CPIC team, and the department’s internal Web site. Despite these important steps in defining portfolio selection criteria, weaknesses remain. Specifically, the department has not developed policies or procedures for modifying the portfolio selection criteria to reflect changes to its strategic initiatives. In addition, because Treasury does not have an executive investment review board, the activities that call for this board to review and approve the portfolio selection criteria are not being performed. Reviews of the portfolio selection criteria are performed by the department’s CPIC subcouncil, which forwards its reviews to TIRB for approval of the criteria. Until Treasury fully defines and implements the practices required for defining the portfolio selection criteria, it will not have the tools it needs to effectively select the mix of investments that best meet the department’s mission needs considering resource and funding constraints. Table 11 shows the rating for each key practice required to create a portfolio and summarizes the evidence that supports these ratings. At Stage 3, organizations create a portfolio of IT investments to ensure that IT investments are analyzed according to the organization’s portfolio selection criteria and to ensure that an optimal IT investment portfolio with manageable risks and returns is selected and funded. According to ITIM, creating the portfolio requires organizations to, among other things, document policies and procedures for analyzing, selecting, and maintaining the portfolio; provide adequate resources, including people, funding, and tools for creating the portfolio; and capture the information used to select, control, and evaluate the portfolio and maintain it for future reference. In creating the portfolio, the investment board must also (1) examine the mix of new and ongoing investments and their respective data and analyses and select investments for funding and (2) approve or modify the performance expectations for the IT investments they have selected. (The complete list of key practices is provided in table 12.) Treasury has executed two of the seven key practices associated with creating the portfolio. For example, the department has adequate resources for creating its portfolio, including the CPIC subcouncil and the use of the department’s portfolio management tool. In addition, information is captured and maintained for future reference in the department’s portfolio management tool. The information in the tool is used to select, control, and evaluate all major IT portfolio investments. Nevertheless, Treasury has weaknesses in the way it creates a portfolio. First, it does not have a complete set of policies and procedures that address this critical process. Even though the department has policies and procedures for selecting the IT portfolio criteria, it lacks policies and procedures for using the criteria to analyze and maintain the department’s IT investment portfolio. Second, since the department does not have an executive investment review board, board members are not knowledgeable about creating a portfolio. In addition, information comparing the performance of IT investments against expectations is not currently being provided to the board because Treasury does not have one. Even though TIRB board selects IT investments based on data associated with the mix of new and ongoing major investments, this activity is not done for nonmajors, and there is not an executive investment review board to select the IT investments. Moreover, the executive investment board does not approve or modify the performance expectations of the selected IT investments. Unless Treasury defines and implements the practices for creating a comprehensive portfolio of IT, it will not be able to determine whether it has selected the mix of investments that best meets its needs and considers resource and funding constraints. Table 12 shows the rating for each key practice required to create a portfolio and summarizes the evidence that supports these ratings. This critical process builds on the Stage 2 critical process—Providing Investment Oversight—by adding the elements of portfolio performance to an organization’s investment control capacity. Compared with less mature organizations, Stage 3 organizations will have the foundation they need to control the risks faced by each investment and to deliver benefits that are linked to mission performance. In addition, a Stage 3 organization will have the benefit of performance data generated by Stage 2 processes. Executive-level oversight of risk management outcomes and incremental benefit accumulation provides the organization with increased assurance that each IT investment will achieve the desired results. (The complete list of key practices is provided in table 13.) Treasury is executing three of the seven key practices for this critical process by providing adequate resources for reviewing the portfolio, including the use of a portfolio tool that captures data on cost, schedule, and risk and is used to produce scorecards on a quarterly basis that summarizes portfolio data. The performance data are consolidated in the portfolio tool and used by TIRB. The CPIC staff is responsible for ensuring that the data are consistent with the portfolio performance criteria and that it is modified as needed. For example, based on OMB guidance, the department has added and modified criteria related to the Exhibit 300s, EA, and earned value management reporting requirements. In addition, Treasury uses the portfolio tool to collect portfolio performance data in a consistent manner that aligns with Treasury’s portfolio performance criteria. Despite these strengths, the department has yet to develop policies and procedures that address the review, evaluation, and improvement of its IT portfolio performance. In addition, TIRB members are not consistently provided with oversight review information for nonmajor IT investments by bureaus even though nonmajors make up about 70 percent of the department’s total number of projects. Also, while the department has a process in place for ensuring that adjustments are made to major investments in response to actual portfolio performance, it does not have a process in place to ensure that the bureaus make the necessary adjustments to their nonmajor investments on a consistent basis. Until Treasury executes all the key practices associated with this critical process, senior executives will not have the information they need to determine whether the investments they have selected are delivering mission value at the expected cost and risk. Table 13 shows the rating for each key practice required to implement the critical process for portfolio performance oversight at the Stage 3 level of maturity and summarizes the evidence that supports these ratings. The purpose of a PIR is to evaluate an investment after it has been completely developed (that is, after its transition from the implementation phase to the operations and maintenance phase) in order to validate actual investment results. This review is conducted to (1) examine differences between estimated and actual investment costs and benefits and possible ramifications for unplanned funding needs in the future and (2) extract “lessons learned” about the investment selection and control processes that can be used as the basis for management improvements. Similarly, PIRs should be conducted for investment projects that were terminated before completion, to readily identify potential management and process improvements. (The complete list of key practices is provided in table 14.) Treasury has executed two of the six key practices for conducting PIRs. According to officials, in fiscal year 2006, the department finished revising its PIR policies and procedures as part of the last phase of its CPIC process, the evaluate phase. The PIR guidance states that PIRs are to be conducted 6 to 18 months after the investment has been deployed (transitioned into the steady state life-cycle stage) or after the investment has rolled out major functionality. In addition, the department’s portfolio tool (PIR form) requires that reviews measure user satisfaction, achievement of strategic goals, and whether the investment met cost, schedule, and performance goals. The CPIC guidance also stipulates that project managers are responsible for conducting the reviews and collecting the information needed to document lessons learned, and who is responsible for approving the final PIR recommendations. Nevertheless, the department has not yet performed any PIRs since the CPIC policy was issued and therefore has not performed any of the activities associated with this critical process. Treasury officials stated that, since the issuance of their PIR policy, they have not conducted any PIRs because they have not had any investments transitioning from the development phase into the steady state phase. In 2005, the department conducted pilot PIRs on two major IT investments. Of the two, one review met its goals and the other review was recommended for a follow-up PIR because it was unable to provide information on customer satisfaction, benefits analysis, and systems performance due to schedule delays. Until PIRs are conducted on a regular basis with senior executive management involvement, Treasury will not be able to effectively evaluate the results of its IT investments to determine whether continuation, modification, or termination of an IT investment would be necessary in order to meet stated Treasury mission objectives. Table 14 shows the rating for each key practice required to conduct PIRs and summarizes the evidence that supports these ratings. We have previously reported that to effectively implement IT investments management processes, organizations need to be guided by a plan that (1) is based on an assessment of strengths and weaknesses; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior-level management. Such a plan is instrumental in helping agencies coordinate and guide improvement efforts. Treasury has initiated efforts to improve its investment management process. Treasury has contracted for a review of the CPIC governance process at each of its bureaus that entails performing portfolio investment validation and evaluation on the bureaus’ major investments. The reviews involve visiting the respective bureaus to verify key CPIC documentation, the health of their governance and investment processes, and their compliance with the department’s CPIC process. These reviews are to provide the department with a better understanding of the bureau’s processes and help the department identify opportunities for investment management improvements. The reviews also are to provide the department with greater confidence in the investment information being provided by the bureaus. In April 2007, Treasury issued an Internal Watch List that identifies major investments at risk of not meeting established goals. Among the criteria for placement on this list is cost or schedule variances greater than plus or minus 10 percent for two consecutive quarters. The department’s Office of the CIO is responsible for overseeing the Internal Watch List. Investments placed on this list are subject to additional reporting requirements, including development of an action plan to remediate the investment’s noncompliant conditions. Bureaus are to report on the status of their corrective actions to the CIO monthly. Once the corrective actions have been implemented and the CIO concurs, the investment may be removed from the list. According to officials, as of May 2007, bureaus were beginning to submit their corrective action plans to the CIO. The Internal Watch List process should improve project oversight by providing greater assurance that actions are taken to address deficiencies. Although Treasury has initiated these efforts, the department has not developed a comprehensive plan with the characteristics listed above that would help guide improvements to its investment management process. Treasury officials recognize the value of having a comprehensive plan and told us they plan to develop one once their new assistant secretary for management is confirmed; however, a time frame for completing the plan has not been established. Until Treasury develops this plan, the department risks not being able to put in place an effective management process that will provide appropriate executive-level oversight for minimizing risks and maximizing returns. The Clinger-Cohen Act, E-Government Act of 2002, and implementing guidance from OMB provide a number of investment management responsibilities to CIOs that generally entail working with the agency head and senior managers to define and implement processes for selecting, controlling, and evaluating investments. Our IT investment management framework defines practices that are consistent with these provisions. Because CIOs are to carry out their investment management functions with the support of an enterprisewide investment review board, many of the responsibilities we used to evaluate the Treasury CIO’s role relate to key practices discussed earlier in the report as part of our evaluation of the department’s investment management capabilities. The Treasury CIO’s role in managing the department’s IT investments has been mixed, although it has gradually increased since September 2005, when the department’s CPIC policy was issued. Many responsibilities have been fully performed, including responsibilities for establishing investment management policy, several associated with selecting investments, and some associated with controlling investments. Several responsibilities have been partially performed—including some associated with selecting investments, and others associated with controlling investments—either because the department has not extended them to nonmajor investments or because some activities have not yet been completed. A few responsibilities—most of them associated with controlling investments—have not yet been performed, primarily because they are just getting under way and have yet to produce results. Table 15 shows the CIO’s role in performing key investment management responsibilities. The CIO’s involvement in managing the department’s investments has strengthened the investment management process. For example, by regularly reviewing and modifying investment selection criteria, as appropriate, to reflect organizational objectives, the CIO, as Chair of the TIRB, has helped ensure investments supporting organizational goals are selected. However, several responsibilities have not been fully performed. For example, several responsibilities for selecting and controlling investments have not been performed for nonmajor investments. As discussed earlier in the report, Treasury officials stated they have not made the nonmajor investments a priority because they have instead chosen to devote their resources to the major investments, which represent about 80 percent of the department’s IT expenditures. As noted earlier, while it is reasonable to focus on the major investments, the nonmajor investments also require a certain level of oversight, given the significant amount of funding (about $480 million) and number of investments (160) involved. Because several responsibilities have not been fully performed, there is increased risk that investments will not be effectively managed. Given the importance of IT to Treasury’s mission, it is vital that the department manage its investments effectively. To its credit, because of the attention that has recently been given to investment management, Treasury has established many of the practices needed to build the investment foundation and manage its projects as a portfolio and, as such, has made progress since we examined the department’s process as part of our governmentwide review 3 years ago. However, the absence of an executive investment review board actively engaged in the investment management process and the department’s limited involvement in the management of nonmajor investments are significant weaknesses that hamper the department’s ability to effectively manage its investments. As a result, the department cannot ensure that it is managing the mix of investments that will maximize returns to the organization, taking into account the appropriate level of risk. Critical to Treasury’s success going forward will be the development and implementation of a plan that (1) is based on the assessment of strengths and weaknesses identified in this report; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior management. Without such a plan and procedures for implementing it, it will be difficult for the department to maintain steady progress in improving its investment management process. As a result, Treasury will continue to be challenged in its ability to make informed and prudent investment decisions in managing its annual multibillion-dollar IT budget. By fully performing selected investment management responsibilities, the CIO has taken positive steps toward strengthening the department’s process for selecting, controlling, and evaluating investments. However, the department’s investments will continue to be at risk as long as there are responsibilities that are partially performed or not performed. To strengthen Treasury’s investment management capability, we recommend that the Secretary of the Department of the Treasury direct the Assistant Secretary for Management, in collaboration with the CIO, to develop and implement a plan to address the following two actions: (1) Establish an executive investment review board, composed of executives representing IT and business units, that would be actively engaged in the investment management process. (2) Develop and implement policies and procedures to manage nonmajor investments. We also recommend that the plan include actions to address the weaknesses in eight critical processes identified in this report, beginning with those identified in our Stage 2 analysis and continuing with those identified in our Stage 3 analysis. The plan should, at a minimum, provide for fully implementing the following: instituting the investment board, selecting an investment, and providing investment oversight. defining the portfolio criteria, evaluating the portfolio, and conducting postimplementation reviews. In developing the plan, the Secretary of the Department of the Treasury should direct the Chief Information Officer to ensure that the plan draws together ongoing and additional efforts needed to address the weaknesses identified in this report, including those relating to the CIO’s role in performing investment management responsibilities. The plan should also (1) specify measurable goals, objectives, and milestones; (2) specify needed resources; (3) assign clear responsibility and accountability for accomplishing tasks; and (4) be approved by senior management. In implementing the plan, the Chief Information Officer should ensure that the resources are available to carry out the plan and that progress is measured and reported periodically to the Secretary of the Department of the Treasury. In e-mail comments on a draft of this report, the Acting CIO stated that the report reflects both Treasury’s shortcomings as well as progress to date and recognized the need to take proactive steps to strengthen its investment board operations and oversight of information technology resources and programs. Treasury also commented on the need for an executive review board, nonmajor investments, and the department’s authority to redirect funding from one Treasury bureau to another. Regarding the need for an executive investment review board, Treasury noted that, in addition to the Technical Investment Review Board chaired by the CIO, an E-Board consisting of Treasury executives previously existed. We acknowledge the establishment of these boards in our report but emphasize that there currently is no executive investment review board composed of executives from IT and business units that is actively engaged in the investment management process. The department recognizes this in its comments, stating that it agrees it needs to reconstitute its executive board such that it is actively engaged in the investment management process. Regarding nonmajor investments, Treasury commented that nonmajor investments have not been a priority because the major investments the department has chosen to devote its resources to represent the more significant portion of the portfolio in terms of dollar value, visibility to OMB and Congress, and importance to Treasury’s mission. We recognize the importance of the major investments in our report and acknowledge that it is reasonable to focus attention on these investments. Nevertheless, we maintain that nonmajor investments should require a certain level of oversight given the amount of funding involved (about $480 million in estimated expenditures for fiscal year 2007) and the fact that they represent the bulk of most bureaus investment portfolio. Treasury also stated that its CPIC guide contains guidance on managing nonmajor IT investments and that the department conducts quarterly control reviews of all IT investments, both major and nonmajor. While the guide requires all IT investments to comply with its provisions, it clearly states that the select phase described applies to major investments and that bureaus are responsible for conducting their own select process for nonmajor investments. In addition, while, as we note in the report, Treasury requires bureaus to report on the cost, schedule, and performance of its nonmajor investments on a quarterly basis, this information is not provided to TIRB for review. Treasury noted that it is currently developing guidance and reporting requirements for nonmajors that integrates enterprise architecture and capital planning. In its comments, Treasury also noted that the department’s ability to exercise effective management of its IT portfolio requires that the CIO (as chairman of the Technical Investment Review Board) be empowered to make recommendations to the executive board concerning IT budgetary requests across the department. Additionally, the executive board needs to be empowered to make decisions across organizational lines on behalf of the department. Treasury added that, currently, neither the Treasury Department, including the Acting CIO, nor the executive board has the prerogative (authority) to redirect IT funding from one Treasury bureau to another. While this particular authority was not the subject of our review, we agree that not having it could present a challenge to effectively managing the IT portfolio. Nevertheless, effective portfolio management requires the collective decisionmaking of executives from both IT and business units, which highlights the importance of having an executive investment review board that is actively engaged in the investment management process. We are sending copies of this report to the Chairmen and Ranking Minority Members of other Senate and House committees that have authorization and oversight responsibilities for Treasury and other interested congressional committees; the Director of the Office of Management and Budget; the Secretary of the Treasury; the Assistant Secretary for Management and Chief Financial Officer; and the Chief Information Officer. We also will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. The objectives of our review were to (1) assess the Department of the Treasury’s capabilities for managing its IT investments, (2) determine any plans Treasury might have for improving those capabilities, and (3) evaluate the CIO’s role in managing the department’s IT investments. To address our first objective, we reviewed the results of the department’s self-assessment of Stages 2 and 3 practices using our IT investment management framework and validated and updated the results of the self- assessment through document reviews and interviews with officials. We reviewed written policies, procedures, and guidance and other documentation providing evidence of executed practices, including Treasury’s Capital Planning and Investment Control Policy Guide, Earned Value Management Policy Guide, Exhibit 300 Scoring Guide, Alternative Analysis Policy Guide, FY06 IT Portfolio Alignment Summary, IT Modernization Blueprint Volume 2: IT Strategic Plan, portfolio management tool guidance, and various memorandums. We also reviewed TIRB and CIO Council meeting materials. In addition, we conducted interviews with officials from the Office of the CIO, whose main responsibility is to oversee and ensure that Treasury’s IT investment management process is implemented and followed. We compared the evidence collected from our document reviews and interviews to the key practices in ITIM. We rated the key practices as “executed” on the basis of whether the agency demonstrated (by providing evidence of performance) that it had met the criteria of the key practice. A key practice was rated as “not executed” when we found insufficient evidence of a practice during the review or when we determined that there were significant weaknesses in Treasury’s execution of the key practice. In addition, Treasury was provided with the opportunity to produce evidence for key practices rated as “not executed.” We did not assess progress in establishing the capabilities found in Stages 4 and 5 because the department acknowledged it had not executed the key practices in these higher maturity stages. To determine the level of guidance the department is providing to its bureaus, we interviewed officials and obtained written responses from the Bureau of the Public Debt, Financial Management Service, and the Internal Revenue Service (IRS) to determine the level of investment management guidance and oversight that is provided by the department. As part of our analysis, we selected one enterprisewide and three bureau-level IT projects as case studies to verify that the critical processes and key practices were being applied. The projects selected (1) are in different life- cycle phases, (2) represent a mix of headquarters and component bureau investments, (3) support different functional areas, and (4) required different levels of funding. The four projects are described as follows: 1. Customer Account Data Engine (CADE). The database initiative is the foundation for managing taxpayer accounts in IRS’s Business Systems Modernization effort. CADE is being incrementally designed, developed, and implemented to form the data foundation for a modernized IRS by replacing the Individual Master File and its related applications with new technology, new applications, and new databases. The system’s purpose is to enable IRS tax specialists to post transactions and update taxpayer account and return data using an online interface tool. Updates are to be available daily to authorized personnel who have access to this data, which provide a complete, timely, and accurate account of the individual taxpayer’s information. The project is a major investment and has an estimated life-cycle cost of over $1.3 billion. 2. Savings Bond Replacement System (SaBRe). SaBRe supports two of the President’s Management Agenda initiatives: financial performance and expanded e-government. It processes cash and security transactions that result when accrued savings bonds are sold or redeemed by Federal Reserve Bank processing sites or by financial institutions and corporate entities designated as fiscal agents. Federal Reserve Bank processing sites consolidate and report to SaBRe daily issue and retirement transactions generated by processing cash and security transactions. SaBRe processes the transactions, updates electronic records that are used for customer service, and reports daily financial transactions for inclusion in the Daily Treasury Statement. The project is a major investment and has an estimated life-cycle cost of over $57 million. 3. Treasury Receivable, Accounting, and Collection System (TRACS). TRACS is to provide Treasury’s Financial Management Service with a tool for supporting its Payment Business Line for the accounting, debt billing, collection, and reporting requirements associated with Treasury’s check claims business process. It is to aid in the processing of check claims accounting, authorization of payments, issuing of bills, debt collection, and funds transfers from and to federal program agencies. Currently all funding for TRACS will be used to maintain and enhance the system. The project is a nonmajor investment and has an estimated life-cycle cost of over $11 million through fiscal year 2012. 4. Treasury Foreign Intelligence Network (TFIN). TFIN exists to assist Treasury analysts in their ongoing efforts to provide meaningful intelligence to senior Treasury management as well as to other agencies within the intelligence community. It was originally built as a customized in-house network over 10 years ago. In early fiscal year 2005, Treasury identified a need to modernize TFIN due to the age of the system, outdated components, and performance issues, and to address Treasury’s expanding mission in the fight against terrorism. The system is currently listed as a major department-level development, modernization, and enhancement effort, with total estimated life-cycle costs of $43 million. For these projects, we reviewed project management documentation, such as project plans, and status reports. We also obtained investment information from the bureau officials responsible for managing the projects. To address our second objective, we obtained and evaluated documents showing what management actions had been taken and what initiatives had been planned by the agency. This documentation included the IT Modernization Blueprint Volume 2, IT Strategic Plan, The Department of the Treasury’s Strategic Plan, and a contractor work request for an independent validation and verification of Treasury’s capital planning program support process. We also interviewed officials from the Office of the CIO to determine efforts undertaken to improve IT investment management processes. To address our third objective, we reviewed legislation, including the Clinger-Cohen Act of 1996 and the E-Government Act of 2002, and OMB guidance to determine the roles and responsibilities of CIOs regarding investment management. We also reviewed the practices laid out in GAO’s IT investment management framework. We reviewed documentation and conducted interviews with Treasury officials, including the Associate CIO for Capital Planning and Information Management, to determine the extent of the CIO’s involvement in selecting, controlling, and evaluating the department’s IT investments. We conducted our work at Treasury headquarters in Washington, D.C., from August 2006 through July 2007 in accordance with generally accepted government auditing standards. In addition to the contact named above, Sabine Paul, Assistant Director; William Barrick; Camille Chaires; Neil Doherty; Nancy Glover; and Tomas Ramirez; made key contributions to this report.

Summary: The Department of the Treasury relies extensively on information technology (IT) to carry out its mission. For fiscal year 2007, Treasury requested about $2.8 billion--the third largest planned IT expenditure among civilian agencies. GAO's objectives included (1) assessing Treasury's capabilities for managing its IT investments and (2) determining any plans the agency has for improving its capabilities. GAO used its IT investment management framework (ITIM) and associated methodology to address these objectives, focusing on the framework's stages related to the investment management provisions of the Clinger-Cohen Act of 1996. While Treasury has established many of the capabilities needed to select, control, and evaluate its IT investments, the department has significant weaknesses that hamper its ability to effectively manage its investments. Specifically, the department has executed 19 of the 38 key practices that the ITIM requires to build a foundation for IT investment management (Stage 2), including practices needed to ensure that projects support business needs and that a disciplined process exists for capturing investment information. In addition, the department has executed 11 of the 27 key practices required to manage investments as a portfolio (Stage 3), including documenting policies and procedures for conducting postimplementation reviews. However, Treasury does not have an executive investment review board--a group of executives from IT and business units that is intended to be the final decision-making authority--that is actively engaged in the investment management process. In addition, the department does not have any policies and procedures for managing its nonmajor investments, although they represent almost 70 percent of the total number of investments. Until the department addresses these weaknesses, it will not have the investment management structure needed to effectively assess and manage the risks associated with its multibillion-dollar portfolio. To its credit, Treasury has initiated efforts to improve its investment management process. For example, it has recently implemented a process for identifying major projects that should receive additional oversight. However, the department has not developed a comprehensive improvement plan that (1) is based on an assessment of strengths and weaknesses; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior-level management. GAO has previously reported that such a plan is instrumental in helping agencies coordinate and guide improvement efforts. Until Treasury develops this plan and the controls for implementing it, the department risks not being able to put in place an effective management process that will provide appropriate executive-level oversight for minimizing risks and maximizing returns.