The mission of INS, an agency of the Department of Justice, is to administer and enforce the immigration laws of the United States. To accomplish its mission, INS has three interrelated business areas— enforcement, immigration services, and corporate (i.e., mission-support) services. Enforcement includes border inspections of persons entering the United States, detecting and preventing smuggling and illegal entry, and identifying and removing illegal entrants. Immigration services include granting legal permanent residence status, nonimmigrant status (e.g. students and tourists), and naturalization. INS efforts to protect our nation’s borders are performed under both of these core mission areas. Corporate services include functions such as financial and human capital management. INS’ field structure consists of 3 regional offices, 4 regional service centers, 3 administrative centers, 36 district offices, 21 Border Patrol sectors, and more than 300 land, sea, and air ports of entry. To carry out its responsibilities, INS relies on IT. For example, the Integrated Surveillance Intelligence System (ISIS) is to provide “24 by 7” border coverage through ground-based sensors, fixed cameras, and computer-aided detection capabilities. Also the Student Exchange Visitor Information System (SEVIS) is to manage information about nonimmigrant foreign students and exchange visitors from schools and exchange programs. Each year INS invests, on average, about $300 million in IT systems, infrastructure, and services. Recent studies have identified significant weaknesses in INS’ management of IT projects. In August 1998, the Logistics Management Institute (LMI) reported that INS did not track and manage projects to a set of cost, schedule, technical, and benefit baselines. LMI noted that while INS had defined good procedures for developing systems, it did not consistently follow them. Similarly, in July 1999, the Justice Inspector General (IG) reported that INS was not adequately managing its IT systems. In particular, the IG reported that (1) estimated completion dates for some IT projects had been delayed without explanation, (2) project costs continued to spiral upward with no justification for how funds are spent, and (3) projects were nearing completion with no assurance that they would meet performance and functional requirements. In light of the reported problems on individual projects, we reviewed INS’ institutional approach to managing IT to determine the root cause of project problems and to provide the basis for recommending fundamental management reform. In doing so, we focused on two key and closely related IT management process controls: investment management and enterprise architecture management. In August 2000 and December 2000, we reported that INS lacked both of these management process controls because the former agency leadership had not viewed either as an institutional priority. We also provided INS, through our recommenda- tions, a roadmap for establishing and implementing both controls. INS agreed with our findings and recommendations, and it committed to implementing the recommendations. Although INS has made progress to date in doing so, much remains to be accomplished before it will have implemented these management controls and have the capability to effectively and efficiently manage IT. As defined by the Clinger-Cohen Act of 1996 and associated Office and Management and Budget instructions, and as practiced by leading public and private sector organizations, effective IT investment management requires implementing process controls for maximizing the value and assessing and managing the risks of investments. The goal is to have the means in place and functioning to help ensure that IT projects are being implemented at acceptable costs, within reasonable and expected time frames, and are contributing to tangible, observable improvements in mission performance. To help agencies understand their respective IT investment management capabilities, we developed the Information Technology Investment Management (ITIM) maturity framework. The ITIM framework is a tool that identifies critical processes and practices for successful IT investment and organizes them into a framework of increasingly mature stages. A fundamental premise of the framework is that each incremental stage lays a foundation on which subsequent stages build. The initial stage focuses on controlling investments already underway, while also starting to establish a way to select new investments. Later stages emphasize managing investments from a portfolio perspective in which individual investments are evaluated as a set of competing options based on their contribution to mission goals and objectives. The goal is to arrive at the optimal mix of projects in which to invest resources. Agencies can use the framework for assessing the strengths and weaknesses of their existing investment management processes and for developing a roadmap for improvement. The Chief Information Officers Council has endorsed the ITIM framework. In order for an agency to achieve a minimum level of IT management effectiveness, it needs to first gain control of its current investments. To do this, it must establish and implement processes and practices for ensuring that projects have defined cost, schedule, and performance expectations; that projects are continuously controlled to determine whether commitments are being met and to address deviations; and that decisionmakers have this basic investment information to use in selecting new projects for funding and deciding whether to continue existing projects. Once it has established these project-specific control and selection processes, the agency then should move to considering each new investment not as a separate and distinct project, but rather as part of an integrated portfolio of investments that collectively contribute to mission goals and objectives. To do this, the agency should establish and implement processes and practices for analyzing the relative pros and cons of competing investment options and selecting a set of investments that agency leadership believes best meets mission-based and explicitly defined investment criteria. Integral to an effective IT investment management process is having a well-defined enterprise architecture or blueprint for guiding the content and characteristics of investments in new and existing IT systems, infrastructure, and services. The goal is to help ensure that the new and modified IT assets will, among other things, be designed and implemented to promote interoperability and avoid duplication, thereby optimizing agencywide performance and accountability. In more specific terms, an enterprise architecture is a comprehensive and systematically derived description of organization’s operations, both in logical terms (including business functions and applications, business rules, work locations, information needs and users, and the interrelation- ships among these variables) and in technical terms (including IT hardware, software, data, communications, security, and performance characteristics and standards). If defined properly, enterprise architectures can clarify and help optimize the connections among an organization’s interrelated and interdependent business operations and the underlying IT supporting these operations. A complete enterprise architecture includes both the current architecture (as it is now) and the target architecture (the goal), as well as a plan for moving between the two. To assist agencies in developing, maintaining, and implementing enterprise architectures, we collaborated with the Chief Information Officers Council to develop a practical guide for enterprise architecture management. In December 2000 we reported that while INS had some investment control elements, it nevertheless lacked the full set of foundational investment management processes and practices needed to effectively control its ongoing IT projects and ensure that it was meeting cost, schedule, and performance commitments and contributing to measurable mission performance and accountability goals. For example, INS had not consistently (1) developed and maintained project management plans that specified cost and schedule baselines, (2) linked projects to INS mission needs, and (3) tracked and monitored projects to determine whether they were meeting project baselines and mission needs. Without this information, the investment review board (that, to its credit, INS had established to make investment selection decisions) could not act to effectively address deviations. The result was increased risk that the technology needed to support mission goals, such as securing America’s borders, would not be delivered on time and on budget and would not perform as intended. We also reported in December 2000 that INS was not effectively managing its IT investments, both new proposals and ongoing projects, as a portfolio, meaning that INS’ investment review board was not making portfolio selection and control decisions in terms of what mix of proposed and ongoing projects collectively best supported achievement of mission needs and priorities. In particular, INS had not defined, and thus was not using, investment selection criteria that were linked to mission needs and addressed cost, schedule, benefits, and risk. Without such criteria, the board lacked the basic information needed to assess the relative merits of and make trade-offs among its options for increasing IT capabilities, including acquiring new, enhancing existing, and operating and maintaining existing systems and infrastructure. By not employing portfolio investment management, we concluded that INS was at risk of not having the right mix of technology in place to support critical mission priorities, such as protecting America’s borders against the threat of terrorism. Accordingly, we made a series of recommendations to INS aimed at, among other things, treating the development and implementation of IT investment management process controls as an agency priority and managing them as such. Since our December 2000 report, INS has taken steps to implement our recommendations for establishing and following rigorous and disciplined investment management controls. In particular, it has developed a guide for IT investment management that, according to INS, defines many of the missing processes and practices. The key for INS will be to ensure that these processes and practices are effectively implemented. Given that the Justice IG, in reporting on IT project problems, found that INS was not following established project management procedures, successful implementation of INS’ newly developed investment guide cannot be taken for granted, and needs to be given the attention it deserves. In July 2000, we reported that INS did not have an enterprise architecture, including a description of both its “as is” and “to be” operational and technology environments and a roadmap for transitioning between the two environments. Moreover, we also reported that the efforts underway to develop the architecture were flawed and unlikely to produce useful architectural products. In particular, the development efforts were limited to a producing a bottom-up description of INS’ current IT environment (e.g., hardware and system software computing platforms, data structures and schemas, software applications) and mapping the software applications to mission areas. While this was a reasonable start to describing the current architectural environment, important steps still needed to be accomplished, such as linking the systems environment description to a decomposed view of agency mission areas, including each area’s component business functions, information needs, and information flows among functions. Moreover, doing this reliably required the participation of agency business owners; however, these owners were not involved. Also, INS had not begun developing either a target architecture or a capital investment plan for sequencing the projects that will it allow to migrate from its current architecture to its target architecture. These two components would be integral to INS’ previously mentioned need to implement effective investment management processes and practices because both controlling and selecting IT projects requires ensuring that these projects are provided for in the sequencing plan and are aligned with the target architecture. By doing so, investment decisionmakers can know (1) how proposed projects contribute to the strategic mission goals, needs, and priorities and (2) whether these projects will be engineered according to the technical models and standards, that are both embedded in the target architecture descriptions. Equally important, we reported that INS’ architecture development efforts were not being managed as a formal program, including having meaningful plans that provided a detailed breakdown of the work and associated schedules and resource needs. Further, these efforts did not include performance measures and progress reporting requirements to ensure that the effort was progressing satisfactorily. As a result, we concluded that it was unlikely that INS could produce a meaningful architecture that could be used to effectively and efficiently guide and constrain IT investment and project decisionmaking. Accordingly, we made a series of recommendations to INS aimed at making development of an enterprise architecture an agency priority and managing it as such.

Summary: Information technology (IT) management process controls are predictors of organizational success in developing, acquiring, implementing, operating, and maintaining IT systems and related infrastructure. GAO found that the Immigration and Naturalization Service (INS) has not implemented practices associated with effective IT investment and enterprise architecture management. Furthermore, these investments are not aligned with an agencywide blueprint that defines the agency's future operational and technological plans. INS does not know whether its ongoing investments are meeting their cost, schedule, and performance commitments.