The mission of INS, an agency of the Department of Justice, is to administer and enforce the immigration laws of the United States. To accomplish this, INS is organized into three core business areas— enforcement, immigration services, and corporate services. Enforcement includes, among other things, conducting inspections of travelers entering the United States as they arrive at more than 300 land, sea, and air ports of entry; detecting and preventing the smuggling and illegal entry of aliens; and identifying and removing persons who have no lawful immigration status in the United States. Immigration services, which involve regulating permanent and temporary immigration to the United States, include granting legal permanent residence status, nonimmigrant status (e.g., tourists and students), and naturalization. Corporate services include records management, financial management, personnel management, and inventory management support for INS activities. INS' IT assets play a significant role in (1) receiving and processing naturalization and other benefit applications, (2) processing immigrants and nonimmigrants entering and leaving the United States, and (3) identifying and removing people who have no lawful immigration status in the United States. For example, the Computer-Linked Application Information Management System (CLAIMS 4) is a centralized case management tracking system, that offers support for a variety of tasks associated with processing and adjudicating naturalization benefits. In addition, the Deportable Alien Control System (DACS) automates many of the functions associated with tracking the location and status of illegal aliens in removal proceedings, including detention status. INS has multiple efforts underway to develop and acquire new information systems and to maintain existing ones. According to INS, in fiscal year 2000, it obligated about $327 million on IT activities, including about $94 million for new development and the remaining amount, which includes enhancing existing systems, for operations and maintenance. For example, INS obligated $14.5 million in fiscal year 2000 to continue development of CLAIMS 4, which supports the processing of applications and petitions for immigrant benefits and is intended to fully replace CLAIMS 3. In addition, INS obligated about $18 million in fiscal year 2000 to further deploy its Integrated Surveillance Intelligence System (ISIS), which includes the deployment of intelligent computer aided detection systems, unattended ground sensors, and fixed cameras along the northern and southern borders to provide around-the-clock visual coverage of the border. For fiscal year 2001, INS plans to spend about $226 million on IT for operations and maintenance activities. INS funds most of its IT efforts with operation and maintenance funds and currently is developing or maintaining 74 information systems. Recent reviews have identified several weaknesses in INS' management of its IT projects. For example, in August 1998, the Logistics Management Institute (LMI) reported that INS' Office of Information Resources Management (OIRM) (1) did not maintain accurate cost estimates for the complete life cycle of projects and (2) did not track and manage projects to a set of cost, schedule, technical, and benefit baselines. Further, LMI noted that while INS' System Development Life Cycle (SDLC) manual provides a good model for systems development projects, OIRM did not consistently follow it, often bypassing key SDLC phases. Similarly, in July 1999, the Justice Inspector General (IG) reported that (1) estimated completion dates for some INS IT projects had been delayed without explanation for the delays, (2) project costs continued to spiral upward with no justification for how funds are spent, and (3) projects were nearing completion with no assurance that they would meet performance and functional requirements. Recognizing the need to address these weaknesses, INS established an Operational Assessment Team to analyze reported weaknesses and recommend specific actions to address them. The Operational Assessment Team validated the deficiencies identified in the LMI and Justice IG reports and identified additional ones. For example, the team found that system requirements were not consistently collected, recorded, documented, tracked, and controlled. To illustrate, of 105 projects reviewed by the team, fewer than 50 percent had documented requirements and most of the requirements that had been documented were not current. Further, in August 2000, we reported that INS did not have an enterprise architecture to guide the development and evolution of its information systems. An enterprise architecture is an institutional systems blueprint that defines in both business and technological terms the organization's current and target operating environments and provides a road map for moving from one to the other. It is required by the Clinger-Cohen Act and is a recognized practice of successful public and private sector organizations. INS had initiated some limited efforts to document its current architecture, but it had not yet begun developing a target architecture or a plan to move from the current to the target environment. Moreover, INS had not yet established the management structure and controls to develop the architecture. The absence of such an enterprise architecture increases the risk that the hundreds of millions of dollars INS spends each year on information systems will not be well integrated or compatible and will not effectively support mission needs and priorities. In 1997, INS established an investment review board (IRB). The IRB consists of four voting members—the Deputy Commissioner (Chair) and INS' three Executive Associate Commissioners—and advisory or supporting members, including the Director of the Budget Office and the Acting Associate Commissioner of the Office of Information Resources Management. In November 1998, INS also established the Executive Steering Committee (ESC) to support the IRB. The ESC comprises portfolio managers and advisory members, which analyze investment proposals and make recommendations on these proposals to the IRB. The IRB has established a process for selecting new IT proposals. According to INS officials, new proposals are developed throughout the year as business needs are identified and are forwarded to the appropriate portfolio manager for review. After reviewing the proposal, the portfolio manager forwards it to the ESC for consideration for funding. The ESC examines the proposals submitted and determines the appropriate funding for each project. Once funding is determined, the ESC forwards the proposed funding levels to the IRB, which makes the final investment selections and budget formulation decisions. See figure 2 for INS' new proposal selection process. As part of INS' annual budget execution process, the IRB considers the funding requests of ongoing and new projects. Project managers define requirements for their ongoing projects, which they submit to the responsible portfolio managers for review. After reviewing the requirements and funding requests, each portfolio manager submits them to the ESC for review and to the IRB for approval. The approved funding is submitted to the Budget Office for inclusion into its budget execution process. According to INS officials, new proposals are considered for funding only after ongoing projects have been funded. Several recent management reforms—including the revision to the Paperwork Reduction Act and the passage of the Clinger-Cohen Act of 1996, the Government Performance and Results Act of 1993, and the Chief Financial Officers Act of 1990—have introduced requirements emphasizing the need for federal agencies to improve their management processes for selecting and managing IT resources. In particular, the Clinger-Cohen Act requires that the head of each agency implement a process for maximizing the value of the agency's IT investments and for assessing and managing the risks of its acquisitions. A key goal of the Clinger-Cohen Act is that agencies have processes and information in place to help ensure that projects are being implemented at acceptable costs within reasonable and expected time frames and that they are contributing to tangible, observable improvements in mission performance. We and the Office of Management and Budget (OMB) have developed guidance to assist federal agencies in managing IT investments. One such guide, Assessing Risks and Returns: A Guide for Evaluating Federal Agencies' IT Investment Decision-making, incorporates our analysis of the management practices of leading private and public sector organizations as well as the provisions of major federal legislation (e.g., Clinger-Cohen Act) and executive branch guidance that address investment decision-making. The guide provides a method for determining how well a federal agency is selecting and managing its IT resources and identifies specific areas where improvements can be made. To enhance this guidance, we issued an Information Technology Investment Management (ITIM) maturity framework in May 2000. ITIM provides a common framework for assessing IT capital planning and investment management practices by describing the organizational processes, and their interrelationships that are the tenets of good investment management. ITIM is based on the best-practices work done as part of our ongoing research into the IT management practices of leading organizations. ITIM is a hierarchical model comprising five maturity stages. These maturity stages represent steps toward achieving stable and mature investment management processes. As agencies advance through the model's stages, their capability to manage IT increases. Each stage builds upon the lower stages and enhances the organization's ability to manage its investments. With the exception of the first stage, each maturity stage is composed of critical processes that must be implemented and institutionalized for the organization to satisfy the requirements of that stage. These critical processes are further broken down into key practices that describe the types of activities that an agency should be engaged in to successfully implement each critical process. An organization that has these critical processes in place is in a better position to successfully invest in IT. (See figure 3 for the five stages and associated critical processes). As established by the model, each critical process contains five core elements that indicate whether the implementation and institutionalization of a process can be effective and repeated. The five core elements are: Purpose: This is the primary reason for engaging in the critical process and states the desired outcome for the critical process. Organizational commitment: This comprises management actions that ensure that the critical process is established and will endure. Key practices typically involve establishing organizational policies and engaging senior management sponsorship. Prerequisites: These are the conditions that must exist within an organization to successfully implement a critical process. This typically involves allocating resources, establishing organizational structures, and providing training. Activities: These are the key practices necessary to implement a critical process. An activity occurs over time and has recognizable results.