SSA’s mission is to advance the nation’s economic security through compassionate and vigilant leadership in shaping and managing America’s Social Security programs. This includes one of the nation’s largest entitlement programs––federal Old-Age, Survivors, and Disability Insurance benefits––commonly referred to as Social Security. The program provides monthly benefits to retired and disabled workers, their spouses and children, and the survivors of insured workers. SSA also administers Supplemental Security Income, a needs-based program for the aged, blind, and disabled that pays monthly benefits to individuals. Over 54 million people, one-sixth of the total U.S. population, receive monthly Social Security or Supplemental Security Income benefit payments. The agency’s estimated 2008 budget of about $657 billion includes an administrative budget of $9.7 billion to support these programs, including about $1 billion for IT. Organizationally, SSA is headed by the Commissioner, who is assisted by a deputy commissioner and various other executive officials, including the Deputy Commissioner, Budget, Finance and Management; Chief Information Officer (CIO); Chief Strategic Officer; and nine deputy commissioners responsible for the agency’s various business components. The organizational structure of the agency is depicted in figure 1. The Commissioner is supported by approximately 60,000 employees located at headquarters and throughout a decentralized network of over 1,400 offices that include regional offices, field offices, teleservice centers, processing centers, state Disability Determination Services, program service centers, and hearing offices. Of these employees, approximately 3,300 IT staff and contractors are assigned to the Office of Deputy Commissioner, Systems. According to SSA, its organizational structure is designed to provide timely, accurate, and responsive service to the American public. The agency relies extensively on information technology to administer its programs and to support related administrative needs. In this regard, IT is used to, among other things: evaluate evidence and make determinations of eligibility for benefits on issue new and replacement Social Security cards, process earnings items for crediting to workers’ earnings records, handle millions of transactions on SSA’s toll-free telephone number, issue Social Security statements, process continuing disability reviews, and process nondisability Supplemental Security Income redeterminations. The agency’s IT budget for fiscal year 2008 is approximately $1 billion. Of this amount, $400 million is for work year support of software development projects in the Office of Deputy Commissioner, Systems and about $610 million is for acquisition of IT-related products and services. The agency expects to spend about 80 percent of its acquisition budget on infrastructure. A corporate approach to IT investment management is characteristic of successful public and private organizations. Recognizing this, Congress enacted the Clinger-Cohen Act of 1996, which requires the Office of Management and Budget (OMB) to establish processes to analyze, track, and evaluate the risks and results of major capital investments in IT systems made by executive agencies. In implementing the Clinger-Cohen Act and other statutes, OMB has developed policy and issued guidance for the planning, budgeting, acquisition, and management of federal capital assets. We have also issued guidance in this area that defines institutional structures, such as investment boards; processes for developing information on investments (such as cost/benefit); and practices to inform management decisions (such as whether a given investment is aligned with an enterprise architecture). IT investment management is a process for linking IT investment decisions to an organization’s strategic objectives and business plans. Consistent with this, the federal approach to IT investment management focuses on selecting, controlling, and evaluating investments in a manner that minimizes risks while maximizing the return on investment. During the selection phase, the organization (1) identifies and analyzes each project’s risks and returns before committing significant funds to any project and (2) selects those IT projects that will best support its mission needs. During the control phase, the organization ensures that projects, as they develop and investment expenditures continue, meet mission needs at the expected levels of cost and risk. If the project is not meeting expectations or if problems arise, steps are quickly taken to address the deficiencies. During the evaluation phase, expected results are compared with actual results after a project has been fully implemented. This comparison is done to (1) assess the project’s impact on mission performance, (2) identify any changes or modifications to the project that may be needed, and (3) revise the investment management process based on lessons learned. Our ITIM framework consists of five progressive stages of maturity for any given agency relative to selecting, controlling, and evaluating its investment management capabilities. (See fig. 2 for the five ITIM stages of maturity.) This framework is grounded in our research of IT investment management practices of leading private and public sector organizations. The framework can be used to assess the maturity of an agency’s investment management processes and as a tool for organizational improvement. The overriding purpose of the framework is to encourage investment processes that increase business value and mission performance, reduce risk, and increase accountability and transparency in the decision process. We have used the framework in many of our evaluations, and a number of agencies have adopted it. ITIM’s five maturity stages represent steps toward achieving stable and mature processes for managing IT investments. Each stage builds on the lower stages and the successful attainment of each stage leads to improvement in the organization’s ability to manage its investments. With the exception of Stage 1, each maturity stage is composed of “critical processes” that must be implemented and institutionalized in order for the organization to achieve that stage. These critical processes are further broken down into key practices that describe the types of activities that an organization should be performing to successfully implement each critical process. It is not unusual for an organization to perform key practices from more than one maturity stage at the same time. However, our research has shown that agency efforts to improve investment management capabilities should focus on implementing all lower stage practices before addressing the higher stage practices. Figure 2 provides an overview of the five ITIM stages of maturity and the critical processes associated with each stage. In the ITIM framework, Stage 2 critical processes lay the foundation for sound IT investment management by helping the agency to attain successful, predictable, and repeatable investment management processes at the project level. Specifically, Stage 2 encompasses building a sound investment management foundation by establishing basic capabilities for selecting new IT projects. This stage also involves developing the capability to control projects so that they finish predictably within established cost and schedule expectations and developing the capability to identify potential exposures to risk and put in place strategies to mitigate that risk. It also involves instituting an IT investment board, which includes defining its membership, guidance policies, operations, roles, responsibilities, and authorities. The basic selection processes established in Stage 2 lay the foundation for more mature management capabilities in Stage 3, which represents a major step forward in maturity, in which the agency moves from project-centric processes to an agencywide portfolio approach. Stage 3 requires that an organization continually assess both proposed and ongoing projects as part of a complete investment portfolio—an integrated and competing set of investment options. It focuses on establishing a consistent, well-defined perspective on the IT investment portfolio and maintaining mature, integrated selection (and reselection), control, and evaluation processes. This portfolio perspective allows decision makers to consider the interaction among investments and the contributions to organizational mission goals and strategies that could be made by alternative portfolio selections, rather than focusing exclusively on the balance between the costs and benefits of individual investments. Organizations that have implemented Stage 2 and 3 practices have capabilities in place that assist in establishing selection; control; and evaluation structures, policies, procedures, and practices that are required by the investment management provisions of the Clinger-Cohen Act. Stages 4 and 5 require the use of evaluation techniques to continuously improve both the investment portfolio and the investment processes in order to better achieve strategic outcomes. At Stage 4, an organization has the capacity to conduct IT succession activities and, therefore, can plan and implement the deselection of obsolete, high-risk, or low-value IT investments. An organization with Stage 5 maturity conducts proactive monitoring for breakthrough information technologies that will enable it to change and improve its business performance. SSA’s investment management process is intended to meet the objectives of the Clinger-Cohen Act by providing a framework for selecting, controlling, and evaluating investments that helps to ensure it meets the strategic and business objectives of the agency. The investment management process is documented in the agency’s Capital Planning and Investment Control (CPIC) Guide. The CPIC Guide assigns the responsibility for the investment management process to SSA executive-level managers. In this regard, the Information Technology Advisory Board (ITAB) is responsible for assigning resources to projects reported in the 2-year Agency IT Plan, which specifies which projects and systems the agency will build and operate. The board, which meets quarterly, is comprised of the deputy commissioners and other senior executives, such as the general counsel and the Deputy Commissioner, Budget, Finance and Management and it is chaired by the CIO. The CIO is the key decision maker in the CPIC process. He provides advice to the Commissioner and Deputy Commissioner of Social Security to ensure that IT is acquired and information resources are managed in a manner that is consistent with the policies and procedures of the Clinger- Cohen Act. The CIO is the chairman of the investment board and makes final IT budget recommendations to the Commissioner. The Deputy Commissioner, Systems is responsible for monitoring all development and operations projects included in the Agency IT Plan. Each deputy commissioner responsible for a portfolio has a portfolio manager and portfolio team to assist in the day-to-day management of the corresponding investment portfolio within each business component. Table 1 identifies the key participants that have a role in the agency’s investment management process and their responsibilities. SSA uses its established CPIC process to manage the work years associated with its in-house software development projects. (The acquisition budget is managed by a separate process discussed later in this report.)