Senior executives in the successful organizations we studied were personally committed to improving the management of technology. The PRA and the Clinger-Cohen Act make federal agency heads directly responsible for establishing goals and measuring progress in improving the use of information technology to enhance the productivity and efficiency of their agency’s operations. To help them with their major information management responsibilities, the reform legislation directs the heads of the major agencies to appoint CIOs. The legislation assigns a wide range of duties and responsibilities to CIOs, foremost of which are working with the agency head and senior program managers to implement effective information management to achieve the agency’s strategic goals; helping to establish a sound investment review process to select, control, and evaluate spending for information technology; promoting improvements to the work processes used by the agency to carry out its programs; increasing the value of the agency’s information resources by implementing an integrated agencywide technology architecture; and strengthening the agency’s knowledge, skills, and capabilities to effectively manage information resources, deal with emerging technology issues, and develop needed systems. While there are various approaches on how best to use the CIO position to accomplish these duties, the legislative requirements, OMB guidance, and our best practices experience with leading organizations define common tenets for the CIO position. An agency should place its CIO at a senior management level, working as a partner with other senior officials in decision-making on information management issues. Specifically, agencies should appoint a CIO with expertise and practical experience in technology position the CIO as a senior partner reporting directly to the agency head; ensure that the CIO’s primary responsibilities are for information have the CIO serve as a bridge between top management, line management, and information management support professionals, working with them to ensure the effective acquisition and management of the information resources needed to support agency programs and missions; task the CIO with developing strategies and specific plans for the hiring, training, and professional development of staff in order to build the agency’s capability to develop and manage its information resources; and support the CIO position with an effective CIO organization and management framework for implementing agencywide information technology initiatives. Having effective CIOs will make a real difference in building the institutional capacity and structure needed to implement the management practices embodied in the broad set of reforms set out in the PRA and the Clinger-Cohen Act. The CIO must combine a number of strengths, including leadership ability, technical skills, an understanding of business operations, and good communications and negotiation skills. For this reason, finding an effective CIO can be a difficult task. Agencies faced a similar difficulty in trying to find qualified chief financial officers to implement the CFO Act’s financial management reforms. It took time and concerted effort by the Administration, the CFO Council, and the Congress to get strong, capable leaders into the CFO positions. Shortly after the Clinger-Cohen Act went into effect, OMB evaluated the status of CIO appointments at the 27 agencies. OMB noted that at several agencies, the CIO’s duties, qualifications, and placement met the requirements of the Clinger-Cohen Act. According to OMB, these CIOs had experience, both operationally and technically, in leveraging the use of information technology, capital planning, setting and monitoring performance measures, and establishing service levels with technology users. These CIOs also had exposure to a broad range of technologies, as well as knowledge of government budgeting and procurement processes and information management laws, regulations, and policies. However, OMB had concerns about a number of other agencies that had acting CIOs, CIOs whose qualifications did not appear to meet the requirements of the Clinger-Cohen Act, and/or CIOs who did not report directly to the head of the agency. OMB also raised concerns about agencies where the CIOs had other major management responsibilities or where it was unclear whether the CIOs’ primary duty was the information resource management function. OMB stated that it would reevaluate the situations at these agencies at a later date, after agencies had time to put permanent CIOs in place or take corrective actions to have their CIO appointment and organizational alignment meet the necessary requirements. OMB called for updated information on the status of governmentwide CIO appointments in its April 1997 data request on individual agency efforts to implement provisions of the Clinger-Cohen Act. OMB has not yet issued a status report based on this information and subsequent follow-up. In a recent discussion, OMB officials stated that they will provide feedback on individual CIO appointments as part of the fiscal year 1999 budget review process. On the basis of preliminary observations, however, OMB officials stated that they still have some of the same concerns that they had a year ago about CIO positions that have not been filled, have not been properly positioned, or have multiple responsibilities. It is very important for OMB to follow through on its efforts to assess CIO appointments and resolve outstanding issues. Information technology reforms simply will not work without effective CIO leadership in place. We will continue to monitor this situation to provide our suggestions on actions that need to be taken. One area that we will focus on during the coming year is CIOs who have major responsibilities in addition to information management. The Clinger-Cohen Act clearly calls for CIOs to have information resources management as their primary duty. We have stressed the importance of this principle in testimonies and, most recently, in our February 1997 high-risk report, in which we emphasized that the CIO’s duties should focus sharply on strategic information management issues and not include other major responsibilities. In addition to the escalating demands of rapidly evolving technologies, CIOs are faced with many serious information management issues, any one of which would be a formidable task to address. Taken together, these issues create a daunting body of work for any full-time CIO, much less for one whose time and attention is divided by other responsibilities. As you know, Mr. Chairman, we have reported extensively on a number of these compelling challenges. The following are just a few of these challenges. Ensuring that federal operations will not be disrupted by the Year 2000 problem is one of the foremost and most pressing issues facing agencies—one that we have designated as a governmentwide high-risk area. Efforts by this Subcommittee have underscored repeatedly that many agencies are seriously behind schedule in resolving this problem during the next 2 years. Poor security management is putting billions of dollars worth of assets at risk of loss and vast amounts of sensitive data at risk of unauthorized disclosure, making it another of our governmentwide high-risk areas. Agencies need to make much better progress in designing and implementing security programs and getting skilled staff in place to manage them. This extreme vulnerability has been given added emphasis by the recent Presidential commission report on the growing exposure of U.S. computer networks to exploitation and terrorism. Agencies need to develop, maintain, and facilitate integrated systems architectures to guide their system development efforts. We have seen major modernization efforts handicapped by incomplete architectures, such as at the Federal Aviation Administration (FAA) and the Internal Revenue Service (IRS), as well as the departments of Veterans Affairs and Education. Agencies need to establish sound information management investment review processes that provide top executives with a systematic, data-driven means to select and control how technology funds are spent. Our reviews of system development and modernization projects, such as the Medicare Transaction System and the four high-risk efforts included in our 1997 High-Risk Series, continue to show the crucial importance of structured investment oversight.In our 1997 High-Risk Series we identified 25 high-risk areas covering a wide array of key federal activities, ranging from Medicare fraud to financial management at the Department of Defense. Resolving the problems in these areas depends heavily on improved information management. Agencies need to integrate strategic information planning with the overall strategic plan that they must prepare under the Results Act. Our review of recent attempts by agencies to develop sound strategic plans showed very weak linkages between the strategic goals and the information technology needed to support those goals. Agencies must build their staffs’ skills and capabilities to react to the rapid developments in information technology, develop needed systems, and oversee the work of systems contractors. Weaknesses in agencies’ technology skills bases, especially in the area of software acquisition and development, have been a recurring theme in our reviews of federal information technology projects. Despite the urgent need to deal with these major challenges, we still see many instances of CIOs who have responsibilities beyond information management. At present, only 12 agencies have CIOs whose responsibilities are focused solely on information management. The other 15 agencies have CIOs with multiple responsibilities. Together, these 15 agencies account for about $19 billion of the nearly $27 billion dollars in annual federal planned obligations for information technology. While some of these CIO’s additional responsibilities are minor, in many cases they include major duties, such as financial operations, human resources, procurement, and grants management. At the Department of Defense, for example, the CIO is also the Assistant Secretary for Command, Control, Communications and Intelligence. By asking the CIO to also shoulder a heavy load of programmatic responsibility, it is extremely difficult, if not impossible, for the CIO to devote full attention to information resource management issues. Recognizing this problem, the Department’s Task Force on Defense Reform is examining the current structure of the CIO position to ensure that the person can devote full attention to reforming information management within the Department. We are particularly troubled by agencies that have vested CIO and Chief Financial Officer responsibilities in one person. The challenges facing agencies in both financial and information management are monumental. Each requires full-time leadership by separate individuals with appropriate talent, skills, and experience in these two areas.