DOD is one of the largest and most complex organizations in the world, and is entrusted with more taxpayer dollars than any other federal department or agency. For fiscal year 2013, the department requested approximately $613.9 billion—$525.4 billion in spending authority for its base operations and an additional $88.5 billion to support overseas contingency operations, such as those in Iraq and Afghanistan. In support of its military operations, DOD performs an assortment of interrelated and interdependent business functions, such as logistics management, procurement, health care management, and financial management. As we have previously reported, the DOD systems environment that supports these business functions is overly complex and error prone, and is characterized by (1) little standardization across the department, (2) multiple systems performing the same tasks, (3) the same data stored in multiple systems, and (4) the need for data to be entered manually into multiple systems. The department recently requested about $17.2 billion for its business systems environment and IT infrastructure investments for fiscal year 2013.department’s systems inventory, this environment is composed of about 2,200 business systems and includes 310 financial management, 724 human resource management, 580 logistics, 254 real property and installation, and 287 weapon acquisition management systems. DOD currently bears responsibility, in whole or in part, for 14 of the 30 areas across the federal government that we have designated as high risk. Seven of these areas are specific to the department, and 7 other high-risk areas are shared with other federal agencies. Collectively, these high-risk areas relate to DOD’s major business operations that are inextricably linked to the department’s ability to perform its overall mission. Furthermore, the high-risk areas directly affect the readiness and capabilities of U.S. military forces and can affect the success of a mission. In particular, the department’s nonintegrated and duplicative systems impair its ability to combat fraud, waste, and abuse. As such, DOD’s business systems modernization is one of the department’s specific high-risk areas and is an essential enabler in addressing many of the department’s other high-risk areas. For example, modernized business systems are integral to the department’s efforts to address its financial, supply chain, and information security management high-risk areas. The department’s approach to modernizing its business systems environment includes developing and using a BEA and associated enterprise transition plan, improving business systems investment management, and reengineering the business processes supported by its defense business systems. These efforts are guided by DOD’s Chief Management Officer and Deputy Chief Management Officer (DCMO). The Chief Management Officer’s responsibilities include developing and maintaining a departmentwide strategic plan for business reform and establishing performance goals and measures for improving and evaluating overall economy, efficiency, and effectiveness, and monitoring and measuring the progress of the department. The DCMO’s responsibilities include recommending to the Chief Management Officer methodologies and measurement criteria to better synchronize, integrate, and coordinate the business operations to ensure alignment in support of the warfighting mission. The DCMO is also responsible for developing and maintaining the department’s enterprise architecture for its business mission area. The DOD Chief Management Officer and DCMO are to interact with several entities to guide the direction, oversight, and execution of DOD’s business transformation efforts, which include business systems modernization. These entities include the Defense Business Systems Management Committee, which is intended to serve as the department’s highest-ranking investment review and decision-making body for business systems programs and is chaired by the Deputy Secretary of Defense. The committee’s composition includes the principal staff assistants, defense agency directors, DOD Chief Information Officer (CIO), and military department Chief Management Officers. Table 1 describes key DOD business systems modernization governance entities and their composition. Since 2005, DOD has employed a “tiered accountability” approach to business systems modernization. Under this approach, responsibility and accountability for business architectures and systems investment management are assigned to different levels in the organization. For example, the DCMO is responsible for developing the corporate BEA (i.e., the thin layer of DOD-wide policies, capabilities, standards, and rules) and the associated enterprise transition plan. Each component is responsible for defining a component-level architecture and transition plan associated with its own tiers of responsibility and for doing so in a manner that is aligned with (i.e., does not violate) the corporate BEA. Similarly, program managers are responsible for developing program- level architectures and plans and for ensuring alignment with the architectures and transition plans above them. This concept is to allow for autonomy while also ensuring linkages and alignment from the program level through the component level to the corporate level. Consistent with the tiered accountability approach, the NDAA for Fiscal Year 2008 required the Secretaries of the military departments to designate the department Under Secretaries as Chief Management Officers with primary responsibility for business operations. Moreover, the Duncan Hunter NDAA for Fiscal Year 2009 required the military departments to establish business transformation offices to assist their Chief Management Officers in the development of comprehensive business transformation plans.departments have designated their respective Under Secretaries as the Chief Management Officers. In addition, the Department of the Navy (DON) and Army have issued business transformation plans. Air Force officials have stated that the department’s corporate Strategic Plan also serves as its business transformation plan. DOD’s BEA is intended to serve as a blueprint for DOD business transformation. In particular, the BEA is to guide and constrain implementation of interoperable defense business systems by, among other things, documenting the department’s business functions and activities, the information needed to execute its functions and activities, and the business rules, laws, regulations, and policies associated with its business functions and activities. According to DOD, the BEA is being developed using an incremental approach, where each new release addresses business mission area gaps or weaknesses based on priorities identified by the department. The department considers its current approach to developing the BEA both a “top-down” and “bottom-up” approach. Specifically, it focuses on developing content to support investment management and strategic decision making and oversight (“top-down”) while also responding to department needs associated with supporting system implementation, system integration, and software development (“bottom-up”). The department’s most recent BEA version (version 9.0), released in March 2012, focuses on documenting information associated with its 15 end-to-end business process areas. (See table 2 for a list and description of these business process areas.) In particular, the department’s most recent Strategic Management Plan has identified the Hire-to-Retire and Procure-to-Pay business process areas as its priorities. According to the department, the process of documenting the needed architecture information also includes working to refine and streamline each of the associated end-to-end business processes. In addition, DOD’s approach to developing its BEA involves the development of a federated enterprise architecture. Such an approach treats the architecture as a family of coherent but distinct member architectures that conform to an overarching architectural view and rule set. This approach recognizes that each member of the federation has unique goals and needs, as well as common roles and responsibilities with the levels above and below it. Under a federated approach, member architectures are substantially autonomous, although they also inherit certain rules, policies, procedures, and services from higher-level architectures. As such, a federated architecture gives autonomy to an organization’s components while ensuring enterprisewide linkages and alignment where appropriate. Where commonality among components exists, there are also opportunities for identifying and leveraging shared services. Figure 1 provides a conceptual overview of DOD’s federated BEA approach. The certification of business system investments is a key step in DOD’s IT investment selection process that the department has aimed to model after GAO’s Information Technology Investment Management (ITIM) framework. While defense business systems with a total cost over $1 million are required, as of June 2011, to use the Business Capability Lifecycle,are also subject to the formal review and certification process through the IRBs before funds are obligated for them. a streamlined process for acquiring systems, these systems Under DOD’s current approach to certifying investments, there are several types of certification actions as follows: Certify or certify with conditions: An IRB certifies the modernization as fully meeting criteria defined in the act and IRB investment review guidance (certify) or imposes specific conditions to be addressed by a certain time (certify with conditions). Recertify or recertify with conditions: An IRB certifies the obligation of additional modernization funds for a previously-certified modernization investment (recertify) or imposes additional related conditions to the action (recertify with conditions). Decertify: An IRB may decertify or reduce the amount of modernization funds available to an investment when (1) a component reduces funding for a modernization by more than 10 percent of the originally certified amount, (2) the period of certification for a modernization is shortened, or (3) the entire amount of funding is not to be obligated as previously certified. An IRB may also decertify a modernization after development has been terminated or if previous conditions assigned by the IRB are not met. Congress included provisions in the act, as amended, that are aimed at ensuring DOD’s development of a well-defined BEA and associated enterprise transition plan, as well as the establishment and implementation of effective investment management structures and processes.