OMB plays a key role in overseeing how federal agencies manage their IT investments by working with them to better plan, justify, and determine how to manage them. To provide visibility into the performance of such investments, OMB deployed the IT Dashboard in 2009, which displays federal agencies’ cost, schedule, and performance data for over 770 major federal IT investments at 26 federal agencies, accounting for $42 billion of those agencies’ planned $82 billion in IT spending for fiscal year 2017. According to OMB, these data are intended to provide a near-real- time perspective on the performance of these investments, as well as a historical perspective. The Dashboard’s data span the period from its June 2009 inception to the present, and are based, in part, on agency assessments of individual investment performance and each agency’s budget request to OMB. Further, the public display of these data is intended to allow OMB; other oversight bodies, including Congress; and the general public to hold government agencies accountable for progress and results. The Dashboard visually presents performance ratings for agencies and for individual investments using metrics that OMB has defined—cost, schedule, and CIO evaluation. Cost and schedule ratings. The Dashboard calculates these ratings by determining cost and schedule variances based on agency- submitted data, such as planned versus actual costs or planned versus actual completion dates. The Dashboard then assigns rating colors (red, yellow, green) based on the magnitude of the variances. Specifically, a variance greater than 30 percent is red, a variance between 10 percent and 30 percent is yellow, and a variance less than 10 percent is green. CIO ratings. Unlike the cost and schedule ratings, the Dashboard’s “Investment Evaluation by Agency CIO” (also called the CIO rating) is determined by the agency CIO. According to OMB’s instructions, each agency CIO is to assess his or her IT investments against a set of pre-established evaluation factors and then assign a rating of 1 (high risk) to 5 (low risk) based on the CIO’s best judgment of the level of risk facing the investment. OMB suggests six evaluation factors, as shown in table 1. OMB recommends that CIOs consult with appropriate stakeholders in making their evaluations, including Chief Acquisition Officers, program managers, and other interested parties. According to an OMB staff member, agency CIOs are responsible for determining appropriate thresholds for the risk levels and for applying them to investments when assigning CIO ratings. OMB requires agencies to update these ratings as soon as new information becomes available which will affect an investment’s assessment and, since June 2015, has required that this be at least once each calendar month. After agencies assign a level of risk to each investment, the Dashboard assigns colors to CIO ratings according to a five-point scale: high risk and moderately high risk are red, medium risk is yellow, and moderately low risk and low risk are green. Recognizing the importance of government-wide management of IT, in December 2014, Congress enacted IT acquisition reform legislation, FITARA. The law was designed to improve agencies’ acquisition of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. FITARA contains specific requirements related to seven areas, including one titled “Enhanced Transparency and Improved Risk Management in Information Technology Investments.” Among other things, that area requires OMB and agencies to make publicly available detailed information on federal IT investments, and agency CIOs to categorize their IT investments by risk. This requirement is addressed by OMB’s IT Dashboard. Over the past 5 years, we have issued a series of reports about the IT Dashboard that noted both significant steps OMB has taken to enhance the oversight, transparency, and accountability of federal IT investments by creating its IT Dashboard, as well as issues with the accuracy and reliability of data. Further, we have reported on the Dashboard’s CIO ratings: In October 2012, we reported that CIOs at six agencies rated a majority of investments listed on the IT Dashboard as low or moderately low risk from June 2009—when the Dashboard was implemented—through March 2012 and two agencies, the Department of Defense (Defense) and the National Science Foundation, rated no investments as high or moderately high risk during this time period (categorized as “red” by the Dashboard). Additionally, agencies generally followed OMB’s instructions for assigning CIO ratings, although Defense’s ratings were unique in reflecting additional considerations, such as the likelihood of OMB review. Most of the selected agencies reported various benefits associated with producing and reporting CIO ratings, such as increased quality of their performance data and greater transparency and visibility of investments. We recommended that OMB analyze and report on agencies’ CIO ratings over time, and that Defense ensure that its CIO ratings reflect available investment performance assessments and its risk management guidance. Both agencies concurred with our recommendations. Subsequently, OMB reported on CIO rating trends. Further, Defense now identifies red investments on the Dashboard. More recently in December 2013, we reported that, as of August 2013, the CIOs at eight selected agencies had rated 198 of their 244 major IT investments listed on the Dashboard as low risk or moderately low risk, 41 as medium risk, and 5 as high risk or moderately high risk. However, the total number of investments reported by these agencies had varied over time, which impacted the number of investments receiving CIO ratings. For example, the Department of Energy (Energy) reclassified several of its supercomputer investments from IT to facilities, and the Department of Commerce (Commerce) decided to reclassify its satellite ground system investments. Both decisions resulted in the removal of the investments from the Dashboard, even though the investments were clearly IT. We recommended that these agencies appropriately categorize all investments, but they disagreed with our recommendation. In that same report, we reviewed 80 investments and found that 53 of the CIO ratings were consistent with the investment risk, 20 were partially consistent, and 7 were inconsistent. While two agencies’ CIO ratings were entirely consistent, other agencies’ ratings were inconsistent for a variety of reasons, including delays in updating the Dashboard and how investment performance was tracked. For example, the Social Security Administration (SSA) resets investment cost and schedule performance baselines annually, an approach that increases the risk of undetected cost or schedule variances that will impact investment success. As such, we recommended that SSA revise its investment management approach. The agency agreed with our recommendation and discussed planned actions to address it. Additionally, we reported that OMB does not update the public version of the Dashboard as the President’s annual budget request is being created. Consequently, the public version of the Dashboard was not updated for 15 of the past 24 months. We recommended that OMB make Dashboard information available independent of the budget process. OMB recently updated the Dashboard with a number of changes, and intends for the Dashboard to be able to show updates throughout the year. Agencies determine investments’ CIO ratings using a variety of processes, which include OMB’s suggested factors. However, their interpretation of these factors varies significantly. In addition, the majority of agencies base their ratings on qualitative assessments, but several base theirs on formulas. Further, 13 agencies’ process guidance calls for at least monthly updates to CIO ratings, 1 agency (the Department of Homeland Security (DHS)) schedules its reviews based on risk, and 3 agencies require less frequent updates. As described earlier, OMB requires that each agency CIO rate the risk of his or her IT investments. OMB gives the CIOs the flexibility to use their judgment and suggests six evaluation factors. As noted above, we reviewed data reported to OMB as part of the federal budget process to identify major investments which planned to spend at least 80 percent of their fiscal year 2015 funding on development, modernization, and enhancement activities. This selection produced a list of 17 agencies and 107 investments. Each of the 17 agencies has incorporated at least 2 of OMB’s suggested factors into their CIO’s risk rating processes and 9 use all of the factors. OMB requires that agencies provide CIO evaluations for all major IT investments which reflect the CIO’s best judgment of the current level of risk for the investment in terms of its ability to accomplish its goals. According to OMB’s guidance, the evaluation can be informed by the following factors, including, but not limited to: risk management, requirements management, contractor oversight, historical performance, human capital, and other factors that the CIO deems important to forecasting future success. Table 2 summarizes the extent to which the 17 selected agencies incorporate OMB’s suggested evaluation factors into their CIO’s risk rating processes. Appendix II provides more information on the selected agencies’ CIO rating processes. While the factors suggested by OMB were considered in the agencies’ CIO rating processes, their interpretation of these factors varied. In particular, most agencies considered active risks when rating investments, but others only evaluated compliance with risk processes. For example: Defense, the Department of the Treasury (Treasury), and the General Services Administration (GSA) consider individual active risks, rather than investments’ compliance with risk guidance. For example, Defense considered the risk caused by budget cuts and their potential impact through the following fiscal year when rating its Base Information Transport Infrastructure Wired investment. In addition, GSA, when rating its Integrated Award Environment investment, considered the risk involved with transitioning from an existing contract to one that could provide better expertise and greater oversight. The Departments of Agriculture (Agriculture), Education (Education), Energy, the Interior (Interior), State (State), and Veterans Affairs (VA), and the Office of Personnel Management (OPM) review compliance with risk management practices, but do not assess active risks.