Despite a substantial investment in IT, the federal government’s management of information resources has produced mixed results. Although agencies have taken constructive steps to implement modern strategies, systems, and management policies and practices, our work continues to find that agencies face significant challenges. These challenges can be addressed with strong and committed leadership by the agency CIOs—a position that was established by the Congress to serve as the focal point for information and technology management issues within an agency. Our most recent high-risk and performance and accountability series identified continuing high-risk system modernization efforts and governmentwide information and technology management challenges, namely, pursuing opportunities for e-government; improving the collection, use, and dissemination of government strengthening information security; constructing and enforcing sound enterprise architectures; employing IT system and service management practices; and using effective agency IT investment management practices. Unless and until these challenges are overcome, federal agencies are unlikely to optimize their use of information and technology, which can affect an organization’s ability to effectively and efficiently implement its programs and missions. Agency CIOs are key leaders in addressing these challenges. To allow them to serve effectively in this role, federal agencies must utilize the full potential of CIOs as information and technology management leaders and active participants in the development of the agency’s strategic plans and policies. The CIOs, in turn, must meet the challenges of building credible organizations and developing and organizing information and technology management capabilities to meet mission needs. For more than 20 years, federal law has structured the management of information technology and information-related activities under the umbrella of information resources management (IRM). Originating in the 1977 recommendations of the Commission on Federal Paperwork, the IRM approach was first enacted into law in the Paperwork Reduction Act of 1980 (PRA). The 1980 Act focused primarily on centralizing governmentwide responsibilities in the Office of Management and Budget (OMB). The law gave OMB specific policy-setting and oversight duties regarding individual IRM areas—for example: records management, privacy, and the acquisition and use of automatic data processing and telecommunications equipment (which was later renamed information technology). The law also gave agencies a more general responsibility to carry out their IRM activities in an efficient, effective, and economical manner and to comply with OMB policies and guidelines. To assist in this effort, the law required that each agency head designate a senior official who would report directly to the agency head to carry out the responsibilities of the agency under the law. Together these requirements were intended to provide for a coordinated approach to managing federal agencies’ information resources. The requirements addressed the entire information life cycle, from collection through disposition, in order to reduce information collection burdens on the public and to improve the efficiency and effectiveness of government. Amendments to the PRA in 1986 and in 1995 were designed to strengthen agency and OMB implementation of the law. Most particularly, the PRA of 1995 provided detailed agency requirements for each IRM area, to match the specific OMB provisions. The 1995 Act also required agencies to develop, for the first time, processes to select, control, and evaluate the results of major information systems initiatives. In 1996, the Clinger-Cohen Act supplemented the information technology management provisions of the PRA with detailed CIO requirements for IT capital planning and investment control and performance and results-based management. The 1996 Act also established the position of agency CIO by amending the PRA to rename the senior IRM officials CIOs and specifying additional responsibilities for them. Among these responsibilities, the act required that the CIOs in the 24 major departments and agencies specified in 31 U.S.C. 901 have IRM as their “primary duty.” Accordingly, under current law, agency CIOs are required to carry out the responsibilities of their agencies with respect to information resources management, including information collection and the control of paperwork; statistical policy and coordination; records management; privacy, including compliance with the Privacy Act; information security, including compliance with the Federal Information information disclosure, including compliance with the Freedom of information technology. Together, these legislated roles and responsibilities embody the policy that CIOs should play a key leadership role in ensuring that agencies manage their information functions in a coordinated and integrated fashion in order to improve the efficiency and effectiveness of government programs and operations. To address the objectives of this review, we first identified and reviewed major information and technology management legislative requirements. Specifically, we reviewed the Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 1996, the E-Government Act of 2002, the Federal Information Security Management Act of 2002, the Federal Records Act, the Freedom of Information Act, and the Privacy Act of 1974. We identified the following 13 major areas of CIO responsibilities as either statutory requirements or critical to effective information and technology management. IT/IRM strategic planning. CIOs are responsible for strategic planning for all information and information technology management functions— thus, the term IRM strategic planning . IT capital planning and investment management. CIOs are responsible for IT capital planning and investment management [44 U.S.C. 3506(h) and 40 U.S.C. 11312 & 11313]. Information security. CIOs are responsible for ensuring compliance with the requirement to protect information and systems [44 U.S.C. 3506(g) and 3544(a)(3)]. IT/IRM workforce planning. CIOs have responsibilities for helping the agency meet its IT/IRM workforce or human capital needs [44 U.S.C. 3506(b) and 40 U.S.C. 11315(c)]. Information collection/paperwork reduction. CIOs are responsible for the review of agency information collection proposals to maximize the utility and minimize public “paperwork” burdens . Information dissemination. CIOs are responsible for ensuring that the agency’s information dissemination activities meet policy goals such as timely and equitable public access to information . Records management. CIOs are responsible for ensuring that the agency implements and enforces records management policies and procedures under the Federal Records Act . Privacy. CIOs are responsible for compliance with the Privacy Act and related laws . Statistical policy and coordination. CIOs are responsible for the agency’s statistical policy and coordination functions, including ensuring the relevance, accuracy, and timeliness of information collected or created for statistical purposes . Information disclosure. CIOs are responsible for information access under the Freedom of Information Act . Enterprise architecture. Federal laws and guidance direct agencies to develop and maintain enterprise architectures as blueprints to define the agency mission, and the information and IT needed to perform that mission. Systems acquisition, development, and integration. We have found that a critical element of successful IT management is effective control of systems acquisition, development and integration [44 U.S.C. 3506(h)(5) and 40 U.S.C. 11312]. E-government initiatives. Various laws and guidance direct agencies to undertake initiatives to use IT to improve government services to the public and internal operations [44 U.S.C. 3506(h)(3) and the E- Government Act of 2002]. We then developed and administered a questionnaire to the CIOs of the 27 major departments and agencies requesting information on whether these officials were responsible for each of these areas, their reporting relationships, their professional and educational backgrounds, and their challenges. We also asked each agency to supply the name, beginning and ending dates in office, and circumstances (e.g., whether they were in an acting or permanent position) of each of the individuals who had served as CIO at the agency since the enactment of the Clinger-Cohen Act. We subsequently interviewed each of the CIOs who were in place at the time of our review (see app. I for the list of the CIOs) in order to corroborate their responses and obtain more detailed explanations of these responses. In addition, as applicable, we collected and reviewed the resumes or biographies of the current CIOs. In analyzing CIOs comments on their challenges, two GAO analysts reviewed the responses and arrived at agreement for the broad categories. Each comment was then placed into one or more of the resulting categories, and agreement regarding each placement was reached between the two analysts. We also conducted two panel discussions with former agency IT executives (six in each panel), including former CIOs, that addressed their experiences and challenges. Appendix II lists these panelists. Finally, we discussed our findings with representatives of OMB’s Office of Information and Regulatory Affairs and the members of our Executive Council of Information Management and Technology—a preexisting panel of outside industry, state government, and academic experts—to obtain their views. We conducted our work at the 27 agencies during November 2003 through May 2004 in greater Washington, D.C. in accordance with generally accepted government auditing standards. CIOs generally were responsible for most of the 13 key areas we had identified as either required by statute or among those critical to effective information and technology management, and most reported directly to their agency heads. All 27 CIOs had responsibility for 5 of the 13 areas, such as information security and IT capital planning. Of the other eight areas, two of them—information disclosure and statistics—were the responsibility of fewer than half of the CIOs. This assignment of responsibilities is not consistent with the law. However, in those cases where the CIOs were not assigned the expected responsibilities and expressed an opinion about this situation, more than half of the CIOs’ responses were that the applicable information and technology management areas are appropriately held by some other organizational entity. Moreover, virtually all of the responses indicated that the CIOs were comfortable with their roles. Nevertheless, having these responsibilities performed by multiple officials could make the integration of various information and technology management areas, as envisioned by the law, more difficult to achieve.