Since May 1999, IRS has submitted two spending plans and two interim, stopgap plans. On June 15, 1999, we reported on IRS’ first spending plan, stating that the $35 million requested satisfied the legislative conditions for the use of ITIA funds and was consistent with our open recommendations. We also said that it was an appropriate first step but that the key to success would be effective implementation of the plan. We recommended that future plans specify progress against prior plan commitments and that the next plan clarify the roles and responsibilities of IRS, its prime systems integration services contractor (PRIME) for modernization, and other modernization support contractors. Because IRS was unable to submit its second plan on time, it submitted in December 1999 a stopgap request for $33 million and additional time as an interim measure. We reviewed the request and raised concerns about projects that were scheduled to begin detailed design and software development before, among other things, the enterprise architecture was completed and the ELC was defined and implemented. Later that December, the appropriations subcommittees approved IRS’ $33 million funding measure but, in discussions and correspondence, directed IRS to (1) expedite completion of the architecture and implementation of the ELC and (2) explain in future expenditure plans how it plans to manage the risk of performing detailed design or development work if the architecture is not completed or the ELC is not implemented. Subsequently, IRS reassessed its modernization program plans and decided to restructure the program by scaling back its systems development efforts until it addressed our concerns and put in place the requisite modernization management capability. On March 7, 2000, IRS submitted to the appropriations subcommittees its second spending plan, which reflected these restructuring decisions and sought to obligate about $176 million from ITIA. On March 31, 2000, we briefed the subcommittee and subsequently reported that (1) the plan satisfied the legislative conditions and was generally consistent with recommendations contained in our earlier reports and (2) IRS met few of the commitments in its first spending plan, even though it later received an additional $33 million and nearly 5 months additional time to do so. We stated that the key to success would be whether IRS effectively implemented the second plan. We also stated that until IRS implemented the plan, it would continue to lack key modernization and technical controls. In April 2000, the appropriations subcommittees approved IRS’ plan for $148.4 million of the funds requested and underscored the need for IRS to pursue its restructuring plans by, among other things, directing IRS to establish modernization management capabilities and controls—including completion and implementation of the blueprint and systems life cycle methodology—before it began building systems. Recognizing that it would fully obligate the $148.4 million before it was ready to submit another spending plan, on August 25, 2000, IRS submitted its second interim plan. This interim plan requested $32.8 million to carry the modernization program into early fiscal year 2001. IRS did not fully satisfy all of the conditions that its appropriations subcommittees established in their April 2000 letters releasing modernization investment account funding. However, IRS has made important progress on both modernization projects and initiatives to address long-standing modernization management weaknesses. Our assessment of IRS’ success in satisfying each condition is detailed below. IRS did not adhere to the approved and funded March 7, 2000, spending plan and did not seek approval to deviate from the plan. IRS’ position is that variances from the approved funding levels were small and inevitable given the scale and complexity of the program and that because IRS is closely managing the variances, they do not necessitate the subcommittees’ actions. In sum, IRS varied from the approved spending levels for twelve program projects and initiatives. These variances ranged in amount from approximately $44,000 to $9,000,000. In our view, such variances are to be expected given the projects’ and initiatives’ complexity and early stage in the life cycle and the inherent uncertainty associated with software/systems cost estimating. IRS did not meet its cost and schedule commitments on most projects and initiatives in its March 7, 2000, spending plan. For example, Milestone III for the Customer Account Data Engine (CADE) project slipped by 3 months, and the estimated cost for meeting Milestone III rose by about $1.4 million (9.1 percent). Also, Milestone III for the STIR project slipped 2 months, and its cost increased about $1.4 million (17.0 percent). In our view, these cost and schedule variances are to be expected because, as we previously reported, the milestone commitments for most of the initiatives in the March 2000 plan were not based on detailed work breakdown structures and schedules. Rather, they were merely targets that IRS had represented in its plan as achievable commitments. As a result, these variances are not good measures of progress. Most modernization initiatives, including key projects, have made important progress since March 2000. For example, the CADE and e-Services projects each completed the system planning and definition phase of the ELC, including a preliminary business case showing a positive return on investment, and both projects have met ELC criteria for beginning preliminary design work. However, one project, CAP, has been approved to begin the detailed design and development phase (i.e., the system is being built) without sufficient definition and without a compelling business case to justify treating it as a near-term investment priority. Specifically, the CAP business case does not show a positive return on investment; the $150 million estimated total project cost does not include the cost to define and build interfaces with projects that are yet to be defined (i.e., Integrated Financial Systems’ standard general ledger, CADE, and STIR); CAP business requirements are not yet sufficiently defined to verify CAP was approved to begin the development phase with two important conditions that could affect the system’s baseline requirements and functions (and thus cost); and CAP integration with other modernization projects is unclear because CAP is not included in the integrated master schedule and monthly program management reviews. Another project, STIR, was granted approval to begin the preliminary design phase without a risk-based approach to defining and economically justifying its requirements (i.e. preliminary security risk assessment, preliminary security certification package, and preliminary business case). Such an approach, as discussed in our November 1999 guide on security risk assessment practices of leading organizations, is a federal requirement and a key element of successful organizations’ security risk assessment programs. IRS has fully addressed two of the five modernization management weaknesses cited by the subcommittees. Namely, it has hired a BSMO executive, and it reports that 20 of its 22 task orders issued since June 2000 are performance based. We reviewed 3 key task orders and found that they reflected the tenets of performance-based contracting. IRS is also making progress in addressing other modernization management weaknesses. For example, since March 2000, as part of the ELC, it has defined processes, roles, responsibilities, etc. for implementing selected Level 2 key process areas of the Software Engineering Institute (SEI) Software Acquisition Capability Maturity Model . IRS plans to train staff and have all projects following these by the November 2000-to- January 2001 timeframe. In September 2001, IRS plans to conduct an evaluation (via an independent assessor) to ensure compliance with SEI’s Level 2 requirements. In addition, IRS has taken other steps to increase its acquisition discipline, such as conducting monthly program management reviews with the modernization contractor and establishing an integrated master schedule to track the projects’ schedules and interdependencies. In July 2000, IRS defined and baselined most parts of the ELC. Our review of selected projects (CAP, CADE, and STIR) indicates that the ELC is generally being followed. Further, IRS has defined IT investment management controls and is in the process of incorporating them into the ELC. The initial release of IRS’ enterprise architecture was being drafted and was not yet available for our review, however, some parts of the ELC are still being developed and finalized (e.g., program control policies and procedures, 75 to 80 change requests, legacy system impact supplement, and enterprise architecture management supplement). While IRS did not satisfy the September 30, 2000, commitments it made in the March 2000 plan for issuing the enterprise architecture and fully implementing the ELC, it is making important progress and plans to complete both between November 2000 and January 2001. IRS has revised and validated its March 2000 spending plan cost and schedule estimates to increase their reliability. According to IRS, it tasked the contractor to develop, for each initiative, a detailed work breakdown schedule of the tasks, deliverables, staff, and time needed to complete the initiatives in accordance with the ELC. With the resulting staffing and time requirements, the contractor applied its cost rates to determine cost and schedule estimates and then submitted the estimates to IRS in task order proposals. IRS validated these costs during the task order “definitization” process by, among other things, comparing them to historical and current contractor rates charged to IRS and other federal agencies (e.g., General Services Administration). IRS then negotiated rates that could not be validated. For two projects—CADE and Customer Communications—we verified that IRS followed this process (although we did not specifically evaluate the reliability of IRS’ cost validation). IRS has made important progress in establishing its BSMO, although this office is not yet fully operational. Specifically, the office is in place, staff have been assigned, and roles, responsibilities, policies, and procedures have been defined that include SEI Level 2 software acquisition processes.