Successful implementation of VA’s information technology program requires strong leadership and management to help define and guide the department’s plans and actions. The Paperwork Reduction Act of 1980 and the Clinger-Cohen Act of 1996 articulate the importance of CIOs in promoting improvements in their agencies’ work processes and making sound investment decisions that effectively align IT projects with the organization’s business planning and measurement processes. To be successful in this role, CIOs must build credible organizations and develop and organize information management capabilities to meet agency mission needs. With the hiring of a department-level CIO in August 2001, VA took a significant step toward addressing critical and longstanding weaknesses in its management of information technology. Our prior work has highlighted some of the challenges that the CIO faced as a result of the way in which the department was organized to carry out its information technology mission. Among these challenges was that information systems and services were highly decentralized, with the VA administrations and staff offices controlling a majority of the department’s information technology budget. As illustrated in figure 1, out of the approximately $1.25 billion fiscal year 2002 information technology budget, the Veterans Health Administration (VHA) oversaw approximately $1.02 billion, VBA approximately $158.3 million, and the National Cemetery Administration (NCA) approximately $5.87 million. The remaining $60.2 million was controlled at the department level. In addition, our testimony in March noted that there was neither direct nor indirect reporting to VA’s cyber security officer—the department’s senior security official—thus raising questions about this person’s ability to enforce compliance with security policies and procedures and ensure accountability for actions taken throughout the department. The more than 600 information security officers in VA’s three administrations and its many medical facilities throughout the country were responsible for ensuring the department’s information security, although they reported only to their facility’s director or to the chief information officer of their administration. Given the large annual funding base and decentralized management structure, it is crucial that the CIO ensure that well-established and integrated processes for leading, managing, and controlling investments are commonplace and followed throughout the department. The Secretary has recognized weaknesses in accountability for the department’s information technology resources and the consequent need to reorganize how information technology is managed and financed. Accordingly, in a memorandum dated August 6, 2002, he announced a realignment of the department’s information technology operations. According to the memorandum, the realignment will centralize information technology functions, programs, workforce personnel, and funding into the office of the department-level CIO. In particular, several significant changes are being made: The CIOs in each of the three administrations—VHA, VBA, and NCA— have been designated deputy CIOs and will report directly to the department-level CIO. Previously, these officials served as component- level CIOs who reported only to their respective administrations’ undersecretaries. All administration-level cyber security functions have been consolidated under the department’s cyber security office, and all monies earmarked for these functions have been placed under the authority of the cyber security officer. Information security officers previously assigned to VHA’s 21veterans integrated service networks will now report directly to the cyber security officer, thus extending the responsibilities of the cyber security office to the field. Beginning in fiscal year 2003, the department-level CIO will assume executive authority over VA’s IT appropriations. The realignment had not been finalized at the conclusion of our review, thus its full impact on VA’s mission and the CIO’s success in managing information technology at the department level could not yet be measured. Nonetheless, in pursuing these reforms, the Secretary has demonstrated the significance of establishing an effective management structure for building credibility in the way information technology is used, and has taken a significant step toward achieving a “One VA” vision. The Secretary’s initiative also represents a bold and innovative step by the department, and is one that has been undertaken by few other federal agencies. For example, as part of our review, we sent surveys to the 23 other major federal agencies, seeking information on the organization and reporting relationships of their department- and component-level CIOs. Of the 17 agencies that responded, 8 reported having component-level CIOs, none of which reported to the department-level CIO. Only one agency with component-level CIOs reported that its department-level CIO had authority over all IT funding. As the realignment proceeds, the CIO’s success in managing information technology operations will hinge on effective collaboration with business counterparts to guide IT solutions that meet mission needs. Guidance that we issued in February 2001 on the effective use of CIOs in several leading private and public organizations provides insight into three key factors contributing to CIO successes: First, senior executives embrace the central role of technology in accomplishing mission objectives and include the CIO as a full participant in senior executive decision-making. Second, effective CIOs have legitimate and influential roles in leading top managers to apply IT to business problems and needs. While placement of the CIO position at an executive management level in the organization is important, effective CIOs earn credibility and produce results by establishing effective working relationships with business unit heads. Third, successful CIOs structure their organizations in ways that reflect a clear understanding of business and mission needs. Along with business processes, market trends, internal legacy structures, and available IT skills, this understanding is necessary to ensure that the CIO’s office is aligned to best serve the needs of the enterprise. VA’s new organizational structure holds promise for building a more solid foundation for investing in and improving the department’s accountability over information technology resources. Specifically, under the realignment the CIO assumes budget authority over all IT appropriations, including authority to veto proposals submitted from sub-department levels. This could have a significant effect on VA’s accountability for how components are spending money, as we have previously noted the department’s inability to adequately capture all of its IT costs. As the first step toward gaining accountability for information technology investments, the CIO is attempting to determine what expenditures have been incurred in fiscal year 2002. Since VA’s annual budget submissions to OMB have not included a specific line item for information technology operations, the CIO has asked each administration to provide accurate information identifying the costs incurred by each of them for this fiscal year. According to the CIO, preliminary results showed that certain non-IT costs, such as for users’ personnel, had been included in the total expenditures, while some IT costs, such as for IT personnel and telecommunications, had been excluded. The CIO’s goal is to compile cost data that accurately reflect the department’s information technology expenditures. In the absence of a budget line item, the CIO is requiring each facility to develop “spend plans” for fiscal year 2003 IT funding. These plans are expected to serve as a control mechanism for information technology expenditures during the year and will be administered by each facility, with the CIO retaining veto power over them. The plans have been designed to provide the CIO with investment cost details at a departmentwide level, allowing for a portfolio-based project selection process and lessening duplication of effort. Once the plans are implemented, the CIO anticipates being able to compare planned and actual expenditures and to uncover the details of specific projects. Developing and implementing an enterprise architecture to guide VA’s information technology activities continues to be an essential and challenging undertaking. VA and other federal agencies are required to develop and implement enterprise architectures to provide a framework for evolving or maintaining existing and planned IT, in accordance with OMB guidelines. In addition, guidance issued last year by the Federal CIO Council, in collaboration with us, further emphasizes the importance of enterprise architectures in evolving information systems, developing new systems, and inserting new technologies that optimize an organization’s mission value. Overall, effective implementation of an enterprise architecture can facilitate VA’s management by serving to inform, guide, and constrain the information technology investment decisions being made for the department, and subsequently decreasing the risk of buying and building systems that are duplicative, incompatible, and unnecessarily costly to maintain and interface. As depicted in figure 2, the enterprise architecture is both dynamic and iterative, changing the enterprise over time by incorporating new business processes, new technology, and new capabilities. Depending on the size of the agency’s operations and the complexity of its environment, enterprise architecture development and implementation require sustained attention to process management and agency action over an extended period of time. Once implemented, the enterprise architecture must be kept current through regular maintenance. Periodic reassessments are required to ensure that it remains aligned with the department’s strategic mission and priorities, changing business practices, funding profiles, and technology innovation. When we testified last March, VA had taken a number of promising steps toward establishing some of the core elements of an enterprise architecture. Among other actions, it had obtained executive commitment from the Secretary, department-level CIO, and other senior executives and business teams that is crucial to raising awareness of and leveraging participation in developing the architecture. VA had also chosen a highly recognized framework to organize the structure of its enterprise architecture. Further, it had begun defining its current architecture, an important step for ensuring that future progress can be measured against such a baseline, and it was developing its future (target) telecommunications architecture. Nonetheless, at that time we noted that VA still faced many more critical tasks to successfully develop, implement, and manage its enterprise architecture. One of the key activities that required attention was the establishment of a program management office headed by a permanent chief architect to manage the development and maintenance of the enterprise architecture. In addition, the department needed to complete a program management plan delineating how it would develop, use, and maintain the architecture.