For more than a decade, we have identified weak contract management and the lack of reliable financial and performance information as posing significant challenges to NASA’s ability to effectively run its largest and most costly programs. While NASA has made some progress in addressing its contract management weaknesses through improved management controls and evaluation of its procurement activities, NASA has struggled to implement a modern, integrated financial management system. NASA made two efforts in the past to improve its financial management processes and develop a supporting system intended to produce the kind of accurate and reliable information needed to manage its projects and programs and produce timely, reliable financial information for external reporting purposes. However, both of these efforts were eventually abandoned after a total of 12 years and a reported $180 million in spending. In April 2000, NASA began its third attempt at modernizing its financial management processes and systems. With its current financial management system effort, known as IEMP, NASA has invested in an ERP solution that is intended to meet the information needs of both internal and external customers and to promote standardization and integration of business processes and systems across the agency. NASA plans to complete IEMP by 2009 for a total cost of over $800 million. As of March 2007, NASA had deployed the following nine IEMP functional components: core financial, Travel Manager, ERASMUS, resume management, position description management, budget formulation, Agency Labor Distribution System, Project Management Information Improvement, and contract management. Early in fiscal year 2007, NASA also implemented an updated version of the core financial software, which includes several critical enhancements to the previous core financial software. According to NASA, the core financial upgrade provided the opportunity for it to leverage the best practices inherent in the new version and allowed it to redesign or enhance business processes. NASA updated its core financial system in order to improve compliance with Federal Financial Management System Requirements, Federal Accounting Standards, and the Federal Financial Management Improvement Act, and to respond to GAO recommendations. According to NASA, the software upgrade has enabled it to implement critical process changes related to financial tracking and reporting, support the goal of achieving financial management integrity, and provide better project management information. NASA claims that the updated software has also provided other enhancements, which should contribute to NASA’s goals of achieving a clean audit opinion and achieving a “Green” rating on the President’s Management Agenda scorecard for “improved financial performance.” Other IEMP modules that NASA plans to implement in the future include aircraft management and asset management. As discussed previously, we issued a series of four reports in April and November 2003 that detailed weaknesses in NASA’s acquisition and implementation strategy for IEMP in general and the core financial module in particular. The core financial module, which utilizes SAP software and is considered the backbone of IEMP, was implemented in June 2003. Because NASA did not follow key best practices or disciplined processes for acquiring and implementing IEMP, we reported that NASA had made a substantial investment in a financial management system that fell far short of its stated goal of providing meaningful, reliable, and timely information to support effective day-to-day program management and external financial reporting. We noted problems in the areas of requirements development, requirements management, testing, performance metrics, risk management, and business process reengineering. Neither program managers nor cost estimators were involved in the process of defining requirements for the core financial module. As a result, the module was not designed to maintain the level of detailed cost information needed by program managers to perform contract oversight and by cost estimators to develop reliable cost estimates. The requirements management methodology and tools used to implement the core financial module did not result in requirements that were consistent, verifiable, and traceable or that contained enough specificity to minimize requirement-related defects. Because NASA had not effectively implemented disciplined requirements management processes, we reported that it had increased the risk that it would not be able to effectively identify and manage the detailed system requirements necessary to properly acquire, implement, and test the core financial module. NASA’s ability to effectively test the core financial module was limited because of the lack of complete and specific requirements. Industry best practices, as well as NASA’s own system planning documents, indicated that detailed system requirements should be documented to serve as the basis for effective system testing. Because the link between these two key processes was not maintained, NASA had little assurance that all requirements were properly tested. NASA also did not effectively capture the type of metrics that could have helped the agency understand the effectiveness of its IEMP management processes. For example, NASA did not employ metrics to help it identify and quantify weaknesses in its requirements management processes. Because of its lack of performance metrics, NASA was unable to understand (1) its capabilities to manage IEMP projects; (2) how its process problems affected cost, schedule, and performance objectives; and (3) the corrective actions needed to reduce the risks associated with the problems identified. NASA did not consistently identify known and potential risks for the core financial module. Risk management processes are needed to ensure that a project’s risk is kept at an acceptable level by taking actions to mitigate risk before it endangers the project’s success. NASA did not use the implementation of IEMP to fundamentally change the way it did business. Instead of reengineering its business processes, NASA automated many of its existing ineffective business processes. First, NASA did not design the system to accommodate the information needed to adequately oversee its contracts and programs and to prepare credible cost estimates. Second, NASA did not reengineer its contractor cost reporting processes and therefore, did not always obtain sufficient contract cost information needed by program managers to oversee contracts and needed by financial managers for external financial reporting. When we last reported on NASA’s IEMP effort, in September 2005, NASA had begun to implement a number of recommendations from our earlier reports—including steps toward implementing the disciplined processes necessary to manage IEMP. For example, we reported that NASA had engaged program managers to identify program management needs, implemented new requirements management and testing processes, and developed metrics to evaluate the effectiveness of its system implementation processes. However, at that time, the agency had not implemented several of our other recommendations, including the following: Properly define and document system requirements for already- deployed IFMP modules, including the core financial module. This is important not only because it would affect the way the core financial module functions but also because it would affect NASA’s ability to implement future upgrades and other modules expected to interface with the core financial module. Enhance regression testing processes and performance metrics. Develop a risk mitigation plan. Reengineer its business processes so that the commercial off-the-shelf software products selected for IEMP could support these processes. At the time of our last report, NASA was making plans to reengineer some of its business processes. However, because the agency was in the very early planning stage of implementing this recommendation, the details for how NASA would accomplish its objectives were still vague. Overall, our September 2005 report concluded that it was not possible to assess whether NASA’s plans would accomplish its stated goal of enhancing the core financial module to provide better project management information for decision-making purposes. Since September 2005, when we last reported on NASA IEMP implementation efforts, NASA has implemented some of the disciplined processes needed to manage IEMP. Specifically, NASA has, as we previously recommended, implemented more effective requirements management and testing processes, improved its performance metrics program related to tracking system defects, and developed an IEMP risk management strategy. In addition, NASA has developed quantitative entry and exit criteria for moving from one phase of an IEMP project to another—a recognized industry best practice. However, weaknesses in the areas of requirements development and project scheduling have undermined some of the progress made in other key areas. As a result, NASA struggled to complete required systems testing and deliver the agency’s core financial upgrade. Ultimately, through the heroic efforts of the core financial upgrade team, NASA delivered the upgrade within about 2 weeks of the October 30, 2006, planned completion date. According to NASA officials, the system is functioning as expected for most transactions. However, until the end of March 2007, the upgrade was in a “stabilization” phase as NASA worked on correcting a number of system errors, including posting errors for certain types of transactions. Because the upgrade was still quite new and NASA was continuing to stabilize the system, we were unable to determine the significance of these weaknesses. Since our September 2005 report, NASA has used its new requirements management process—which documents sufficiently detailed requirements that are traceable from the highest (most general) level to the lowest (most detailed) level in NASA’s requirements management system—for both the core financial upgrade and the contract management module. For example, we selected several requirements for both the core financial module and the contract management module and validated that the requirements management process (1) clearly linked related requirements consistent with industry standards and (2) contained the information necessary to understand how each requirement should be implemented and tested in a quantitative manner. Because NASA developed and is now using a disciplined requirements management process, it has the quantitative information necessary to support disciplined testing processes. NASA’s disciplined testing processes include (1) documentation of the scenarios that need to be tested to obtain adequate test coverage, (2) requirements that are traced to the test cases to ensure that all requirements are tested, (3) instructions and other guidance for the testers, and (4) an effective regression testing program. Although NASA had disciplined requirements management and testing processes in place for the implementation of both the contract management module and the core financial upgrade, difficulties related to requirements development and project scheduling, discussed later, forced NASA to compress the testing phase of its core financial upgrade implementation. As a result, according to NASA officials, completion of testing for the core financial upgrade required an extraordinary effort on the part of NASA’s implementation team.