Each year, OMB and federal agencies work together to determine how much government plans to spend for IT and how these funds are to be allocated. Over the past decade, federal IT spending has risen to an estimated $64 billion in fiscal year 2007. OMB plays a key role in overseeing these IT investments and how they are managed, stemming from its predominant mission: to assist the President in overseeing the preparation of the federal budget and to supervise budget administration in Executive Branch agencies. In helping to formulate the President’s spending plans, OMB is responsible for evaluating the effectiveness of agency programs, policies, and procedures; assessing competing funding demands among agencies; and setting funding priorities. OMB also ensures that agency reports, rules, testimony, and proposed legislation are consistent with the President’s budget and with administration policies. In carrying out these responsibilities, OMB depends on agencies to collect and report accurate and complete information; these activities depend, in turn, on agencies having effective IT management practices. To drive improvement in the implementation and management of IT projects, Congress enacted the Clinger-Cohen Act in 1996 to further expand the responsibilities of OMB and the agencies under the Paperwork Reduction Act. In particular, the act requires agency heads, acting through agency chief information officers (CIO), to, among other things, better link their IT planning and investment decisions to program missions and goals and to implement and enforce IT management policies, procedures, standards, and guidelines. OMB is required by the Clinger-Cohen Act to establish processes to analyze, track, and evaluate the risks and results of major capital investments in information systems made by executive agencies. OMB is also required to report to Congress on the net program performance benefits achieved as a result of major capital investments in information systems that are made by executive agencies. OMB is aided in its responsibilities by the Chief Information Officers Council as described by the E-Government Act of 2002. The council is designated the principal interagency forum for improving agency practices related to the design, acquisition, development, modernization, use, operation, sharing, and performance of federal government information resources. Among the specific functions of the CIO Council are the development of recommendations for the Director of OMB on government information resources management policies and requirements and the sharing of experiences, ideas, best practices, and innovative approaches related to information resources management. Only by effectively and efficiently managing their IT resources through a robust investment management process can agencies gain opportunities to make better allocation decisions among many investment alternatives and further leverage their investments. However, the federal government faces enduring IT challenges in this area. For example, in January 2004 we reported on mixed results of federal agencies’ use of IT investment management practices. Specifically, we reported that although most of the agencies had IT investment boards responsible for defining and implementing the agencies’ IT investment management processes, no agency had fully implemented practices for monitoring the progress of its investments. Executive-level oversight of project-level management activities provides organizations with increased assurance that each investment will achieve the desired cost, benefit, and schedule results. Accordingly, we made several recommendations to agencies to improve their practices. In carrying out its responsibilities to assist the President in overseeing the preparation of the federal budget, OMB reported in the President’s fiscal year 2004 budget that there were 771 IT investment projects on what was called the At-Risk List (later referred to as the Management Watch List). This list included mission-critical projects that did not successfully demonstrate sufficient potential for success based on the agency Capital Asset Plan and Business Case, also known as the exhibit 300, or did not adequately address IT security. To identify projects for inclusion on the Management Watch List, OMB used scoring criteria contained in OMB Circular A-11 that the agency established for evaluating the justifications for funding that federal agencies submitted for major investments and for ensuring that agency planning and management of capital assets is consistent with OMB policy and guidance. This evaluation is carried out as part of OMB’s responsibility to help ensure that investments of public resources are justified and that public resources are wisely invested. In presenting the fiscal year 2005 budget, OMB reported that there were 621 major projects on the Management Watch List, consisting of mission- critical projects that needed to improve performance measures, project management, and IT security. OMB staff described this assessment as again being based on evaluations of the exhibit 300s that agencies submitted to justify project funding. Agencies were required to successfully correct identified project weaknesses and business case deficiencies; otherwise, they risked OMB’s placing limits on their spending. In April 2005, we reported on OMB’s development of its Management Watch List. We concluded that OMB’s scoring of the exhibit 300s addressed many critical IT management areas and promoted the improvement of investments. However, because OMB did not compile a single aggregate list and had not developed a structured, consistent process for deciding how to follow up on corrective actions being taken by the agencies, the agency missed the opportunity to use its scoring process more effectively to identify management issues that transcended individual agencies, to prioritize follow-up actions, and to ensure that high- priority deficiencies were addressed. To take advantage of this potential benefit, we recommended that OMB compile a single aggregate list and use the list as the basis for selecting projects for follow up and for tracking follow-up activities by developing specific criteria for prioritizing the IT projects included on the list. OMB has continued to report on its Management Watch List in the most recent President’s budget request. Table 1 shows the budget information for projects on the Management Watch List for fiscal years 2004, 2005, 2006, and 2007. Table 2 shows the number of projects on the Management Watch List for fiscal years 2004, 2005, 2006, and 2007. To continue improving IT project planning and execution, OMB issued a memorandum in August 2005 to all federal chief information officers, directing them to begin taking steps to identify IT projects that are high risk and to report quarterly on their performance. As originally defined in OMB Circular A-11 and subsequently reiterated in the August 2005 memorandum, high risk projects are those that require special attention from oversight authorities and the highest levels of agency management because of one or more of the following four reasons: The agency has not consistently demonstrated the ability to manage complex projects. The project has exceptionally high development, operating, or maintenance costs, either in absolute terms or as a percentage of the agency’s total IT portfolio. The project is being undertaken to correct recognized deficiencies in the adequate performance of an essential mission program or function of the agency, a component of the agency, or another organization. Delay or failure of the project would introduce for the first time unacceptable or inadequate performance or failure of an essential mission function of the agency, a component of the agency, or another organization. As directed in the memorandum, by August 15, 2005, agencies in collaboration with OMB were required to initially identify their high risk IT projects using these criteria. In addition, OMB subsequently provided additional instructions through e-mails to agencies. Through these instructions, OMB directed agencies to declare all e-government and line of business (LOB) initiatives managed by their agency as high risk. In addition, the instructions specified that partner agencies consider investments associated with migrations to an e-government or LOB initiative as high risk until they have completed migration or OMB determines they should no longer be designated as high risk. For the identified high risk projects, beginning September 15, 2005, and quarterly thereafter, CIOs were to assess, confirm, and document projects’ performance. Specifically, agencies were required to determine, for each of their high risk projects, whether the project was meeting one or more of four performance evaluation criteria: (1) establishing baselines with clear cost, schedule, and performance goals; (2) maintaining the project’s cost and schedule variances within 10 percent; (3) assigning a qualified project manager; and (4) avoiding duplication by leveraging inter-agency and governmentwide investments. If a high risk project meets these four performance evaluation criteria, agencies are instructed to document this using a standard template provided by OMB and provide this template to oversight authorities (e.g., OMB, agency inspectors general, agency management, and GAO) on request. If any of the identified high risk projects have performance shortfalls, meaning that the project did not meet one or more of the four performance evaluation criteria, agencies are required to document the information on these projects on the standard template and provide it to OMB along with copies to the agency inspector general. For each of these projects, agencies must specify, using the template, (1) the specific performance shortfalls, (2) the specific cause of the shortfall, (3) a plan of action and milestones actions needed to correct each shortfall, and (4) the amount and source of additional funding needed to improve performance. In response to OMB’s August 2005 memorandum, as of March 2006, the 24 CFO agencies identified 226 IT projects as high risk, totaling about $6.4 billion and representing about 10 percent of the President’s total IT budget request for fiscal year 2007. According to the agencies, these projects were identified as such mainly because of one or more of the four reasons provided in OMB’s memorandum. About 70 percent of the projects identified were reported as high risk because their delay or failure would impact the agency’s essential business functions. Moreover, about 35 percent of the high risk projects—or 79 investments, totaling about $2.2 billion in fiscal year 2007 planned funding, were reported as having performance shortfalls primarily because of cost and schedule variances exceeding 10 percent. As of March 2006, the 24 CFO agencies identified 226 IT investments as high risk. Collectively, five agencies—the Small Business Administration, National Aeronautics and Space Administration, Office of Personnel Management, and the Departments of Veterans Affairs and Homeland Security—identified about 100 of these projects.