In e-mail comments on a draft of this report, the Acting CIO stated that the report reflects both Treasury’s shortcomings as well as progress to date and recognized the need to take proactive steps to strengthen its investment board operations and oversight of information technology resources and programs. Treasury also agreed with the need for an executive investment review board that is actively engaged in the investment management process and noted that nonmajor investments have not been a priority because the major investments the department has chosen to devote its resources to represent the more significant portion of the portfolio in terms of dollar value, visibility to OMB and Congress, and importance to Treasury’s mission. Treasury also commented on the department’s authority to redirect funding from one Treasury bureau to another. We incorporated these comments into our report where appropriate. The Department of the Treasury is the primary federal agency responsible for the economic and financial prosperity and security of the United States, and as such is responsible for a wide range of activities, including advising the President on economic and financial issues, promoting the President’s growth agenda, and enhancing corporate governance in financial institutions. To accomplish its mission, Treasury is organized into departmental offices and operating bureaus. The departmental offices are primarily responsible for the formulation of policy and management of the department as a whole, while the nine operating bureaus—including the Internal Revenue Service and the Bureau of Engraving and Printing—carry out the specific functions assigned to Treasury. Figure 1 shows the organizational structure of the department. Information technology plays a critical role in helping Treasury meet its mission. For example, the Internal Revenue Service relies on information systems to process tax returns, account for tax revenues collected, send bills for taxes owed, issue refunds, assist in the selection of tax returns for audit, and provide telecommunications services for business activities, including the public’s toll-free access to tax information. To modernize the systems it relies on to carry out these functions, Treasury is engaged in a Business Systems Modernization program. Treasury requested $11.4 billion in the President’s fiscal year 2007 budget. Of this amount, the department estimates it will spend approximately $2.8 billion for 235 IT investments—some $2.3 billion (about 80 percent) for 75 major investments and some $480 million (about 20 percent) for 160 nonmajor investments. Since mid-1999, we have been reviewing the Internal Revenue Service’s (IRS) progress in implementing its Business Systems Modernization program as part of our reviews of the service’s associated expenditure plans. Our reviews have identified a number of weaknesses in IRS’s modernization management controls and capabilities and, over the years, we have made numerous recommendations to address these weaknesses. IRS has addressed many of our recommendations; however, several weaknesses remain. In January 2004, we reported as part of a governmentwide review, that Treasury had significant weaknesses in investment management. We noted, for example, that the department had neither developed a capital planning and investment control guide nor developed work processes and procedures for the agency’s IT investment management board. In addition, Treasury had not documented the alignment and coordination of responsibilities of its various boards for decision making related to investments, including the criteria for which investments—including crosscutting investments—were to be reviewed by the executive investment review board. We also reported that Treasury did not have a department-level control process; instead, each bureau could conduct its own reviews that address the performance of its IT investments and corrective actions for underperforming projects. We made several recommendations to address the weaknesses we identified. Treasury concurred with our recommendations, stating that it recognized its shortcomings and was working to correct them. In July 2006, we reported on Treasury’s Financial Crimes Enforcement Network’s (FinCEN) BSA Direct Retrieval and Sharing project, a nonmajor investment, noting that FinCEN did not always apply effective investment management processes to oversee this project. We recommended that the director of FinCEN direct its CIO to develop a plan for improving the agency’s capabilities for overseeing this project. FinCEN officials concurred with our findings and recommendation. In January 2007, in an update to our high-risk series report on the Internal Revenue Service’s Business Systems Modernization, which we first designated as high-risk in 1995, we reported that while the Internal Revenue Service had made progress in reducing risk with systems modernization and financial management, improvements made have not been sustained long enough to provide confidence that the program is fully stable. We also reported that many challenges remain, including improving processes for designing, developing, and delivering modernized IT systems. Several of Treasury’s projects have been deemed to be poorly planned and managed by the Office of Management and Budget (OMB) and have warranted inclusion on OMB’s Management Watch and High Risk Lists. The Clinger-Cohen Act of 1996 requires agency heads to designate the CIO to lead reforms to help control system development risks; better manage technology spending; and achieve real, measurable improvements in agency performance through better management of information resources. The agency head, through the department-level CIO, is responsible for providing leadership and oversight for foundational critical processes by ensuring that written policies and procedures are established, repositories of information are created that support investment decision making, resources are allocated, responsibilities are assigned, and all of the activities are properly carried out where they may be most effectively executed. Treasury’s IT investment management process is to provide the framework for decision making and accountability required to ensure IT investments meet the strategic and business objectives of the department in an efficient and effective manner. In carrying out this process, the department makes a distinction between its major and nonmajor investments, to determine the extent and scope of the department’s investment management oversight and the level of reporting requirements. An IT investment is classified as major if it meets at least one of the following criteria:requires special management attention because of its importance to the mission or function of the agency, a component of the agency or another organization; is for financial management and obligations of more than $500,000 annually; has significant program or policy implications; has high executive visibility; has high development, operating, or maintenance costs; has total life-cycle costs exceeding $50 million; has an annual budget of $5 million or more; or significantly impacts more than one bureau. Investments that do not meet at least one of these criteria are considered to be nonmajor investments. Several groups and individuals play a role in the department’s process to manage its IT investments at the department and bureau levels. They are involved in all aspects of the process, including reviewing and approving proposed investments, monitoring the investments through implementation, and evaluating the investments once they become operational. Table 1 identifies the groups and individuals that have a role in this process and shows their composition and responsibilities. Reviews by TIRB and the department’s executive investment review board focus on IT investments that are defined as major strategic investments for the department. To support this process, Treasury uses an automated portfolio management tool for collecting and maintaining data during the four phases of the process. Various forms in the tool are available for staff to enter new and updated data on Treasury’s IT investments. In September 2005, the department issued a Capital Planning and Investment Control Policy Guide defining a four-phase process for managing its IT investments. These phases consist of preselect, select, control, and evaluate. Completing the requirements of one phase is necessary before moving on to the subsequent phase. Each phase is to be overseen by Treasury’s executive investment review board, which ultimately approves or rejects an investment’s advancement to the next phase. Preselect phase is the annual process by which potential new major investments seeking funding in the upcoming budget year are approved to move into the select phase and are considered for inclusion in the department’s budget request. Only major IT investments are promoted through the preselect process and reviewed at the departmental level. During this phase, an investment’s business owner is to document the business need for the investment and describe its anticipated alignment with bureau, Treasury, and e-government initiatives, and the President’s Management Agenda strategic goals. The CPIC team is then expected to review and validate the preselect data and pass on its assessment and recommendation to TIRB, which is to provide recommendations to the department’s executive investment review board. Once a major investment is approved by the executive investment review board, it moves forward to the select phase. The department’s bureaus have the exclusive responsibility for the preselection of nonmajor investments within their respective bureaus, and the bureaus’ executive leadership must approve a nonmajor investment in order for it to enter the select phase. Select phase is the process by which new and existing major IT investments seeking funding in the upcoming budget year are annually screened, scored, and selected for inclusion in Treasury’s IT investment portfolio. In this phase, Treasury is to ensure that only IT investments that best support its mission, investment principles, and approach to EA are chosen and that the investment owners have taken steps to be successful, such as having a qualified project manager and analyzing risks. As in the preselect phase, the CPIC team is expected to review and validate that all data is complete, score each investment based on Treasury’s investment principles, and submit its findings and recommendations to TIRB. TIRB, in turn, is to review the scoring results and provide its recommendations to Treasury’s executive investment review board, which is then to select which investments will be included in the department’s IT investment portfolio that is ultimately submitted to OMB for funding considerations. Investments do not technically exit the select phase until they are terminated, since they must be reviewed annually for reselection. The bureaus are responsible for conducting their own select process for nonmajor investments. Control Phase ensures, through timely oversight, quality control, and executive review, that IT investments are managed in a disciplined and consistent manner.