DOD Business Systems Modernization
Progress in Establishing Corporate Management Controls Needs to Be Replicated Within Military Departments Gao ID: GAO-08-705 May 15, 2008In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high risk," and GAO continues to do so today. To assist in addressing this high-risk area, the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 contains provisions that are consistent with prior GAO investment management and enterprise architecture-related recommendations, and requires the department to submit annual reports to its congressional committees on its compliance with these provisions. The act also directs GAO to review each annual report. In response, GAO assessed the actions taken by DOD to comply with requirements of the act. To do so, GAO leveraged its recent reports on various aspects of the department's modernization management controls, and it reviewed, for example, the latest version of its business enterprise architecture and the associated transition plan and architecture federation strategy. GAO also interviewed key officials.
As part of DOD's continuing efforts to strengthen management of its business systems modernization program, it has taken steps over the last year to build on past efforts and further comply with the National Defense Authorization Act's requirements and related federal guidance. Notwithstanding this progress, aspects of these requirements and relevant guidance have yet to be fully satisfied. In particular, the military departments, under DOD's "federated" and "tiered" approach to establishing institutional modernization management controls, have lagged well behind DOD's corporate efforts, and the corporate efforts are still not yet where they need to be. For example, the latest version of DOD's corporate business enterprise architecture continues to add content needed to improve its completeness, consistency, understandability, and usability. Moreover, its latest architecture federation strategy is more detailed and explicit than the prior version. However, the corporate architecture is still missing important content, such as business rules for, and information flows among, certain business activities. Moreover, the architecture has yet to be federated. Specifically, the military departments, which are the largest members of the federation, do not yet have mature enterprise architecture programs, and the federation strategy aimed at accomplishing this is still evolving. GAO has existing recommendations to address these and other architecture issues. The updated enterprise transition plan, which provides a temporal investment roadmap for transitioning from the current architectural environment to the target environment, continues to identify systems and initiatives that are to fill business capability gaps and address the DOD-wide and component business priorities that are contained in the business enterprise architecture. However, the plan still does not include investments for all components and does not reflect key factors associated with properly sequencing planned investments, such as dependencies among investments and the capability to execute the plan. Furthermore, the military departments, which are the largest members of the business federation, have yet to fully develop their own architecturally-based transition plans. GAO has existing recommendations to address these and other transition plan issues. DOD and the military departments have yet to fully establish key investment review structures and have yet to define related policies and procedures for effectively performing both project-level and portfolio-based investment management. GAO has existing recommendations to address these and other investment issues. Until DOD fully implements GAO's existing recommendations relative to the act and related guidance, its business systems modernization will likely remain a high-risk program.
GAO-08-705, DOD Business Systems Modernization: Progress in Establishing Corporate Management Controls Needs to Be Replicated Within Military Departments
This is the accessible text file for GAO report number GAO-08-705
entitled 'DOD Business Systems Modernization: Progress in Establishing
Corporate Management Controls Needs to Be Replicated Within Military
Departments' which was released on May 15, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
May 2008:
DOD Business Systems Modernization:
Progress in Establishing Corporate Management Controls Needs to Be
Replicated Within Military Departments:
GAO-08-705:
GAO Highlights:
Highlights of GAO-08-705, a report to congressional committees.
Why GAO Did This Study:
In 1995, GAO first designated the Department of Defense‘s (DOD)
business systems modernization program as ’high risk,“ and GAO
continues to do so today. To assist in addressing this high-risk area,
the Ronald W. Reagan National Defense Authorization Act for Fiscal Year
2005 contains provisions that are consistent with prior GAO investment
management and enterprise architecture-related recommendations, and
requires the department to submit annual reports to its congressional
committees on its compliance with these provisions. The act also
directs GAO to review each annual report. In response, GAO assessed the
actions taken by DOD to comply with requirements of the act. To do so,
GAO leveraged its recent reports on various aspects of the department‘s
modernization management controls, and it reviewed, for example, the
latest version of its business enterprise architecture and the
associated transition plan and architecture federation strategy. GAO
also interviewed key officials.
What GAO Found:
As part of DOD‘s continuing efforts to strengthen management of its
business systems modernization program, it has taken steps over the
last year to build on past efforts and further comply with the National
Defense Authorization Act‘s requirements and related federal guidance.
Notwithstanding this progress, aspects of these requirements and
relevant guidance have yet to be fully satisfied. In particular, the
military departments, under DOD‘s ’federated“ and ’tiered’ approach to
establishing institutional modernization management controls, have
lagged well behind DOD‘s corporate efforts, and the corporate efforts
are still not yet where they need to be. For example:
* The latest version of DOD‘s corporate business enterprise
architecture continues to add content needed to improve its
completeness, consistency, understandability, and usability. Moreover,
its latest architecture federation strategy is more detailed and
explicit than the prior version. However, the corporate architecture is
still missing important content, such as business rules for, and
information flows among, certain business activities. Moreover, the
architecture has yet to be federated. Specifically, the military
departments, which are the largest members of the federation, do not
yet have mature enterprise architecture programs, and the federation
strategy aimed at accomplishing this is still evolving. GAO has
existing recommendations to address these and other architecture
issues.
* The updated enterprise transition plan, which provides a temporal
investment roadmap for transitioning from the current architectural
environment to the target environment, continues to identify systems
and initiatives that are to fill business capability gaps and address
the DOD-wide and component business priorities that are contained in
the business enterprise architecture. However, the plan still does not
include investments for all components and does not reflect key factors
associated with properly sequencing planned investments, such as
dependencies among investments and the capability to execute the plan.
Furthermore, the military departments, which are the largest members of
the business federation, have yet to fully develop their own
architecturally-based transition plans. GAO has existing
recommendations to address these and other transition plan issues.
* DOD and the military departments have yet to fully establish key
investment review structures and have yet to define related policies
and procedures for effectively performing both project-level and
portfolio-based investment management. GAO has existing recommendations
to address these and other investment issues.
Until DOD fully implements GAO‘s existing recommendations relative to
the act and related guidance, its business systems modernization will
likely remain a high-risk program.
What GAO Recommends:
Because GAO has previously made recommendations to DOD aimed at putting
in place the management controls needed to fully comply with the act
and related federal guidance, it is not making additional
recommendations. DOD provided technical comments that have been
incorporated into the report.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-705]. For more
information, contact Randolph C. Hite at (202) 512-3439 or
hiter@gao.gov.
[End of section]
Report to Congressional Committees:
Contents:
Letter:
Results in Brief:
Background:
DOD Is Continuing to Improve Its Approach to Modernizing Business
Systems:
Conclusions:
Recommendations for Executive Action:
Agency Comments:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: DOD Business Systems Modernization Governance Entities' Roles,
Responsibilities, and Composition:
Table 2: DOD Investment Tiers:
Figures:
Figure 1: Simplified DOD Organizational Structure:
Figure 2: The Five ITIM Stages of Maturity with Critical Processes:
Figure 3: Simplified Diagram of DOD's Business Mission Area Federated
Architecture:
Abbreviations:
ASD(NII)/CIO: Assistant Secretary of Defense (Networks and Information
Integration)/Chief Information Officer:
BEA: business enterprise architecture:
BCL: Business Capability Lifecycle:
BTA: Business Transformation Agency:
CIO: chief information officer:
CMO: chief management officer
DBSMC: Defense Business Systems Management Committee:
DOD: Department of Defense:
EGB: Enterprise Guidance Board:
ETP: enterprise transition plan
GIG: global information grid:
IRB: Investment Review Board:
IT: information technology:
ITIM: Information Technology Investment Management framework:
IV&V: independent verification and validation:
NCES: Net-Centric Enterprise Services:
OMB: Office of Management and Budget:
SOA: service-oriented architecture:
USD(AT&L): Under Secretary of Defense (Acquisition, Technology, and
Logistics):
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
May 15, 2008:
Congressional Committees:
For decades, the Department of Defense (DOD) has been challenged in
modernizing its timeworn business systems.[Footnote 1] In 1995, we
designated DOD's business systems modernization program as high risk,
and we continue to designate it as such today.[Footnote 2] As our
research on public and private sector organizations shows, two
essential ingredients to a successful systems modernization program are
having a well-defined enterprise architecture[Footnote 3] and an
effective institutional approach to managing information technology
(IT) investments.
Accordingly, we made recommendations to the Secretary of Defense in May
2001 that included the means for effectively developing an enterprise
architecture and establishing a corporate, architecture-centric
approach to investment control and decision making.[Footnote 4] Between
2001 and 2005, we reported that the department's business systems
modernization program continued to lack both of these, concluding in
2005 that hundreds of millions of dollars had been spent on a business
enterprise architecture (BEA) and investment management structures that
had limited value.[Footnote 5] Accordingly, we made more explicit
architecture and investment management-related recommendations.
To further assist DOD in addressing these modernization management
challenges, Congress included provisions in the Ronald W. Reagan
National Defense Authorization Act for Fiscal Year 2005 [Footnote 6]
that were consistent with our recommendations. More specifically, the
act required the department to, among other things, (1) develop a BEA,
(2) develop a transition plan to implement the architecture, (3)
identify systems information in its annual budget submission, (4)
establish a system investment approval and accountability structure,
(5) establish an investment review process, and (6) certify and approve
any system modernizations costing in excess of $1 million. The act
further requires that the Secretary of Defense submit an annual report
to congressional defense committees on DOD's compliance with certain
requirements of the act not later than March 15 of each year from 2005
through 2009. Additionally, the act directs us to submit to these
congressional committees--within 60 days of DOD's report submission--an
assessment of DOD's actions to comply with these requirements.
As agreed with your offices, the objective of our review was to assess
the actions taken by DOD to comply with requirements of section 2222 of
Title 10, U.S. Code. To accomplish this, we used our prior annual
report under the act[Footnote 7] as a baseline, analyzing whether the
department had taken actions to comply with those provisions of the
act, related guidance, and our prior recommendations that we had
previously identified as not yet addressed. In doing this, we also
relied on the results of relevant reports that we have issued since our
prior annual report.[Footnote 8] We conducted this performance audit at
DOD headquarters in Arlington, Virginia, from March to May 2008, in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. Details on our
objectives, scope, and methodology are contained in appendix I.
Results in Brief:
DOD continues to take steps to comply with legislative requirements and
related guidance pertaining to its business systems modernization high-
risk area. In particular, on March 14, 2008, DOD released a new version
of its BEA and issued its annual report to congressional defense
committees describing steps taken and planned relative to the act's
requirements, among other things. The steps address several of the
missing elements that we previously identified relative to the
legislative provisions and related best practices concerning the BEA,
enterprise transition plan, and investment management, and continue to
address the act's requirements relative to business system budgetary
disclosure and certification and approval of systems costing in excess
of $1 million. However, additional steps are needed to fully comply
with the act and relevant guidance:
* The latest version of the BEA resolves several of the architecture
gaps associated with the prior version, such as adding business rules
and data attributes. However, like the previous version, its focus is
largely on DOD-wide corporate policies, capabilities, rules, and
standards. While these are essential to meeting the act's requirements,
this version has yet to be augmented by the DOD component
organizations' subsidiary architectures that also are essential to
meeting the act's requirements and the department's goal of having a
federated family of architectures. DOD has taken some steps toward
extending its architecture through its recently updated federation
strategy, however the military departments' architecture programs
remain immature, particularly those of the Army and the Navy. To
address these challenges, we have existing recommendations that DOD has
agreed to implement.[Footnote 9] Once these challenges are addressed,
the federated BEA should provide a more sufficient frame of reference
to optimally guide and constrain DOD-wide system investments.
* The updated transition plan continues to identify more systems and
initiatives that are to fill business capability gaps and address DOD-
wide and component business priorities. Further, the plan continues to
provide a range of information for each identified system and
initiative (e.g., budget information, performance metrics, and
milestones), and it identifies legacy systems that will not be part of
DOD's target architectural environment. However, this latest transition
plan still does not include system investment information for all
organizational components (e.g., defense agencies). Moreover, the plan
does not yet sequence the planned investments based on a range of
relevant factors, such as technology opportunities, marketplace trends,
institutional system development and acquisition capabilities, legacy
and new system dependencies and life expectancies, and the projected
value of competing investments. Finally, the plan is not augmented by
military department enterprisewide transition plans that are based on
analyses of the gaps between their respective current and target
architectures. Thus, component-unique investments may not have been
chosen based on an enterprisewide strategy, and thus may not represent
the optimal investment mix and sequence. We have existing
recommendations aimed at addressing these issues that DOD has agreed to
implement.[Footnote 10] Once they are addressed, the department will be
better positioned to effectively and efficiently migrate to a more
modernized systems environment.
* The department's fiscal year 2009 budget submission provides a range
of information on its approximately 3,000 business systems, of which
273 are listed as development/modernization investments. Consistent
with the act, the types of information provided include system name,
designated approval authority, and funding development/modernization
versus operations/maintenance activities.
* The department has established and begun implementing most of the
investment review structures and processes that are consistent with the
act. However, it has yet to establish one of the five investment review
boards that are required pursuant to the act, and has not defined
related investment management policies and procedures in a manner that
is consistent with relevant guidance. In particular, the Enterprise
Information Environment Mission Area review board has not been
chartered, although DOD officials told us that the department
anticipates issuing a policy shortly that, among other things, will
establish an information technology infrastructure guidance board that
will meet the act's requirement. In addition, neither DOD nor the
military departments have defined the full range of project-level and
portfolio-based IT investment management policies and procedures that
are necessary to meet the investment selection and control provisions
of the Clinger-Cohen Act of 1996. To address these investment
management limitations, we have previously made recommendations that
DOD has agreed to implement.[Footnote 11] In this regard, the
department reports that it is defining missing policies and procedures
in its new business capability lifecycle methodology. However, this
methodology has not been approved and released. Moreover, based on a
draft of the methodology, it may not address all the investment
management policy and procedure gaps that our recommendations address.
Until DOD and the military departments have well-defined investment
management processes, its business systems and portfolios of systems
will continue to risk being inconsistently and improperly selected and
controlled.
* The department continues to certify and approve business systems as
directed by the act. As of September 30, 2007, the department reported
that its highest investment review and decision-making body, the
Defense Business System Management Committee, had approved 314 systems
that had been certified by DOD's Investment Review Boards. According to
DOD, the 314 systems represent the total number of certified and
approved systems since the act became effective and includes all
modernization investments that involved at least $1 million in
obligations through fiscal year 2007. Since then, the department
reports that it has certified and approved 39 additional investments
during fiscal year 2008.
Notwithstanding the progress that DOD continues to make in meeting the
business systems modernization provisions of the act and related
federal guidance, more needs to be accomplished, particularly with
respect to the institutionalization of modernization management
controls by the department's largest component organizations--the
military departments. In this regard, we have made a number of
recommendations that provide an effective roadmap for progress. As a
result, we are not making additional recommendations at this time, but
would add that until DOD fully implements our existing modernization
management-related recommendations, its business systems modernization
will likely remain a high-risk program.
In comments on a draft of this report, signed by the Deputy Under
Secretary of Defense (Business Transformation), the department stated
that it appreciated our support in advancing its business
transformation efforts. It also provided several technical comments
that we have incorporated throughout the report, as appropriate.
Background:
DOD is a massive and complex organization. The department reported that
its fiscal year 2007 operations involved approximately $1.5 trillion in
assets and $2.1 trillion in liabilities; more than 2.9 million military
and civilian personnel; and $544 billion in net cost of operations. For
fiscal year 2008, the department has received discretionary budget
authority for about $546 billion and reports total obligations of about
$492 billion to support ongoing operations and activities related to
the Global War on Terrorism. Organizationally, the department includes
the Office of the Secretary of Defense, the Chairman of the Joint
Chiefs of Staff, the military departments, numerous defense agencies
and field activities, and various unified combatant commands that are
either responsible for specific geographic regions or specific
functions. (See fig. 1 for a simplified depiction of DOD's
organizational structure.)
Figure 1: Simplified DOD Organizational Structure:
[See PDF for image]
The simplified DOD organizational structure is illustrated as follows:
Top Level:
Secretary of Defense;
* Deputy Secretary of Defense;
Second level:
* Department of the Army;
* Department of the Navy;
* Department of the Air Force;
* Office of the Secretary of Defense;
- DOD Field Activities;
- Defense Agencies;
* Inspector General;
* Joint Chiefs of Staff;
* Combatant Commands[A].
Source: GAO based on DOD documentation.
[A] The Chairman of the Joint Chiefs of Staff serves as the spokesman
for the commanders of the combatant commands, especially on the
administrative requirements of the commands.
[End of figure]
In support of its military operations, the department performs an
assortment of interrelated and interdependent business functions,
including logistics management, procurement, health care management,
and financial management. As we have previously reported,[Footnote 12]
the DOD systems environment that supports these business functions is
overly complex and error prone, and is characterized by (1) little
standardization across the department, (2) multiple systems performing
the same tasks, (3) the same data stored in multiple systems, and (4)
the need for data to be entered manually into multiple systems.
Moreover, the department recently reported that this systems
environment is comprised of approximately 3,000 separate business
systems. For fiscal year 2007, Congress appropriated approximately
$15.7 billion to DOD, and for fiscal year 2008, the department has
requested about $15.9 billion in appropriated funds to operate,
maintain, and modernize these business systems and associated IT
infrastructure.
As we have previously reported,[Footnote 13] the department's
nonintegrated and duplicative systems impair its ability to combat
fraud, waste, and abuse. In fact, DOD currently bears responsibility,
in whole or in part, for 15 of our 27 high-risk areas.[Footnote 14]
Eight of these areas are specific to the department,[Footnote 15] while
it shares responsibility for seven other governmentwide high-risk
areas.[Footnote 16] DOD's business systems modernization is one of the
high-risk areas, and it is an essential enabler to addressing many of
the department's other high-risk areas. For example, modernized
business systems are integral to the department's efforts to address
its financial, supply chain, and information security management high-
risk areas.
Enterprise Architecture and IT Investment Management Controls Are
Critical to Achieving Successful Systems Modernization:
Effective use of an enterprise architecture--a modernization blueprint-
-is a hallmark of successful public and private organizations. For more
than a decade, we have promoted the use of architectures to guide and
constrain systems modernization, recognizing them as a crucial means to
this challenging goal: optimally defined operational and technological
environments. Congress, the Office of Management and Budget (OMB), and
the federal Chief Information Officer's (CIO) Council also have
recognized the importance of an architecture-centric approach to
modernization. The Clinger-Cohen Act of 1996[Footnote 17] mandates that
an agency's CIO develop, maintain, and facilitate the implementation of
an information technology architecture. Further, the E-Government Act
of 2002[Footnote 18] requires OMB to oversee the development of
enterprise architectures within and across agencies. In addition, we,
OMB, and the CIO Council have issued guidance that emphasizes the need
for system investments to be consistent with these
architectures.[Footnote 19]
A corporate approach to IT investment management is characteristic of
successful public and private organizations. Recognizing this, Congress
enacted the Clinger-Cohen Act of 199[Footnote 20]6, which requires OMB
to establish processes to analyze, track, and evaluate the risks and
results of major capital investments in IT systems made by executive
agencies.[Footnote 21] In response to the Clinger-Cohen Act and other
statutes, OMB has developed policy and issued guidance for planning,
budgeting, acquisition, and management of federal capital
assets.[Footnote 22] We also have issued guidance in this area.
[Footnote 23]
Enterprise Architecture: A Brief Description:
An enterprise architecture provides a clear and comprehensive picture
of an entity, whether it is an organization (e.g., a federal
department) or a functional or mission area that cuts across more than
one organization (e.g., financial management). This picture consists of
snapshots of both the enterprise's current ("As Is") environment and
its target ("To Be") environment. These snapshots consist of "views,"
which are one or more interdependent and interrelated architecture
products (e.g., models, diagrams, matrixes, and text) that provide
logical or technical representations of the enterprise. The
architecture also includes a transition or sequencing plan, which is
based on an analysis of the gaps between the "As Is" and "To Be"
environments; this plan provides a temporal road map for moving between
the two environments and incorporates such considerations as technology
opportunities, marketplace trends, fiscal and budgetary constraints,
institutional system development and acquisition capabilities, legacy
and new system dependencies and life expectancies, and the projected
value of competing investments.
The suite of products produced for a given entity's enterprise
architecture, including its structure and content, is largely governed
by the framework used to develop the architecture. Since the 1980s,
various architecture frameworks have been developed, such as John A.
Zachman's "A Framework for Information Systems Architecture"[Footnote
24] and the DOD Architecture Framework.[Footnote 25]
The importance of developing, implementing, and maintaining an
enterprise architecture is a basic tenet of both organizational
transformation and systems modernization. Managed properly, an
enterprise architecture can clarify and help optimize the
interdependencies and relationships among an organization's business
operations (and the underlying IT infrastructure and applications) that
support these operations. Moreover, when an enterprise architecture is
employed in concert with other important management controls, such as
portfolio-based capital planning and investment control practices,
architectures can greatly increase the chances that an organization's
operational and IT environments will be configured to optimize mission
performance. Our experience with federal agencies has shown that
investing in IT without defining these investments in the context of an
architecture often results in systems that are duplicative, not well
integrated, and unnecessarily costly to maintain and
interface.[Footnote 26]
One approach to structuring an enterprise architecture is referred to
as a federated enterprise architecture. Such a structure treats the
architecture as a family of coherent but distinct member architectures
that conform to an overarching architectural view and rule set. This
approach recognizes that each member of the federation has unique goals
and needs as well as common roles and responsibilities with the levels
above and below it. Under a federated approach, member architectures
are substantially autonomous, although they also inherit certain rules,
policies, procedures, and services from higher-level architectures. As
such, a federated architecture enables component organization autonomy
while ensuring enterprisewide linkages and alignment where appropriate.
Where commonality among components exists, there also are opportunities
for identifying and leveraging shared services.
A service-oriented architecture (SOA) is an approach for sharing
business capabilities across the enterprise by designing functions and
applications as discrete, reusable, and business-oriented services. As
such, service orientation permits sharing capabilities that may be
under the control of different component organizations. As we have
previously reported,[Footnote 27] such capabilities or services need to
be, among other things, (1) self-contained, meaning that they do not
depend on any other functions or applications to execute a discrete
unit of work; (2) published and exposed as self-describing business
capabilities that can be accessed and used; and (3) subscribed to via
well-defined and standardized interfaces. A SOA approach is thus not
only intended to reduce redundancy and increase integration, but also
to provide the kind of flexibility needed to support a quicker response
to changing and evolving business requirements and emerging conditions.
IT Investment Management: A Brief Description:
IT investment management is a process for linking IT investment
decisions to an organization's strategic objectives and business plans
that focuses on selecting, controlling, and evaluating investments in a
manner that minimizes risks while maximizing the return of
investment.[Footnote 28]
* During the selection phase, the organization (1) identifies and
analyzes each project's risks and returns before committing significant
funds to any project and (2) selects those IT projects that will best
support its mission needs.
* During the control phase, the organization ensures that, as projects
develop and investment expenditures continue, they continue to meet
mission needs at the expected levels of cost and risk. If the project
is not meeting expectations or if problems arise, steps are quickly
taken to address the deficiencies.
* During the evaluation phase, actual versus expected results are
compared once a project has been fully implemented. This is done to (1)
assess the project's impact on mission performance, (2) identify any
changes or modifications to the project that may be needed, and (3)
revise the investment management process based on lessons learned.
Consistent with this guidance, our IT Investment Management framework
(ITIM)[Footnote 29] consists of five progressive stages of maturity for
any given agency relative to selecting, controlling, and evaluating its
investment management capabilities. (See fig. 2 for the five ITIM
stages of maturity.) Stage 2 critical processes lay the foundation by
establishing successful, predictable, and repeatable investment control
processes at the project level. Stage 3 is where the agency moves from
project-centric processes to portfolio-based processes and evaluates
potential investments according to how well they support the agency's
missions, strategies, and goals. Organizations implementing these
Stages 2 and 3 practices have in place selection, control, and
evaluation processes that are consistent with the Clinger-Cohen
Act.[Footnote 30] Stages 4 and 5 require the use of evaluation
techniques to continuously improve both investment processes and
portfolios in order to better achieve strategic outcomes.
Figure 2: The Five ITIM Stages of Maturity with Critical Processes:
[See PDF for image]
This figure is an illustration of the five ITIM Stages of Maturity with
Critical Processes. Each stage builds upon the previous stage. The
following information is illustrated:
Maturity stage: Stage 1: Creating investment awareness;
Critical processes: IT spending without disciplined investment
processes.
Maturity stage: Stage 2: Building the investment foundation;
Critical processes:
- Instituting the investment board;
- Meeting business needs;
- Selecting an investment;
- Providing investment oversight;
- Capturing investment information.
Maturity stage: Stage 3: Developing a complete investment portfolio;
Critical processes:
- Defining the portfolio criteria;
- Creating the portfolio;
- Evaluating the portfolio;
- Conducting post-implementation reviews.
Maturity stage: Stage 4: Improving the investment process;
Critical processes:
- Improving the portfolio's performance;
- Managing the succession of information systems.
Maturity stage: Stage 5: Leveraging IT for strategic outcomes;
Critical processes:
- Optimizing the investment process;
- Using IT to drive strategic business change.
Source: GAO.
[End of figure]
The overriding purpose of the framework is to encourage investment
selection, control, and evaluate processes that promote business value
and mission performance, reduce risk, and increase accountability and
transparency. We have used the framework in several of our
evaluations,[Footnote 31] and a number of agencies have adopted it.
With the exception of the first stage, each maturity stage is composed
of "critical processes" that must be implemented and institutionalized
in order for the organization to achieve that stage. Each ITIM critical
process consists of "key practices"--to include organizational
structures, policies, and procedures--that must be executed to
implement the critical process. Our research shows that agency efforts
to improve investment management capabilities should focus on
implementing all lower stage practices before addressing higher stage
practices.
DOD's Institutional Approach to Business Systems Modernization:
In 2005, the department reassigned responsibility for providing
executive leadership for the direction, oversight, and execution of its
business systems modernization efforts to several entities. These
entities and their responsibilities include the Defense Business
Systems Management Committee (DBSMC), which serves as the highest
ranking investment review and decision-making body for business systems
modernization activities; the Principal Staff Assistants, who serve as
the certification authorities for business system modernizations in
their respective core business missions; the Investment Review Boards
(IRB), which are chaired by the certifying authorities and form the
review and decision-making bodies for business system investments in
their respective areas of responsibility; and the Business
Transformation Agency (BTA), which is responsible for supporting the
DBSMC and the IRBs, and for leading and coordinating business
transformation efforts across the department. DOD's component
organizations, to varying degrees, have leveraged existing, and
established new, business system governance bodies to support their
respective investment precertification responsibilities.
Table 1 lists these entities and provides greater detail on their
roles, responsibilities, and composition.
Table 1: DOD Business Systems Modernization Governance Entities' Roles,
Responsibilities, and Composition:
Entity: DBSMC;
Roles and responsibilities:
* Provides strategic direction and plans for the business mission
area[A] in coordination with the warfighting and enterprise information
environment mission areas;
* Recommends policies and procedures required to integrate DOD business
transformation and attain cross-department, end-to-end interoperability
of business systems and processes;
* Serves as approving authority for business system modernization;
* Establishes policies and approves the business mission area[A]
strategic plan, the enterprise transition plan for implementation for
business systems modernization, the transformation program baseline,
and the BEA;
Composition: Chaired by the Deputy Secretary of Defense; Vice Chair is
the Under Secretary of Defense for Acquisition, Technology, and
Logistics (USD(AT&L)). Includes senior leadership in the Office of the
Secretary of Defense, the military departments' secretaries, and
defense agencies' heads, such as the Assistant Secretary of Defense
(Networks and Information Integration)/Chief Information Officer
(ASD(NII)/CIO), the Vice Chairman of the Joint Chiefs of Staff, and the
Commanders of the U.S. Transportation Command and Joint Forces Command.
Entity: Principal Staff Assistants/Certification Authorities;
Roles and responsibilities:
* Support the DBSMC's management of enterprise business IT investments;
* Serve as the certification authorities accountable for the obligation
of funds for respective business system modernizations within
designated core business missions[B];
* Provide the DBSMC with recommendations for system investment
approval;
Composition: Under Secretaries of Defense for Acquisition, Technology,
and Logistics; Comptroller; and Personnel and Readiness.
Entity: IRBs;
Roles and responsibilities:
* Serve as the oversight and investment decision-making bodies for
those business capabilities that support activities under their
designated areas of responsibility;
* Recommend certification for all business systems investments costing
more than $1 million that are integrated and compliant with the BEA;
Composition: Includes the Principal Staff Assistants; Joint Staff;
ASD(NII)/CIO; core business mission area representatives; military
departments; defense agencies; and combatant commands.
Entity: Component Pre-Certification Authority;
Roles and responsibilities:
* Ensures component-level investment review processes integrate with
the Investment Management system;
* Identifies those component systems that require IRB certification and
prepare, review, approve, validate and transfer investment
documentation as required;
* Assesses and precertifies architecture compliance of component
systems submitted for certification and annual review;
* Acts as the component's principal point of contact for communication
with the IRBs;
Composition: Includes the Chief Information Officer from Air Force, the
Principal Director of Governance, Acquisition, and Chief Knowledge
Office from the Army; the Chief Information Officer from the Navy; and
comparable representatives from other defense agencies.
Entity: BTA;
Roles and responsibilities:
* Operates under the authority of the USD(AT&L) under the direction of
the Deputy Under Secretary of Defense for Business Transformation and
the Deputy Under Secretary of Defense for Financial Management;
* Maintains and updates the department's BEA and enterprise transition
plan;
* Ensures that functional priorities and requirements of various
defense components, such as the Army and Defense Logistics Agency are
reflected in the architecture;
* Ensures adoption of DOD-wide information and process standards as
defined in the architecture;
* Serves as the day-to-day management entity of the business
transformation effort at the DOD enterprise level;
* Provides support to the DBSMC and IRBs;
Composition: Comprised of eight directorates (Chief of Staff, Defense
Business Systems Acquisition Executive, Enterprise Integration,
Enterprise Planning and Investment, Priorities and Requirements
Financial Management, Priorities and Requirements Human Resource
Management, Priorities and Requirements Supply Chain Management, and
Warfighter Support Office).
Source: DOD.
[A] According to DOD, the business mission area is responsible for
ensuring that capabilities, resources, and materiel are reliably
delivered to the warfighter. Specifically, the business mission area
addresses areas such as real property and human resources management.
[B] DOD has five core business missions: Human Resources Management,
Weapon System Lifecycle Management, Materiel Supply and Service
Management, Real Property and Installations Lifecycle Management, and
Financial Management.
[End of table]
Tiered Accountability:
In 2005, DOD reported that it had adopted a "tiered accountability"
approach to business transformation. Under this approach,
responsibility and accountability for business architectures and
systems investment management are assigned to different levels in the
organization. For example, the BTA is responsible for developing the
corporate BEA (i.e., the thin layer of corporate policies,
capabilities, standards, rules), and the associated enterprise
transition plan (ETP). The components are responsible for defining a
component-level architecture and transition plans associated with their
own tier of responsibility and for doing so in a manner that is aligned
with (i.e., does not violate) the corporate BEA. Similarly, program
managers are responsible for developing program-level architectures and
plans and ensuring alignment with the architectures and transition
plans above them. This concept is to allow for autonomy while also
ensuring linkages and alignment from the program level through the
component level to the enterprise level. Table 2 describes the four
investment tiers and identifies the associated reviewing and approving
entities.
Table 2: DOD Investment Tiers:
Tier description:
Tier 1; MDAP[A] or MAIS[B];
Reviewing/Approving entities: IRB and DBSMC.
Tier description:
Tier 2; Exceeding $10 million in total development/modernization costs,
but not designated as a MAIS or MDAP;
Reviewing/Approving entities: IRB and DBSMC.
Tier description:
Tier 3; Exceeding $1 million and up to $10 million in total
development/modernization costs;
Reviewing/Approving entities: IRB and DBSMC.
Tier description:
Tier 4; Investment funding required up to $1 million;
Reviewing/Approving entities: Component-level review only (unless the
system or line of business it supports is designated as special
interest by the Certification Authority).
Source: DOD.
[A] A MDAP is an acquisition program so designated by the Under
Secretary of Defense for Acquisition, Technology, and Logistics or that
is estimated to require an eventual total expenditure for research,
development, and test and evaluation of more than $365 million (fiscal
year 2000 constant dollars) or, for procurement, of more than $2.190
billion (fiscal year 2000 constant dollars).
[B] A MAIS is a program or initiative that is so designated by the
Assistant Secretary of Defense (Networks and Information
Integration)/Chief Information Officer or that is estimated to require
program costs in any single year in excess of $32 million (fiscal year
2000 constant dollars), total program costs in excess of $126 million
(fiscal year 2000 constant dollars), or total life-cycle costs in
excess of $378 million (fiscal year 2000 constant dollars).
[End of table]
Summary of Fiscal Year 2005 National Defense Authorization Act
Requirements:
Congress included six provisions in the fiscal year 2005 National
Defense Authorization Act[Footnote 32] that are aimed at ensuring DOD's
development of a well-defined BEA and associated ETP, as well as the
establishment and implementation of effective investment management
structures and processes. The requirements are as follows:
1. Develop a BEA that includes an information infrastructure that, at a
minimum, would:
* comply with all federal accounting, financial management, and
reporting requirements;
* routinely produce timely, accurate, and reliable financial
information for management purposes;
* integrate budget, accounting, and program information and systems;
* provide for the systematic measurement of performance, including the
ability to produce timely, relevant, and reliable cost information;
* include policies, procedures, data standards, and system interface
requirements that are to be applied uniformly throughout the
department; and:
* be consistent with OMB policies and procedures.
2. Develop an ETP for implementing the architecture that includes:
* an acquisition strategy for new systems needed to complete the
enterprise architecture;
* a list and schedule of legacy business systems to be terminated;
* a list and strategy of modifications to legacy business systems; and:
* time-phased milestones, performance metrics, and a statement of
financial and non-financial resource needs.
3. Identify each business system proposed for funding in DOD's fiscal
year budget submissions and include:
* description of the certification made on each business system
proposed for funding in that budget;
* funds, identified by appropriations, for current services and for
business systems modernization; and:
* the designated approval authority for each business system.
4. Delegate the responsibility for business systems to designated
approval authorities within the Office of the Secretary of Defense.
5. Require each approval authority to establish investment review
structures and processes, including a hierarchy of IRBs--each with
appropriate representation from across the department. The review
process must cover:
* review and approval of each business system by an IRB before funds
are obligated;
* at least an annual review of every business system investment;
* use of threshold criteria to ensure an appropriate level of review
and accountability;
* use of procedures for making architecture compliance certifications;
* use of procedures consistent with DOD guidance; and:
* incorporation of common decision criteria.
6. Effective October 1, 2005, DOD may not obligate appropriated funds
for a defense business system modernization with a total cost of more
than $1 million unless the approval authority certifies that the
business system modernization:
* complies with the BEA and:
* is necessary to achieve a critical national security capability or
address a critical requirement in an area such as safety or security;
or is necessary to prevent a significant adverse effect on an essential
project in consideration of alternative solutions, and the
certification is approved by the DBSMC.
Summary of Recent GAO Reviews of DOD's Business Systems Modernization
and Business Transformation Efforts:
In November 2005,[Footnote 33] May 2006,[Footnote 34] and May 2007,
[Footnote 35] we reported that DOD had partially satisfied four of the
six business system modernization requirements in the fiscal year 2005
National Defense Authorization Act[Footnote 36] relative to
architecture development, transition plan development, budgetary
disclosure, and investment review. In addition, we reported that it had
fully satisfied the requirement concerning designated approval
authorities and it was in the process of satisfying the last
requirement for certification and approval of modernizations costing in
excess of $1 million. As a result, each report concluded that the
department had made important progress in defining and beginning to
implement institutional management controls (i.e., processes,
structures, and tools). However, each report also concluded that much
remained to be accomplished relative to the act's requirements and
relevant guidance. Among other things, this included developing
component architectures that are aligned with the corporate BEA and
ensuring that investment review and approval processes are fully
developed and institutionally implemented across all organizational
levels.
Notwithstanding this progress on business systems modernization, we
previously reported[Footnote 37] and more recently testified in
February 2008[Footnote 38] that two items remained to be done before
DOD's overall business transformation efforts, which include business
systems modernization, would be on a sustainable path to success.
First, DOD had yet to establish a strategic planning process that
results in a comprehensive, integrated, and enterprisewide plan or set
of plans that would guide transformation. Second, DOD had yet to
designate a senior official who could provide full-time attention and
oversight to the business transformation effort. Subsequently, the
National Defense Authorization Act for Fiscal Year 2008 designated the
Deputy Secretary of Defense as the department's Chief Management
Officer (CMO), created a Deputy CMO position, and designated the
undersecretaries of each military department as CMOs for their
respective departments.[Footnote 39] The act also required the
Secretary of Defense, acting through the CMO, to develop a strategic
management plan that, among other things, is to include a detailed
description of performance goals and measures for improving and
evaluating the overall efficiency and effectiveness of the business
operations of the department. According to DOD, steps have been taken
and are ongoing to address these provisions.
We also testified in February 2008 that DOD continues to take steps to
comply with key business systems modernization legislative
requirements, but that much remained to be accomplished before the full
intent of this legislation would be achieved. In particular, we stated
that DOD's BEA, while addressing several issues previously reported by
us, was still not sufficiently complete to effectively and efficiently
guide and constrain business system investments across all levels of
the department. Most notably, the BEA did not yet include well-defined
architectures for DOD's components, and DOD's strategy for "federating"
or extending its architecture to the military departments and defense
agencies was still evolving and had yet to be implemented. In addition,
the scope and content of the department's ETP still did not address
DOD's complete portfolio of IT investments. We also testified that
while the department had established and begun to implement
legislatively mandated corporate investment review structures and
processes, neither DOD nor the military departments had done so in a
manner that was fully consistent with relevant guidance.
DOD Is Continuing to Improve Its Approach to Modernizing Business
Systems:
DOD continues to take steps to comply with the requirements of the act
and to satisfy relevant systems modernization management guidance. In
particular, on March 14, 2008, DOD released an update to its BEA
(version 5.0) and ETP, and issued its annual report to Congress
describing steps that have been taken and are planned relative to the
act's requirements, among other things. Collectively, these steps
address several legislative provisions and best practices concerning
the BEA, transition plan, budgetary disclosure, and investment review
of systems costing in excess of $1 million. However, additional steps
are needed to fully comply with the act and relevant guidance. Most
notably, the department has yet to extend and evolve its corporate BEA
to the department's component organizations' (military departments and
defense agencies) architectures and fully define IT investment
management policies and procedures at the corporate and component
levels. BTA officials agree that additional steps are needed to fully
implement the act's requirements and our related recommendations.
According to these officials, DOD leadership is committed to fully
addressing these areas and efforts are planned and under way to do so.
DOD Continues to Improve Its Corporate BEA, but Component Architectures
Remain a Challenge:
Among other things, the act requires DOD to develop a BEA that would
cover all defense business systems and the functions and activities
supported by defense business systems and enable the entire department
to (1) comply with all federal accounting, financial management, and
reporting requirements, (2) routinely produce timely, accurate, and
reliable financial information for management purposes, and (3) include
policies, procedures, data standards, and system interface requirements
that are to be applied throughout the department. As such, the act
provides for an architecture that extends to all defense organizational
components. In 2006, the department adopted an incremental and
federated approach to developing such an architecture. Under this
approach, the department committed to releasing new versions of its BEA
every 6 months that would include a corporate BEA that was augmented by
a coherent family of component architectures. As we have previously
reported, such an approach is consistent with best practices and
appropriate given the DOD's scope and size.
In 2007,[Footnote 40] we reported that the then current version of the
BEA (version 4.1) resolved several of the architecture gaps associated
with the prior version and added content proposed by DOD
stakeholders,[Footnote 41] but that gaps still remained. On March 14,
2008, DOD released BEA 5.0 which addresses some of these remaining
gaps. For example, it improves the Financial Visibility business
enterprise area by expanding the Standard Financial Information
Structure data elements (i.e., types of data) associated with
information exchanges among operational nodes (e.g., organizational
units or system functions) to include data attributes (characteristics
of data elements). In addition, the latest version introduces data
standards for the Enterprise Funds Distribution initiative. Together,
these additions bolster the department's efforts to standardize
financial data across DOD so that information is available to inform
corporate decision making.
Version 5.0 of the BEA also addresses, to varying degrees, missing
elements, inconsistencies, and usability issues that we previously
identified. Examples of these improvements and remaining issues are
summarized below.
* The latest version includes performance metrics for the business
capabilities within enterprise priority areas, including actual
performance relative to performance targets that are to be met. For
example, it states that 62 percent of DOD assets are now using the
Department of the Treasury's United States Standard General
Ledger[Footnote 42] compliant formats, as compared to a target of 100
percent. Further, this version provides actual baseline performance for
operational activities (e.g., "Manage Audit and Oversight of
Contractor"). As we previously reported,[Footnote 43] performance
models are an essential part of any architecture because having defined
performance baselines to measure actual performance against provides
the means for knowing whether the intended mission value to be
delivered by each business process is actually being realized.
* The latest version includes important "As Is" information (e.g.,
current capability problems and limitations that enterprise priorities
are to address and their root causes) for all six business enterprise
priorities. As we previously reported, such "As Is" content is
essential for analyzing capability gaps that in turn inform the plan
for transitioning from the "As Is" to the "To Be" environments.
* The latest version includes 1,201 new business rules. As we
previously reported, business rules are important because they
explicitly translate business policies and procedures into specific,
unambiguous rules that govern what can and cannot be done. As such,
they facilitate consistent implementation of policies and procedures.
Examples of new business rules are that (1) each request for commercial
export of DOD technology must be processed within 30 days of request
from the Department of State or the Department of Commerce and (2) DOD
must first seek to acquire commercial items before developing military
unique material. In addition to adding business rules, Version 5.0
reflects the deletion of 1,046 business rules that were no longer
applicable and thus obsolete.
Notwithstanding these additions and deletions, BEA 5.0 still does not
provide business rules for all business processes. For example, there
are no business rules for the "Perform Acceptance Procedures for Other
Goods and Services" business process under the Common Supplier
Engagement enterprise priority area. Also, business rules are defined
at inconsistent levels of detail. For example, the Travel Authorization
business rule states that each travel authorization must be processed
in accordance with the Allowance Law, however, it does not identify the
specific conditions that must be met. In contrast, the Trial Balance
Reporting business rule is more explicitly defined, specifically citing
the conditions under which actions are to be taken. Without well-
defined business rules, policies and procedures can be implemented
inconsistently because they will be interpreted differently by
different organizations.
* The latest version includes updates on the information that flows
among operational nodes (i.e., organizations, business operations, and
system elements). Information flows are important because they define
what information is needed and where and how the information moves to
and from operational entities. In particular, Version 5.0 adds 240 new
information exchanges (e.g., Accounts Payable) among business
operations and 28 data exchanges (e.g., Acknowledge Inter-governmental
Order) among system elements. However, it still does not provide
information flows for all organizational units. For example, it does
not identify information exchanges among the organizations that support
the Human Resources Management enterprise priority area, and continues
to lack information flows among DOD corporate and components
organizations. Without such information exchanges, a common
understanding of the semantic meaning of the information moving among
these organizations does not exist. Moreover, Version 5.0 contains
information exchanges (e.g., Accounts Payable Account) that are not
attached or linked to any operational nodes. Further, this version's
information-related architecture products contain inconsistencies. For
example, "Acceptance Results" is identified as a new information
exchange in the integrated dictionary, but it is not in the operational
information exchange product.
* The latest version expands on the operational activities that are or
will be performed at each location and by each organization. For
example, it now identifies the Defense Logistics Agency as one of the
organizations involved in the "Authorize Return or Disposal" activity.
However, as was the case with BEA Version 4.1, not all operational
activities are assigned to an organization. For example, the "Manage
Capabilities Based Acquisition" activity is not assigned. In addition,
BEA 5.0 still does not include the roles and responsibilities of
organizations performing the same operational activity, which is
important because not doing so can result in either duplicative
organizational efforts or gaps in activity coverage. Moreover, BEA 5.0
still does not include the Foreign Military Sales operational activity,
which affects multiple DOD business missions and organizations.
* The latest version continues to lack important security architecture
content. For example, while DOD officials told us that the Enterprise
Information Environment Mission Area will provide infrastructure
information assurance services (e.g., secure, reliable messaging) for
business systems and applications, this information is not reflected in
the latest version. Also, this version still does not describe relevant
information assurance requirements contained in laws, regulations, and
policies, or provide a reference to where these requirements are
described. Such information is essential to adequately reflect security
in the BEA, and thereby ensure that designs for business systems,
applications, and services comply with applicable information assurance
requirements.
Beyond the above discussed limitations, Version 5.0 also continues to
represent only the thin layer of corporate architectural policies,
capabilities, rules, and standards that apply DOD-wide (i.e., to all
DOD federation members). This means that Version 5.0 appropriately
focuses on addressing a limited set of enterprise-level (DOD-wide)
priorities, and providing the overarching and common architectural
context that the distinct and substantially autonomous member (i.e.,
component) architectures inherit. However, this also means that Version
5.0 does not provide the total federated family of DOD parent and
subsidiary architectures for the business mission area that are needed
to comply with the act.
To produce the federated BEA, the BTA released an update to its
federation strategy in January 2008. (See fig. 3 for a simplified
diagram of DOD's federated BEA.) In April 2007,[Footnote 44] we
reported on the prior version of this strategy, concluding that while
it provided a foundation on which to build and align DOD's parent BEA
with its subsidiary architectures, it lacked sufficient details to
permit effective and efficient execution. Accordingly, we made
recommendations to improve the strategy.
The updated strategy, along with the associated global information grid
[Footnote 45] (GIG) strategy,[Footnote 46] partially addresses our
recommendations. For example, the strategies now provide high-level
roles and responsibilities for federating the architecture and
additional definition around the tasks needed to achieve alignment
among DOD and component architectures. In particular, the strategy for
the business mission area provides for conducting pilot programs across
the components to demonstrate the technical feasibility of architecture
federation. BTA and CIO officials described the strategy for federating
DOD's architectures as still evolving. They added that lessons learned
from the pilots will be used to improve and update the strategies. They
also noted that subsequent releases of the corporate BEA will reflect
the evolving federation strategy by, for example, defining enforceable
interfaces to ensure interoperability and information sharing.
Figure 3: Simplified Diagram of DOD's Business Mission Area Federated
Architecture:
[See PDF for image]
This figure is an diagram of DOD's Business Mission Area Federated
Architecture, as follows:
DOD-Enterprise Layer:
* DOD BEA and Enterprise Transition Plan;
* Enterprise Shared Services and System Capabilities;
* Enterprise Rules and Standards for Interoperability.
[BTA is comprised of the above layer, as well as the component layer]
Component Layer: Military departments and example defense agencies:
* Army: Architectures; Transition Plans; Systems Solutions;
* Navy: Architectures; Transition Plans; Systems Solutions;
* Air Force: Architectures; Transition Plans; Systems Solutions;
* Defense Logistics Agency: Architectures; Transition Plans; Systems
Solutions;
* Defense Finance and Accounting Service: Architectures; Transition
Plans; Systems Solutions;
* United States Transportation Command: Architectures; Transition
Plans; Systems Solutions;
Program Layer: Example programs:
* Army: General Fund Enterprise Business System; Single Army Financial
Enterprise;
* Navy: Navy Enterprise Resource Planning; Navy Tactical Command
Support System;
* Air Force: Expeditionary Combat Support System; Technical Training
Management System;
* Defense Logistics Agency: Business Systems Modernization;
Distribution Planning Management System;
* Defense Finance and Accounting Service: Automated Disbursing System;
Defense Joint Military Pay System;
* United States Transportation Command: Defense Enterprise Accounting
and Management System; Defense Personal Property System.
Source: GAO analysis of DOD data.
[End of figure]
To help assist the department in its BEA federation efforts, we have
made a number of recommendations. While DOD agreed with these
recommendations, it did not implement one related to its latest annual
report. Specifically, we previously recommended that DOD include in its
annual report, required under the National Defense Authorization Act
for Fiscal Year 2005, the results of its BEA independent verification
and validation (IV&V) contractor's assessment of the completeness,
consistency, understandability, and usability of the federated family
of architectures. However, its latest annual report does not include
this information. According to BTA officials, this is because the
contractor's report was not finalized in time to include the results.
While we have yet to receive either the contractor's statement of work
or the results of the contractor's assessments, BTA officials provided
us with a report dated April 11, 2008, that summarizes selected IV&V
contractor observations and recommendations relative to the Version
5.0's ability to provide a foundation for BEA federation. Overall, the
summary confirms our findings by stating that while the BEA provides a
foundation for federation, much remains to be done before the
department will have a complete family of architectures. In this
regard, it provides several recommendations, such as having BTA track,
measure, and report on the adoption of shared vocabularies and
standards within the component architectures. However, the summary does
not demonstrate that the IV&V contractor is being used to address the
full scope of our recommendation. For example, the summary does not
address the extent to which the department's federated family of
architectures, including the related transition plan(s), are complete,
consistent, understandable, and useable.
The challenges that the department faces in federating its BEA, and the
importance of disclosing to congressional defense committees the state
of its federation efforts, are amplified by our recent report on the
current state of the military departments' enterprise architecture
programs. Specifically, we reported in May 2008,[Footnote 47] that none
of the three military departments could demonstrate through verifiable
documentation that it had established all of the core foundational
commitments and capabilities needed to effectively manage the
development, maintenance, and implementation of an architecture,
although in relative terms the state of the Air Force's architecture
efforts was well ahead of those of the Navy and Army. Examples of their
architecture limitations are discussed below.
* None of the military departments had fully defined its "As Is" and
"To Be" architecture environments and associated transition plans. This
is important because without a full understanding of architecture-based
capability gaps, the departments would not have an adequate basis for
defining and sequencing its ongoing and planned business system
investments.
* None of the military departments had fully addressed security as part
of its respective "As Is" and "To Be" environments. This is important
because security is relevant and essential to every aspect of an
organization's operations, and therefore the nature and substance of
institutionalized security requirements, controls, and standards should
be embedded throughout the architecture, and reflected in each system
investment.
* None of the military departments was using an IV&V agent to help
ensure the quality of its architecture products. IV&V is a proven means
for obtaining unbiased insight into such essential architecture
qualities as completeness, understandability, usability, and
consistency.
* None of the military departments had established a committee or group
with representation from across the enterprise to direct, oversee, and
approve its architecture. This is significant because the architecture
is a corporate asset that needs to be enterprisewide in scope and
endorsed by senior leadership if it is to be leveraged for optimizing
operational and technology change.
* None of the military departments could demonstrate that its IT
investments were actually in compliance with its architectures. This is
relevant because the benefits from using an architecture, such as
improved information sharing, increased consolidation, enhanced
productivity, and lower costs, cannot be fully realized unless
individual investments are actually in compliance with, among other
things, architectural rules and standards.
To address these limitations, we have made recommendations aimed at
improving the management and content of these architectures. DOD agreed
with our recommendations. Until DOD has a well-defined family of
architectures for its business mission area, it will not fully satisfy
the requirements of the act and it will remain challenged in its
ability to effectively manage its business system modernization
efforts.
DOD Continues to Expand and Update Its Enterprise Transition Plan, but
Important Elements and Component Plans Are Still Missing:
Among other things, the act requires DOD to develop an ETP for
implementing its BEA that includes listings of the legacy systems that
will and will not be part of the target business systems environment
and specific time-phased milestones and performance metrics for each
business system investment.
In 2007,[Footnote 48] we reported that the then version of the ETP
addressed several of the missing elements that we previously identified
relative to the act's requirements and relevant guidance. However, we
also reported that the ETP was limited in several ways. On March 15,
2008, DOD released the latest version of its ETP, which provides
required information on 102 programs (systems and initiatives) that are
linked to key transformational objectives. For example, it includes
specific time-phased milestones[Footnote 49] for about 90 business
system programs and performance metrics for about 75 of these. Further,
the latest version of the ETP discusses progress made on business
system investments over the last 6 months, as well as descriptions of
planned near-term activities (i.e., next 6 months).
* The Defense Integrated Military Human Resources System program
completed all interface designs required for system deployment to the
Army and to defense agencies, and over half of the interface designs
required for deployment to the Air Force. It also states that system
interface testing and operational testing for the Army deployment will
be completed in the next 6 months.[Footnote 50]
* The Contractor Performance Assessment Reporting System was fully
implemented following replacement of a proprietary software product
with an open source product and rehosting of this product to a new
facility. As a result, improvements in system performance, reliability,
and security were attained.
This version also partially addresses issues that we identified in our
prior report.[Footnote 51] Examples of improvements and remaining
issues are summarized here.
* The latest version contains the results of analyses of gaps between
its "As Is" and "To Be" architectural environments, in which capability
and performance shortfalls are described and investments (such as
transformation initiatives and systems) that are to address these
shortfalls are identified. It also discusses planned and ongoing gap
analyses. For example, it relates the DOD Electronic Mall investment to
the Common Supplier Engagement business enterprise priority area and
describes how it will address business capability gaps by providing
access to off-the-shelf finished goods and services from both
commercial and government sources. It also describes how related
performance shortfalls will be addressed through shorter logistics
response time, improved visibility of sources of supplies, one-stop
tracking of order status, and improved ability to shop for best price.
As we stated, determining how business capability gaps between the
baseline and target architecture are to be addressed for all priority
areas is key to the department's transition plan's ability to support
informed investment selection and control decisions.
* The latest version provides a range of information for the 102
systems and initiatives identified, such as 3 years of budget
information for 67 of these systems and initiatives. However, as we
reported last year,[Footnote 52] the plan has yet to address our prior
finding for including system and budget information for investments by
13 of DOD's 15 agencies[Footnote 53] and for eight of its nine
combatant commands.[Footnote 54] At that time, BTA officials stated
that information for these defense agencies and combatant commands was
excluded because the ETP focused on those business-related
organizations having the majority of the tier 1 and 2 business
investments, and the majority of the defense agencies and combatant
commands do not have investments that meet this threshold criteria.
However, not all DOD components have developed subordinate transition
plans. For example, we recently reported that only one military
department, the Air Force, had developed a transition plan and that
this plan was limited because it did not include an analysis of the gap
in capabilities between the military departments' "As Is" and "To Be"
environments. This means that, similar to DOD's federated BEA, a
complete family of DOD and component transition plans does not yet
exist.
* The latest version provides performance measures for both enterprise
and component investments (i.e., programs), including key milestones
(e.g., initial operating capability). However, it does not include
other important information needed to understand the sequencing of
these investments. In particular, the planned investments are not
sequenced based on a range of important factors cited in federal
guidance, such as technology opportunities, marketplace trends, fiscal
and budgetary constraints, institutional system development and
acquisition capabilities, new and legacy system dependencies and life
expectancies, and the projected value of competing investments.
[Footnote 55] While the ETP has begun to incorporate some top-down
analysis based on gaps in the business enterprise priorities, the plan
continues to be largely based on a bottom-up planning process in which
ongoing programs were examined and categorized in the plan around
business enterprise priorities. For example, many of these investments
are dependent on Net-Centric Enterprise Services (NCES)[Footnote 56]
for its core services, and as such the plans and milestones for each
should reflect the incremental capability deployment of NCES. According
to the BTA official responsible for the ETP, the investments were
sequenced based on only fiscal year budgetary constraints. However, BTA
officials said that they intend to depict investment dependencies in
future versions of the ETP, especially program-to-program dependencies
associated with adoption of a service- oriented architecture approach.
* The latest version of the ETP also includes discussion of how the
department plans to use enterprise application integration,[Footnote
57] including plans, methods, and tools for reusing applications that
already exist while also adding new applications and databases.
However, as we reported last year,[Footnote 58] this discussion lacks
specifics on which investments will reuse which applications.
According to BTA officials, a number of actions are envisioned to
address the above cited areas and further improve the ETP, such as
adding the results of capability gap analyses for all business priority
areas, including tier 1 and 2 programs for all components, and
recognizing dependencies among investments. Until the ETP, or a
federated family of such plans, either directly or by reference
includes relevant information on the full inventory of investments
across the department (and does so in a manner that reflects
consideration of the range of variables associated with a well-defined
transition plan, such as timing dependencies among investments and the
department's capability to manage them), it will not have a sufficient
basis for informed investment decision making regarding disposition of
the department's existing inventory of systems or for sequencing the
introduction of modernized systems. To help DOD in addressing its
transition planning challenges, we have previously made recommendations
that the department is in the process of addressing.
DOD's Fiscal Year 2009 Budget Submission Includes Key Information on
Business Systems:
Among other things, the act requires DOD's annual IT budget submission
to include key information on each business system for which funding is
being requested, such as the system's designated approval authority and
the appropriation type and amount of funds associated with development/
modernization and current services (i.e., operation and maintenance).
The department's fiscal year 2009 budget submission includes a range of
information for the approximately 3,000 business system investments for
which DOD is requesting funding. Of these, 273 involve modernization/
development activities. For each of the 273, the information provided
includes the system's (1) name, (2) approval authority, and (3)
appropriation type. The submission also identifies the amount of the
fiscal year 2009 request that is for development/modernization versus
operations/maintenance. For example, the Army's General Fund Enterprise
Business System, the amount of modernization funds related to "Other
Procurement, Army" and "Research, Development, Testing and Evaluation,
Army" are identified. For systems in excess of $1 million in
modernization funding, the submission also cites its certification
status (e.g., approved, approved with conditions, not applicable, and
withdrawing) and the DBSMC approval date, where applicable.
DOD and Military Departments Have Partially Established Key Investment
Management Structures, but Have Yet to Fully Define Related Policies
and Procedures:
The National Defense Authorization Act for Fiscal Year 2005 requires
DOD to establish business system investment review structures, such as
the previously mentioned DBSMC and five IRBs, and processes that are
consistent with the investment management provisions of the Clinger-
Cohen Act.[Footnote 59] As we have previously reported, organizations
that have satisfied stages 2 and 3 of our ITIM framework have
established the investment selection, control, and evaluation
structures, and the related policies, procedures, and practices that
are consistent with the investment management provisions of the Clinger-
Cohen Act.
DOD and the Air Force have established the kind of investment
management structures provided for in the act and our ITIM framework.
[Footnote 60] However, the Navy has not. Moreover, neither DOD, the Air
Force, nor the Navy have defined the full range of related investment
management policies and procedures that our framework identifies as
necessary to effectively manage investments as individual business
system projects (stage 2) and as portfolios of projects (stage 3).
Accordingly, we made recommendations to address the limitations that
the department is addressing. Until all of DOD has in place these
requisite investment management structures and supporting policies and
procedures, the billions of dollars that the department and its
components invest annually in business systems will remain at risk.
Investment Management Structures Have Been Partially Established:
DOD has partially established the organizational structures that are
associated with Stages 2 and 3 of our framework. Specifically, we
reported in May 2007[Footnote 61] that the department had established
an enterprisewide investment board and four subordinate boards, and
assigned them responsibility for business systems investment
governance, including conducting investment certification and approval
reviews and annual reviews as provided for in the act. The
enterprisewide board--the DBSMC--is composed of senior executives, such
as the Deputy Secretary of Defense and the ASD(NII)/CIO, as provided
for in the act. Among other things, the DBSMC is responsible for
establishing and implementing policies governing the organization's
investment process and approving lower-level investment board processes
and procedures. The subordinate boards include four IRBs[Footnote 62]
that are composed of senior officials representing their respective
business areas, including representatives from the combatant commands,
defense agencies, military departments, and Joint Chiefs of Staff.
Among other things, the IRBs are responsible and accountable for
overseeing and controlling certain business system investments,
including ensuring compliance and consistency with the BEA. The
department has also assigned responsibility to the USD(AT&L) for
managing business system portfolio selection criteria.
However, as we reported last year, the department has yet to establish
the fifth review board required pursuant to the act, the Enterprise
Information Environment Mission Area[Footnote 63] IRB. According to
ASD(NII)/CIO officials, this board has been operating under a draft
concept of operations for about 2 years, but has not been chartered
because of issues surrounding its authority across IT infrastructure-
related investments. However, they stated that a policy is expected to
be approved and issued by the end of May 2008 that will, among other
things, establish a CIO Enterprise Guidance Board that will meet the
act's requirements for Enterprise Information Environment Mission Area
IRB. Specifically, the policy is to provide the Enterprise Guidance
Board with DOD-wide oversight of IT investments.
With respect to the military departments' investment management
structures, we reported in October 2007[Footnote 64] that the Air Force
had established the organizational structures associated with stages 2
and 3 of our framework. Specifically, it has instituted a business
systems IRB, called the Senior Working Group, consisting of senior
executives from the functional business units, including the Office of
the Air Force CIO. This group has been assigned responsibility for
business system investment governance, including conducting investment
precertification and approval reviews and annual reviews, as required
by the act. However, we also reported in October 2007[Footnote 65] that
the Navy had not established such investment management structures.
Specifically, it did not have an enterprisewide IRB, composed of senior
executives from its IT and business units, to define and implement a
Navy-wide business system governance process. Without such structures,
we concluded that the Navy's ability to ensure that business system
investment decisions are made consistently and reflect the needs of the
organization is limited. Accordingly we made a recommendation to the
Navy for establishing these management structures.
Investment Management Policies and Procedures Are Lacking at Both
Corporate and Component Levels:
Neither DOD nor the departments of the Air Force and the Navy have
defined the full range of policies and procedures needed to effectively
support project-level (stage 2) and portfolio-based (stage 3)
investment management practices. While the department is in the process
of developing a new methodology for managing its business system
investments throughout their life cycles that it reports will address
this lack of policies and procedures, this new methodology is still in
draft, has not been approved, and we have yet to be provided a copy.
Until these missing policies and procedures are defined, it is unlikely
that the thousands of DOD business system investments will be managed
in a consistent, repeatable, and effective manner.
To DOD's credit, it has defined corporate policies and procedures
relative to several key practices in our ITIM framework that are
associated with project-level investment management (stage 2). However,
it does not have the full range of project-level policies and
procedures needed for effective investment management. Specifically, we
reported in May 2007[Footnote 66] that DOD had satisfied several policy-
and procedure-related stage 2 practices, such as requiring that systems
support ongoing and future business needs through alignment with the
BEA, having procedures for identifying and collecting information about
these systems to support DBSMC and IRB investment decision making, and
assigning responsibility for ensuring that the information collected
about projects meets the needs of DOD's investment review structures
and processes. However, we also reported that it had not, for example,
developed policies and procedures outlining how the DBSMC/IRB
investment review processes are to be coordinated with other decision-
support processes used at DOD, such as the Joint Capabilities
Integration and Development System; the Planning, Programming,
Budgeting, and Execution process; and the Defense Acquisition System.
[Footnote 67] Without clear linkage among these processes, inconsistent
and uninformed decision making may result. Furthermore, without
considering component and corporate budget constraints and
opportunities, the IRBs risk making investment decisions that do not
effectively consider the relative merits of various projects and
systems when funding limitations exists.
Other important project-level, as well as portfolio-based, investment
management policies and procedures that we reported as lacking include
ones that (1) specify how the full range of cost, schedule, and benefit
data accessible by the IRBs is to be used in making selection
decisions; (2) ensure sufficient oversight and visibility into
component-level (e.g., Air Force and Navy) investment management
activities, including component reviews of systems in operations and
maintenance; (3) define the criteria to be used for making portfolio
selection decisions; (4) create the portfolio of business systems
investments; and (5) provide for conducting postimplementation reviews
of these investments. DOD agreed with our findings and described
actions that it planned to take to address our recommendations,
including developing a new life cycle management methodology for
business systems. In addition, it stated that while its actions would
improve the department's corporate policies and procedures for business
system investments, each component is responsible for developing and
executing investment management policies and procedures needed to
manage its business systems.
In this regard, the military departments also have not developed the
full range of related investment management policies and procedures
needed to execute the project and portfolio-level practices reflected
in our ITIM framework. Specifically, we reported in October 2007
[Footnote 68] that the state of the Air Force and the Navy's investment
management policies and procedures were similar to that of DOD in that
while several of our ITIM framework stage 2 practices were satisfied,
others were not, and none of the stage 3 practices were satisfied. For
example, both the Air Force and the Navy, to their credit, had
developed procedures for identifying and collecting information about
their business systems to support investment selection and control, and
assigned responsibility for ensuring that the information collected
during project identification meets the needs of the investment
management process. However, neither the Air Force nor the Navy had
fully documented policies and procedures for overseeing the management
of business system investments and for developing and managing complete
business systems investment portfolio(s). Among other things, they did
not have policies and procedures that specify decision-making processes
for program oversight and describe how corrective actions should be
taken when projects deviate from their project management plans.
Without such policies and procedures, we concluded that both are at
risk of investing in systems that are duplicative, stovepiped,
nonintegrated, and unnecessarily costly to manage, maintain, and
operate. To address these areas, we made recommendations aimed at
implementing our framework's stage 2 and 3 practices, and DOD partially
agreed with these recommendations.
DOD reports that it has begun to address our investment management
findings and recommendations. Specifically,[Footnote 69] it has drafted
and is piloting aspects of (e.g., an Enterprise Risk Assessment
Methodology) a new lifecycle management methodology, called the
Business Capability Lifecycle (BCL). The annual report states that
these pilots have validated the BCL and that interim guidance for major
business systems[Footnote 70] has been developed. However, the new
methodology has yet to be approved. Further, BTA officials stated that
plans for its finalization and full implementation have been placed on
hold until the department has implemented the Chief Management Officer
(CMO) provisions of the National Defense Authorization Act for Fiscal
Year 2008.[Footnote 71]
Based on a draft of the BCL and descriptions of it contained in the
annual report and briefed to us by BTA officials, this new lifecycle
methodology could address some, but not all, of the policy and
procedure gaps that we have recently reported. For example, the BCL is
to consolidate DOD's currently distinct and separate system
requirements, acquisition, and architectural/investment oversight
processes into a single governance process. However, while lack of
integration among these separate processes is a limitation that
reported with DOD's business system investment management policies and
procedures, this limitation also included lack of integration with
DOD's budgeting process. Unless this new lifecycle methodology
incorporates DOD's funding process, the risk of the respective
processes producing inconsistent investment decisions remains.
The following are other examples of investment management policy and
procedure limitations cited in our recent reports that the draft of the
BCL methodology does not fully address.
* The BCL does not apply to programs after they have completed
development/modernization activities and are in an operations and
maintenance mode, except for certain programs designated as "special
interest." As we recently reported,[Footnote 72] our ITIM framework
provides for including both new system development/acquisition
investments and operations and maintenance of existing system
investments in the investment management process. According to the
department, it plans to examine the applicability of the BCL
methodology to systems in operations and maintenance.
* The BCL does not address how the full range of cost, schedule, and
benefit data is to be used by the IRBs when making their program
certification decisions. Without documenting how such boards are to
consider cost, schedule, and benefits factors when making these
decisions, the department cannot ensure that the boards consistently
and objectively select proposals that best meet the department's needs
and priorities.
* The BCL does not provide for DOD-level oversight and visibility into
component-level investment management activities, including component
reviews of systems in operations and maintenance and smaller
investments, commonly referred to as tier 4 investments.[Footnote 73]
This is particularly important because, as DOD reports, only 353 of
about 3,000 total business systems have completed the IRB certification
process and have been approved by the DBSMC. This means that the vast
majority of business systems have not come before the IRBs and DBSMC,
and thus are reviewed and approved only within the component
organizations. Without policies and procedures defining how the DBSMC
and IRBs have visibility into and oversight of all business system
investments, DOD risks components continuing to invest in systems that
will fall short of expectations.
* The BCL does not provide for portfolio-based business system
investment management. Without defining how projects are to be managed
as part of portfolios of related investments, the department will not
be able to take advantage of the synergistic benefits to be found among
the entire collection of investments, rather than just from the sum of
individual investments. Further, adequately documenting both the
policies and procedures that provide predictable, repeatable, and
reliable investment selection and control and govern how an
organization reduces investment risk of failure and provides the basis
for having rigor, discipline, and respectability in how investments are
selected and controlled across the entire organization. According to
the department, as it implements both the CMO provisions of the
National Defense Authorization Act for Fiscal Year 2008, and capability
portfolio management, the IRB/DBSMC investment management approach is
expected to become more portfolio oriented.
In finalizing the BCL, it will be important for DOD to address these
gaps in its draft methodology. If it does not, the department will
continue to risk selecting and controlling its business system
investments in an inconsistent, incomplete, and ad hoc manner, which in
turn will reduce the chances that these investments will optimally
support mission needs in the most cost-effective manner.
DOD Continues to Certify and Approve Business Systems Cited in the Act:
The act specifies two basic requirements that took effect October 1,
2005, relative to DOD's use of funds for business system modernizations
that involve more than $1 million in obligations in any given fiscal
year. First, it requires that these modernizations be certified by a
designated approval authority[Footnote 74] as meeting specific
criteria.[Footnote 75] Second, it requires that the DBSMC approve each
of these certifications. The act also states that failure to do so
before the obligation of funds for any such modernization constitutes a
violation of the Anti-deficiency Act.[Footnote 76]
As we have previously reported,[Footnote 77] the department has
established an approach to meeting the act's requirements that reflects
its philosophy of "tiered accountability." Under its approach,
investment review begins within the military departments and defense
agencies and advances through a hierarchy of review and decision-making
authorities, depending on the size, nature, and significance of the
investment. For those investments that meet the act's dollar
thresholds, this sequence of review and decision making includes
component precertification, IRB certification, and DBMSC approval. For
those investments that do not, investment decision-making authority
remains with the component. This review and decision-making approach
has two types of reviews for business systems: certification/approval
reviews and annual reviews.
* Certification/approval reviews. Certification/approval reviews apply
to new modernization projects with total costs over $1 million. These
reviews focus on program alignment with the BEA and must be completed
before components obligate funds for programs. Tiers 1, 2, and 3
investments in development and modernization are certified at three
levels--components precertify, the IRBs certify, and the DBSMC
approves. At the component level, program managers prepare, enter,
maintain, and update information about their investments in their
respective data repositories. Examples of information are regulatory
compliance reporting, architectural profile, and requirements for
investment certification and annual reviews. According to the process,
the component precertification authority is to validate that the system
information is complete and accessible on the repository, review system
compliance with the BEA, and verify the economic viability analysis.
This information is then transferred to DOD's IT Portfolio
Repository.[Footnote 78] The precertification authority asserts the
status and validity of the investment information by submitting a
component precertification letter to the appropriate IRB for its
review.
At the corporate level, the IRB reviews the pre-certification letter
and related material, and if certification is decided, prepares a
certification memorandum for the designated certification authority's
signature that documents the IRB's decisions and any related
conditions. The memorandum is forwarded to the DBSMC, which either
approves or disapproves the IRB's decisions and issues a memorandum
containing its decisions. If the DBSMC disapproves a system investment,
it is up to the component precertification authority to decide whether
to resubmit the investment after it has resolved the relevant issues.
* Annual reviews. The annual reviews apply to all business system
investments and are intended to determine whether the investment is
meeting its milestones and addressing its IRB certification conditions.
Tiers 1, 2, 3, and 4 business system investments are annually reviewed
at two levels--the component and the IRBs. At the component level,
program managers update information on all tiers of system investments
that are identified in their component's data repository. For tiers 1
through 3 systems that are in development or being modernized,
information is updated on cost, milestones, and risk variances and
actions or issues related to certification conditions. The component
precertification authority then verifies and submits the information
for these business system investments for the IRB in an annual letter.
The letter addresses system compliance with the BEA and ETP and
includes investment cost, schedule, and performance information.
[Footnote 79]
IRBs annually review tiers 1, 2, and 3 business system development or
modernization investments. These reviews focus on program compliance
with the BEA, program cost and performance milestones, and progress in
meeting certification conditions. IRBs can advise the DBSMC to revoke a
certification when the investment has significantly failed to achieve
performance commitments (i.e., capabilities and costs). When this
occurs, the component must address the IRB's concerns and resubmit the
investment for certification.
Since October 1, 2005 (the effective date of the relevant provision of
the act), DOD has continued to certify and approve investments with
annual obligations in excess of $1 million. For example, as of March
2007, DOD reported that the DBSMC had approved 285 system investments
that had been previously certified by the IRBs. By September 30, 2007,
DOD reported that the DBSMC had approved an additional 29 IRB-certified
system investments, for a total of 314 approved systems. According to
DOD:
* All 314 systems were certified and approved as meeting the first
condition in the act--being in compliance with the BEA--and the 314
systems represent all of the modernization programs meeting the act's
threshold through fiscal year 2007. Collectively, these 314 involved
$7.9 billion in modernization funding.
* About 60 percent (187) of the 314 were reviewed and precertified
within the military departments. More specifically, 69 were pre-
certified within the Army, 58 within the Navy, and 60 within the Air
Force. The remaining 127 were reviewed and precertified within 1 of 15
defense agencies, including 26 in the Military Health Service, 24
within the Defense Logistics Agency, and 20 in the BTA.
Since September 30, 2007, the IRBs have certified and the DBSMC has
approved 39 additional system modernization investments. Moreover,
available information from the military departments shows that 35
additional investments have been precertified. Specifically, the Air
Force, Navy, and Army, report that 14, 19, and 2 investments,
respectively, have been precertified. In addition, both the Air Force
and Navy reported that they have reviewed and approved investments that
are below the act's thresholds, and thus do not require IRB
certification or DBSMC approval. Specifically, the Air Force reports 46
of these systems have been reviewed and approved, while the Navy
reports 4 additional systems reviewed and approved. We have yet to
receive comparable information from the Army.
The basis for DOD's continuing efforts to certify and approve business
systems modernization investments as being compliant with the BEA are
essentially each individual program's assertion of compliance. These
assertions in turn are largely based on DOD BEA compliance assessment
guidance. At the request of the Senate Armed Services Committee, we
have ongoing reviews of several major business systems investments that
include determining the extent to which these investments have
demonstrated compliance with the BEA.
Conclusions:
Over the last year, DOD has continued to make important progress in
defining and implementing key institutional modernization management
controls, but much remains to be accomplished. In particular, the
corporate BEA, while continuing to improve, is still missing important
content, and it has yet to be federated through development of aligned
subordinate architectures for each of the department's component
organizations. Further, while the department has developed a strategy
for federating the BEA in this manner, this strategy is still evolving
and has yet to be implemented. Compounding this situation are recurring
limitations in the ETP, as well as the immaturity of the military
service architecture programs, to include their own transition plans.
In addition, neither the corporate nor the military departments'
approaches to business systems investment management have all the
requisite structures and defined policies and procedures in place to be
considered effective investment selection, control, and evaluation
mechanisms. These architecture and investment management limitations
continue to put billions of dollars spent each year on thousands of
business system investments at risk.
Development of a well-defined federated architecture and accompanying
transition plans for the business mission area, along with
institutionalization of effective business system investment management
policies and procedures across all levels of the department, are
critically important to addressing the business system modernization
high-risk area. Equally, if not more important is for the department to
actually implement the architecture and investment management controls
on each and every business system investment. While not a guarantee,
having an architecture-centric approach to investment management,
combined with following the other key system acquisition disciplines
that are reflected in our existing recommendations to the department,
can be viewed as a recipe for the business systems modernization
program's removal from our high-risk list.
Related to implementing our existing recommendations is the
department's need to keep congressional defense committees fully
informed about its progress in federating the DOD corporate BEA, to
include the maturity of component organization architecture efforts and
the related transition plan(s). In its most recent annual report to
congressional defense committees pursuant to the National Defense
Authorization Act for Fiscal Year 2005, the department missed an
opportunity to do this by not including the results of its IV&V
contractor's assessments of the completeness, consistency,
understandability, and usability of the federated family of business
mission area architectures, including associated transition plans, as
we previously recommended.
Recommendations for Executive Action:
Because we have existing recommendations to the Secretary of Defense
that address the issues raised in this report and that the department
has yet to fully implement, we are not making additional
recommendations at this time.
Agency Comments:
In comments on a draft of this report, signed by the Deputy Under
Secretary of Defense (Business Transformation), the department stated
that it appreciated our support in advancing its business
transformation efforts. It also provided several technical comments
that we have incorporated throughout the report, as appropriate.
We are sending copies of this report to interested congressional
committees; the Director, Office of Management and Budget and the
Secretary of Defense. Copies of this report will be made available to
other interested parties upon request. This report will also be
available at no charge on our Web site at [hyperlink,
http://www.gao.gov].
If you or your staffs have any questions on matters discussed in this
report, please contact me at (202) 512-3439 or hiter@gao.gov. Contact
points for our Offices of Congressional Relations and Public Affairs
may be found on the last page of this report. GAO staff who made major
contributions to this report are listed in appendix II.
Signed by:
Randolph C. Hite:
Director:
Information Technology Architecture and Systems Issues:
List of Committees:
The Honorable Carl Levin:
Chairman:
The Honorable John McCain:
Ranking Member:
Committee on Armed Services:
United States Senate:
The Honorable Daniel Inouye:
Chairman:
The Honorable Ted Stevens:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
United States Senate:
The Honorable Ike Skelton:
Chairman:
The Honorable Duncan L. Hunter:
Ranking Member:
Committee on Armed Services:
House of Representatives:
The Honorable John P. Murtha:
Chairman:
The Honorable C.W. Bill Young:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
House of Representatives:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
As agreed with defense congressional committees, our objective was to
assess the actions by the Department of Defense (DOD) to comply with
the requirements of section 2222 of Title 10, U.S. Code.[Footnote 80]
To address this, we focused on five of the six requirements in section
2222, and related best practices contained in federal guidance, that we
identified in our last annual report under the act as not being fully
satisfied.[Footnote 81] Generally, these five requirements are (1)
development of a business enterprise architecture (BEA), (2)
development of a transition plan for implementing the BEA, (3)
inclusion of business systems information in DOD's budget submission,
(4) establishment of business systems investment review processes and
structures, and (5) approval of defense business systems investments
with obligations in excess of $1 million. (See the background section
of this report for additional information on the act's requirements.)
We did not include the sixth requirement because our 2006 annual report
under the act shows that it had been satisfied. Our methodology
relative to each of the five requirements is as follows:
* To determine whether the BEA addressed the requirements specified in
the act, and related guidance, we analyzed version 5.0 of the BEA,
which was released on March 14, 2008, relative to the act's specific
architectural requirements and related guidance that our last annual
report under the act identified as not being met. We also reviewed
version 5.0 to confirm whether statements made in DOD's March 15, 2008,
annual report about the BEA's content were accurate. In addition, we
reviewed DOD's Business Mission Area Federation Strategy and Road Map
Version 2.0 released in January 2008, comparing the strategy and any
associated implementation plans with prior findings and recommendations
relative to the content of the strategy. Further, we reviewed the
Business Transformation Agency's report of selected independent
verification and validation (IV&V) contractor observations and
recommendations relative to the Version 5.0's ability to provide a
foundation for BEA federation, and compared this to our prior finding
and recommendation relative to the content of an IV&V review of the
BEA. Finally, we reviewed and leveraged the applicable results
contained in our recent reports on the military departments' enterprise
architecture programs, on the Air Force and Navy's investment
management processes, and our recent testimony on DOD's Business
Transformation.[Footnote 82]
* To determine whether the enterprise transition plan (ETP) addressed
the requirements specified in the act, we reviewed the updated version
of the ETP, which was released on March 15, 2008, relative to the act's
specific transition plan requirements and related guidance that our
last annual report under the act identified as not being met. We also
reviewed the ETP to confirm that statements in DOD's March 15, 2008,
annual report about the content of the ETP were accurate.
* To determine whether DOD's fiscal year 2009 information technology
budget submission was prepared in accordance with the criteria set
forth in the act, we reviewed and analyzed the department report
entitled "Report on Defense Business System Modernization FY 2005
National Defense Authorization Act, Section 332," dated February 2008
and compared it to the specific requirements in the act.
* To determine whether DOD has established investment review structures
and processes, we focused on the act's requirements that our last
annual report under the act identified as not being met, obtaining
documentation and interviewing cognizant DOD officials about efforts to
establish the one IRB specified in the act that we previously reported
had yet to be established. We also reviewed and leveraged our recent
reports that assessed the department's,[Footnote 83] Air
Force's,[Footnote 84] and Navy's[Footnote 85] approaches to managing
business system investments.
* To determine whether the department was reviewing and approving
business system investments exceeding $1 million, we reviewed DOD's
list of business system investments certified by the Investment Review
Boards (IRB) and approved by the Defense Business Systems Management
Committee (DBSMC). We then compared the detailed information provided
with the summary information contained in the department's March 15,
2008, report to the congressional defense committees to identify any
anomalies. We also obtained documentation from the Air Force and the
Navy to ascertain the specific actions that were taken (or planned to
be taken) in order to perform the annual systems reviews as required
pursuant to the act. We requested similar information from
representatives of the Army, but did not receive it in time to include
in this report.
We did not independently validate the reliability of the cost and
budget figures provided by DOD because the specific amounts were not
relevant to our findings. We conducted this performance audit at DOD
headquarters in Arlington, Virginia, from March 2008 to May 2008, in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives.
[End of section]
Appendix II: GAO Contact and Staff Acknowledgments:
GAO Contact:
Randolph C. Hite, (202) 512-3439 or hiter@gao.gov:
Acknowledgments:
In addition to the contact person named above, key contributors to this
report were Elena Epps, Michael Holland, Tonia Johnson (Assistant
Director), Neelaxi Lakhmani, Rebecca LaPaze, Anh Le, and Freda
Paintsil.
[End of section]
Footnotes:
[1] Business systems support DOD's business operations, such as
civilian personnel, finance, health, logistics, military personnel,
procurement, and transportation.
[2] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-07-310] (Washington, D.C.:
January 2007).
[3] An enterprise architecture, or modernization blueprint, provides a
clear and comprehensive picture of an entity, whether it is an
organization (e.g., federal department or agency) or a functional or
mission area that cuts across more than one organization (e.g.,
financial management). This picture consists of snapshots of the
enterprise's current "as is" operational and technological environment
and its target or "to be" environment, and contains a capital
investment road map for transitioning from the current to the target
environment. These snapshots consist of "views," which are basically
one or more architecture products that provide conceptual or logical
representations of the enterprise.
[4] GAO, Information Technology: Architecture Needed to Guide
Modernization of DOD's Financial Operations, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-01-525] (Washington, D.C.: May
17, 2001).
[5] See, for example, GAO, Defense Business Transformation: Sustaining
Progress Requires Continuity of Leadership and an Integrated Approach,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-462T] (Washington
D.C.: Feb.7, 2008); GAO, DOD Business Systems Modernization: Progress
Continues to Be Made in Establishing Corporate Management Controls, but
Further Steps Are Needed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-733] (Washington D.C.: May 14, 2007); GAO, Business
Systems Modernization: Strategy for Evolving DOD's Business Enterprise
Architecture Offers a Conceptual Approach, but Execution Details are
Needed, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-451]
(Washington, D.C.: Apr.16, 2007); GAO, Defense Business Transformation:
A Comprehensive Plan, Integrated Efforts, and Sustained Leadership Are
Needed to Assure Success, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-229T] (Washington, D.C.: Nov. 16, 2006); GAO,
Business Systems Modernization: DOD Continues to Improve Institutional
Approach, but Further Steps Needed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-06-658] (Washington, D.C.: May 15, 2006); GAO, DOD
Business Systems Modernization: Long-standing Weaknesses in Enterprise
Architecture Development Need to Be Addressed, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-05-702] (Washington, D.C.: July
22, 2005); GAO, DOD Business Systems Modernization: Billions Being
Invested without Adequate Oversight, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-05-381] (Washington, D.C.: Apr. 29, 2005); GAO, DOD
Business Systems Modernization: Limited Progress in Development of
Business Enterprise Architecture and Oversight of Information
Technology Investments, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-04-731R] (Washington, D.C.: May 17, 2004); GAO, DOD
Business Systems Modernization: Important Progress Made to Develop
Business Enterprise Architecture, but Much Work Remains, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-1018] (Washington, D.C.: Sept.
19, 2003); GAO, Business Systems Modernization: Summary of GAO's
Assessment of the Department of Defense's Initial Business Enterprise
Architecture, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-
877R] (Washington, D.C.: July 7, 2003); GAO, Information Technology:
Observations on Department of Defense's Draft Enterprise Architecture,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-571R] (Washington,
D.C.: Mar. 28, 2003); GAO, DOD Business Systems Modernization:
Improvements to Enterprise Architecture Development and Implementation
Efforts Needed, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-
458] (Washington, D.C.: Feb. 28, 2003); and [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-01-525].
[6] Ronald W. Reagan National Defense Authorization Act for Fiscal Year
2005, Pub. L. No. 108-375, § 332, 118 Stat. 1811, 1851-1856 (Oct. 28,
2004) (codified in part at 10 U.S.C. § 2222).
[7] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[8] GAO, Business Systems Modernization: Air Force Needs to Fully
Define Policies and Procedures for Institutionally Managing
Investments, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-52]
(Washington, D.C.: Oct. 31, 2007); GAO, Business Systems Modernization:
Department of the Navy Needs to Establish Management Structure and
Fully Define Policies and Procedures for Institutionally Managing
Investments, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-53]
(Washington, D.C.: Oct. 31, 2007); GAO, DOD Business Systems
Modernization: Military Departments Need to Strengthen Management of
Enterprise Architectures, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-519] (Washington, D.C.: May 12, 2008); and
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-462T].
[9] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-519].
[10] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[11] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-538].
[12] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-658].
[13] See, for example, GAO, DOD Travel Cards: Control Weaknesses
Resulted in Millions of Dollars of Improper Payments, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-04-576] (Washington, D.C.: June
9, 2004); GAO, Military Pay: Army National Guard Personnel Mobilized to
Active Duty Experienced Significant Pay Problems, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-04-89] (Washington, D.C.: Nov.
13, 2003); and GAO, Defense Inventory: Opportunities Exist to Improve
Spare Parts Support Aboard Deployed Navy Ships, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-887] (Washington, D.C.: Aug.
29, 2003).
[14] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-310].
[15] These eight high-risk areas include DOD's overall approach to
business transformation, business systems modernization, financial
management, the personnel security clearance program, supply chain
management, support infrastructure management, weapon systems
acquisition, and contract management.
[16] The seven governmentwide high-risk areas are disability programs,
ensuring the effective protection of technologies critical to U.S.
national security interests, interagency contracting, information
systems and critical infrastructure, information-sharing for homeland
security, human capital, and real property.
[17] 40 U.S.C. § 11315(b)(2).
[18] 44 U.S.C. § 3602(f)(14).
[19] GAO, Information Technology Investment Management: A Framework for
Assessing and Improving Process Maturity, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-04-394G] (Washington, D.C.: March
2004); OMB Capital Programming Guide, Version 1.0 (July 1997); and CIO
Council, A Practical Guide to Federal Enterprise Architecture, Version
1.0 (February 2001).
[20] The Clinger-Cohen Act of 1996, 40 U.S.C. § 11302(c)(1). This act
expanded the responsibilities of OMB and the agencies that had been set
under the Paperwork Reduction Act with regard to IT management. See 44
U.S.C. 3504(a)(1)(B)(vi) (OMB); 44 U.S.C. 3506(h)(5) (agencies).
[21] We have made recommendations to improve OMB's process for
monitoring high-risk IT investments; see GAO, Information Technology:
OMB Can Make More Effective Use of Its Investment Reviews, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-05-276] (Washington, D.C.: Apr.
15, 2005).
[22] This policy is set forth and guidance is provided in OMB Circular
No. A-11 (Nov. 2, 2005) (section 300), and in OMB's Capital Programming
Guide, which directs agencies to develop, implement, and use a capital
programming process to build their capital asset portfolios.
[23] See for example, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-
04-394G]; GAO, Information Technology: A Framework for Assessing and
Improving Enterprise Architecture Management (Version 1.1), [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-584G] (Washington, D.C.: April
2003); and GAO, Assessing Risks and Returns: A Guide for Evaluating
Federal Agencies' IT Investment Decision-making, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-10.1.13] (Washington, D.C.:
February 1997).
[24] J.A. Zachman, "A Framework for Information Systems Architecture,"
IBM Systems Journal 26, no. 3 (1987).
[25] DOD, Department of Defense Architecture Framework, Version 1.0,
Volume 1 (August 2003) and Volume 2 (February 2004).
[26] See, for example, GAO, Homeland Security: Efforts Under Way to
Develop Enterprise Architecture, but Much Work Remains, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-04-777] (Washington, D.C.: Aug.
6, 2004); [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-731R];
GAO, Information Technology: Architecture Needed to Guide NASA's
Financial Management Modernization, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-04-43] (Washington, D.C.: Nov. 21, 2003); [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-1018]; [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-877R]; GAO, Information
Technology: DLA Should Strengthen Business Systems Modernization
Architecture and Investment Activities, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-01-631] (Washington, D.C.: June
29, 2001); and GAO, Information Technology: INS Needs to Better Manage
the Development of Its Enterprise Architecture, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-212] (Washington, D.C.:
Aug. 1, 2000).
[27] GAO, Information Technology: FBI Has Largely Staffed Key
Modernization Program, but Strategic Approach to Managing Program's
Human Capital Is Needed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-19] (Washington, D.C.: Oct. 16, 2006).
[28] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-394G];
GAO/AIMD-10.1.13; GAO, Executive Guide: Improving Mission Performance
Through Strategic Information Management and Technology, GAO/AIMD-94-
115 (Washington, D.C.: May 1994); and OMB, Evaluating Information
Technology Investments, A Practical Guide (Washington, D.C.: November
1995).
[29] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-394G].
[30] 40 U.S.C. §§ 11311-11313.
[31] GAO, Information Technology: Centers for Medicare & Medicaid
Services Needs to Establish Critical Investment Management
Capabilities, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-12]
(Washington, D.C.: Oct. 28, 2005); GAO, Information Technology: HHS Has
Several Investment Management Capabilities in Place, but Needs to
Address Key Weaknesses, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-06-11] (Washington, D.C.: Oct. 28, 2005); GAO,
Information Technology: FAA Has Many Investment Management Capabilities
in Place, but More Oversight of Operational Systems Is Needed,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-822] (Washington,
D.C.: Aug. 20, 2004); GAO, Information Technology: Departmental
Leadership Crucial to Success of Investment Reforms at Interior,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-1028] (Washington,
D.C.: Sept. 12, 2003); GAO, Bureau of Land Management: Plan Needed to
Sustain Progress in Establishing IT Investment Management Capabilities,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-1025] (Washington,
D.C.: Sept. 12, 2003); GAO, United States Postal Service: Opportunities
to Strengthen IT Investment Management Capabilities, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-03-3] (Washington, D.C.: Oct. 15,
2002); and GAO, Information Technology: DLA Needs to Strengthen Its
Investment Management Capability, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-02-314] (Washington, D.C.: Mar. 15, 2002).
[32] Ronald W. Reagan National Defense Authorization Act for Fiscal
Year 2005, Pub. L. No. 108-375, § 332, 118 Stat. 1811, 1851-1856 (Oct.
28, 2004) (codified in part at 10 U.S.C. § 2222).
[33] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-219].
[34] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-658].
[35] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[36] Ronald W. Reagan National Defense Authorization Act for Fiscal
Year 2005, Pub. L. No. 108-375, § 332, 118 Stat. 1811, 1851-1856 (Oct.
28, 2004) (codified in part at 10 U.S.C. § 2222).
[37] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1072].
[38] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-462T].
[39] Pub. L. No. 100-181 § 904, 122 Stat. 3, 273-75 (Jan. 28, 2008).
[40] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[41] According to DOD, stakeholders include representatives from the
core business mission areas through the Business Enterprise Priorities
(e.g, Personnel Visibility, Acquisition Visibility, Common Supplier
Engagement, Materiel Visibility, Real Property Accountability, and
Financial Visibility). They also will include representatives from the
component organizations that must align their architectures to the
corporate BEA, the program that must align to the corporate BEA and the
component architectures, the IRBs that use the BEA to guide and
constrain investments, and contractors that support programs in
building and configuring architecturally compliant systems.
[42] The United States Standard General Ledger provides a uniform chart
of accounts and technical guidance used in standardizing federal agency
accounting.
[43] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-777];
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-584G].
[44] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-451].
[45] According to DOD, the GIG consists of a globally interconnected,
end-to-end set of information capabilities, associated processes, and
personnel for collecting, processing, storing, disseminating, and
managing information on demand to warfighters, policymakers, and
support personnel, and as such represents the department's IT
architecture.
[46] The GIG strategy provides for federating the many and varied
architectures across the department's four mission areas--Warfighting,
Business, DOD Intelligence, and Enterprise Information Environment. It
was issued in August 2007 by the Assistant Secretary of Defense
(Networks and Information Integration)/Chief Information Officer
(ASD(NII)/CIO).
[47] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-519].
[48] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[49] The time-phased milestones refer to milestones, such as initial
operating capability, full operating capability, technology development
phase, and system development and demonstration phase.
[50] We did not independently verify the reliability of this reported
progress because we have an ongoing review of this program.
[51] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[52] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[53] DOD included system and budget information for the Defense
Financial and Accounting Service and Defense Logistics Agency in the
transition plan. DOD did not include this information for the following
defense agencies: (1) Missile Defense Agency, (2) Defense Advanced
Research Projects Agency, (3) Defense Commissary Agency, (4) Defense
Contract Audit Agency, (5) Defense Contract Management Agency, (6)
Defense Information Systems Agency, (7) Defense Intelligence Agency,
(8) Defense Legal Services Agency, (9) Defense Security Cooperation
Agency, (10) Defense Security Service, (11) Defense Threat Reduction
Agency, (12) National Geospatial-Intelligence Agency, and (13) National
Security Agency.
[54] DOD included system and budget information for the Transportation
Command in the transition plan. DOD did not include this information
for the (1) Central Command, (2) Joint Forces Command, (3) Pacific
Command, (4) Southern Command, (5) Space Command, (6) Special
Operations Command, (7) European Command, and (8) Strategic Command.
[55] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-584G] and CIO
Council, A Practical Guide to Federal Enterprise Architecture, Version
1.0 (February 2001).
[56] NCES is intended to provide capabilities that are key to enabling
ubiquitous access to reliable decision-quality information. NCES
capabilities can be packaged into four product lines: service-oriented
architecture foundation (e.g., security and information assurance),
collaboration (e.g., application sharing), content discovery and
delivery (e.g., delivering information across the enterprise), and
portal (e.g., user-defined Web-based presentation).
[57] Enterprise application integration software is a commercial
software product, commonly referred to as middleware, to permit two or
more incompatible systems to exchange data from different databases.
[58] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[59] 40 U.S.C. § 11312.
[60] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-394G].
[61] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[62] The four IRBs are for (1) Financial Management, (2) Weapon Systems
Lifecycle Management and Materiel Supply and Services Management, (3)
Real Property and Installations Lifecycle Management, and (4) Human
Resources Management.
[63] The Enterprise Information Environment Mission Area enables the
functions of the other mission areas (e.g., Warfighting Mission Area,
Business Mission Area, and Defense Intelligence Mission Area) and
encompasses communications, computing, and core enterprise service
systems, equipment, or software that provides a common information
capability or service for enterprise use.
[64] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-52].
[65] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-53].
[66] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[67] The Joint Capabilities Integration and Development System is a
need-driven management system used to identify future capabilities for
DOD; the Planning, Programming, Budgeting, and Execution process is a
calendar-driven management system for allocating resources and
comprises four phases--planning, programming, budgeting, and executing--
that define how budgets for each DOD component and the department as a
whole are created, vetted, and executed; and the Defense Acquisition
System is an event-driven system for managing product development and
procurement and guides the acquisition process for DOD.
[68] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-52];
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-53].
[69] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-538].
[70] DOD refers to these systems as Major Automated Information
Systems.
[71] The National Defense Authorization Act for Fiscal Year 2008
designates the Deputy Secretary of Defense as its CMO, creates a Deputy
CMO position within the department, and designates the undersecretaries
of each military department as CMOs for their respective departments.
[72] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-538].
[73] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[74] The approval authorities, as discussed earlier in this report, are
the heads of the IRBs. They are the USD(AT&L); the Under Secretary of
Defense (Comptroller); the Under Secretary of Defense for Personnel and
Readiness; and the ASD(NII)/CIO. They are responsible for the review,
approval, and oversight of business systems and must establish
investment review processes for systems under their cognizance.
[75] A key condition identified in the act includes certification by
designated approval authorities that the defense business system
modernization is (1) in compliance with the enterprise architecture;
(2) necessary to achieve critical national security capability or
address a critical requirement in an area such as safety or security;
or (3) necessary to prevent a significant adverse effect on a project
that is needed to achieve an essential capability, taking into
consideration the alternative solutions for preventing such an adverse
effect.
[76] 10 U.S.C.§2222(b); 31 U.S.C.§1341(a) (1) (A).
[77] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733].
[78] DOD's IT Portfolio Repository is the authoritative repository for
certain information about DOD's business systems, such as system names
and the responsible DOD components that are required for the
certification, approval, and annual reviews of these business system
investments.
[79] In addition, each component precertification authority submits a
list of system names to the IRBs on a semiannual basis, to include Tier
4 systems and systems in operations and maintenance that have been
reviewed at the component level.
[80] Ronald W. Reagan National Defense Authorization Act for Fiscal
Year 2005, Public Law 108-375, § 332, 118 Stat. 1811, 1851-1856 (Oct.
28, 2004) (codified in part at 10 U.S.C. § 2222).
[81] GAO, DOD Business Systems Modernization: Progress Continues to Be
Made in Establishing Corporate Management Controls, but Further Steps
are Needed, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-733]
(Washington, D.C.: May 14, 2007).
[82] GAO, Business Systems Modernization: Air Force Needs to Fully
Define Policies and Procedures for Institutionally Managing
Investments, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-52]
(Washington D.C.: Oct. 31, 2007); GAO, Business Systems Modernization:
Department of the Navy Needs to Establish Management Structure and
Fully Define Policies and Procedures for Institutionally Managing
Investments, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-53]
(Washington D.C.: Oct. 31, 2007); GAO, DOD Business Systems
Modernization: Military Departments Need to Strengthen Management of
Enterprise Architectures, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-519] (Washington D.C.: May 12, 2008); and GAO,
Defense Business Transformation: Sustaining Progress Requires
Continuity of Leadership and an Integrated Approach, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-08-462T] (Washington D.C.: Feb.
7, 2008).
[83] GAO, Business Systems Modernization: DOD Needs to Fully Define
Policies and Procedures for Institutionally Managing Investments,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-538] (Washington,
D.C.: May 11, 2007).
[84] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-52].
[85] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-53].
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
