Information Technology
HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment Gao ID: GAO-09-675 July 31, 2009Information technology (IT) plays a critical role in the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission, which was recently expanded under the Housing and Economic Recovery Act of 2008. Pursuant to a congressional mandate to study HUD's IT environment, GAO reviewed the adequacy of key IT management and modernization controls within the department, including strategic planning and performance measurement, investment management, human capital management, enterprise architecture development and use, and modernization program office establishment. To do so, GAO compared HUD policies, guidance, plans, reports, and other products and actions to relevant aspects of statutory requirements, federal guidance, and related best practices.
The department has to varying degrees established key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. Specifically, HUD has (1) developed an IT strategic plan, with strategic goals and related activities and performance targets, but it has not assessed its IT performance since fiscal year 2007, and its assessment at that time showed performance shortfalls. For example, it reported that it was behind schedule or not making progress on about one-half of the activities needed to achieve its IT strategic goals. (2) established policies and procedures for creating portfolios of IT investments, but it lacks related practices to effectively control them. For example, criteria to evaluate the performance of its portfolio do not exist. (3) analyzed gaps in its IT workforce and developed a strategy for addressing them, but the analysis was based on an incomplete and outdated inventory of human capital skill levels, thus rendering its strategy unreliable. (4) established an enterprise architecture program--to connect strategic plans with individual programs and system solutions--that meets key aspects of related best practices, but its efforts to extend its architecture by adding the level of detail needed to implement modernization projects, referred to as segment architectures, are not sufficient. For example, while HUD has identified and prioritized segments to be modernized, it has not adhered to these priorities, and the segments developed do not reflect important elements of federal guidance, and most are out of date. (5) identified the need for a modernization program office with the responsibility for managing its modernization efforts but has not established this office. Department officials acknowledged these shortcomings and stated that efforts to address them have been constrained by such factors as turnover in IT leadership and, until recently, limited modernization resources and initiatives. Until it strengthens these IT management controls, the performance of its existing IT environment and the success of its recent and future efforts to modernize this environment will be at risk.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-09-675, Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment
This is the accessible text file for GAO report number GAO-09-675
entitled 'Information Technology: HUD Needs to Strengthen Its Capacity
to Manage and Modernize Its Environment' which was released on July 31,
2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
United States Government Accountability Office:
GAO:
July 2009:
Information Technology:
HUD Needs to Strengthen Its Capacity to Manage and Modernize Its
Environment:
GAO-09-675:
GAO Highlights:
Highlights of GAO-09-675, a report to congressional committees.
Why GAO Did This Study:
Information technology (IT) plays a critical role in the Department of
Housing and Urban Development‘s (HUD) ability to carry out its home
ownership and community development mission, which was recently
expanded under the Housing and Economic Recovery Act of 2008. Pursuant
to a congressional mandate to study HUD‘s IT environment, GAO reviewed
the adequacy of key IT management and modernization controls within the
department, including strategic planning and performance measurement,
investment management, human capital management, enterprise
architecture development and use, and modernization program office
establishment. To do so, GAO compared HUD policies, guidance, plans,
reports, and other products and actions to relevant aspects of
statutory requirements, federal guidance, and related best practices.
What GAO Found:
The department has to varying degrees established key IT management and
modernization controls needed to help ensure that its existing IT
environment adequately supports mission operations and that its efforts
to modernize this environment are successful. However, these controls
have not been fully implemented either in accordance with a statutory
requirement, federal guidance, or related best practices. Specifically,
HUD has:
* developed an IT strategic plan, with strategic goals and related
activities and performance targets, but it has not assessed its IT
performance since fiscal year 2007, and its assessment at that time
showed performance shortfalls. For example, it reported that it was
behind schedule or not making progress on about one-half of the
activities needed to achieve its IT strategic goals.
* established policies and procedures for creating portfolios of IT
investments, but it lacks related practices to effectively control
them. For example, criteria to evaluate the performance of its
portfolio do not exist.
* analyzed gaps in its IT workforce and developed a strategy for
addressing them, but the analysis was based on an incomplete and
outdated inventory of human capital skill levels, thus rendering its
strategy unreliable.
* established an enterprise architecture program”to connect strategic
plans with individual programs and system solutions”that meets key
aspects of related best practices, but its efforts to extend its
architecture by adding the level of detail needed to implement
modernization projects, referred to as segment architectures, are not
sufficient. For example, while HUD has identified and prioritized
segments to be modernized, it has not adhered to these priorities, and
the segments developed do not reflect important elements of federal
guidance, and most are out of date.
* identified the need for a modernization program office with the
responsibility for managing its modernization efforts but has not
established this office.
Department officials acknowledged these shortcomings and stated that
efforts to address them have been constrained by such factors as
turnover in IT leadership and, until recently, limited modernization
resources and initiatives. Until it strengthens these IT management
controls, the performance of its existing IT environment and the
success of its recent and future efforts to modernize this environment
will be at risk.
What GAO Recommends:
GAO recommends that the HUD Secretary strengthen the IT management
controls discussed in this report and completes recommended steps to
address shortcomings with each control. In commenting on a draft of
this report, HUD agreed with GAO‘s recommendations.
View [hyperlink, http://www.gao.gov/products/GAO-09-675] or key
components. For more information, contact Randolph C. Hite at (202) 512-
3439 or hiter@gao.gov.
[End of section]
Contents:
Letter:
Background:
Key IT Management and Modernization Controls Have Not Been Fully
Established:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Objective, Scope, and Methodology:
Appendix II: Descriptions of HUD Segment Architectures:
Appendix III: Comments from the Department of Housing and Urban
Development:
Appendix IV: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: HUD OCIO Offices and Their Roles and Responsibilities:
Table 2: Stage 3 Critical Processes--Developing a Complete Investment
Portfolio:
Table 3: Summary of Policies and Procedures for Stage 3 Critical
Processes--Developing a Complete Investment Portfolio:
Table 4: Summary of Key Practices for Evaluating the Portfolio (Stage 3
Critical Process):
Table 5: Summary of HUD's Segments:
Table 6: Status of HUD Segment Architectures:
Table 7: Summary of Extent to Which HUD Segment Architectures Address
OMB Guidance:
Table 8: Developed Segment Architectures and Year Completed:
Table 9: Descriptions of HUD Segment Architectures:
Figures:
Figure 1: Simplified HUD Organizational Chart:
Figure 2: HUD OCIO Organizational Chart:
Figure 3: WCF Direct Appropriations and Program Transfers for Fiscal
Years 2005-2009:
Figure 4: Percentage of WCF Obligations for Fiscal Year 2005-2008 Going
Toward Maintenance of Existing IT Versus Development of New IT:
Abbreviations:
CIO: Chief Information Officer:
EA: enterprise architecture:
EPMO: Enterprise Program Management Office:
FHA: Federal Housing Administration:
Ginnie Mae: Government National Mortgage Association:
HUD: Department of Housing and Urban Development:
IPT: Integrated Project Team:
IT: information technology:
ITIM: Information Technology Investment Management:
OCIO: Office of the Chief Information Officer:
OMB: Office of Management and Budget:
TIBEC: Technology Investment Board Executive Committee:
TIBWG: Technology Investment Board Working Group:
WCF: working capital fund:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
July 31, 2009:
The Honorable Patty Murray:
Chair:
The Honorable Christopher Bond:
Ranking Member:
Subcommittee on Transportation, Housing and Urban Development, and
Related Agencies:
Committee on Appropriations:
United States Senate:
The Honorable John W. Olver:
Chairman:
The Honorable Tom Latham:
Ranking Member:
Subcommittee on Transportation, Housing and Urban Development, and
Related Agencies:
Committee on Appropriations:
House of Representatives:
The Department of Housing and Urban Development (HUD) performs a range
of significant home ownership and community development missions that
are integral to our nation's economic recovery. To accomplish these
missions, HUD relies extensively on information technology (IT) and has
been attempting to modernize its IT infrastructure and systems to
enhance its ability to do so.
The Explanatory Statement that accompanies the Department of Housing
and Urban Development Appropriations Act, 2008,[Footnote 1] identifies
concerns about HUD's capacity to manage its IT modernization and
directs GAO to review HUD's information systems. As agreed, our
objective was to determine if HUD has adequately established
institutional management controls needed to manage and modernize its
existing IT environment. To address this objective, we focused on key
IT institutional management controls that our research and experience
across the federal government have shown are hallmarks of successful
organizations (strategic planning and performance measurement,
portfolio-based investment management, human capital management,
enterprise architecture development and use, and a responsible and
accountable modernization program office). For each control, we
compared pertinent agency documentation, such as policies, procedures,
and plans, to statutory requirements, federal guidance, and related
best practices. Details on our objective, scope, and methodology are in
appendix I.
We conducted this performance audit from July 2008 to July 2009, in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Background:
HUD's mission is to increase home ownership, support community
development, and increase access to affordable housing free from
discrimination. To these ends, it has established six strategic goals:
(1) increasing home ownership opportunities; (2) promoting decent
affordable housing; (3) strengthening communities; (4) ensuring equal
opportunity in housing; (5) embracing high standards of ethics,
management, and accountability; and (6) promoting participation of
faith-based and community organizations. HUD works with other federal
agencies and branches of government, as well as with local governments,
faith-based and community organizations, and the private sector to
achieve these goals.
To carry out its mission, HUD is organized into five main program
areas: Housing, Community Planning and Development, Fair Housing and
Equal Opportunity, Public and Indian Housing, and the Government
National Mortgage Association.
* Office of Housing: This office oversees the Federal Housing
Administration (FHA) and regulates certain aspects of the housing
industry. Among other things, its mission is to contribute to building
and preserving healthy neighborhoods and communities; maintain and
expand home ownership, rental housing, and health care opportunities;
and stabilize credit markets in times of economic disruption. The
office is composed of two mission areas: single-family housing and
multifamily housing. Single-family housing programs provide mortgage
insurance on loans to purchase homes. Multifamily programs provide
mortgage insurance to lenders on loans for the development of housing
projects and health care facilities.
* Office of Community Planning and Development: The office's mission is
to provide decent housing, a suitable living environment, and economic
opportunities for people of low and moderate income. To accomplish
this, it engages in partnerships with all levels of government, the
private sector, and nonprofit organizations.
* Office of Fair Housing and Equal Opportunity: The office's mission is
to administer and enforce federal laws that prohibit discrimination in
housing, such as the Fair Housing Act[Footnote 2] and the Civil Rights
Act of 1964.[Footnote 3] To accomplish this, it establishes and
enforces policies intended to ensure that all Americans have equal
access to housing of their choice.
* Office of Public and Indian Housing: The office's mission is to
ensure safe, decent, and affordable housing and create opportunities
for residents' self-sufficiency and economic independence. Among other
things, this office administers and manages programs authorized by the
Housing Act of 1937[Footnote 4] to provide housing to over 1.3 million
households.
* Government National Mortgage Association (Ginnie Mae): This HUD-owned
corporation's mission is to expand affordable housing by linking global
capital markets to the nation's housing markets. While Ginnie Mae does
not issue loans or mortgage-backed securities, it guarantees investors
timely payment and interest on mortgage-backed securities backed by
federally insured or guaranteed loans.
HUD also consists of a number of mission support offices, such as the
Office of Healthy Homes and Lead Hazard Control and the Office of Faith-
Based and Community Initiatives, as well as administrative offices,
such as the Office of the Chief Procurement Officer and the Office of
the Chief Information Officer (OCIO). Figure 1 provides a simplified
view of the department's organizational structure.
Figure 1: Simplified HUD Organizational Chart:
[Refer to PDF for image: organizational chart]
HUD Organizational Chart:
Top level:
Secretary[A].
Second level, reporting to the Secretary:
Deputy Secretary.
Third level, reporting to the Deputy Secretary:
Fair Housing and Equal Opportunity;
Housing;
Chief Financial Officer;
Chief Procurement Officer;
Community Planning and Development;
Government National Mortgage Association;
Public and Indian Housing;
Chief Information Officer;
Other support offices[B].
Source: GAO based on HUD data.
[A] Other offices exist that directly report to the Office of the
Secretary, such as the Office of Hearings and Appeals.
[B] Other support offices include: Administration, Center for Faith-
Based and Community Initiatives, Congressional and Intergovernmental
Affairs, Departmental Equal Employment Opportunity, Departmental
Operations and Coordination, Field Policy and Management, General
Counsel, Healthy Homes and Lead Hazard Control, Inspector General,
Policy Development and Research, and Public Affairs.
[End of figure]
HUD's fiscal year 2008 appropriation was about $37.6 billion, while its
fiscal year 2009 appropriation is about $41.5 billion. HUD's budget
request for fiscal year 2010 is about $46.3 billion. The department has
approximately 8,500 employees in 81 field offices that are resident in
all 50 states, the District of Columbia, and Puerto Rico.
Recent Economic Recovery Legislation Has Increased HUD's Mission
Responsibilities and Funding for IT Support:
During the past year, legislation has been enacted to stimulate our
nation's economy, in part through strengthening the housing market.
Under this legislation, HUD was given new responsibilities and
additional funding to help meet these new responsibilities.
Specifically, the Housing and Economic Recovery Act of 2008[Footnote 5]
established a program at FHA intended to help families avoid home
foreclosure by refinancing them into FHA-insured mortgages. The act
also authorized $25 million for each of fiscal years 2009 through 2013
for improvements to FHA's IT, among other things.
In addition, the American Recovery and Reinvestment Act of 2009
provided roughly $11.6 billion to HUD across a range of programs, and
authorized HUD to, depending on the program, use either up to 1/2
percent or up to 1 percent of the funds for IT and other administrative
costs related to most of these programs. As such, the act recognizes
that HUD's ability to effectively implement these programs depends in
part on its simultaneous delivery of enhanced IT support. According to
OCIO officials, of the approximately $61 million made available for IT
under this act, about 2.5 percent or $1.5 million will be spent on the
development of a new system[Footnote 6] supporting reporting
requirements mandated by the act, while the remainder is planned to be
used to maintain or enhance existing systems.
HUD Relies Extensively on IT to Support Its Mission Operations and on
OCIO to Provide This Support:
IT plays a critical role in HUD's ability to carry out its missions,
supporting data collection and dissemination throughout the department
and to external partners. For instance, the department reports that its
business areas rely on IT to process over 50,000 loan requests per
week, over 12,000 service calls per month, and more than 7,000 grant
requests annually for each of its major grant programs. Further, the
department's increased responsibilities under the Housing and Economic
Recovery Act of 2008 will introduce greater processing requirements for
FHA loan applications and new budget reporting requirements, and thus
further increase its reliance on IT.
OCIO is responsible for supporting HUD programs, services, and
management processes by providing high-quality IT solutions and
services. To this end, OCIO has established four IT strategic goals:
(1) rapidly modernizing IT to support key HUD business initiatives; (2)
transforming the IT infrastructure to adapt to and adopt emerging
technologies; (3) developing a cadre of highly capable IT professionals
with mission critical competencies; and (4) providing secure, rapid,
and reliable data and information to customers, citizens, and business
partners.
OCIO consists of the Chief Information Officer (CIO), two Deputy Chief
Information Officers, and eight offices. These offices are responsible
for systems integration and efficiency; policy and E-government; IT
governance and investment; IT operations; enterprise architecture (EA);
IT strategic planning and communication; administrative services; and
IT security. (See figure 2 for an OCIO organizational chart depicting
key positions; see table 1 for a summary of each office's roles and
responsibilities.)
Figure 2: HUD OCIO Organizational Chart:
[Refer to PDF for image: organizational chart]
HUD OCIO Organizational Chart:
Top level:
Chief Information Officer.
Second level, reporting to the Chief Information Officer:
General Deputy Chief Information Officer.
Third level, reporting to the General Deputy Chief Information Officer:
Deputy Chief Information Officer for Information Technology Operations.
Fourth level, reporting to the Deputy Chief Information Officer for
Information Technology Operations:
Administrative Services;
Strategic Planning;
Information Security Office;
Office of Systems Integration and Efficiency;
Office of Investment Strategies, Policy, and Management;
Office of IT Operations;
Office of Enterprise Architecture;
Office of IT Reform.
Source: HUD.
[End of figure]
Table 1: HUD OCIO Offices and Their Roles and Responsibilities:
Office: Office of Systems Integration and Efficiency;
Roles and responsibilities: Advises the CIO on IT systems engineering
and is the focal point for information systems modernization.
Office: Office of Investment Strategies, Policy, and Management;
Roles and responsibilities: Advises the CIO on IT policy and
management, including compliance with IT related legislation, such as
the Clinger-Cohen Act of 1996, and is the focal point with the Office
of Management and Budget concerning the department's IT policies.
Office: Office of IT Reform;
Roles and responsibilities: Advises the CIO on all aspects of IT reform
including the IT investment strategy and capital planning program and
provides leadership to departmentwide governance boards on IT
investment matters.
Office: Office of IT Operations;
Roles and responsibilities: Delivers technical assistance and overall
support for initiatives and daily operations including maintaining and
monitoring IT infrastructure.
Office: Office of Enterprise Architecture;
Roles and responsibilities: Informs, guides, and governs the business
and IT strategic decisions for the enterprise.
Office: Strategic Planning;
Roles and responsibilities: Designs, develops, and manages the IT
strategic planning process and short-term to long-term guidance on
development of IT strategy.
Office: Administrative Services;
Roles and responsibilities: Provides basic resource management in the
areas of personnel, training, budget, travel, space, and other
essential resource-related needs of the OCIO workforce.
Office: Information Security Office;
Roles and responsibilities: Develops and implements security and
privacy programs, policies, and procedures to ensure the security,
reliability, and accessibility of information and IT resources.
Source: GAO analysis of HUD data.
[End of table]
Overview of the Department's IT Environment:
HUD's current IT environment does not effectively support its ongoing
business operations. According to the department's recent operating
plans and budget submissions to Congress, its information systems are
overlapping and duplicative, are not integrated, necessitate manual
workloads, and employ antiquated technologies that are costly to
maintain. More specifically:
* It consists of over 200 information systems, many of which perform
the same functions and thus are duplicative. For example, it has at
least 16 financial management systems that it plans to consolidate.
* It consists of stove-piped, nonintegrated systems. For example,
multiple systems support grants management and cannot share related
data.
* It provides insufficient support for key business processes, such as
grants management, thus necessitating reliance on manual processing.
Specifically, four of its offices perform most of their own grants
management operations manually, about $7 billion in annual low-income,
housing, project-based contracts are renewed using a paper intensive
process, and about $16 billion per year is managed using a spreadsheet
application.
* It consists of antiquated and complex systems that are costly to
maintain. For example, HUD relies on several different operating
systems and 35 different programming languages, each of which requires
specialized skills to operate and maintain. In addition, a 2007 study
of HUD's IT environment found that the average age of its information
systems was nearly 15 years, which is more than twice that of other
agencies (6 years).
Summary of HUD's Recent IT Funding:
HUD funds its IT operations through its working capital fund (WCF).
[Footnote 7] The WCF is funded through both direct appropriations and
program transfers from HUD mission-focused programs. As illustrated in
figure 3, the majority of WCF funding has consistently been through
direct appropriations, although funding from program transfers has
increased steadily. As also illustrated, until fiscal year 2009, the
level of total IT funding had declined.
Figure 3: WCF Direct Appropriations and Program Transfers for Fiscal
Years 2005-2009:
[Refer to PDF for image: stacked vertical bar graph]
Fiscal year: 2005;
Direct appropriations: $270 million;
Program Transfers: $61 million.
Fiscal year: 2006;
Direct appropriations: $197 million;
Program Transfers: $67 million.
Fiscal year: 2007;
Direct appropriations: $197 million;
Program Transfers: $67 million.
Fiscal year: 2008;
Direct appropriations: $155 million;
Program Transfers: $79 million.
Fiscal year: 2009;
Direct appropriations: $224 million;
Program Transfers: $121 million.
Source: GAO analysis of HUD appropriations.
[End of figure]
Funding for HUD's IT environment can be split into two categories:
maintenance and development. Maintenance of its existing IT environment
includes application operations support for approximately 200 existing
systems; infrastructure costs for shared IT services across the
department and regional locations, such as hardware support, disaster
recovery, and facilities management; and salaries and indirect expenses
for 255 full-time equivalent OCIO positions, as well as certain staff
who provide management support to IT services from the Office of the
Chief Procurement Officer and the Office of the Chief Financial
Officer. Development includes modernizing systems to better support
HUD's mission and business priorities. As illustrated in figure 4, the
percentage of funds obligated for new development (i.e., modernization)
has consistently been a small percentage of total IT obligations,
particularly in fiscal year 2008 when only about 2 percent of IT
obligations was for development.
Figure 4: Percentage of WCF Obligations for Fiscal Year 2005-2008 Going
Toward Maintenance of Existing IT Versus Development of New IT:
[Refer to PDF for image: stacked vertical bar graph]
Fiscal year: 2005;
Maintenance: $89 million;
Development: $11 million.
Fiscal year: 2006;
Maintenance: $87 million;
Development: $13 million.
Fiscal year: 2007;
Maintenance: $85 million;
Development: $15 million.
Fiscal year: 2008;
Maintenance: $98 million;
Development: $2 million.
[End of figure]
HUD's fiscal year 2010 budget request provides for increases in IT
funding under what it refers to as its "Transformation Initiative."
This initiative consists of four related components, one of which
focuses on modernizing IT systems in order to decrease HUD's reliance
on its legacy environment. According to the budget request, the
initiative's funding is to be 1 percent of HUD's total budget, or
approximately $434 million. HUD officials stated that the potential
exists for as much as one-half of this amount (or about $217 million)
to be used for modernization of its IT systems.
Effective Maintenance and Modernization of IT Depends on
Institutionalizing Key IT Management Controls:
A federal agency's ability to effectively and efficiently maintain and
modernize its existing IT environment depends in large part on how well
it employs certain IT management controls that are embodied in
statutory requirements, federal guidance, and best practices. Among
other things, these controls include strategic planning and performance
measurement, portfolio-based investment management, human capital
management, enterprise architecture (and supporting segment
architecture) development and use, and establishing responsibility and
accountability for modernization management. The purpose of each of
these controls is as follows:
* Strategic planning and performance measurement are intended to ensure
that an organization's IT strategic goals are aligned with its overall
mission goals and outcomes and that these IT goals are supported by
clearly defined (1) activities aimed at accomplishing the goals and (2)
measures for determining performance in accomplishing these activities
and goals. These principles are reinforced through statutory
requirements.[Footnote 8] By establishing such activities and measures
and then monitoring actual-versus-expected performance, an organization
can better understand progress, and thus the need for corrective
action, in achieving its IT strategic goals.
* Investment management is aimed at selecting, controlling, and
evaluating investments in IT in a manner that better ensures that they
produce business value, reduce investment-related risks, and increase
accountability and transparency in the investment decision-making
process. In 2004, we issued a framework for assessing federal agencies'
investment management practices[Footnote 9] that consists of five
progressive stages of maturity, with Stage 1 representing immature and
undisciplined investment management structures and processes, and Stage
5 representing optimized maturity focused on continuous improvement.
Stage 3--our focus in this report--is where an organization moves from
project-centric to portfolio-based investment processes. Through a
portfolio-based approach, the organization can consider new investment
proposals, along with previously funded investments, and identify the
appropriate mix and synergies of these investments to best meet mission
needs, technology needs, and priorities for improvement. Organizations
that have implemented Stage 3 practices have capabilities in place that
assist in the establishment of selection, control, and evaluation
structures, policies, procedures, and practices that are consistent
with the investment management provisions of the Clinger-Cohen Act.
[Footnote 10]
* Human capital management is intended to ensure that an organization
has the employees with the appropriate knowledge and skills to
effectively execute critical IT functions. It involves assessing IT
workforce needs, inventorying existing staff's knowledge and skills and
identifying any gaps between needs and existing capabilities, and
developing strategies and plans to fill any gaps.
* EA development and use is aimed at establishing a corporate blueprint
for investing that connects strategic plans with individual programs
and system solutions. As such, this blueprint provides the information
details needed to guide and constrain investments in a consistent,
coordinated, and integrated fashion--thereby improving
interoperability, reducing duplicative efforts, and optimizing mission
operations. In brief, an EA includes descriptions of an organization's
current or "as is" environment and its target or "to be" environment.
The architecture also includes a transition or sequencing plan, which
is based on an analysis of the gaps between the "as is" and "to be"
environments. In 2003, we issued a framework for assessing and
improving an organization's EA management that includes five stages of
maturity for developing, maintaining, and implementing an architecture.
[Footnote 11] One approach to providing the EA information details
needed to adequately inform, and thus guide and direct, program and
system solution implementations is to divide the architecture into
segments and to develop more detailed architectures for each segment.
As such, segment architectures can be used to provide a bridge between
the corporate frame of reference captured in the EA and each individual
program and system investment. The Office of Management and Budget
(OMB) has issued guidance related to segment architectures.[Footnote
12] As part of its guidance, agencies are to group their segments into
three categories: core mission areas (e.g., single-family housing),
business services (e.g., financial management), and enterprise services
(e.g., records management).
* Effective modernization management includes having clearly defined
and assigned responsibilities. This often involves a modernization
program office that is accountable for planning, evaluating, executing,
and tracking an enterprise's modernization efforts.
Key IT Management and Modernization Controls Have Not Been Fully
Established:
The department has, to varying degrees, established certain key IT
management and modernization controls needed to help ensure that its
existing IT environment adequately supports mission operations and that
its efforts to modernize this environment are successful. However,
these controls have not been fully implemented either in accordance
with a statutory requirement, federal guidance, or related best
practices.
HUD officials are aware of the need to strengthen each of these
controls, but they stated that a combination of turnover in OCIO senior
leaders and a pre-2009 decline in IT resources constrained their
efforts to do so. Because these controls are critical to managing an
organization's existing IT environment and to modernizing it, and given
HUD's recent and planned increases in modernization-related activities,
it is important for the department to fully establish each control.
Until it does, the performance of HUD's existing IT environment, as
well as its efforts to modernize this environment, will be at risk.
HUD Has Stopped Assessing Performance in Meeting Its IT Strategic
Goals, and Its Most Recent Assessment Showed Performance Shortfalls:
Effective IT strategic planning and performance measurement can help an
organization effectively and efficiently leverage IT in meeting mission
goals and achieving performance outcomes. To this end, executive
agencies are to establish goals for improving the efficiency and
effectiveness of their operations through the effective use of IT,
[Footnote 13] annually submit to Congress a report on their progress in
achieving these goals,[Footnote 14] and establish and apply performance
measures to determine how well IT supports their programs.[Footnote 15]
In addition, HUD guidance[Footnote 16] emphasizes the importance of
regularly assessing progress in implementing its IT strategic plan and
provides for quarterly and annual CIO reporting on progress against its
strategic goals.
To its credit, HUD established goals and performance measures, as
required. Specifically, it developed an IT strategic plan in January
2006 that defines four strategic goals that are intended to improve
IT's contribution to program productivity, efficiency, and
effectiveness. These goals are to (1) rapidly modernize IT to support
key HUD business initiatives; (2) transform the IT infrastructure to
adapt to and adopt emerging technologies; (3) develop a cadre of highly
capable IT professionals with mission critical competencies; and (4)
provide secure, rapid, and reliable data and information to customers,
citizens, and business partners. In addition, the plan identifies a
range of activities necessary to achieve each of these goals. For
example, to transform the IT infrastructure to adapt to and adopt
emerging technologies, HUD intends to increase the reuse of its
components, improve program management, identify infrastructure
requirements, and perform customer training for new technologies. The
plan also includes performance measures for each strategic goal, which
according to HUD, are to serve as indicators of the extent to which the
IT goals are being met and how well IT is supporting the department's
mission. For example, for this same strategic goal, two of its
performance measures are "100 percent of contract actions are completed
on time" and "infrastructure collaborates with 100 percent of program
areas/project managers and developers to ensure project plans and
architectures are agreed upon."
However, HUD did not assess and report on performance against its four
IT strategic goals in fiscal year 2008, as required.[Footnote 17]
Moreover, while HUD assessed and reported on its IT performance in
fiscal year 2007, this assessment showed that it was either behind
schedule or not making progress in 46 percent of the activities it
defined as needed to achieve its IT strategic goals. At the same time,
the basis for those assessments is not clear. For example, for its
strategic goal to develop a cadre of highly capable IT professionals
with mission critical competencies, HUD only reported that it was "not
progressing in establishing a team to support customer service
management," and thus did not relate the specific status of this
activity to measurable commitments. In addition, the fiscal year 2007
assessment did not address how well IT supports the department's
mission outcomes, and it did not measure performance against any of the
indicators in the IT strategic plan.
OCIO officials attributed the agency's performance measurement
weaknesses to, among other things, turnover in OCIO senior leaders.
According to these officials, efforts are under way to redefine HUD's
process for measuring the performance and progress of IT operations,
and this new process is to be implemented by the end of fiscal year
2010. In the meantime, HUD reports that it has commenced efforts to
assess performance during fiscal year 2009. However, no plan exists
that defines how performance in fiscal year 2009 will be assessed or
how this new process is to be developed and implemented, including a
schedule of activities and resource needs. Until HUD regularly assesses
and reports progress against its strategic IT performance measures and
activities, it will not be in compliance with a statutory requirement
and will not know how well it is achieving its IT strategic goals and
where it needs to improve. Thus, its ability to effectively and
efficiently support HUD mission operations may be impaired.
Policies and Procedures for Developing Investment Portfolios Are
Largely Established, but Key Policies and Practices to Effectively
Control Them Have Not Been Implemented:
If managed effectively, IT investments can have a dramatic impact on an
organization's performance and accountability. If mismanaged, they can
result in wasteful spending and lost opportunities for achieving
mission goals and improving mission performance. According to our
Information Technology Investment Management (ITIM) framework,[Footnote
18] an organization that has reached Stage 3 of maturity manages
projects as a portfolio of investments, treating them as integrated
packages of competing investment options and thereby pursuing those
that best meet the organization's strategic goals and mission. Managing
IT investments as portfolios also allows an organization to make more
informed decisions about which projects to begin funding and continue
funding based on analyses of the relative organizational value and
risks of all projects, including those that are proposed, under
development, and in operation. Our prior work has shown that the
absence of a portfolio-based approach to IT investment management can
contribute to duplication in programs and equipment that do not operate
effectively together.[Footnote 19]
Stage 3 maturity involves implementation of four critical processes:
(1) defining the portfolio criteria; (2) creating the portfolio; (3)
evaluating (i.e., controlling) the portfolio; and (4) conducting
postimplementation reviews. Table 2 summarizes the purpose of each of
these processes. To effectively manage a portfolio of investments, an
organization should establish policies and procedures to address each
of these critical processes, as well as the key practices needed to
evaluate its portfolio.
Table 2: Stage 3 Critical Processes--Developing a Complete Investment
Portfolio:
Critical process: Defining the portfolio criteria;
Purpose: To ensure that the organization develops and maintains IT
portfolio selection criteria that support its mission, organizational
strategies, and business priorities.
Critical process: Creating the portfolio;
Purpose: To ensure that IT investments are analyzed according to the
organization's portfolio selection criteria and to ensure that an
optimal IT investment portfolio with manageable risks and returns is
selected and funded.
Critical process: Evaluating the portfolio;
Purpose: To review the performance of the organization's investment
portfolio(s) at agreed-upon intervals and to adjust the allocation of
resources among investments as necessary.
Critical process: Conducting postimplementation reviews;
Purpose: To compare the results of recently implemented investments
with the expectations that were set for them and to develop a set of
lessons learned from these reviews.
Source: GAO.
[End of table]
To HUD's credit, it has established the range of necessary policies and
procedures needed to execute three of the four critical processes
associated with developing a complete investment portfolio--defining
the portfolio, creating the portfolio, and conducting
postimplementation reviews. However, it has not established policies
and procedures and is not executing five of the six key practices
needed to satisfy the fourth--evaluating the portfolio.
* For defining portfolio criteria, HUD's ITIM process guide identifies
an annual time frame and responsibilities for creating and modifying
investment selection criteria. Specifically, the OCIO is to develop
proposed criteria, the Technology Investment Board Working Group
(TIBWG) is responsible for reviewing and commenting on the criteria,
and the Technology Investment Board Executive Committee (TIBEC)
approves the final criteria. The process guide also states that the
criteria are to reflect HUD strategies, modernization goals, and OMB
exhibit 300 criteria.[Footnote 20]
* For creating the portfolio, the TIBWG is to annually analyze and
compare IT projects to be included in the portfolio using, among other
things, IT portfolio selection criteria, funding requests, and
departmental priorities identified by the TIBEC. The group's
recommendations for the portfolio, including recommended project
priorities, are to be provided to the TIBEC for an approval decision.
This decision is to be guided by HUD's policy that identifies a series
of questions, such as "Does the portfolio reflect HUD's strategic
priorities?" and "Have potential funding constraints been considered?"
To maintain the portfolio, HUD's guidance states that, as a result of
ongoing control reviews, recommendations can be made to the TIBEC to
maintain or adjust the IT portfolio, including the cancellation of a
project.
* For conducting postimplementation reviews, HUD has developed detailed
guidance. For example, these reviews are to be conducted within 6 to 18
months after the implementation of a project to validate actual
investment results and extract lessons learned for ITIM process
improvement. These reviews are to be conducted by designated teams that
are selected annually by ITIM staff using identified criteria and
represent a cross section of representatives from various disciplines,
such as EA and IT operations. The guide also provides a step-by-step
process for conducting the reviews, as well as detailed evaluation
criteria to be applied to help formulate findings. The results of this
review process are to be provided to the reviewed project's sponsors,
managers, and other stakeholders, and a summary of the results is to be
provided to the TIBWG.
* For evaluating the portfolio, HUD does not have policies and
procedures for reviewing, evaluating, and improving the performance of
its portfolio. Specifically, while the TIBEC charter establishes that
it is responsible for conducting regular reviews to assess and improve
the performance of HUD's investment portfolio, policies and procedures
that address this responsibility have not been established. (See table
3 for a summary of our analysis relative to HUD's policies and
procedures for each Stage 3 critical process.)
Table 3: Summary of Policies and Procedures for Stage 3 Critical
Processes--Developing a Complete Investment Portfolio:
Critical process: Defining the portfolio criteria;
Key practice: The organization has documented policies and procedures
for creating and modifying IT portfolio selection criteria;
Rating: Executed;
Summary of evidence: HUD's ITIM guide identifies an annual process for
creating and modifying portfolio selection criteria based on HUD
strategies, modernization goals, and OMB exhibit 300 criteria.
Critical process: Creating the portfolio;
Key practice: The organization has documented policies and procedures
for analyzing, selecting, and maintaining the investment portfolio(s);
Rating: Executed;
Summary of evidence: HUD has policies and procedures for the annual
creation of its portfolio. This includes an application of the
portfolio selection criteria by the TIBWG and final approval by the
TIBEC.
Critical process: Evaluating the portfolio;
Key practice: The organization has documented policies and procedures
for reviewing, evaluating, and improving the performance of the
portfolio(s);
Rating: Not Executed;
Summary of evidence: HUD does not have policies and procedures for
reviewing, evaluating, and improving the performance of its portfolio.
Critical process: Conducting postimplementation reviews;
Key practice: The organization has documented policies and procedures
for conducting postimplementation reviews;
Rating: Executed;
Summary of evidence: HUD has developed a postimplementation review
guide that provides specific details for conducting these reviews. This
includes a step-by-step process for conducing postimplementation
reviews, as well as detailed evaluation criteria to be applied to help
formulate findings.
Source: GAO analysis of HUD practices.
[End of table]
Moreover, the department is not executing five of the six additional
key practices associated with evaluating its portfolio. Specifically,
the department does not evaluate performance of its overall investment
portfolio on a continuing basis and has not established criteria for
assessing overall portfolio performance. (See table 4 for a summary of
our analysis of the practices related to the evaluating the portfolio
critical process, with the exception of the establishment of policies
and procedures, which is addressed in table 3.)
Table 4: Summary of Key Practices for Evaluating the Portfolio (Stage 3
Critical Process):
Type of practice: Prerequisite;
Key practice: Adequate resources, including people, funding, and tools
have been provided for reviewing the investment portfolio and its
projects;
Rating: Not executed;
Summary of evidence: According to HUD, a lack of funding has limited
its ability to create portfolio evaluation criteria.
Type of practice: Prerequisite;
Key practice: Board members are familiar with the process for
evaluating and improving the portfolio's performance;
Rating: Type of practice: Not executed;
Summary of evidence: Type of practice: HUD does not evaluate the
performance of its overall portfolio. As a result, this practice cannot
be executed.
Type of practice: Prerequisite;
Key practice: Results of relevant oversight reviews of individual
investments are provided to the investment board;
Rating: Type of practice: Executed;
Summary of evidence: Type of practice: HUD conducts several individual
investment reviews, the results of which are provided to its investment
boards. This includes monthly reports on cost and schedule variances,
detailed project reviews on select investments, and an annual strategic
portfolio review.
Type of practice: Prerequisite;
Key practice: Criteria for assessing portfolio performance are
developed, reviewed, and modified at regular intervals to reflect
current performance expectations;
Rating: Not executed;
Summary of evidence: HUD does not have criteria for assessing portfolio
performance. As a result, this practice cannot be executed.
Type of practice: Activities;
Key practice: IT portfolio performance measurement data are defined and
collected consistent with portfolio performance criteria;
Rating: Not executed;
Summary of evidence: HUD does not have criteria for assessing portfolio
performance. As a result, this practice cannot be executed.
Type of practice: Activities;
Key practice: Adjustments to the IT investment portfolio are executed
in response to actual portfolio performance;
Rating: Not executed;
Summary of evidence: HUD does not evaluate the performance of its
overall portfolio. As a result, this practice cannot be executed.
Source: GAO analysis of HUD practices.
[End of table]
The OCIO's Director of ITIM attributed these portfolio management
weaknesses to limitations in resources. The Director of ITIM also
stated that the department recognizes the need to improve IT portfolio
investment management, adding that a plan will be developed within the
next 12 months to address the key practice weaknesses that we
identified. Without having defined and implemented practices for
evaluating the performance of its IT investment portfolios, HUD will be
limited in its ability to control the risks and achieve the benefits
associated with the mix of legacy system and modernization investments
that it selects.
HUD Is Not Adequately Managing Its IT Human Capital:
Effective human capital management requires a strategic and proactive
approach to meeting current and future human capital needs. By
employing such an approach, organizations can be better positioned to
have the people with the right knowledge, skills, and abilities to
support mission operations both today and in the future. The success or
failure of federal programs depends, in large part, on having the right
number of people with the right mix of knowledge and skills. Since
2001, we have designated the strategic management of human capital as a
governmentwide high-risk area.[Footnote 21]
We have previously reported on principles for strategic workforce
planning,[Footnote 22] which outline guidance for human capital
management. Strategic workforce planning involves (1) determining the
critical skills and competencies needed to achieve current and future
program results, (2) analyzing the gaps between current skills and
future needs, and (3) developing strategies for filling gaps. If
performed effectively, these activities can collectively create a
strategic and proactive approach to human capital management.
OCIO has not adequately performed most of these activities:
* The office assessed its needed IT workforce skills and competencies
(requirements) in fiscal year 2008, based on interviews with most, but
not all, OCIO managers.
* The office performed an analysis of the gaps between its IT workforce
requirements and skills (inventory) in fiscal year 2008 using an
outdated inventory of human capital skills, thus rendering the
identified gaps unreliable. Specifically, OCIO's IT workforce skills
inventory was based on a 2006 governmentwide survey conducted by the
Office of Personnel Management and the Federal Chief Information
Officer's Council.[Footnote 23] However, this inventory only covered
about 48 percent of HUD's IT workforce. Moreover, since then, HUD has
reduced its IT workforce by about 26 percent, and this reduction,
according to the Acting CIO, mostly affected persons with specialized
skills who operate and maintain existing systems and are difficult to
replace. According to OCIO officials, they plan to conduct an inventory
of IT workforce skills, as well as to participate in a follow-up to the
2006 governmentwide survey that is to begin in early 2010. However,
they did not have a plan or time frame for completing their own
inventory.
* The office developed a strategy for closing the gaps, including
steps, activities, and related milestones. However, the strategy is
based on the aforementioned unreliable gap analysis, and it has yet to
be implemented. OCIO officials did not know when implementation of this
strategy would begin or be completed. Aspects of this strategy not yet
implemented include developing and implementing performance metrics for
gauging HUD's IT project management capability by December 2008 and a
training plan for building its IT investment management capability by
January 2009.
OCIO officials cited various reasons for these weaknesses in its IT
human capital management, including the expense of conducting an
inventory of current IT workforce skills and limitations in resources
available to implement its strategy for closing its human capital gaps.
Without effective IT human capital management, it is unlikely that HUD
will have the people it needs to effectively operate and maintain
existing systems and to deliver modernized systems, thus impairing its
ability to provide the department's mission operations with effective
and efficient IT support.
HUD Has Yet to Develop Sufficient Architectural Context to Guide and
Manage Modernization Projects:
A key aspect of HUD's approach to modernizing its IT environment is to
extend its EA to include what are referred to as segment architectures,
which are to provide the modernization details needed to develop and
implement system solutions for portions, or segments, of a department
or agency. Such a "divide and conquer" approach to modernizing is
advocated by OMB. To this end, HUD has established a departmentwide EA
that largely satisfies relevant federal guidance, and it has identified
and prioritized 37 segments, as provided for in federal guidance.
However, it has only developed architectures for 8 of its segments, and
not all of these 8 are its highest priority segments. Moreover, the
majority of the segment architectures developed thus far are out of
date and do not fully address key aspects of federal guidance, such as
provisions for performance goals and measurement. At the same time, HUD
is investing in modernization projects in at least 3 of these segments
in fiscal year 2009. Unless HUD develops well-defined segment
architectures to guide and constrain modernization projects, it risks
investing time and resources in systems that do not reflect department
priorities, are not well integrated, are potentially duplicative, and
do not optimally support mission operations and performance.
The Department's EA Management Program Largely Satisfies Relevant
Guidance:
In August 2006,[Footnote 24] we reported that HUD had largely
established an EA program but was nevertheless missing two key aspects.
Since then, HUD has taken steps to address these aspects and additional
steps are planned. As noted earlier, our EA Management Maturity
Framework[Footnote 25] provides a five-stage approach to managing the
development, maintenance, and implementation of an architecture and
understanding the extent to which effective architecture management
practices are being performed and where an organization is progressing
toward having a well-managed architecture program. In short, the
framework consists of 31 core elements that relate to architecture
governance, content, use, and measurement. These elements reflect
research by us and others showing that architecture programs should be
founded upon institutional architecture commitment and capabilities,
and on measured and verified products and results. Satisfying the
framework's core elements helps organizations reduce the risk of
investing in IT assets that are duplicative, are not well-integrated,
and do not optimally support mission operations.
To HUD's credit, it had satisfied the vast majority of the core
elements described in our framework as of August 2006, as the following
examples illustrate:
* HUD established a committee or group representing the enterprise and
responsible for directing, overseeing, and approving the EA, and
thereby demonstrating the organization's commitment to obtaining buy-in
for the EA from across the organization, and providing vested ownership
and accountability for the EA and its use as a transformational tool at
the most senior levels of the organization.
* The department developed EA plans that called for describing the
enterprise in terms of business, performance, information/data,
application/service, technology, and security. Having such descriptions
is consistent with recognized frameworks governing EA content,
including OMB's EA "reference models." In short, these models
collectively provide for defining an enterprise's operations in both
business terms (e.g., business processes, business rules, information
needs and flows, shared business services, and work locations and
users) as well as technical terms (e.g., hardware, software, data, and
security attributes and standards).
* It measured and reported on the quality of its EA products, which is
important for informing senior leadership about EA progress and thus
providing a means for timely and appropriate actions to address
deviations from established goals.
* It established the EA as an integral part of the IT investment
management process, thus ensuring that the organization approves those
investments that move it toward the target architecture, as defined in
the sequencing plan.
* It developed the EA using a framework, methodology, and automated
tool, thereby helping to ensure that its architecture was developed
according to a defined structure and nomenclature, as well as explicit
and consistent steps, and that the architecture is captured in a
repository that is accessible and can be updated.
Nevertheless, we also reported that HUD had not addressed two important
elements. First, HUD had yet to adequately incorporate information
security into its EA. Since that time, HUD issued an Enterprise
Security Architecture in April 2007 that provides a target conceptual
framework for information protection. For example, it contains the
architecture's goals and objectives and generally (1) discusses
security drivers (e.g., external threats such as hackers and cyber
terrorists); (2) describes security governance (e.g., roles and
responsibilities of key players with references to HUD security policy,
standards, and guidelines); (3) identifies the purpose of the HUD
security concept of operations, planning, and risk management, noting
that each is resident in other HUD procedural and process guidance; and
(4) describes a target security environment (e.g., types of security
services and the security impact levels for categories of data).
In addition, HUD's Enterprise Security Architecture states that segment
architectures are to be the primary means of implementing its security
architecture, and thus the details surrounding how target concepts will
be implemented and achieved will be specified in these segment
architectures. Of the 8 HUD segment architectures developed to date,
each of which are discussed later in this report, only its single-
family housing segment architecture addresses information security,
while the others do not. According to HUD's Director of EA, security
will be addressed in the remaining segment architectures, as new ones
are developed and existing ones are updated. However, no schedule
exists defining when this will occur. Adequately incorporating security
into the EA and related segment architectures is important because
security is an integral aspect of an architecture's performance,
business, information/data, application/service, and technical models,
and needs to be reflected thoroughly and consistently across each of
them to ensure that new and existing investments meet the department's
information assurance needs.
Second, we also reported that HUD had yet to submit its EA products and
management processes to independent verification and validation. Since
that time, HUD developed an independent verification and validation
plan, and a HUD OCIO organization has reviewed three EA products,
including the Enterprise Security Architecture document. However, OCIO
officials told us independent verification and validation activities
were discontinued in 2007 because of resource limitations. As a result,
HUD continues to lack important information about the quality of its
architecture products and management processes that are needed to have
a mature EA program.
HUD Has Begun to Extend Its EA by Identifying and Prioritizing
Modernization Segments:
HUD is approaching its business modernization efforts through the
development of segment architectures, which can be viewed as subsets of
an EA or a bridge between the EA and IT investments. According to OMB
guidance,[Footnote 26] agencies should (1) define enterprise segments
as components of their EA planning activities and (2) prioritize
segments by focusing first on those that will help the agency perform
its mission most effectively. Further, it identifies three segment
types: core mission areas, business services (e.g., financial
management), and enterprise services (e.g., information sharing). It
also states that agencies (1) must have a structured process to
determine high-priority segments that is based on such factors as
statutory requirements, the agency's strategic plan and its IT
strategic plan, impact on mission performance, and cost efficiency
opportunities and (2) should initiate development of architectures for
high-priority segments after the CIO has approved segment priorities.
HUD's 2005 EA transition plan, which was approved by the TIBEC,
identifies, classifies, and prioritizes 37 segments. According to the
plan, the priorities were based on the following considerations:
business transformation impact, financial impact, impact on execution
of other high-priority transition activities, resource availability,
opportunities for early success, and the ability to leverage work in
progress. Further, the priorities were determined using a scale of 1 to
5, with 5 as the highest priority. (See table 5 for these priorities
and appendix II for descriptions of each segment.)
Table 5: Summary of HUD's Segments:
Type of segment: Core Mission Area;
Segment: Single-family housing;
Priority score: 3.7.
Type of segment: Core Mission Area;
Segment: Multifamily housing finance;
Priority score: 2.9.
Type of segment: Core Mission Area;
Segment: Rental housing assistance;
Priority score: 2.9.
Type of segment: Core Mission Area;
Segment: Community and economic development;
Priority score: 2.9.
Type of segment: Core Mission Area;
Segment: Fair housing;
Priority score: 2.5.
Type of segment: Core Mission Area;
Segment: Secondary mortgage market;
Priority score: 2.1.
Type of segment: Business Service;
Segment: Financial management;
Priority score: 4.6.
Type of segment: Business Service;
Segment: Controls and oversight;
Priority score: 4.4.
Type of segment: Business Service;
Segment: Human resources management;
Priority score: 3.7.
Type of segment: Business Service;
Segment: Grants management;
Priority score: 3.6.
Type of segment: Business Service;
Segment: Enforcement;
Priority score: 3.6.
Type of segment: Business Service;
Segment: Loan insurance;
Priority score: 3.5.
Type of segment: Business Service;
Segment: Planning and resource allocation;
Priority score: 2.9.
Type of segment: Business Service;
Segment: Information and technology management;
Priority score: 2.9.
Type of segment: Business Service;
Segment: Acquisition management;
Priority score: 2.5.
Type of segment: Business Service;
Segment: Internal risk management and mitigation;
Priority score: 2.1.
Type of segment: Business Service;
Segment: Public affairs;
Priority score: 2.1.
Type of segment: Business Service;
Segment: Administrative management;
Priority score: 2.1.
Type of segment: Business Service;
Segment: Subsidies management;
Priority score: 2.1.
Type of segment: Business Service;
Segment: Loan guarantees;
Priority score: 2.0.
Type of segment: Business Service;
Segment: Direct loans;
Priority score: 1.5.
Type of segment: Business Service;
Segment: Market research and analysis;
Priority score: 1.0.
Type of segment: Business Service;
Segment: Regulatory development;
Priority score: 1.0.
Type of segment: Business Service;
Segment: Legislative relations;
Priority score: 1.0.
Type of segment: Business Service;
Segment: Revenue collection;
Priority score: 1.0.
Type of segment: Enterprise Service;
Segment: Tracking and workflow;
Priority score: 4.4.
Type of segment: Enterprise Service;
Segment: Integrated enterprise data management;
Priority score: 4.0.
Type of segment: Enterprise Service;
Segment: Identity management;
Priority score: 4.0.
Type of segment: Enterprise Service;
Segment: Portal;
Priority score: 3.8.
Type of segment: Enterprise Service;
Segment: Electronic document and records management;
Priority score: 3.8.
Type of segment: Enterprise Service;
Segment: Business partner management;
Priority score: 3.8.
Type of segment: Enterprise Service;
Segment: Knowledge management/collaboration;
Priority score: 3.6.
Type of segment: Enterprise Service;
Segment: Reporting;
Priority score: 3.5.
Type of segment: Enterprise Service;
Segment: Asset management;
Priority score: 3.3.
Type of segment: Enterprise Service;
Segment: Survey;
Priority score: 2.9.
Type of segment: Enterprise Service;
Segment: Decision support/business intelligence;
Priority score: 2.6.
Type of segment: Enterprise Service;
Segment: Geospatial data management and analysis;
Priority score: 1.9.
Source: GAO analysis of HUD data.
[End of table]
Segment Architectures Have Not Been Developed According to Established
Priorities:
To date, HUD has developed 8 segment architectures. However, the 8
segments are not the department's 8 highest priorities (see table 6).
Specifically, HUD has developed an architecture for its highest
priority segment, financial management, but its next 4 highest segment
priorities (controls and oversight, tracking and workflow, integrated
enterprise data management, and identity management), each with
priority scores of 4.0 or above, do not yet have architectures.
Moreover, HUD has developed architectures for only 4 of the next 10
highest priority segments, each with scores between 3.5 and 4. At the
same time, it has developed architectures for 3 segments with priority
scores of less than 3.
Table 6: Status of HUD Segment Architectures:
Segment: Financial management;
Reported maturity of segment[A]: Completed;
Priority score: 4.6.
Segment: Controls and oversight;
Reported maturity of segment[A]: Notional[B];
Priority score: 4.4.
Segment: Tracking and workflow;
Reported maturity of segment[A]: Notional;
Priority score: 4.4.
Segment: Integrated enterprise data management;
Reported maturity of segment[A]: Notional;
Priority score: 4.0.
Segment: Identity management;
Reported maturity of segment[A]: Notional;
Priority score: 4.0.
Segment: Portal;
Reported maturity of segment[A]: Notional;
Priority score: 3.8.
Segment: Electronic document and records management;
Reported maturity of segment[A]: Completed;
Priority score: 3.8.
Segment: Business partner management;
Reported maturity of segment[A]: Notional;
Priority score: 3.8.
Segment: Single-family housing;
Reported maturity of segment[A]: Completed;
Priority score: 3.7.
Segment: Human resources management;
Reported maturity of segment[A]: Completed;
Priority score: 3.7.
Segment: Grants management;
Reported maturity of segment[A]: Completed;
Priority score: 3.6.
Segment: Enforcement;
Reported maturity of segment[A]: Notional;
Priority score: 3.6.
Segment: Knowledge management/collaboration;
Reported maturity of segment[A]: Notional;
Priority score: 3.6.
Segment: Loan insurance;
Reported maturity of segment[A]: Notional;
Priority score: 3.5.
Segment: Reporting;
Reported maturity of segment[A]: Notional;
Priority score: 3.5.
Segment: Asset management;
Reported maturity of segment[A]: Notional;
Priority score: 3.3.
Segment: Multifamily housing finance;
Reported maturity of segment[A]: Completed;
Priority score: 2.9.
Segment: Rental housing assistance;
Reported maturity of segment[A]: Completed;
Priority score: 2.9.
Segment: Community and economic development;
Reported maturity of segment[A]: Notional;
Priority score: 2.9.
Segment: Planning and resource allocation;
Reported maturity of segment[A]: Notional;
Priority score: 2.9.
Segment: Information and technology management;
Reported maturity of segment[A]: Planned;
Priority score: 2.9.
Segment: Survey;
Reported maturity of segment[A]: Notional;
Priority score: 2.9.
Segment: Decision support/business intelligence;
Reported maturity of segment[A]: Notional;
Priority score: 2.6.
Segment: Acquisition management;
Reported maturity of segment[A]: Completed;
Priority score: 2.5.
Segment: Fair housing;
Reported maturity of segment[A]: Notional;
Priority score: 2.5.
Segment: Secondary mortgage market;
Reported maturity of segment[A]: Notional;
Priority score: 2.1.
Segment: Internal risk management and mitigation;
Reported maturity of segment[A]: Notional;
Priority score: 2.1.
Segment: Public affairs;
Reported maturity of segment[A]: Notional;
Priority score: 2.1.
Segment: Administrative management;
Reported maturity of segment[A]: Notional;
Priority score: 2.1.
Segment: Subsidies management;
Reported maturity of segment[A]: Notional;
Priority score: 2.1.
Segment: Loan guarantees;
Reported maturity of segment[A]: Notional;
Priority score: 2.0.
Segment: Geospatial data management and analysis;
Reported maturity of segment[A]: Notional;
Priority score: 1.9.
Segment: Direct loans;
Reported maturity of segment[A]: Notional;
Priority score: 1.5.
Segment: Market research and analysis;
Reported maturity of segment[A]: Notional;
Priority score: 1.0.
Segment: Regulatory development;
Reported maturity of segment[A]: Notional;
Priority score: 1.0.
Segment: Legislative relations;
Reported maturity of segment[A]: Notional;
Priority score: 1.0.
Segment: Revenue collection;
Reported maturity of segment[A]: Notional;
Priority score: 1.0.
Source: GAO analysis of HUD documentation.
[A] OMB guidance on agency submission of segment architecture
information, Enterprise Architecture Segment Report Instruction Guide,
Version 1.1, February 2009, defines four segment maturity levels:
completed, in-progress, planned, or notional.
[B] Notional indicates that only a conceptual view of the segment
exists and that development of the segment is currently not planned.
[End of table]
OCIO's Director of EA stated that because IT funding has not been
available to develop segment architectures according to the established
priorities, HUD's development of segment architectures has been driven
by whether individual business units make funds available for their
respective segments. For example, even though acquisition management
ranks as 24th out of 37 in priority, it is one of the eight developed
architectures because the Office of the Chief Procurement Officer
provided funding for its development. According to the Director of EA,
HUD is currently developing a structured methodology for prioritizing
segments, and once this process is approved by the TIBWG and TIBEC, the
department will begin implementing it. Until the department begins
developing segment architectures in accordance with defined priorities,
it will increase the risk of investing limited IT resources in a manner
that does not reflect the department's priorities.
Segment Architectures Have Not Been Developed According to Key Aspects
of Federal Guidance:
The development and maintenance of the eight segment architectures do
not reflect key aspects of relevant federal guidance. According to
relevant guidance,[Footnote 27] a segment architecture is to be
developed and maintained by an integrated project team (IPT) that
consists of key stakeholders, such as a program manager, business
subject matter experts, and enterprise architects. In this regard, the
guidance states that this team is critical to successful segment
architecture development and should be involved in each step of
development process and responsible for making decisions relative to
defining business and technology requirements and achieving these
requirements. In addition to requiring an IPT, this guidance also
specifies the following key activities relative to analyzing and
developing each segment architecture:[Footnote 28]
* Prioritized opportunities--The IPT is to consider current change
drivers, such as key strategic, legislative, and management
requirements, to identify and prioritize opportunities to achieve
performance improvements within the context of the current operating
environment. These prioritized opportunities are to be used to define
the scope of the segment architecture and help the IPT make informed
decisions about the potential reuse of common or shared business
processes, data, and services.
* Performance goals--The IPT is to establish performance goals that
include target measures and time frames for achieving them. The
performance goals are to provide the basis for developing the
performance layer of the target segment architecture, and they are to
be reconciled with the agency EA and agency strategic plan to ensure
consistency. They are also to be used to determine the segment
performance gaps that need to be closed.
* Target architecture--The IPT is to develop a target segment
architecture that establishes the business, data, services, and
technology architecture layers to support the performance layer of the
architecture. The target architecture should, among other things,
describe the systems that are required, including those to be
consolidated. These targets are to be used by the IPT to develop the
segment transition strategy.
* Segment transition strategy--The IPT is to use the target segment
architecture to define the specific projects needed to close identified
performance gaps and achieve the target state. Among other things, the
strategy is to include project priorities, project dependencies, and
project sequencing. The IPT and the agency's Chief Architect are to
jointly reconcile the segment architecture and transition strategy with
the agency's EA to ensure consistency. The transition strategy is to be
used to prepare project funding strategies and business cases.
None of the eight segment architectures that HUD has developed
incorporates all of these key activities, with only one (acquisition
management) fully addressing most of the elements. The remaining seven
segment architectures fully address no more than two elements and
either partially address or did not address the others. (See table 7
for a summary of the extent to which the eight segment architectures
reflect OMB guidance.) The extent to which the eight reflect each of
the key activities is discussed in detail following the table.
Table 7: Summary of Extent to Which HUD Segment Architectures Address
OMB Guidance:
Segment architecture: Acquisition management;
Integrated project team: [A];
Prioritized opportunities: [A];
Performance goals: [B];
Target architecture: [A];
Segment transition strategy: [A].
Segment architecture: Electronic document and records management;
Integrated project team: [A];
Prioritized opportunities: [C];
Performance goals: [B];
Target architecture: [B];
Segment transition strategy: [C].
Segment architecture: Financial management;
Integrated project team: [A];
Prioritized opportunities: [B];
Performance goals: [Empty];
Target architecture: [B];
Segment transition strategy: [B].
Segment architecture: Grants management;
Integrated project team: [A];
Prioritized opportunities: [B];
Performance goals: [Empty];
Target architecture: [B];
Segment transition strategy: [B].
Segment architecture: Human resources management;
Integrated project team: [A];
Prioritized opportunities: [B];
Performance goals: [B];
Target architecture: [B];
Segment transition strategy: [C].
Segment architecture: Multifamily housing;
Integrated project team: [A];
Prioritized opportunities: [B];
Performance goals: [C];
Target architecture: [B];
Segment transition strategy: [B].
Segment architecture: Rental housing assistance;
Integrated project team: [A];
Prioritized opportunities: [C];
Performance goals: [B];
Target architecture: [C];
Segment transition strategy: [C].
Segment architecture: Single-family housing;
Integrated project team: [A];
Prioritized opportunities: [C];
Performance goals: [C];
Target architecture: [A];
Segment transition strategy: [C].
[A] Segment architecture addresses this element of the OMB guidance.
[B] Segment architecture addresses some, but not all aspects of this
element of the OMB guidance.
[C] Segment architecture does not address this element of the OMB
guidance.
Source: GAO analysis of HUD documentation.
[End of table]
* OCIO's Director of EA stated that all eight segment architectures
were developed by IPTs. However, two of the segment architectures
(financial management and human resources management) did not have
charters or any other form of documentation demonstrating that key
stakeholders were involved in developing the architectures.
* One of the segment architectures (acquisition management) identifies
and prioritizes opportunities for improvement, while four (financial
management, grants management, human resources management, and
multifamily housing) identify opportunities for improvement but do not
prioritize these opportunities. The remaining three do not identify
opportunities for improvement.
* None of the segment architectures identify performance goals and time
frames. While four (acquisition management, electronic records and
documents management, human resources management, and rental:
* housing assistance) have performance goals, none of the four include
time frames to achieve these goals. The remaining four do not establish
performance goals or time frames.
* Two of the segment architectures (acquisition management and single-
family housing) define their respective target states to be achieved,
while five others (electronic records and documents management,
financial management, grants management, human resources management,
and multifamily housing) partially define these targets. For example,
the grants management segment architecture identifies the systems
required in the target environment but does not address any impact to
existing systems. The rental housing assistance segment architecture
does not define any aspects of its target architecture in support of
the performance goals it identified.
* One segment architecture (acquisition management) has a complete
transition strategy, while three others (financial management, grants
management, and multifamily housing) have partial strategies. For
example, the financial management and grants management architectures
identify, prioritize, and sequence projects, and the multifamily
housing architecture identifies projects to be completed; however, none
of the three identify dependencies among projects. The remaining four
segment architectures do not identify any aspects of a transition
strategy.
The extent to which the majority of the eight segment architectures
reflect relevant federal guidance is attributable to the fact that the
architectures were developed prior to the issuance of federal guidance
(only the acquisition management architecture was developed after this
guidance was issued). Accordingly, in a June 2008 strategic portfolio
review,[Footnote 29] HUD recognized the need to update the segment
architectures to reflect relevant guidance.[Footnote 30] Moreover, this
review recognized that seven of the eight segment architectures (all
except acquisition management) were not current. For example, 4 of the
segment architectures are 4 or more years old (see table 8). According
to federal guidance,[Footnote 31] regular maintenance of segment
architectures is important to ensuring that they reflect the current
direction of the agency.
Table 8: Developed Segment Architectures and Year Completed:
Segment architecture: Rental housing assistance;
Year completed: 2004.
Segment architecture: Financial management;
Year completed: 2005.
Segment architecture: Human resources management;
Year completed: 2005.
Segment architecture: Single-family housing;
Year completed: 2005.
Segment architecture: Electronic document and records management;
Year completed: 2006.
Segment architecture: Grants management;
Year completed: 2006.
Segment architecture: Multifamily housing;
Year completed: 2006.
Segment architecture: Acquisition management;
Year completed: 2008.
Source: HUD.
[End of table]
The Director of EA said that, since June 2008, efforts have been
initiated to update one of the segment architectures--human resources
management. Specifically, the Director of EA said that an IPT is being
formed and will begin to update this segment architecture this summer.
However, the department did not have a plan to update the remaining
segment architectures.
The need to develop segment architectures that are complete and current
is significant because HUD currently has three major investments under
way in its financial management, rental housing assistance, and grants
management segments. In fiscal year 2009, these investments total about
$50 million in development as follows:
* Financial management--Approximately $27 million is being used to
develop a single core financial system that integrates the programmatic
and financial information of four existing financial systems.
* Rental housing assistance--Approximately $16 million is being used to
develop a system for HUD's rental housing assistance program to support
management of public housing assets.
* Grants management--Approximately $7 million is being used to develop
a system for HUD's grants programs to support the administration of
grants and the automation of redundant processes.
Until HUD's segment architectures are defined in accordance with
applicable federal guidance and kept current, they will not provide a
sufficient basis for guiding and directing segment projects in a manner
to ensure that both system enhancements and new development efforts
are, among other things, properly sequenced, well integrated, and not
duplicative.
HUD Has Yet to Assign Responsibility and Accountability for
Modernization Management:
Effective systems modernization requires a structured management
approach, to include clearly defined and assigned responsibility and
accountability for enterprisewide modernization management. Our
experience in reviewing large-scale system modernization programs in
other federal departments and agencies, such as the Internal Revenue
Service[Footnote 32] and Department of Defense,[Footnote 33] shows that
this often involves, among other things, establishing a modernization
program management office. In addition, independent research recommends
establishing a modernization management office before attempting an
enterprisewide modernization effort.[Footnote 34] According to this
research, this type of office brings structure and support to
evaluating, justifying, defining, planning, tracking, and executing an
IT modernization effort, and it facilitates interaction among senior
leaders, program managers, and project managers.
To HUD's credit, its EA transition plan identifies the need for an
Enterprise Program Management Office (EPMO) to manage its modernization
projects, calling this office a critical success factor to delivering
modernized systems. Specifically, the plan states that the size and
complexity of the department's modernization efforts will introduce a
paradigm shift and that this office is a "foundational enabler" to
these efforts and would, among other things, ensure that independent
segments are pursued in an integrated manner.
To date, the department has not established its EPMO and thus has not
assigned responsibility and authority for management of its
modernization efforts. While OCIO has identified a range of functions
that this office would need to perform, such as establishing a
systematic, standardized, repeatable process for management of IT
projects across the enterprise, and included these responsibilities as
a contract task in an existing contract awarded in August 2007, OCIO
officials told us that this EPMO task was not executed due to funding
constraints. These officials also stated that alternative contract
solutions to meeting the department's EPMO needs will be examined.
However, they did not have a plan defining how and when this would
occur, stating that it is dependent on funding available in fiscal year
2010. Without an EPMO, HUD will be challenged in its ability to
successfully deliver modernized systems.
Conclusions:
HUD's ability to effectively and efficiently perform mission-critical
operations, including those integral to our nation's economic recovery
and reinvestment activities, is constrained by its current IT
environment. To overcome these limitations and maximize IT support to
HUD programs, such as those that involve home mortgages and provide
rental assistance, it is essential for the department to have the
capability and capacity to manage both its existing IT environment and
its ongoing and future IT modernization efforts. Currently, it does
not, as evidenced by limitations in a number of core IT controls that
are instrumental to managing both an organization's existing IT
environment and its IT modernization efforts. In particular, HUD is not
effectively measuring whether it is meeting its IT goals and, as a
result, is not in compliance with a statutory requirement. HUD is also
not adequately controlling its IT investment portfolios to ensure that
they optimally deliver mission capabilities and value and is not taking
key steps to ensure that it has an adequate workforce to both operate
and maintain its existing systems and to deliver modernized systems.
Moreover, it has not ensured that modernization projects are governed
by well-defined segment architectures and that responsibility and
accountability for enterprisewide modernization management has been
assigned.
To HUD's credit, it is aware of the need to improve many of these IT
management controls, but its IT resources have in recent years been
almost exclusively directed to sustaining its existing IT environment,
and it has yet to develop specific plans for strengthening each of
these management controls. Given the recent increase in modernization
resources available this year and, with further increases envisioned
for future years, it is important that building this capability and
capacity be treated as a department priority. Until HUD establishes
effective and mature structures, processes, practices, and tools for
managing IT, it will be challenged in its ability to effectively
modernize its IT environment and thus provide IT support to critical
mission operations.
Recommendations for Executive Action:
To ensure that HUD has an IT environment that effectively and
efficiently supports its mission operations, we recommend that the
Secretary of Housing and Urban Development ensure that recent and
anticipated increases in IT resources be allocated to strengthening
each of the IT management controls discussed in this report.
To these ends, we further recommend that the Secretary take the
following five actions:
1. Direct the CIO to develop a plan for developing and implementing the
department's new performance management framework, including an
implementation schedule of key activities and related resource needs,
and to ensure that this plan provides for complying with the statutory
requirement for annual reporting of progress in achieving IT strategic
goals.
2. Direct the Deputy Secretary, as the TIBEC chairperson, to develop
and implement a plan to address the IT portfolio investment management
weaknesses that we identified. This plan should address the following:
a. instituting policies and procedures for reviewing, evaluating, and
improving the performance of the department's portfolio of investments;
b. establishing resources for reviewing the investment portfolio,
including people, funding, and tools and ensuring board members are
familiar with the process for evaluating and improving portfolio
performance;
c. developing criteria for assessing portfolio performance and
reviewing and modifying them at regular intervals to reflect current
performance expectations;
d. defining and collecting IT portfolio performance measurement data
consistent with the portfolio performance criteria; and:
e. executing adjustments to the IT investment portfolio in response to
actual portfolio performance.
3. Direct the CIO to establish and execute IT human capital gap closure
strategies that are based on a complete and current inventory of its
existing IT workforce skills.
4. Direct the Deputy Secretary, as the TIBEC chairperson, to:
a. report to the Secretary on actions planned to address our prior EA
recommendations on defining a security architecture and performing
independent verification and validation, and:
b. develop a plan for reexamining segment priorities and updating and
developing segment architectures in accordance with these priorities
and relevant guidance.
5. Direct the CIO to establish an enterprisewide program office with
the responsibility and authority for managing the department's
modernization efforts.
Agency Comments and Our Evaluation:
In written comments on a draft of our report signed by the Deputy Chief
Information Officer, the department agreed with our recommendations,
adding that it will dedicate resources to implementing each of them. In
addition, it provided largely technical comments to clarify, correct,
or update information in the report, which we have incorporated in the
report as appropriate, and address more specifically in appendix III.
However, it also offered a comment relative to our finding that HUD's
segment architectures do not include performance goals, stating that
such segment performance goals are updated each year in HUD's
performance architecture, and major investment performance goals are
provided in its annual budget submissions. We agree with this comment.
However, the point of our finding is that the segment architectures
themselves do not include performance goals and related time frames, as
required by OMB guidance. As a result, we have not modified our report
to reflect this comment.
We are sending copies of this report to interested congressional
committees; and the Secretary of Housing and Urban Development. The
report also is available at no charge on the GAO Web site at
[hyperlink, http://www.gao.gov].
If you or your offices have questions on matters discussed in this
report, please contact me at (202) 512-3439 or at hiter@gao.gov.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. GAO staff who
made key contributions to this report are listed in appendix IV.
Signed by:
Randolph C. Hite:
Director:
Information Technology Architecture and Systems Issues:
[End of section]
Appendix I: Objective, Scope, and Methodology:
Our objective was to determine if the Department of Housing and Urban
Development (HUD) has adequately established institutional information
technology (IT) management controls needed to manage and modernize its
existing IT environment. To meet this objective, we focused on the
following management controls: IT strategic planning and performance
measurement; portfolio-based IT investment management; IT human capital
management; architecture development and use; and responsibility and
accountability for modernization management.
* To evaluate HUD's IT strategic planning and performance measurement,
we reviewed HUD's agencywide strategic plan and its IT strategic plans,
its IT strategic implementation plan, and available assessments of its
progress in achieving IT strategic goals. We also interviewed HUD
officials including the Office of the Chief Information Officer's
(OCIO) Strategic Planner. We assessed this information against
provisions in the Clinger-Cohen Act[Footnote 35] and Paperwork
Reduction Act[Footnote 36] related to defining IT strategic goals and
plans, assessing progress toward achieving IT strategic goals, and
measuring performance of IT operations.
* To evaluate HUD's IT investment management (ITIM) practices
associated with portfolio management, we used GAO's ITIM framework
[Footnote 37] and assessed the extent to which HUD had established the
policies and procedures needed to effectively manage its investments as
a portfolio, as well as the key practices needed to control its
portfolio (practices specific to the evaluating the portfolio critical
process of Stage 3). To conduct our assessment, we reviewed relevant
HUD policies, procedures, guidance, and documentation--including HUD's
investment management guide, related process guides, such as its ITIM
select guide, postimplementation review guide, investment board
charters, budget documents, and project reviews and presentations. We
also interviewed HUD's Director of ITIM and the Associate Deputy Chief
Information Officer for Business and Information Technology
Modernization. We then compared this information with the selected key
practices in the ITIM framework to determine the extent to which the
department was employing effective IT investment portfolio management
practices. We rated ITIM key practices as "executed" on the basis of
whether the agency demonstrated (by providing evidence of performance)
that it had fully met the criteria of the key practice. A key practice
was rated as "not executed" when we found insufficient evidence of a
practice during the review or when we determined that there were
significant weaknesses in HUD's execution of the key practices. We
provided HUD an opportunity to produce evidence for the key practices
that we rated as "not executed."
* To evaluate HUD's IT human capital management, we reviewed IT human
capital management plans and related documentation, such as a workforce
needs assessment, gap analyses, and gap closure strategies. We also
interviewed HUD officials, including the Office of CIO's Director of
Administrative Services. We assessed this information against strategic
workforce planning principles established in prior GAO work.[Footnote
38]
* To evaluate HUD's enterprise architecture (EA) development and use,
we relied on our previous report on HUD's EA,[Footnote 39] updating
this report relative to two weaknesses that we reported--security in
its EA and independent verification and validation of EA products and
management processes. To do so, we reviewed HUD EA work products,
including security and independent verification and validation plans
and products. In addition, we reviewed EA transition plans, segment
architectures, performance architecture, and segment architecture
development guidance, and interviewed officials. We assessed this
information against relevant criteria in federal guidance, such as the
Office of Management and Budget's (OMB) Federal Enterprise Architecture
Practice Guidance[Footnote 40] and its EA assessment framework,
[Footnote 41] and best practices in GAO's EA Framework.[Footnote 42]
Specific to segment architecture development, we assessed the extent to
which HUD's segment architectures addressed elements of segment
development guidance in OMB's Federal Enterprise Architecture Practice
Guidance. Specifically, we determined the extent to which segment
architectures addressed the element (addresses all aspects of the
element); partially addressed the element (addresses some, but not all
aspects of the element); or did not address the element (does not
address any aspect of the element).
* To evaluate HUD's modernization management office, we reviewed
published reports[Footnote 43] and research on having such an office
[Footnote 44] and HUD plans for establishing this office, including EA
transition plans and an acquisition contract for program management
support. We also interviewed the Associate Deputy CIO for Business and
Information Technology Modernization, the Director of Enterprise
Architecture, and the Director of Information Technology Systems
Integration and Efficiency. We assessed this information to determine
the extent to which HUD had established responsibility and
accountability for modernization management.
We conducted this performance audit from July 2008 to July 2009, in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
[End of section]
Appendix II: Descriptions of HUD Segment Architectures:
Table 9 provides descriptions of segment architectures as identified by
HUD.
Table 9: Descriptions of HUD Segment Architectures:
Type of segment: Core Mission Area;
Segment: Single-family housing;
Description: Provides mortgage insurance to lenders on loans for the
development/purchase/refinancing of new or existing homes,
condominiums, and manufactured housing; financing of houses needing
rehabilitation; and for reverse mortgages to elderly homeowners.
Type of segment: Core Mission Area;
Segment: Multifamily housing finance;
Description: Provides mortgage insurance to HUD-approved lenders to
facilitate the construction, rehabilitation, purchase, and refinancing
of multifamily housing properties and health care facilities.
Type of segment: Core Mission Area;
Segment: Rental housing assistance;
Description: The processes, systems, and technologies that allow HUD to
provide decent and affordable rental housing to low-income families,
primarily through the use of grants and subsidies.
Type of segment: Core Mission Area;
Segment: Community and economic development;
Description: Supports efforts by states, local communities, and other
HUD partners for the construction and rehabilitation of homes,
community structures and infrastructure, and other community
revitalization and job creating projects.
Type of segment: Core Mission Area;
Segment: Fair housing;
Description: Promotes, monitors, and enforces fair and equal housing
opportunities, practices, and laws, respectively. In addition, it
equips HUD with the capabilities to develop policies and introduce
legislation that ensure equal access to housing.
Type of segment: Core Mission Area;
Segment: Secondary mortgage market;
Description: Promotes homeownership by managing programs responsible
for channeling funds from investors into the mortgage industry, thereby
establishing a secondary mortgage market that creates an abundant
supply of mortgage funds for potential homeowners.
Type of segment: Business Service;
Segment: Financial management;
Description: Enables HUD to manage its financial control activities and
the flow of financial information across its information systems.
Type of segment: Business Service;
Segment: Controls and oversight;
Description: Type of segment: Allows HUD to maintain close oversight
for the programs and funds for which it is responsible, including the
performance management of its highly distributed business partners.
Type of segment: Business Service;
Segment: Human resources management;
Description: Allows the management of human resources across HUD to
ensure that HUD employees are used in the most effective manner
possible.
Type of segment: Business Service;
Segment: Grants management;
Description: Type of segment: The activities, processes, systems, and
technologies that support the administration and management of grants
programs to develop fair, safe, and affordable housing and to expand
economic opportunity.
Type of segment: Business Service;
Segment: Enforcement;
Description: Involves monitoring HUD partners, the general housing
industry, and individuals subject to housing laws or regulations, and
resolving issues through conciliation, arbitration, and enforcement.
Type of segment: Business Service;
Segment: Loan insurance;
Description: Involves the provision of loan insurance for the financing
of property improvement, manufactured housing, and community
development projects.
Type of segment: Business Service;
Segment: Planning and resource allocation;
Description: Enables HUD to determine its strategic direction, identify
and establish its programs and processes, and allocate resources
(capital and labor) among these programs and processes.
Type of segment: Business Service;
Segment: Information and technology management;
Description: Enables HUD to properly orchestrate the information
technology resources (i.e., hardware and infrastructure) and systems it
requires to effectively provide its services and execute its mission.
Type of segment: Business Service;
Segment: Acquisition management;
Description: Allows HUD to effectively manage the physical goods and
contracted services it acquires in support of delivering its services
and executing its programs. This includes the capability to manage the
private sector contractors that perform much of its outsourced work.
Type of segment: Business Service;
Segment: Internal risk management and mitigation;
Description: Permits HUD to analyze its exposure to risk and develop
appropriate mitigation and countermeasure strategies.
Type of segment: Business Service;
Segment: Public affairs;
Description: Enables HUD to effectively communicate with and exchange
information between its stakeholders, business partners, citizens, and
other government entities in direct support of its programs, services,
and policies.
Type of segment: Business Service;
Segment: Administrative management;
Description: Enables HUD to perform many of the back-office type
activities that support the execution of its primary, mission-critical
business operations.
Type of segment: Business Service;
Segment: Subsidies management;
Description: Encompasses the activities associated with the provision
of vouchers and other types of subsidies to individuals and public
housing bodies in support of rental assistance, housing modernization,
and home ownership.
Type of segment: Business Service;
Segment: Loan guarantees;
Description: Encompasses activities to provide liquidity to the
secondary mortgage market by attracting capital from the nation's
capital markets to residential mortgage markets.
Type of segment: Business Service;
Segment: Direct loans;
Description: Type of segment: Activities associated with HUD lending
funds directly to nongovernmental entities for affordable housing, home
ownership, and community development activities.
Type of segment: Business Service;
Segment: Market research and analysis;
Description: Type of segment: Allows HUD to perform the research and
analysis of housing markets, industry trends, community needs,
demographics, legislation, policies, programs, and the economy.
Type of segment: Business Service;
Segment: Regulatory development;
Description: Type of segment: Allows HUD to perform activities
associated with developing regulations, policies, and guidance to
implement laws.
Type of segment: Business Service;
Segment: Legislative relations;
Description: Enables HUD to perform activities aimed at the
development, tracking, and amendment of public laws by effectively
communicating and managing its relationship with Congress.
Type of segment: Business Service;
Segment: Revenue collection;
Description: Provides HUD with capabilities to acquire, monitor, track,
and sell its housing properties (e.g., land, multifamily buildings, and
single-family homes) to nongovernmental entities.
Type of segment: Enterprise Service;
Segment: Tracking and workflow;
Description: Defines the set of capabilities for automatic monitoring
and routing of documents to the users responsible for working on them
to support each step of the business cycle.
Type of segment: Enterprise Service;
Segment: Integrated enterprise data management;
Description: Type of segment: Defines the set of capabilities that
support the usage, processing, and general administration of
unstructured information.
Type of segment: Enterprise Service;
Segment: Identity management;
Description: Includes capabilities that support obtaining information
about those parties attempting to log on to a system or application for
security purposes and includes validation of those users.
Type of segment: Enterprise Service;
Segment: Portal;
Description: Type of segment: Allows HUD's business partners, citizens,
and internal users the ability to conveniently and efficiently interact
with HUD via a single electronic interface.
Type of segment: Enterprise Service;
Segment: Electronic document and records management;
Description: Enables HUD to effectively manage all of its documents and
records in a consistent, legal, and logical manner, from creation to
final disposition, using a common set of tools, standards and policies.
Type of segment: Enterprise Service;
Segment: Business partner management;
Description: Enables HUD to effectively manage and control its
communications and information about internal/external customers and
clients and vendors and further provide holistic coordination with its
program participants (e.g., business partners).
Type of segment: Enterprise Service;
Segment: Knowledge management/collaboration;
Description: Type of segment: Defines the set of capabilities that
support the identification, gathering, and transformation of documents,
reports, and other sources into meaningful information.
Type of segment: Enterprise Service;
Segment: Reporting;
Description: Type of segment: Defines the set of capabilities that
support the organization of data into useful information.
Type of segment: Enterprise Service;
Segment: Asset management;
Description: Type of segment: Defines the set of capabilities that
support the acquisition, oversight, and tracking of an organization's
assets.
Type of segment: Enterprise Service;
Segment: Survey;
Description: The set of capabilities that are used to collect useful
information from an organization's customers.
Type of segment: Enterprise Service;
Segment: Decision support/business intelligence;
Description: Defines the set of capabilities that support the analysis
of information and predicts the impact of decisions before they are
made.
Type of segment: Enterprise Service;
Segment: Geospatial data management and analysis;
Description: Integrates geospatial and geographic information services
with data management and analytical capabilities to provide users with
the ability to capture, view, and analyze programmatic information
based on location and associated characteristics.
Source: GAO analysis of HUD documentation.
[End of table]
[End of section]
Appendix III: Comments from the Department of Housing and Urban
Development:
Note: GAO comments supplementing those in the report text appear at the
end of this appendix.
U.S. Department Of Housing And Urban Development:
Chief Information Officer:
Washington, D.C. 20410-3000:
[hyperlink, http://www.hud.gov]
July 22, 2009:
Mr. James R. Sweetman, Jr.
Assistant Director:
Information Technology:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Mr. Sweetman:
Thank you for the opportunity to comment on the Government
Accountability Office (GAO) draft report entitled, Information
Technology: HUD Needs to Strengthen its Capacity to Manage and
Modernize its Environment (GAO-09-675).
The Department of Housing and Urban Development reviewed the draft
report and concurs with the recommendations for Executive Actions. I
note GAO's acknowledgement that the Department has established key IT
management and modernization controls needed to ensure that the IT
environment maintains mission-critical operations and that HUD's
efforts to modernize have been successful.
However, HUD provides the following comments to address sections in the
draft report found to be inaccurate or ambiguous. I invite your
attention to strengthening these sections:
Page 7 - states that, "According to OCIO officials, of the
approximately $61 million made available for IT under this act, about
$13 million will be spent on the development of a new system supporting
reporting requirements mandated by the act, while the remainder is
planned to be used to maintain or enhance existing systems. " This
statement is inaccurate. HUD is developing one new system to support
the American Recovery and Reinvestment Act (ARRA). The funding amount
for that system, the Recovery Act Management and Performance System
(RAMPS), is $1.5 million. The $61 million ARRA Administrative/IT set-
aside is spread among several HUD program areas, including the Office
of the Chief Information Officer (OCIO). [See comment 1]
Page 9 -The HUD OCIO Organizational Chart (Figure 2) is out-of-date.
The current OCIO Organizational Chart is enclosed. [See comment 2]
Page 10 - The Overview of the Department's IT Environment leads with
the assertion that "HUD's current IT environment is not sufficient to
support its ongoing business operations," this assertion is attributed
to "the Department's own reports." Please clarify what report(s)
contain this claim. Only one general citation is provided at the end of
the section. The referenced report is a Gartner Consulting report, 1T
Application Support and Strategic Sourcing Review: Baseline Total Cost
of Ownership and Benchmark, March 2007. Gartner's report recognizes the
challenges HUD faces, including system and business process complexity
and the unclear alignment with key business processes. However,
Gartner's report does not claim that HUD's IT environment cannot
support business operations. [See comment 3]
Page 18 - 2nd paragraph. Comment: As a point of clarification, HUD's
OCIO has begun the process of assessing performance in a more robust
way with the development of the Performance Architecture within the
Enterprise Architecture (EA) modernization plan. HUD began this
activity in Fiscal Year (FY) 2009. [See comment 4]
Page 24 - second bullet: A point of clarification - OCIO officials plan
to conduct their own inventory of IT workforce skills analysis and
intend to participate in a follow-up governmentwide IT workforce
inventory effort. This governmentwide survey is scheduled to begin in
early 2010. [See comment 5]
Page 25 - bottom paragraph, Comment: Performance goals and measurements
are identified in the Performance Architecture that HUD updates
annually for segments and/or major investments. Additionally, through
the OMB 300 process, all of HUD's major investments identify and update
performance goals and measurements annually. [See comment 6]
Page 35 - 2nd bullet, Comment: This paragraph is inaccurate. HUD
updates all of its performance goals and time frames, annually, in the
Performance Architecture and in the OMB 300 process. [See comment 7]
The Department remains committed to strengthening existing IT
management and modernization controls through its policies and
procedures. To this end, we will dedicate resources toward achieving
the five Executive Actions recommended by GAO. More definitive
information with timelines will he provided once the final report has
been issued.
If you have any questions or require additional information, please
contact Jerry E. Williams. Chief Information Officer, at 202-708-0306.
Sincerely,
Lynn Allen:
Deputy, Chief Information Officer:
The following are GAO's comments on the Department of Housing and Urban
Development dated July 22, 2009.
GAO Comments:
1. We revised our report to reflect this comment.
2. We revised our report to reflect HUD's current OCIO organizational
structure.
3. We clarified our report by explicitly identifying the HUD reports
that cite the limitations in HUD's IT environment.
4. We clarified our report to reflect this comment.
5. We clarified our report to reflect this comment.
6. We agree that performance goals are identified in HUD's performance
architecture relative to segments and are included in budget
submissions to OMB for HUD's major investments. However, our point is
that the performance goals and related time frames are not included in
the segment architectures. According to federal guidance, the
establishment of performance goals and time frames for achieving these
goals is to occur during the development of a segment architecture, and
thereby provide the basis for the goals in the performance architecture
and budget submissions. Therefore, we have not modified our report in
response to this comment.
7. See comment 6.
[End of section]
Appendix IV: GAO Contact and Staff Acknowledgments:
GAO Contact:
Randolph C. Hite, (202) 512-3439, hiter@gao.gov:
Staff Acknowledgments:
In addition to the individual named above, key contributions were made
to this report by James Sweetman, Assistant Director; Jamey Collins;
Eric Costello; Kristin English; Michael Holland; Lowell Labaro; Anh Le;
Lee McCracken; Sabine Paul; and Glenn Spiegel.
[End of section]
Footnotes:
[1] Title II of Div. K of the Consolidated Appropriations Act, 2008,
Pub. L. No. 110-161.
[2] Title VIII of the Civil Rights Act of 1968 (Fair Housing Act), as
amended, prohibits discrimination in the sale, rental, and financing of
dwellings, and in other housing-related transactions, based on race,
color, national origin, religion, sex, familial status (including
children under the age of 18 living with parents or legal custodians,
pregnant women, and people securing custody of children under the age
of 18), and handicap (disability).
[3] Title VI of the Civil Rights Act of 1964 prohibits discrimination
on the basis of race, color, or national origin in programs and
activities receiving federal financial assistance.
[4] Under the U. S. Housing Act of 1937, as amended, Congress created
the federal public housing program to provide decent and safe rental
housing for eligible low-income families, the elderly, and persons with
disabilities.
[5] Pub. L. No. 110-289, Sec. 2126.
[6] This system is known as the Recovery Act Management and Performance
System (RAMPS). It is to allow HUD to transmit to the American Recovery
and Reinvestment Act Web site [hyperlink, http://www.recovery.gov]
information related to HUD projects that are funded by the act.
[7] 42 U.S.C. § 3535(f) establishes the working capital fund at HUD.
[8] 40 U.S.C. §§ 11313(1), (2), and (3). See also 44 U.S.C. §
3506(b)(3)(C).
[9] GAO, Information Technology Investment Management: A Framework for
Assessing and Improving Process Maturity, GAO-04-394G (Washington,
D.C.: March 2004).
[10] 40 U.S.C. §§ 11312-11313.
[11] GAO, Information Technology: A Framework for Assessing and
Improving Enterprise Architecture Management (Version 1.1), [hyperlink,
http://www.gao.gov/products/GAO-03-584G] (Washington, D.C.: April
2003).
[12] OMB, Federal Enterprise Architecture Practice Guidance (November
2007); OMB, Improving Agency Performance Using Information and
Information Technology (Enterprise Architecture Assessment Framework
v3.0) (December 2008); and Federal Segment Architecture Working Group
and OMB, Federal Segment Architecture Methodology (January 2009).
[13] 40 U.S.C. § 11313(1). See also 44 U.S.C. § 3506(b)(3)(C).
[14] 40 U.S.C. § 11313(2).
[15] 40 U.S.C. § 11313(3). See also 44 U.S.C. § 3506(b)(3)(C).
[16] HUD, Information Technology Strategic Planning Process Guide (Apr.
26, 2005).
[17] 40 U.S.C. § 11313.
[18] [hyperlink, http://www.gao.gov/products/GAO-04-394G].
[19] GAO, Best Practices: An Integrated Portfolio Management Approach
to Weapon System Investments Could Improve DOD's Acquisition Outcomes,
[hyperlink, http://www.gao.gov/products/GAO-07-388] (Washington, D.C.:
Mar. 30, 2007).
[20] The exhibit 300, also known as the Capital Asset Plan and Business
Case, is an OMB budget submission intended to, among other things,
demonstrate that a given IT investment is employing good project
management, is architecturally aligned, and is economically justified.
[21] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-01-263] (Washington, D.C.: January
2001).
[22] GAO, Human Capital: Key Principles for Effective Strategic
Workforce Planning, [hyperlink, http://www.gao.gov/products/GAO-04-39]
(Washington, D.C.: Dec. 11, 2003).
[23] The results of this survey are published by the Office of Personal
Management and the Federal Chief Information Officer's Council in the
Federal IT Workforce Survey (2006) Data Analysis Report: Information
for Human Capital Planning.
[24] GAO, Enterprise Architecture: Leadership Remains Key to
Establishing and Leveraging Architectures for Organizational
Transformation, [hyperlink, http://www.gao.gov/products/GAO-06-831]
(Washington, D.C.: Aug. 14, 2006).
[25] [hyperlink, http://www.gao.gov/products/GAO-03-584G].
[26] OMB, Improving Agency Performance Using Information and
Information Technology (Enterprise Architecture Assessment Framework
3.0) (December 2008); OMB, Federal Enterprise Architecture Practice
Guidance (November 2007).
[27] OMB, Federal Enterprise Architecture Practice Guidance (November
2007).
[28] OMB's guidance provides key activities relative to the following
four major steps (1) architecture analysis, (2) architecture
definition, (3) investment and funding strategy, and (4) program
management and execution.
[29] This review focuses on the extent to which major IT investments
align with HUD's target architecture.
[30] In October 2007, HUD updated its Business and IT Modernization
Plan Development Guidance, which addresses the activities called for in
federal guidance.
[31] CIO Council, A Practical Guide to Federal Enterprise Architecture
(February 2001).
[32] GAO, Tax Systems Modernization: Results of Review of IRS' March 7,
2000 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO/AIMD-00-175] (Washington, D.C.: May 24,
2000).
[33] GAO, Defense Management: Foundational Steps Being Taken to Manage
DOD Business Systems Modernization, but Much Remains to be Accomplished
to Effect True Business Transformation, [hyperlink,
http://www.gao.gov/products/GAO-06-234T] (Washington, D.C.: Nov. 9,
2005).
[34] Organize to Modernize: The Roles Project Management Offices Can
Play in IT Modernization, [hyperlink, http://www.gartner.com/], ID
Number: G00157601 (May 23, 2008).
[35] 40 U.S.C. §§ 11313(1), (2), and (3).
[36] 44 U.S.C. § 3506(b)(3)(C).
[37] [hyperlink, http://www.gao.gov/products/GAO-04-394G].
[38] [hyperlink, http://www.gao.gov/products/GAO-04-39].
[39] [hyperlink, http://www.gao.gov/products/GAO-06-831].
[40] OMB, Federal Enterprise Architecture Practice Guidance (November
2007).
[41] OMB, Improving Agency Performance Using Information and
Information Technology (Enterprise Architecture Assessment Framework
v3.0) (December 2008).
[42] GAO, Information Technology: A Framework for Assessing and
Improving Enterprise Architecture Management (Version 1.1), [hyperlink,
http://www.gao.gov/products/GAO-03-584G] (Washington, D.C.: Apr. 1,
2003).
[43] GAO, Defense Management: Foundational Steps Being Taken to Manage
DOD Business Systems Modernization, but Much Remains to be Accomplished
to Effect True Business Transformation, [hyperlink,
http://www.gao.gov/products/GAO-06-234T] (Washington, D.C.: Nov. 9,
2005); Tax Systems Modernization: Results of Review of IRS' March 7,
2000 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO/AIMD-00-175] (Washington, D.C.: May 24,
2000).
[44] Gartner Group,Organize to Modernize: The Roles Project Management
Offices Can Play in IT Modernization, [hyperlink,
http://www.gartner.com/], ID Number: G00157601 (May 23, 2008).
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
