Information Technology

FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program's Human Capital Is Needed Gao ID: GAO-07-19 October 16, 2006

The Federal Bureau of Investigation (FBI) recently began a 6-year, $425 million program called Sentinel to replace and expand on both its failed Virtual Case File (VCF) project and its antiquated, paper-based, legacy system for supporting mission-critical intelligence analysis and investigative case management activities. Because of the FBI's experience with VCF and the importance of Sentinel, GAO was requested to address a number of program management issues associated with acquiring Sentinel via a prime development contractor. This report focuses on one of these issues: whether the FBI is adequately providing for the program's human capital needs. The findings are based on GAO's review of relevant program documentation, interviews with program officials, and human capital management guidance.

To its credit, the FBI has moved quickly to staff its Sentinel program office. During the last year, it created a staffing plan for Sentinel, which defines the positions needed for the program, and it has filled most of the positions in the plan, primarily by using contract staff (77 percent). However, a few key program management positions remain to be filled. More importantly, the Sentinel staffing plan addresses only the program office's immediate staffing needs. It does not provide for the kind of strategic human capital management focus that GAO's research and evaluations have shown to be essential to the success of any organizational entity. For example, the staffing plan was not derived using a documented, data-driven methodology and does not provide for inventorying the knowledge and skills of existing staff, forecasting future knowledge and skill needs, analyzing gaps in capabilities between the existing staff and future workforce needs, (including consideration of expected succession needs), and formulating strategies for filling expected gaps. Exacerbating this situation is that the FBI is not proactively managing Sentinel human capital availability as a program risk; it has not included human capital in the program's risk inventory nor has it developed and implemented a proactive risk mitigation strategy, even though program documents cite human capital as both a challenge and a risk. According to program officials, they plan to manage their human capital needs in the same way as when they initially staffed the program office, in part because the bureau's IT system life cycle management policies and procedures do not require them to do otherwise. Unless the FBI adopts a more strategic approach to managing human capital for the Sentinel program and treats human capital as a program risk, the chances of delivering required intelligence and investigative support capabilities in a timely and cost-effective manner are reduced.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone:


GAO-07-19, Information Technology: FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program's Human Capital Is Needed This is the accessible text file for GAO report number GAO-07-19 entitled 'Information Technology: FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program's Human Capital Is Needed' which was released on October 17, 2006. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Committee on the Judiciary, House of Representatives: United States Government Accountability Office: GAO: October 2006: Information Technology: FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program's Human Capital Is Needed: Information Technology: GAO-07-19: GAO Highlights: Highlights of GAO-07-19, a report to Committee on the Judiciary, House of Representatives Why GAO Did This Study: The Federal Bureau of Investigation (FBI) recently began a 6-year, $425 million program called Sentinel to replace and expand on both its failed Virtual Case File (VCF) project and its antiquated, paper-based, legacy system for supporting mission-critical intelligence analysis and investigative case management activities. Because of the FBI‘s experience with VCF and the importance of Sentinel, GAO was requested to address a number of program management issues associated with acquiring Sentinel via a prime development contractor. This report focuses on one of these issues: whether the FBI is adequately providing for the program‘s human capital needs. The findings are based on GAO‘s review of relevant program documentation, interviews with program officials, and human capital management guidance. What GAO Found: To its credit, the FBI has moved quickly to staff its Sentinel program office. During the last year, it created a staffing plan for Sentinel, which defines the positions needed for the program, and it has filled most of the positions in the plan, primarily by using contract staff (77 percent). However, a few key program management positions remain to be filled. More importantly, the Sentinel staffing plan addresses only the program office‘s immediate staffing needs. It does not provide for the kind of strategic human capital management focus that GAO‘s research and evaluations have shown to be essential to the success of any organizational entity. For example, the staffing plan was not derived using a documented, data-driven methodology and does not provide for inventorying the knowledge and skills of existing staff, forecasting future knowledge and skill needs, analyzing gaps in capabilities between the existing staff and future workforce needs, (including consideration of expected succession needs), and formulating strategies for filling expected gaps. (See figure below for an overview of this approach.) Exacerbating this situation is that the FBI is not proactively managing Sentinel human capital availability as a program risk; it has not included human capital in the program‘s risk inventory nor has it developed and implemented a proactive risk mitigation strategy, even though program documents cite human capital as both a challenge and a risk. According to program officials, they plan to manage their human capital needs in the same way as when they initially staffed the program office, in part because the bureau‘s IT system life cycle management policies and procedures do not require them to do otherwise. Unless the FBI adopts a more strategic approach to managing human capital for the Sentinel program and treats human capital as a program risk, the chances of delivering required intelligence and investigative support capabilities in a timely and cost-effective manner are reduced. Figure: Summary of Strategic Approach to Managing Human Capital for IT Programs: [See PDF for Image] Source: GAO. [End of Figure] What GAO Recommends: To strengthen the Sentinel program, GAO recommends that the FBI (1) establish policies and procedures for strategically managing IT programs‘ human capital needs and implement those policies and procedures on all IT programs, including Sentinel and (2) treat and manage Sentinel human capital availability as a program risk. In its comments on a draft of this report, the FBI agreed with the recommendations and described steps completed, under way, and planned. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-19]. To view the full product, including the scope and methodology, click on the link above. For more information, contact Randolph C. Hite at (202) 512-3439 or hiter@gao.gov. [End of Section] Contents: Letter: Results in Brief: Background: Sentinel Short-Term Staffing Needs Largely Met, but Strategic Approach to Managing Program Human Capital Needs Is Lacking: Conclusions: Recommendations for Executive Action: Agency Comments: Appendix I: Scope and Methodology: Appendix II: Comments from the Federal Bureau of Investigation: Appendix III: GAO Contact and Staff Acknowledgments: Figures: Figure 1: Program Management Office Organizational Chart: Figure 2: Status of Staffing Efforts for Sentinel: Figure 3: Overview of Strategic Approach to IT Program Human Capital Management: Abbreviations: ASC: Automated Case Management System: CIO: Chief Information Officer: FBI: Federal Bureau of Investigation: IT: information technology: VCF: Virtual Case File: United States Government Accountability Office: Washington, DC 20548: October 16, 2006: The Honorable F. James Sensenbrenner, Jr. Chairman: The Honorable John Conyers, Jr. Ranking Minority Member: Committee on the Judiciary: House of Representatives: In early 2005, the Federal Bureau of Investigation (FBI) began Sentinel, an estimated 6-year, $425 million program to acquire and deploy an information technology (IT) system to replace and expand on both its failed Virtual Case File (VCF) project and its antiquated, paper-based, legacy system for supporting mission-critical intelligence analysis and investigative case management activities. Among the reasons we and others have cited for VCF's failure were the limitations in the project's human capital capabilities, including the lack of continuity in key positions and shortfalls in requisite program management knowledge, skills, and abilities. Because of the FBI's experience with VCF and the importance of Sentinel to the bureau's mission operations, you asked us to address a number of Sentinel acquisition management issues.[Footnote 1] As agreed with your offices, we are reporting first on whether the FBI is adequately providing for the program's human capital needs. To address this objective, we reviewed FBI policies and procedures, program plans, current staffing profiles, and we interviewed appropriate program officials. Details on our objective, scope, and methodology are included in appendix I. Results in Brief: To its credit, the FBI has moved quickly to staff its Sentinel program office, following what it describes as a meticulous approach that complies with bureau policies and procedures. In particular, it created the staffing plan for Sentinel during the last year, which defined the near-term positions needed for the program, and it has filled most of the positions in the plan, mainly using contractors (77 percent). However, a few key positions remain to be filled, such as the lead test engineer. Moreover, the staffing plan addresses only the program's immediate staffing needs and does not define the kind of strategic approach to human capital management that our research and evaluations have shown to be critical to the success of any organizational entity. In particular, the staffing plan was not derived using a documented, fact-based, data-driven methodology, and the plan does not provide for inventorying the knowledge and skills of existing staff, forecasting future knowledge and skill needs, analyzing gaps in capabilities between the existing staff and future workforce needs, (including consideration of expected succession needs), or formulating strategies for filling expected gaps, including training, additional hiring, and the appropriate degree of reliance on contractors. Exacerbating this situation is that the program's inventory of risks does not include human capital; steps have not been planned to proactively mitigate the probability and impact of future staffing shortfalls, even though other program documents cite it as a challenge and a risk. According to Sentinel program officials, they do not view human capital as a risk to the program because they intend to rely on the same practices that they have used to address their immediate program office staffing needs, which have included bringing in staff from other FBI units and other government agencies and leveraging contractor staff. In addition, they said, and our analysis confirmed, that bureau IT system life cycle management policies and procedures do not require them to address human capital risks. In our view, not having a more strategic and proactive human capital management focus on a major IT program such as Sentinel increases the chances that promised system capabilities and benefits will not be delivered on time and within budget. Accordingly, we are making recommendations for the FBI to develop and implement IT program management policies and procedures that provide for strategic human capital management on all major FBI IT programs, including Sentinel, and for treating Sentinel's human capital availability as a program risk. In its comments on a draft of this report, signed by the FBI Chief Information Officer (CIO) and reprinted in appendix III, the FBI agreed with our recommendations and stated that while they had made progress laying a foundation for improved IT human capital management across the bureau, much work remains. In this regard, the FBI described steps completed, under way, and planned relative to managing human capital on the Sentinel program and the entire FBI IT organization. We support these steps as they are consistent with our findings and recommendations. The bureau also provided technical comments and updated information, which we have incorporated as appropriate in the report. Background: The FBI serves as the primary investigative unit of the Department of Justice. The FBI's mission responsibilities include investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,500 special agents and 18,000 analysts and mission support personnel are located in the bureau's Washington, D.C., headquarters and in more than 450 offices in the United States and more than 50 offices in foreign countries. Mission responsibilities at the bureau are divided among the following five major organizational components: * Intelligence: Collects and analyzes information on evolving threats to the United States and ensures its dissemination within the FBI, to law enforcement, and to the U.S. intelligence community. * Counterterrorism and Counterintelligence: identifies, assesses, investigates, and responds to national security threats. * Criminal Investigations: Investigates serious federal crimes, including those associated with organized crime, violent offenses, white-collar crime, government and business corruption, and civil rights infractions. Probes federal statutory violations involving exploitation of the Internet and computer systems for criminal, foreign intelligence, and terrorism purposes. * Law Enforcement: provides law enforcement information and forensic services to federal, state, local, and international agencies. * Administration: manages the bureau's personnel programs, budgetary and financial services, records, information resources, and information security. Information Technology Is Instrumental to FBI Mission Operations: To execute its mission responsibilities, the FBI relies on IT, and this reliance has continued to grow. The bureau operates and maintains hundreds of computerized systems, networks, databases, and applications, such as: * the Combined DNA Index System, which supports forensic examinations; * the National Crime Information Center and the Integrated Automated Fingerprint Identification System, which helps state and local law enforcement agencies identify criminals; * the Automated Case Management System (ACS), which manages information collected on investigative cases; * the Investigative Data Warehouse, which aggregates data in a standard format from disparate databases to facilitate content management and data mining; and: * the Terrorist Screening Database, which consolidates identification information about known or suspected international and domestic terrorists. Following the terrorist attacks in the United States on September 11, 2001, the FBI shifted its mission focus to detecting and preventing future attacks, which ultimately led to the FBI's commitment to reorganize and transform. According to the bureau, the complexity of this mission shift, along with the changing law enforcement environment, strained its existing IT environment. As a result, the bureau accelerated the IT modernization program that it began in September 2000. This program, later named Trilogy, was the FBI's largest IT initiative to date, and consisted of three parts: (1) the Information Presentation Component to upgrade FBI's computer hardware and system software, (2) the Transportation Network Component to upgrade FBI's communication network, and (3) the User Application Component to upgrade and consolidate FBI's five key investigative software applications. The heart of this last component became the Virtual Case File (VCF) system, which was intended to replace the obsolete Automated Case Support system, FBI's primary investigative application. While the first two components of Trilogy experienced cost overruns and schedule delays, both are nevertheless currently still operating. However, VCF never became fully operational. In fact, the FBI terminated the project after Trilogy's overall costs grew from $380 million to $537 million, the program fell behind schedule, and pilot testing showed that completion of VCF was infeasible and cost prohibitive. Among reasons we and others cited for VCF's failure were poorly defined system requirements, ineffective requirements change control, limited contractor oversight, and human capital shortfalls due to, for example, no continuity in certain management positions and a lack of trained staff for key program positions. The FBI reports that it has almost 500 systems, applications, databases, and networks that are in operation, undergoing enhancement, or being developed or acquired. In particular, it has identified 18 new or enhancement projects that support its intelligence, investigative, and analyst activities. Included in these is the Sentinel program. Sentinel: A Brief Description: The Sentinel program succeeds and expands VCF and is intended to meet FBI's pressing need for a modern, automated capability for investigative case management and information sharing to help field agents and intelligence analysts perform their jobs more effectively and efficiently. The program's key objectives are to: (1) successfully implement a system that acts as a single point of entry for all investigative case management and that provides paperless case management and workflow capabilities, (2) facilitate a bureau-wide organizational change management program, and (3) provide intuitive interfaces that feature data relevant to individual users. Using commercially available software and hardware components, Sentinel is planned to provide a range of system capabilities and services, including: * investigative case management, leads management, and evidence management; * document and records management, indexed searching, and electronic workflow; * links to legacy FBI systems and external data sources; * training, statistical, and reporting tools; and: * security and application management. The FBI plans to acquire Sentinel in four phases, each of which will span 12 to 18 months. While the specific content of each phase is to be proposed by and negotiated with the prime contractor,[Footnote 2] the general content of each phase is as follows: * Phase 1: Includes a Web-based portal that will provide a data access tool for ACS and other legacy systems and includes the definition of a service-oriented architecture[Footnote 3] to support delivery and sharing of common services across the bureau. * Phase 2: Includes the creation of case document and records management capabilities, document repositories, improved information assurance, application workflow, and improved data labeling to enhance information sharing. * Phase 3: Includes updating and enhancing system storage and search capabilities. * Phase 4: Includes implementing a new case management system to replace ACS. Overall, the FBI estimates that the four phases will cost about $425 million and take 6 years to complete. For fiscal year 2005, the FBI reprogrammed $97 million in appropriated funds from various sources to fund Sentinel work and submitted a $100 million budget estimate for fiscal year 2007. To manage the acquisition and deployment of Sentinel, the FBI established a program management office within the Office of the Chief Information Officer. The program office is led by a program manager and consists of the eight primary units described here (see fig. 1). Human capital decision making is vested with the program manager (or deputy program manager in his absence.) * Program Management Office Staff: General Counsel provides legal advice; dedicated Contracting Officer manages program support and development contracts on behalf of the Program Management Office; and office staff manages day-to-day operations. * Communications and Liaison Team: Prepares communications for the user community regarding Sentinel content and progress, media releases, and program briefings for stakeholders through FBI channels. Also, prepares information and reports for congressional stakeholders and testimony for the Director, Deputy Attorney General, and Attorney General regarding the program. * Organizational Change Management Team: Prepares user community for adapting to new technology and associated work process changes and cultural shifts and serves as the user community's representative and information conduit to the program office. * Business and Administrative Support Unit: Provides support and oversight services, including support for human capital management, information and physical security, budget and investment management, contract support, audit, cost estimation, financial management, earned value management, and property management. * Program Integration Unit: Prepares program baselines and plans, including milestones, and tracks progress against them; also, documents baseline changes. Manages the configuration management process, schedules program reviews, and provides major reports and updates regarding the program to bureau management and stakeholders. * System Development Unit: Focuses on system design and development and related technical aspects of the program, such as design, development, and testing to ensure that technical solutions meet system and user requirements. Performs technical analyses of new requirements and changes to the enterprise architecture. * Transition Unit: Manages the phased roll-out of system capabilities, including headquarters and field site preparation, user training, and changeover in user support to the Operations and Maintenance Unit. * Operations and Maintenance Unit: Oversees and supports deployed system capabilities. Figure 1: Program Management Office Organizational Chart: [See PDF for image] Source: GAO analysis of FBI data. [End of figure] To support the program office, the FBI has also issued task orders under existing contracts for program management support and services. Prior Assessments of FBI's IT Human Capital Management Have Raised Concerns: In 2005, we testified[Footnote 4] that the FBI's efforts to establish a strategic approach to managing its IT human capital remained a work in progress, and that completing these efforts posed a significant challenge for the bureau. In addition, we reported that the CIO had yet to create a strategic approach to managing IT human capital. As we said at that time, such an approach includes an assessment of the core competencies and essential knowledge, skills, and abilities needed to perform key IT functions, as well as an inventory of existing workforce capabilities and a gap analysis between defined needs and existing capabilities. The approach also provides for defining strategies and actions for filling identified gaps, such as the appropriate mix of hiring, training, and contract activities. It also establishes performance and accountability mechanisms, such as time frames, resources, roles and responsibilities, and performance measures associated with executing the strategies and actions. In September 2005, the National Academy of Public Administration reported[Footnote 5] that the bureau had developed a strategic human capital plan and had initiatives under way to improve its human capital system. However, it also reported that the bureau's programs, activities, and actions were unlikely to produce a successful human capital program. Specifically, human capital improvement efforts were not carried out in a systematic, coordinated, and strategic manner; human capital management responsibility and authority were shared among different individuals; implementation of initiatives that involved contractors was not effectively coordinated; and implementation of plans and decisions was not always sustained. The Academy concluded that the bureau is likely to miss its staffing targets, due in part to insufficient workforce planning. Sentinel Short-Term Staffing Needs Largely Met, but Strategic Approach to Managing Program Human Capital Needs Is Lacking: To its credit, the FBI has moved quickly to staff its Sentinel program office, following what the Sentinel program manager describes as a meticulous series of actions to determine staffing needs, develop position descriptions, review resumes and reassess program needs. During the last year, it has also filled most of the positions in the plan primarily by using contractors. Nevertheless, a few key positions remain unfilled. Moreover, the staffing plan addressed only the program's immediate staffing needs; it does not provide for the kind of strategic human capital planning and management that our research has shown to be critical to the success of any organization, such as inventorying the knowledge and skills of existing staff, forecasting knowledge and skill needs over the life of the program, and formulating explicit strategies for filling gaps. Exacerbating this lack of a strategic approach to human capital management is that the program's inventory of risks does not include human capital as a program risk, and thus steps are not planned to proactively address these risks. Program officials told us that they are satisfied with Sentinel workforce management efforts, and, although challenges lie ahead, they are confident that the FBI can address the program's evolving human capital needs. In contrast, other program documentation cites human capital as a program challenge and risk. In our view, the FBI's approach to managing human capital in the Sentinel program is reactive and introduces the risk of not having skilled personnel available. A more proactive approach would increase the bureau's ability to deliver Sentinel's needed functionality and promised mission benefits on time and within budget. FBI Has Leveraged Contractors to Quickly Meet Most of Its Short-Term Sentinel Staffing Needs but Several Key Positions Are Unfilled: To its credit, the FBI has moved quickly to staff its Sentinel program office. During the last year, it created a staffing plan for Sentinel that is to serve as the program's primary human capital planning document. Basically, this staffing plan defines the program's immediate workforce requirements and identifies key program functions, positions, skills, and staffing levels that the FBI says it currently needs to begin executing the program. The staffing plan is intended to be a "living" document, meaning that the FBI intends to update it as required to reflect significant changes in the program office's roles and responsibilities and staffing needs throughout the life of the program. These officials also stated that they developed the plan with the assistance of a contractor, and that it reflects their meticulous efforts to analyze staffing needs (skills and levels), develop position descriptions, review resumes, and reassess program needs. Further, they said that it is based on more than 100 years of combined program management experience and knowledge and that these efforts complied with bureau policies and procedures. Using the plan, program officials told us that they collaborated with the FBI Human Capital Office to fill defined positions with transfers from other FBI units and other federal agencies, and by hiring from outside the government. In doing so, the officials said that their approach was to fill program leadership positions with government staff and to fill the rest with government and contractor staff. Further, FBI officials said that they had initially focused on positions associated with near-term program management activities, such as program planning, requirements management, and contract solicitation and award. For government positions, program officials received support from the Human Capital Office in posting job announcements and processing applications. The program officials worked directly with existing contractors to fill contract positions. According to officials, they were able to address their initial staffing needs quickly because of the priority the Sentinel Program Manager, who is directly responsible for human capital decisions, devoted to recruitment and staffing efforts during the program's planning stages, the availability of the FBI's Human Capital Office to assist them, and the ability to draw from existing contract vehicles. Of the program's 78 positions, 60 are to be filled by contractors (77 percent). This level of reliance on contractors for program management is appreciably higher than it was for another major IT program that we recently reviewed [Footnote 6]. For example, the ratio of government- to-contractor staffing on the Department of Homeland Security's US VISIT[Footnote 7] program was about 50-50. According to Sentinel officials, their reliance on contractors for program management is a common practice in intelligence programs. While we are not aware of any generally accepted standards governing the desired mix of government versus contractor personnel performing program management functions, acquisition experts have recently raised over-reliance on contractors in performing program management functions as an emerging issue in the federal government. To date, the program office reports that it has filled 63 of 78 identified positions (81 percent). According to program officials, they are actively recruiting 5 of the 15 unfilled positions and plan to hire the remaining 10 in later phases of the program, when the need for these positions becomes more relevant. Among the 15 vacancies is the lead test engineer position, which is important for ensuring the testability of defined system requirements early in the program. According to program officials, the unfilled positions have had no negative impact on the program's schedule or deliveries to date. (See fig. 2 for a complete list of the program office's positions, including those still unfilled.) Figure 2: Status of Staffing Efforts for Sentinel: [See PDF for image] Source: GAO analysis of FBI data. [End of figure] FBI Has Not Adopted a Strategic Approach for Managing Sentinel's Human Capital: The success of any IT program depends on effectively leveraging people, processes, and tools to achieve defined outcomes and results. To effectively leverage people, they must be treated as strategic assets. As we previously reported, a strategic approach to human capital management enables an organization to be aware of and prepared for its current and future human capital needs, such as workforce size, knowledge, skills, and training. To be effective, our research shows that such a strategic approach includes using data-driven, fact-based methods to (1) assess the knowledge and skills needed to execute a program; (2) inventory existing staff knowledge and skills; (3) forecast the knowledge and skills needed over time; (4) analyze the gaps in capabilities between the existing staff and future workforce needs, including consideration of evolving program and succession needs caused by turnover and retirement; and (5) formulate strategies for filling expected gaps, including training, additional hiring, and the appropriate use of contractors. (See fig. 3 for an overview of this process). Through effective human capital management, organizations can effectively mitigate the serious risks associated with not having highly qualified employees. Figure 3: Overview of Strategic Approach to IT Program Human Capital Management: [See PDF for image] Source: GAO. [End of figure] The Sentinel program has yet to determine and follow such a strategic approach to managing its human capital needs. In particular, in addressing its near-term staffing needs, FBI officials did not use a documented, fact-based, data-driven methodology to assess needs and existing capabilities, nor did it perform a gap analysis of the number of staff required and the specific skills and abilities needed to develop, maintain, and implement Sentinel. As previously stated, officials told us that they relied on their collective years of experience in managing IT projects and the assistance of a contractor to create the staffing plan, and that they reviewed resumes of candidates to fill the positions in the staffing plan. These efforts have not produced program life cycle strategies for retention of key staff, succession planning for key positions, long-term hiring of new staff, replenishment of workforce losses due to foreseeable attrition, or training of existing staff. The staffing plan also fails to specify the desired mix of government and contractor staff for the program. As we reported in 2005, the Chief Information Officer planned, at that time, to hire a contractor with human capital expertise to help identify gaps between existing skills and abilities and those needed to successfully modernize the bureau's entire IT organization. In commenting on a draft of this report, the CIO stated that, in July 2005, he began a three-phase strategic human capital planning initiative, the purpose of which is to provide the CIO with the means to meet the bureau's IT human capital needs for the 21st century. The three phases are (1) development of a competency model and an inventory of existing staff knowledge and skills, (2) an analysis of gaps between staff needs and existing capabilities, and (3) development and implementation of strategies to fill critical gaps. The FBI reports that they are close to completing the first phase, but that much work remains to be done. At the same time, the Sentinel program is well under way. Moreover, while the CIO stated that the Sentinel staffing plan will dovetail with this three-phase initiative, program officials told us that it was not clear to them how, or whether, the program's staffing efforts were aligned with or part of other human capital efforts under way at the bureau. Nevertheless, program officials told us that they do not see a need to change their approach to managing Sentinel human capital because they believe that the approach used to initially staff-up the program office had served them well. Officials told us they will reassess their human capital needs for future phases of the project to ensure the right complement of staff and skills mix is available for each phase. In addition, they said that the bureau's life cycle management policies and procedures do not require such a strategic approach to managing human capital for IT programs. Our analysis of the bureau's system life cycle management directive and program management handbook confirmed that they do not contain policies, procedures, or guidance for doing so. In our view, not addressing Sentinel human capital more strategically and proactively increases the risk of not delivering required system capabilities and expected mission value on time and within budget. FBI Is Not Treating Human Capital as a Program Risk for Sentinel: Risk management is a continuous, forward-looking process that is intended either to prevent program cost, schedule, and performance problems from occurring or to minimize the impact if problems do occur by proactively identifying risks, implementing risk mitigation strategies, and measuring and disclosing progress in doing so. To its credit, the FBI has established a risk management process for Sentinel that includes a risk management plan and an inventory of risks that are to be proactively managed to mitigate the probability of their occurring and their impacts if they do occur. However, this risk inventory does not include any human capital-related risks. According to program officials, the inventory does not include human capital risks because they do not see a need to include them. Available Sentinel program documentation and other statements by program officials, however, suggest otherwise. For instance, the Sentinel staffing plan states that adequate staffing is a critical factor in the program office's ability to successfully execute its responsibilities, and that staff recruitment will be a difficult challenge given the competition for skilled IT professionals with security clearances in the Washington Metropolitan Area. Moreover, the FBI's fiscal year 2007 budget submission for Sentinel (Exhibit 300[Footnote 8]) identifies the availability of human capital for the prime contractor as a program risk, and in commenting on a draft of this report, the CIO stated that human capital risks exist. In addition, officials identified various hiring challenges, such as that two-thirds of applicants fail the bureau's security screening process and that the time it takes to execute the hiring process can be lengthy. Moreover, they said that they will face on-going hiring issues due to attrition and staff rotations. For instance, several contractor staff had recently left the program--although the CIO said that this was normal attrition--and the bureau filled the positions within 30 days. Also, 4 of the program office's 19 government staff are on temporary duty and will rotate to other tours of duty, including the program manager, whose 2-year detail at the FBI expires in 2007 (although the possibility exists for a one- year extension). In our view, not identifying human capital as a program risk and managing it as such on a major IT program like Sentinel increases the chances that promised system capabilities and benefits will not be delivered on time and within budget. Conclusions: The success of any IT program depends on effectively leveraging people, processes, and tools to achieve defined outcomes and results. To effectively leverage people, they must be treated as strategic assets and managed as such. Notwithstanding the FBI's considerable efforts to quickly staff-up the Sentinel program office, it has not adopted the kind of strategic management approach needed to effectively leverage Sentinel human capital throughout the life of the program, in part because the FBI's IT program management policies and procedures do not require it. Moreover, the program's risk management inventory does not include the availability of Sentinel human capital, and thus it is not recognized and managed as a serious program risk. Given the pressing need to deliver mission-critical investigative and intelligence IT support to FBI agents and analysts and the importance of strategic human capital management to programs like Sentinel, it is essential that this program risk be proactively mitigated. Unless the FBI adopts a more strategic and proactive approach to managing Sentinel human capital and treats it as a program risk, the chances of the program delivering required intelligence and investigative capabilities and mission value in a timely and cost effective manner are diminished. Recommendations for Executive Action: To strengthen the FBI's management of its Sentinel program and to better ensure that the program delivers required capabilities and expected benefits on time and within budget, we make the following two recommendations: * The FBI Director should have the bureau's CIO establish IT program management policies and procedures for strategically managing IT programs' human capital needs and ensure that these policies and procedures are fully implemented on all major IT programs, including Sentinel. * The FBI Director should have the CIO treat and manage both Sentinel program office and prime contractor human capital availability as program risks and periodically report to the Director on the status and results of efforts to mitigate these risks. Agency Comments: In written comments on a draft of this report signed by the CIO and reprinted in appendix II, the FBI agreed with our recommendations and stated that while progress has been made to lay a foundation for improved IT human capital management across the bureau, much work remains. In this regard, the FBI described steps completed, under way, and planned relative to managing human capital on the Sentinel program and across the FBI IT organization. For instance, the FBI stated that the CIO's office invested 3 months in developing a staffing plan for Sentinel that analyzed staffing needs in light of lessons learned from other IT projects, analyzed resumes of both government and contactor staff, and used contractor staff until government staff could replace them. In addition, FBI stated that it has initiated Project Management Professional certification and training efforts and begun a strategic human capital planning initiative that is to provide a repeatable and strategic approach to managing IT human capital resources across its IT organization. We support these steps as they are consistent with our findings and recommendations. The bureau also provided other technical comments and updated information, which we have incorporated, as appropriate, in the report. We are sending copies of this report to the Chairman and Vice Chairman of the Senate Select Committee on Intelligence and the Ranking Minority Member of the House Permanent Select Committee on Intelligence, as well as to the Chairman and Ranking Minority Member of the Senate Committee on the Judiciary, the Chairman of the Senate Committee on Appropriations Subcommittee on Commerce, Justice, Science, and Related Agencies, and the Chairman and Ranking Member of the House Committee on Appropriations, Subcommittee on Science, the Departments of State, Justice, and Commerce, and Related Agencies. We are also sending copies to the Attorney General; the Director, FBI; the Director, Office of Management and Budget; and other interested parties. In addition, the report will also be available without charge on GAO's Web site at [Hyperlink, http://www.gao.gov]. Should you have any questions about matters discussed in this report, please contact me at (202) 512-3439 or by e-mail at hiter@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs Office may be found on the last page of this report. Key contributors to this report are listed in appendix II. Signed by: Randolph C. Hite: Director, Information Technology Architecture and Systems Issues: [End of section] Appendix I: Scope and Methodology: Our objective was to determine whether the Federal Bureau of Investigation (FBI) has adequately provided for the human capital needs of its Sentinel program. To address our objective, we focused on three areas: FBI's efforts to date in staffing the Sentinel program office, the bureau's plans to address gaps between the program's human capital needs and existing FBI capabilities, and the extent to which FBI is proactively treating and managing human capital as a program risk. To evaluate whether the FBI is adequately providing for the Sentinel program's human capital needs, we compared the bureau's efforts against relevant criteria and best practices, including our own framework for strategic human capital management.[Footnote 9] These criteria promote the use of data to determine key performance objectives and goals in identifying current and future human capital needs, including the appropriate number of employees, the key competencies and skills mix for mission accomplishment, and the appropriate deployment of staff across the organization. They also advocate strategies for identifying and filling human capital gaps and performing succession planning, as well as being the basis for efforts intended to mitigate human capital- related program risks. To accomplish these steps, we requested key staffing-related documents from the FBI, including (1) the organization chart for the Sentinel program office, including filled positions and vacancies and the source of the resources filling those positions (i.e., internal FBI, contractors, outside hires); (2) FBI's assessment of workforce needs-- including positions, roles and responsibilities, and core competencies- -to adequately perform system acquisition activities (i.e., configuration management, organizational change management, risk management, contractor tracking and oversight, and solicitation); (3) a current skills inventory and identification of gaps and shortfalls in human capital available to meet workforce needs and plans to address these shortfalls; and (4) FBI's inventory of program risks, including risks associated with human capital or workforce planning. In addition, we reviewed the number and mix of contractor and government positions needed to staff the Sentinel program office and analyzed where the FBI stands in filling these positions. We reviewed the evidence provided, including FBI's Life Cycle Management Directive Version 3.0 and the FBI Project Management Handbook Version 1.0, and compared it to our criteria to determine if the bureau's plans and efforts to date comport with best practices and relevant guidance. Further, and in order to verify our analyses, we interviewed appropriate FBI officials and Sentinel program office personnel. We performed our work at FBI headquarters in Washington, D.C., from September 2005 through July 2006 in accordance with generally accepted government auditing standards. [End of section] Appendix II: Comments from the Federal Bureau of Investigation: U.S. Department of Justice: Federal Bureau of Investigation: Washington, D. C. 20535-0001 I: September 22, 2006: Mr. Randolph C. Hite: Director, Information Technology Architecture and Systems Issues: U.S. Government Accountability Office: 441 G Street, NW: Washington, D.C. 20548: Re: GAO'S Draft Report: Information Technology, FBI Has Largely Staffed Key Modernization Program, But Strategic Approach To Managing Program's Human Capital Needed: Dear Mr. Hite: Thank you for the opportunity to review and comment on the Government Accountability Office (GAO) draft report entitled "Information Technology, FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program's Human Capital Needed" (hereafter "Report"). The Report has been reviewed by various components of the FBI, including the Human Resources Branch and the Office of the Chief Information Officer. This letter constitutes the formal FBI response. Based on our review of the Report, the FBI concurs with the GAO's recommendation regarding the importance of establishing a strategic information technology (IT) human capital plan. In fact, I am pleased to inform you that the OLIO has made significant progress towards establishing a strategic approach to managing IT human capital resources. Working in close partnership with the Human Resources Division and the Training & Development Division, the OCIO has taken critical steps to develop and implement a fully integrated strategic IT human capital plan that will address current and future IT workforce needs and align with the FBI's Strategic Human Capital Plan. There are more than 1,100 government professionals who manage and oversee the FBI's IT research, development, acquisition, and operations. They possess the critically important job of developing and implementing the next generation of IT systems, applications, and networks, as well as maintaining our legacy IT systems. The need to hire, develop, and maintain a flexible yet highly skilled IT workforce capable of meeting the current, future, and emergent organizational needs is a major challenge facing the FBI. To address this challenge, the OCIO has initiated several key initiatives over the past two years which will result in the development and implementation of a strategic IT human capital plan. In September 2004, the OLIO initiated the Project Management Professional (PMP) certification initiative. This initiative provides a,means to develop and sustain a professional cadre of trained and certified project managers. The PMP certification is a widely recognized credential within the project management field. It certifies an individual has and maintains the requisite experience, skills, training, and knowledge of project management and is able to apply these skills in the real-world environment. Since inception, 230 FBI employees have completed a comprehensive eight-day project management training course and 53 have earned PMP certifications. Additionally, on April 4, 2006, the FBI-kicked-off the first Project Management Institute (PMI) Community within the FBI. The FBI Community is a component of the PMI Washington, D.C. Chapter and is an extension of the OCIO's commitment to strengthen and integrate professional project management discipline, practices, and principles across the organization. In June 2005, the OLIO initiated the Strategic Human Capital Planning Initiative (SHCPI). The purpose of the SHCPI is to implement a competency-based human capital process that effectively equips the FBI's IT Specialists (ITS) to meet the demands of the 21st century. It will also enable the OCIO to make more informed decisions associated with current and future IT workforce needs, ensuring the workforce has the experience, training, knowledge, skills, and abilities needed to pursue its mission. The three-phased SHCPI Program Plan implemented by the OLIO mirrors the strategic framework and employs the principles that the GAO laid out as necessary to develop an effective human capital management system. For example, during Phase I, the ITS competency model will be completed including an inventory of the existing ITS's knowledge and skills and a needs assessment. During Phase II, a gap analysis will be completed. During Phase III, strategies will be developed and implemented to fill critical gaps. The end result of this three-phased initiative will be a repeatable strategic approach to managing IT human capital resources across the organization. Although progress is being made, much work remains to develop and implement a strategic IT human capital plan. Steps are being taken to lay a solid foundation to improve the IT human capital management system. Human capital planning is vital, and SENTINEL has demonstrated proof of its management as an asset to the program through staff planning, position description development, resume tracking to position needs, and reassessment of needs at strategic control points in the program. This strategic approach to staffing is in compliance with the guidance outlined in the FBI's Project Management Handbook. As described by the GAO, ". a strategic approach to human capital management enables the organization to be aware of and prepared for its current and future human capital needs, such as workforce size, knowledge, skills, and training." The GAO further identified five tasks associated with effective human capital management: "(1) assess the knowledge and skills needed to execute a program; (2) inventory existing staff knowledge and skills; (3) forecast the knowledge and skills needed over time; (4) analyze the gaps in capabilities between the existing staff and future workforce needs, including consideration of evolving program and succession needs caused by turnover and retirement; and (5) formulate strategies for filling expected gaps, including training, additional hiring, and the appropriate use of contractors." The SENTINEL Program Manager's (PM) strategic approach to staffing the Project Management Office (PMO) has practiced four of the five tenets, specifically: * Tenet (1) - The OLIO invested three months developing a staffing plan to assess the correct mix of engineering, business and administrative management, contract, legal, transition, operations and maintenance, organizational change management, communications and staff support to manage the program, interface with major stakeholders, and keep the FBI user population informed and engaged. This well-thought-out staffing plan included an analysis of needs, consideration of lessons learned from other IT project staffing, and full coordination with FBI leadership prior to approval. The PMO Staffing Plan defined the staff's skill requirements, associated government and contractor PMO staffing levels, and actions for filling the PMO positions. It aligned with the personnel needs identified in the Program Management Plan. That plan included the use of Federally Funded Research and Development Centers (FFRDC) personnel to manage units (under the supervision of the unit chief) until qualified government replacements were found to provide continuity. * Tenet (2) - The SENTINEL PMO has collected the resumes of all contractor personnel serving the PMO, and has collected a number of government resumes to understand their skills and how best to use them. The PM and Deputy PM personally reviewed the resumes of all potential staff members - whether government employees or contractors - to ensure the proper mix and balance of skills were reached. The PM formed an integrated team of subject matter experts from government, FFRDC, and Systems Engineering, and Technical Assistance contractors to maximize program expertise, ease the staffing burden for any one contractor, and afford the greatest flexibility in addressing known and unforseen staffing requirements. * Tenet (3) - SENTINEL has also been building management depth in the program organization to ensure each part of the PMO has a trained back up to ensure continuity of the program. When reviewing personnel needs over the life of the program, the PM - with concurrence from the OLIO - determined that filling some of the personnel assets needed in Phase 2 could be deferred to save costs and ensure each employee was fully employed in his/her specific area of expertise. The PMO will continue to periodically review the current workforce skills structure to evaluate skills needed phase by phase and will adjust staffing if necessary. * Tenet (5) - The SENTINEL PMO clearly understands the importance of maintaining a quality workforce and the consequences of allowing staffing levels/quality to decrease to an unacceptable level. As the SENTINEL Program evolves, the management team within the PMO, the OCIO, and the FBI senior leadership team will continue to work together by periodically reassessing program staffing needs to ensure the SENTINEL Program is resourced correctly, and is successful in accomplishing its mission. If necessary, FBI assets will augment the SENTINEL PMO to ensure sufficient SENTINEL staffing levels to succeed in the development and deployment of the system. Ultimately, the SENTINEL Staffing Plan will dovetail into the OCIO IT human capital plan. Current IT policies and procedures such as the IT Life Cycle Management Directive (LCMD) are written to reflect major IT project management functions and activities These are usually addressed in terms of major process areas, such as, requirements, engineering, project planning, project monitoring and control, quality assurance, configuration management (CM), and so forth. References to "resources" (i.e., staffing and training) are usually made in terms of the project management function being addressed in the particular policy or procedure. For example, the Project Planning policy will address the "resources" required for project planning, and the CM policy addresses "resources" for CM. In this context, when the FBI completes the development and approval of all policies and procedures, human capital will have been addressed for all major IT project management functions. The current FBI IT policies state that PM and Senior Management will ensure that these policies and procedures are fully implemented. They also state that critical issues (i.e., resources and risks) and their status be reported on a periodically scheduled basis to Senior Management, in the form of technical or management reviews. The FBI concurs with the GAO's recommendation regarding treating human capital as a program risk. In fact, the OLIO recognizes the importance of implementing effective risk management and it is one of the key supporting processes of the IT LCMD. The FBI's risk management process provides a disciplined environment for pro-active decision-making to: identify continuously what can go wrong (risks); assess which risks require immediate attention; and implement strategies to mitigate risks. In compliance with the established policies and procedures, the SENTINEL PMO has and/or is tracking three program risks related to staffing, and had briefed them to the Director as part of the program's normal status review with the Director. Two of the risks dealt with the development contract and one with the program. One of the risks for the program and the development contractor regarding staffing have been mitigated/resolved and retired. The third, relating to trainer staffing by the contractor, is still being actively monitored. The SENTINEL PM and OCIG regularly keep Congress, other oversight bodies, and FBI leadership apprised of the staffing statistics and efforts to address any personnel shortages on a routine basis. A review of human capital assets is already being performed as part of the program's normal course of business. When the PM reviews risks to the program, human capital could be' added, elevated, lowered, or removed on the Risk Register based on the current/future situation and any mitigating factors. Again, thank you for the opportunity to respond to the Report. Should you or your staff have questions regarding our response, please contact me any time. Sincerely, Signed by: Chief Information Officer: [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: Randolph C. Hite, (202) 512-3439 or hiter@gao.gov: Staff Acknowledgments: In addition to the contact named above, the following people made key contributions to this report: Paula Moore, Assistant Director; JC Ceaser; Neil Doherty; Nancy Glover; Dan Gordon; Kevin Walsh; and Kim Zelonis. FOOTNOTES [1] These areas are the program's (1) use of effective methods for acquiring commercial solutions, (2) efforts to align itself with the bureau's enterprise architecture, (3) basis for reliably estimating costs and schedules, (4) plans for applying earned value management, (5) provisions for adequate human capital to manage the acquisition, and (6) relationship to the governmentwide case management line of business. [2] In August 2005, the FBI issued a request for proposal for Sentinel. In March 2006, it awarded the task order for Sentinel to Lockheed Martin under the National Institutes of Health (NIH) Information Technology Acquisition and Assessment Center's (NITAAC) Chief Information Officer-Solutions and Partners 2 Innovations (CIO-SP2i) contract. [3] A service-oriented architecture is an approach for sharing functions and applications across an organization by designing them as discrete, reusable business-oriented services. These services need to be, among other things, (1) self-contained, meaning that they do not depend on any other functions or applications to execute a discrete unit of work; (2) published and exposed as self-describing business capabilities that can be accessed and used; and (3) subscribed to via well-defined and standardized interfaces instead of unique, tightly coupled connections. Such a service orientation is thus not only intended to promote the reduced redundancy and increased integration that any architectural approach is designed to achieve, but to also provide the kind of flexibility needed to support a quicker response to changing and evolving business requirements and emerging conditions. [4] GAO, Information Technology: FBI Is Building Management Capabilities Essential to Successful System Deployments, but Challenges Remain, GAO-05-1014T (Washington, D.C.: Sept. 14, 2005). [5] National Academy of Public Administration. Transforming the FBI: Roadmap to an Effective Human Capital Plan, (Washington, D.C.: Sept. 2005). [6] GAO, Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status Indicator Technology Program, GAO-05-202 (Washington, D.C.: Feb. 23, 2005). [7] US VISIT is a program to collect, maintain, and share information on foreign nationals. [8] The Exhibit 300 is used by the Office of Management and Budget to collect information from federal agencies. The Exhibit 300 is intended to ensure that business cases for investments are made and are tied to agency mission statements, long-term goals and objectives, and annual performance plans developed pursuant to the Government Paperwork Elimination Act (GPRA). For IT, Exhibit 300s are designed to be used as one-stop documents for many IT management issues such as business cases for investments, IT security reporting, Clinger-Cohen Act implementation, E-Gov Act implementation, GPRA implementation, agency modernization efforts, and overall project (investment) management. [9] A Model of Strategic Human Capital Management, GAO-02-373SP (Washington, D.C.: Mar. 15, 2002). GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.