Business Systems Modernization
IRS Has Made Significant Progress in Improving Its Management Controls, but Risks Remain Gao ID: GAO-03-768 June 27, 2003As required by law, the Internal Revenue Service (IRS), in November 2002 and March 2003, submitted to the congressional appropriations committees its initial and revised fiscal year 2003 expenditure plans, respectively, requesting about $378 million for the Business Systems Modernization (BSM) program. GAO reviewed the plans to (1) determine whether the plans were prepared in accordance with the law, (2) determine what progress IRS had made in implementing modernization management controls and capabilities, and (3) provide any other observations about the plans and IRS's BSM program.
IRS's initial (November 2002) and revised (March 2003) fiscal year 2003 expenditure plans were prepared in accordance with the law. IRS made significant progress in improving its modernization management controls and capabilities and implementing GAO's recommendations. IRS implemented 20 of 23 commitments and is implementing the remaining 3 commitments that address previously reported weaknesses and recommendations. Significant among these efforts were IRS's achievements in improving its software acquisition practices. IRS deployed 3 modernized systems that are currently providing benefits that (1) improve telecommunications infrastructure, including telephone call management, call routing, and customer self-service; (2) provide off-the- shelf software to IRS revenue agents to allow them to accurately compute complex corporate transactions; and (3) improve customer self-service by providing instant refund status information and instructions for resolving refund problems via the Internet. IRS also took steps to balance the scope and pace of the BSM program with the management capacity of IRS and its prime contractor. These steps included reassessing the portfolio of projects that IRS had planned to proceed with during the remainder of fiscal year 2002 and reducing the planned scope and pace of the BSM program for fiscal year 2003. Although significant progress has been made, certain controls and capabilities for modernization have not yet been fully implemented, including human capital management and validation of cost and schedule estimates. Weaknesses in these controls and capabilities contributed, in part, to cost, schedule, and performance shortfalls in the BSM program. For example, in the revised fiscal year 2003 expenditure plan, IRS disclosed that 75 percent of program-level initiatives and acquisition project milestones had cost increases and/or schedule delays exceeding 10 percent of the estimated cost and duration specified in the fiscal year 2002 expenditure plan. Schedule delays affect the delivery of benefits. For example, (1) the opportunity for Form 1040EZ filers to enjoy faster refunds, as promised by the first release of the project that is to replace IRS's master files of taxpayer information, has been delayed for an additional 13 months and (2) schedule delays for the first release of the e-Services project will defer the provision of easy-to-use electronic products and services targeted at tax practitioners who inform, educate, and provide services to the taxpaying public.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-03-768, Business Systems Modernization: IRS Has Made Significant Progress in Improving Its Management Controls, but Risks Remain
This is the accessible text file for GAO report number GAO-03-768
entitled 'Business Systems Modernization: IRS Has Made Significant
Progress in Improving Its Management Controls, but Risks Remain' which
was released on June 27, 2003.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
June 2003:
Business Systems Modernization:
IRS Has Made Significant Progress in Improving Its Management Controls,
but Risks Remain:
GAO-03-768:
GAO Highlights:
Highlights of GAO-03-768, a report to congressional committees
Why GAO Did This Study:
As required by law, the Internal Revenue Service (IRS), in November
2002 and March 2003, submitted to the congressional appropriations
committees its initial and revised fiscal year 2003 expenditure plans,
respectively, requesting about $378 million for the Business Systems
Modernization (BSM) program.
GAO reviewed the plans to (1) determine whether the plans were
prepared in accordance with the law, (2) determine what progress IRS
had made in implementing modernization management controls and
capabilities, and (3) provide any other observations about the plans
and IRS‘s BSM program.
What GAO Found:
IRS‘s initial (November 2002) and revised (March 2003) fiscal year
2003 expenditure plans were prepared in accordance with the law. IRS
made significant progress in improving its modernization management
controls and capabilities and implementing GAO‘s recommendations. For
example:
* IRS implemented 20 of 23 commitments and is implementing the
remaining 3 commitments that address previously reported weaknesses
and recommendations. Significant among these efforts were IRS‘s
achievements in improving its software acquisition practices.
* IRS deployed 3 modernized systems that are currently providing
benefits that (1) improve telecommunications infrastructure, including
telephone call management, call routing, and customer self-service;
(2) provide off-the-shelf software to IRS revenue agents to allow them
to accurately compute complex corporate transactions; and (3) improve
customer self-service by providing instant refund status information
and instructions for resolving refund problems via the Internet.
* IRS also took steps to balance the scope and pace of the BSM program
with the management capacity of IRS and its prime contractor. These
steps included reassessing the portfolio of projects that IRS had
planned to proceed with during the remainder of fiscal year 2002 and
reducing the planned scope and pace of the BSM program for fiscal year
2003.
Although significant progress has been made, certain controls and
capabilities for modernization have not yet been fully implemented,
including human capital management and validation of cost and schedule
estimates. Weaknesses in these controls and capabilities contributed,
in part, to cost, schedule, and performance shortfalls in the BSM
program. For example, in the revised fiscal year 2003 expenditure
plan, IRS disclosed that 75 percent of program-level initiatives and
acquisition project milestones had cost increases and/or schedule
delays exceeding 10 percent of the estimated cost and duration
specified in the fiscal year 2002 expenditure plan. Schedule delays
affect the delivery of benefits. For example, (1) the opportunity for
Form 1040EZ filers to enjoy faster refunds, as promised by the first
release of the project that is to replace IRS‘s master files of
taxpayer information, has been delayed for an additional 13 months and
(2) schedule delays for the first release of the e-Services project
will defer the provision of easy-to-use electronic products and
services targeted at tax practitioners who inform, educate, and
provide services to the taxpaying public.
What GAO Recommends:
GAO recommends that the Commissioner of Internal Revenue direct the
Chief Information Officer (CIO) to continue improvements in IRS‘s
modernization management controls. GAO also recommends that the
Commissioner direct the CIO to promptly update the enterprise
transition strategy to conform to other changes in IRS‘s enterprise
architecture and establish and implement a process for determining the
type of task order to be awarded in acquiring modernized systems. The
Commissioner agreed with GAO‘s findings and commented on actions to
address the recommendations.
www.gao.gov/cgi-bin/getrpt?GAO-03-768.
To view the full product, including the scope and methodology, click
on the link above. For more information, contact Robert F. Dacey at
(202) 512-3317 or daceyr@gao.gov
[End of section]
Letter:
Recommendations for Executive Action:
Agency Comments:
Appendixes:
Appendix I: Briefing Slides from the December 18, 2002, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
Appendix II: Briefing Slides from the April 14, 2003, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
Appendix III: Comments from the Internal Revenue Service:
Appendix IV: GAO Contacts and Staff Acknowledgments:
GAO Contact:
Staff Acknowledgments:
BSM: Business Systems Modernization:
CIO: Chief Information Officer :
IRS: Internal Revenue Service:
OMB: Office of Management and Budget:
PRIME: PRIME Systems Integration Support contractor:
Letter June 27, 2003:
The Honorable Richard Shelby
Chairman
The Honorable Patty Murray
Ranking Member
Subcommittee on Transportation, Treasury and General Government
Committee on Appropriations
United States Senate:
The Honorable Ernest J. Istook, Jr.
Chairman
The Honorable John W. Olver
Ranking Minority Member
Subcommittee on Transportation, Treasury and Independent Agencies
Committee on Appropriations
House of Representatives:
As required by law, the Internal Revenue Service (IRS), in November
2002 and March 2003, submitted to the congressional appropriations
committees its initial and revised fiscal year 2003 expenditure plans,
respectively, requesting about $378 million from its Business Systems
Modernization (BSM) fund. Our objectives in reviewing the plans were to
(1) determine whether the plans satisfied the conditions specified in
the law,[Footnote 1] (2) determine what progress IRS had made in
implementing modernization management controls and capabilities, and
(3) provide any other observations about the initial and revised plans
and IRS's BSM program.
On December 18, 2002, and April 14, 2003, we briefed your respective
offices on the results of our reviews. This report transmits the
materials used at those briefings and reiterates the recommendations
that we made to the then-Acting Commissioner of Internal Revenue that
we specified in our December 2002 briefing.[Footnote 2] The full
briefing materials, including our scope and methodology, are reprinted
in appendixes I and II.
In summary, we made the following four major points in our December
2002 briefing on the results of our review of IRS's initial expenditure
plan for fiscal year 2003:
* IRS's initial expenditure plan satisfied each of the six legislative
conditions.
* IRS had made significant progress in improving its modernization
management controls and capabilities and implementing our
recommendations. For example, IRS had implemented 20 of 23 commitments
and is in the process of implementing the remaining 3 commitments that
address previously reported weaknesses and recommendations.
Significant among these efforts was IRS's achievements in improving its
software acquisition practices.
* IRS also had taken steps to balance the scope and pace of the BSM
program with the management capacity of IRS and the PRIME Systems
Integration Support contractor (PRIME). In accordance with our
recommendation, IRS completed a reassessment of the fiscal year 2002
BSM program in May 2002 and took actions to better balance the system
acquisition workload with the management capacity. Specifically, IRS
(1) deferred the start of five new projects until fiscal years 2003 and
2004 to reduce IRS/PRIME resource demands, (2) reapplied a portion of
these deferred financial resources toward PRIME management processes
and support of the federally funded research and development center to
accelerate correcting modernization management control weaknesses, and
(3) increased its own efforts and executive focus on management process
improvement.
* Although significant progress had been made, certain modernization
management controls and capabilities--related to configuration
management,[Footnote 3] enterprise transition strategy,[Footnote 4]
human capital management, and cost and schedule estimate validation--
had not yet been fully implemented. Weaknesses in these controls and
capabilities increase the risk of cost, schedule, and performance
shortfalls in the BSM program.
We also made the following five observations related to the BSM program
and the initial fiscal year 2003 expenditure plan:
* The number of project milestones experiencing cost and schedule
changes was increasing.
* BSM was entering a critical, high-risk phase as the scope and
complexity of the program continued to grow.
* Opportunities for using performance-based contracts in acquiring
modernized systems were increasing.
* IRS had improved the format of its expenditure plan.
* Internal IRS costs of the BSM program, paid from other IRS
appropriations, were expected to increase, but were not tracked or
known.
In our April 2003 briefing on the results of our review of IRS's
revised fiscal year 2003 expenditure plan, we reported that IRS had
deployed three modernized systems that provide benefits that
(1) improve telecommunications infrastructure, including telephone
call management, call routing, and customer self-service; (2) provide
off-the-shelf software to IRS revenue agents to allow them to
accurately compute complex corporate transactions; and (3) improve
customer self-service by providing instant refund status information
and instructions for resolving refund problems via the Internet.
In addition, we made the following four major points in the April 2003
briefing:
* IRS's revised plan satisfied the conditions specified under the law.
* IRS continued to take steps to balance the pace of the program with
management capacity by reducing the planned scope of the BSM program
for fiscal year 2003. Between November 2002 and March 2003, IRS
deferred four new project releases, discontinued two ongoing project
releases, absorbed one new release into an ongoing project release, and
transferred one ongoing project to another appropriation. Moreover, IRS
reduced the scope of BSM program-level initiatives and core
infrastructure projects. As a result, IRS reduced the initial BSM
funding request for fiscal year 2003 by about $72 million.
* Most initiatives/project milestones continued to experience cost
increases and/or schedule delays. In the revised fiscal year 2003
expenditure plan, IRS disclosed that 75 percent of program-level
initiatives and acquisition project milestones had cost increases and/
or schedule delays exceeding 10 percent of the estimated cost and
duration specified in the fiscal year 2002 expenditure plan.
* Schedule delays affected the delivery of benefits. For example, (1)
the opportunity for the first set of taxpayers (single, Form 1040EZ
filers) to enjoy faster refunds, as promised by the first release of
the project that is to replace IRS's master files of taxpayer
information, has been delayed an additional 13 months; (2) schedule
slippages for the first release of the e-Services project will delay
the provision of easy-to-use electronic products and services targeted
at tax practitioners that inform, educate, and provide services to the
taxpaying public; and (3) remediation of material weaknesses may be
delayed.
Recommendations for Executive Action:
To improve IRS's modernization management controls and capabilities, we
recommend that the Commissioner of Internal Revenue direct the Chief
Information Officer (CIO) to complete actions to:
* institutionalize configuration management procedures for the Business
Systems Modernization Office;
* implement plans for obtaining, developing, and retaining requisite
human capital resources; and:
* implement effective procedures for validating contractor-developed
cost and schedule estimates.
In addition, we recommend that the Commissioner of Internal Revenue
direct the CIO to:
* promptly update the enterprise transition strategy to conform to
other changes in IRS's enterprise architecture and:
* establish and implement a process for determining the type of task
order to be awarded in acquiring modernized systems.
Agency Comments:
In providing written comments on a draft of this report, the
Commissioner of Internal Revenue agreed with this report's findings and
commented on the actions IRS is taking to implement our
recommendations. The Commissioner's comments are reprinted in appendix
III.
:
We are sending copies of this report to the Chairmen and Ranking
Minority Members of other Senate and House committees and subcommittees
that have appropriations, authorization, and oversight
responsibilities for the Internal Revenue Service. We are also sending
copies to the Commissioner of Internal Revenue, the Secretary of the
Treasury, the Chairman of the IRS Oversight Board, and the Director of
the Office of Management and Budget. Copies are also available at no
charge on the GAO Web site at http://www.gao.gov.
Should you or your offices have questions on matters discussed in this
report, please contact me at (202) 512-3317. I can also be reached by
E-mail at daceyr@gao.gov. Key contributors to this report are listed in
appendix IV.
Sincerely,
Robert F. Dacey
Director, Information Security Issues:
Signed by Robert F. Dacey:
[End of section]
Appendixes :
Appendix I: Briefing Slides from the December 18, 2002, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
[See PDF for image]
[End of figure]
[End of section]
Appendix II: Briefing Slides from the April 14, 2003, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
[See PDF for image]
[End of figure]
[End of section]
Appendix III: Comments from the Internal Revenue Service:
DEPARTMENT OF THE TREASURY INTERNAL REVENUE SERVICE WASHINGTON, D.C.
20224:
COMMISSIONER:
June 19, 2003:
Mr. Robert F. Dacey:
Director, Information Security Issues U.S. General Accounting Office:
441 G Street N.W. Washington, DC 20548:
Dear Mr. Dacey:
I have reviewed the General Accounting Office (GAO) draft report
entitled IRS has Made Significant Progress In Improving its Management
Controls But Risks Remain, (GAO-03-768, June 2003). We are pleased that
the GAO:
* Validated that we satisfied the six legislative conditions as
specified in Congressional appropriations;
* Acknowledged the significant improvements made in the modernization
management controls and capabilities and our implementation of past
recommendations;
* Confirmed that we are balancing the scope and pace of the BSM program
with the management capacity of the IRS and the PRIME contractor; and *
Acknowledged that the deployment of three modernized systems provides
benefits to taxpayers and to our employees.
We agree with your report's findings. Both the IRS and the PRIME have
appointed senior executives to coordinate within and across our
respective organizations to ensure that we give priority to completing
your recommendations. We believe this focus was a key factor in
achieving our Level 2 rating in the Software Engineering Institute's
Software Acquisition - Capability Maturity Model (SA-CMM). We are the
first federal civilian agency and multi-project program to achieve a
Level 2 rating distinction. The PRIME contractor is the first company
in the world to achieve SA-CMM Level 3.
We will continue to provide the GAO with monthly dashboard reports on
our progress in maturing these and other management processes, as we
have been doing for the past 15 months. We will continue our bi-weekly
meetings on specific modernization topics.
I would like to briefly comment on each of the five recommendations in
your report.
* Institutionalize configuration management procedures for the Business
Systems Modernization Office (BSMO): We continue to make progress in
this area by improving the speed with which we address change requests,
the quality of impact assessments on change requests, and reporting on
the causes for change requests. We are undertaking internal assessments
of the effectiveness of Configuration Management (CM) procedures on
each project to ensure broad program compliance. We established a MITS-
wide Change Control Board about six months ago to reflect the critical
connection that BSM has with the rest of our systems maintenance and
operations.
* Implement plans for obtaining, developing, and retaining requisite
human capital resources: One of the reasons I established a new Deputy
Commissioner for Operations was to give attention to our human capital
practices. In addition, we have made good progress in BSMO by
increasing the quantity and quality of its staff to provide better
services. Last February, the BSM program, in concert with the
Department of Treasury, rolled out the first phase of a new Human
Resources system to more than 18,000 IRS employees.
* Implement effective procedures for validating contractor-developed
cost and schedule estimates: We are working with the PRIME contractor
to develop and deploy best practice estimating capabilities consistent
with:
Carnegie Mellon University's Software Engineering Institute (SEI). In
fact, we briefed your staff on our progress just last week.
Unfortunately, though critical to improving our cost and schedule
estimates, implementing these capabilities is taking longer than we had
hoped, but our progress to date is good.
* Promptly update the enterprise transition strategy to conform to other
changes in IRS' enterprise architecture: The Core Business Systems
Executive Steering Committee (CBS ESC), BSM's top-level governance
council, approved Release 2.1 of the BSM Enterprise Architecture last
week. This release brings the enterprise transition strategy to being
reasonably current. Of course, it will need to be adjusted as we work
through our FY04 and FY05 plans in the coming months.
* Establish and implement a process for determining the type of task
order to be awarded in acquiring modernized systems: All new BSM
contracts for applications software development of over $1 million are
now incentive-based. We are working with the PRIME in a Contracting
Executive Council to institutionalize best contracting processes across
the whole program.
We appreciate your continued support, and the valuable assistance and
guidance from your staff. If you have any questions, or if you would
like to discuss this response in more detail, please contact Fred
Forman, Associate Commissioner for Business Systems Modernization, at
(202) 622-3378.
Sincerely,
Mark W. Everson:
Signed by Mark W. Everson:
[End of section]
Appendix IV: GAO Contacts and Staff Acknowledgments:
GAO Contact:
Gregory C. Wilshusen (202) 512-6244:
Staff Acknowledgments:
In addition to the individual named above, other key contributors were
Bernard R. Anderson, Timothy D. Hopkins, and Chetna Lal.
:
(310190):
:
:
FOOTNOTES
[1] BSM funds are unavailable until IRS submits to congressional
appropriations committees for approval a modernization expenditure plan
that (1) meets the Office of Management and Budget's (OMB) capital
planning and investment control review requirements; (2) complies with
IRS's enterprise architecture; (3) conforms with IRS's enterprise life-
cycle methodology; (4) is approved by IRS, the Department of the
Treasury, and OMB; (5) is reviewed by GAO; and (6) complies with
federal acquisition rules, requirements, guidelines, and systems
acquisition management practices. See P.L. 108-7 (Feb. 20, 2003), and
intervening continuing resolutions for fiscal year 2003 funding, and
P.L. 107-67 (Nov. 12, 2001), for fiscal year 2002 funding.
[2] Since the time of our briefings, a new Commissioner of Internal
Revenue has been confirmed.
[3] Configuration management is the means for ensuring the integrity
and consistency of system modernization program and project products
throughout their life cycles. Through effective configuration
management, for example, integration among related projects and
alignment between projects and the enterprise architecture can be
achieved.
[4] An enterprise transition strategy describes how an organization
will migrate from its current operating environment to its future
operating environment.
