Business Systems Modernization

Internal Revenue Service Needs to Further Strengthen Program Management Gao ID: GAO-04-438T February 12, 2004

The Internal Revenue Service (IRS) has been grappling with modernizing its computer systems for many years. IRS's current program, commonly referred to as Business Systems Modernization (BSM), began in fiscal year 1999; about $1.4 billion has been reported spent on it to date. While progress has been made, the program continues to face significant challenges and risks. In recognition of these risks, IRS and a contractor recently completed several comprehensive assessments of BSM, including one of its Customer Account Data Engine (CADE) project, which is to modernize the agency's outdated data management system. At the request of the Subcommittee on Oversight, House Committee on Ways and Means, GAO's testimony will summarize (1) GAO's prior findings and recommendations, along with those of the recent assessments; and (2) actions IRS has taken or plans to take to address these issues.

Prior GAO reviews have disclosed numerous modernization management control deficiencies that have contributed to reported cost overruns and schedule delays. Costs and completion dates for ongoing projects have grown from their initial estimates. Reasons for such delays include inadequate definition of systems requirements, increases in project scope, and underestimation of project complexity. These impair IRS's ability to make future systems investment decisions and delay delivery of benefits to taxpayers. GAO has made a series of recommendations focusing on stronger program management--and limiting modernization activities until such management practices were in place. IRS has made important progress in implementing management controls, establishing infrastructure, delivering certain business applications, and balancing the pace of the program with the agency's ability to manage it. Nevertheless, IRS needs to further strengthen BSM program management, including fully implementing modernization management controls in such areas as cost and schedule estimating. The recent BSM assessments identified many weaknesses, consistent with prior GAO findings, that contributed to the cost overruns and schedule delays, and offered recommendations to address them. IRS has responded by identifying 46 discrete issues to be resolved; according to the agency, 27 of these have been completed. Commitment of appropriate resources, top management attention, and continuing oversight by Congress and others are critical to the success of BSM.

GAO-04-438T, Business Systems Modernization: Internal Revenue Service Needs to Further Strengthen Program Management This is the accessible text file for GAO report number GAO-04-438T entitled 'Business Systems Modernization: Internal Revenue Service Needs to Further Strengthen Program Management' which was released on February 12, 2004. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittee on Oversight, Committee on Ways and Means, House of Representatives: United States General Accounting Office: GAO: For Release on Delivery Expected at 9:00 a.m. EST: Thursday, February 12, 2004: Business Systems Modernization: Internal Revenue Service Needs to Further Strengthen Program Management: Statement of Robert F. Dacey: Director, Information Security Issues: GAO-04-438T: GAO Highlights: Highlights of GAO-04-438T, testimony before the Subcommittee on Oversight, House Committee on Ways and Means Why GAO Did This Study: The Internal Revenue Service (IRS) has been grappling with modernizing its computer systems for many years. IRS‘s current program, commonly referred to as Business Systems Modernization (BSM), began in fiscal year 1999; about $1.4 billion has been reported spent on it to date. While progress has been made, the program continues to face significant challenges and risks. In recognition of these risks, IRS and a contractor recently completed several comprehensive assessments of BSM, including one of its Customer Account Data Engine (CADE) project, which is to modernize the agency‘s outdated data management system. At the request of the Subcommittee on Oversight, House Committee on Ways and Means, GAO‘s testimony will summarize (1) GAO‘s prior findings and recommendations, along with those of the recent assessments; and (2) actions IRS has taken or plans to take to address these issues. What GAO Found: Prior GAO reviews have disclosed numerous modernization management control deficiencies that have contributed to reported cost overruns and schedule delays. The table below illustrates the degree to which costs and completion dates for ongoing projects have grown from their initial estimates. Reasons for such delays include inadequate definition of systems requirements, increases in project scope, and underestimation of project complexity. These impair IRS‘s ability to make future systems investment decisions and delay delivery of benefits to taxpayers. GAO has made a series of recommendations focusing on stronger program management”and limiting modernization activities until such management practices were in place. IRS BSM Project Cost/Schedule Variance Summary: [See PDF for table] [End of table] IRS has made important progress in implementing management controls, establishing infrastructure, delivering certain business applications, and balancing the pace of the program with the agency‘s ability to manage it. Nevertheless, IRS needs to further strengthen BSM program management, including fully implementing modernization management controls in such areas as cost and schedule estimating. The recent BSM assessments identified many weaknesses, consistent with prior GAO findings, that contributed to the cost overruns and schedule delays, and offered recommendations to address them. IRS has responded by identifying 46 discrete issues to be resolved; according to the agency, 27 of these have been completed. Commitment of appropriate resources, top management attention, and continuing oversight by Congress and others are critical to the success of BSM. www.gao.gov/cgi-bin/getrpt?GAO-04-438T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Robert F. Dacey at (202) 512-3317 or daceyr@gao.gov. [End of section] Mr. Chairman and Members of the Subcommittee: I am pleased to be here today to discuss the Internal Revenue Service's (IRS) actions to modernize its computer systems. Although updated through the years, IRS's set of computer systems is based on an architecture that dates from the 1960s. This architecture has inhibited IRS's ability to effectively and efficiently perform its mission of providing service to taxpayers and enforcing the nation's tax laws. However, IRS's attempts to modernize its computer systems and underlying architecture now span three decades. Given the long history of continuing delays and design difficulties, we previously designated IRS's modernization program as a high-risk area in 1995.[Footnote 1] It remains so today.[Footnote 2] IRS's current multibillion-dollar effort, known as the Business Systems Modernization (BSM) program, was initiated in fiscal year 1999. IRS contracted with Computer Sciences Corporation (CSC) as the prime contractor to assist with designing, developing, and integrating a new set of information systems that were intended to replace IRS's aging business and tax processing systems. To date, about $1.7 billion has been appropriated for the program, including about $388 million for fiscal year 2004.[Footnote 3] To facilitate congressional oversight of this program, annual appropriations laws since fiscal year 1998 have mandated that modernization funds not be available until IRS submits to the congressional appropriations committees for approval a modernization expenditure plan that satisfies six legislative conditions, including that it be reviewed by us.[Footnote 4] We are currently reviewing the fiscal year 2004 BSM expenditure plan. During our past reviews of such plans, we have noted numerous modernization management control deficiencies and made recommendations to correct them. Although IRS has made progress in implementing our recommendations, BSM continues to face significant challenges and serious risks. Recognizing these risks, IRS and CSC recently completed several in-depth and more comprehensive assessments on the health of the BSM program, including an independent technical assessment of the Customer Account Data Engine (CADE) project, a project critical to the success of BSM. IRS has developed an action plan to address the assessments' recommendations, and has begun to act on it. In my testimony today I will summarize our prior findings and recommendations and those of the recently completed program assessments. I will also discuss the actions IRS reports it has taken or plans to take to address issues raised by these assessments. In preparing this testimony, we relied on our prior reports and testimony on IRS's systems modernization activities and BSM expenditure plans. We also reviewed and analyzed information contained in the BSM expenditure plan for fiscal year 2004; Carnegie Mellon University Software Engineering Institute's (SEI) independent technical assessment of CADE; reports on the BSM program by the Treasury Inspector General for Tax Administration and the IRS Oversight Board; and IRS briefing materials (1) analyzing the root causes of BSM project cost increases and schedule delays, (2) independent reviews of CSC's business processes and IRS's procurement practices, and (3) IRS's action plan to address issues identified by the reviews. We did not independently validate planned projects' cost estimates or confirm, through system and project management documentation, the validity of IRS-provided information on the projects' content and progress. Our work was performed during the past month, in accordance with generally accepted government auditing standards. Background: The tax administration system that collects about $2 trillion in revenues each year is critically dependent on a collection of obsolete computer systems developed by the IRS over the last 40 years. IRS envisions a future in which its tax processing environment will be virtually paper-free, and up-to-date taxpayer information will be readily available to IRS employees to respond to taxpayer inquiries. To accomplish this, IRS embarked on its ambitious BSM program. BSM involves the development and delivery of a number of modernized business, data, and core infrastructure projects that are intended to provide improved and expanded service to taxpayers as well as IRS internal business efficiencies. Recognizing the long-term commitment needed to solve the problem of obsolete computer systems, Congress set up a special BSM account in fiscal year 1998 to fund IRS's systems modernization efforts. IRS initiated CADE as part of BSM, to modernize the agency's outdated and inefficient data management system.[Footnote 5] IRS also sees this project as the corporate data source enabling future customer service and financial management applications. CADE is therefore IRS's linchpin modernization project. In light of the projects that depend on CADE, as well as the many interrelationships that are to exist among CADE and IRS's modernized applications and among CADE and current IRS applications, the agency must manage this critical project effectively. Without CADE, the business systems modernization program cannot succeed. IRS Has Made Improvements, But Systems Modernization Program Remains High-Risk: IRS's attempts to modernize its aging computer systems span several decades. This long history of continuing delays and design difficulties led to our designating IRS's Tax Systems Modernization program, BSM's predecessor, as a high-risk area in 1995.[Footnote 6] During the mid- 1990s we reported on several technical and management weaknesses associated with Tax Systems Modernization, a program that began in the 1980s. These weaknesses related to incomplete or inadequate strategic information management practices; immature software development capability; incomplete systems architecture, integration planning, system testing, and test planning practices; and the lack of an effective organizational structure to consistently manage and control systems modernization organizationwide. We made a series of recommendations for correcting these weaknesses and limiting modernization activities until they were corrected.[Footnote 7] IRS subsequently discontinued the program after the agency had spent about $4 billion without receiving expected benefits. In fiscal year 1999, IRS launched the BSM program. IRS contracted with CSC as its prime systems integration services contractor for systems modernization, helping it design new systems and identify other contractors to develop software and perform other tasks. In our reviews of IRS's BSM expenditure plans, we have identified numerous deficiencies in the BSM program, including a continuation of the weaknesses noted above. Also, a consistent challenge for IRS has been to make sure that the pace of systems acquisition projects does not exceed the agency's ability to manage them. In May and November 2000, we reported that projects were in fact getting ahead of the modernization management capacity that needed to be in place to manage them effectively.[Footnote 8] In February 2002 we reported that such an imbalance was due to IRS's first priority and emphasis being on getting the newer, more modern systems--with their anticipated benefits to taxpayers--up and running.[Footnote 9] In so doing, however, management controls had not been given equal attention and thus had not kept pace. This emphasis on new systems added significant cost, schedule, and performance risks that escalate as a program advances. Moreover, these risks increased as IRS moved forward because of interdependencies among projects, and the complexity of associated workload activities to be performed increased dramatically as more systems projects were built and deployed. In addition, we identified other deficiencies in the BSM program, including the need to establish processes that meet the level 2 requirements of the SEI's Software Acquisition Capability Maturity Model',[Footnote 10] and to improve modernization management controls and capabilities, such as those related to configuration management, risk management, enterprise architecture implementation, human capital strategic management, integrated program scheduling, and cost and schedule estimating. In response to our recommendations, IRS has made important progress. First, significant progress has been made in establishing the modernization management controls needed to effectively acquire and implement information technology systems. For example, IRS has: * invested incrementally in its modernization projects; * defined a systems life cycle management methodology, which IRS refers to as the Enterprise Life Cycle; * developed and is using a modernization blueprint, commonly called an enterprise architecture, to guide and constrain its modernization projects; and: * established processes that meet the level 2 requirements of the SEI's Software Acquisition Capability Maturity Model'. Second, IRS has made progress in establishing the infrastructure systems on which future business applications will run. For example, IRS has delivered elements of the Security and Technology Infrastructure Release to provide the hardware, software, and security solutions for modernization projects. IRS has also built an enterprise integration and test environment that provides the environment and tools for multiple vendors associated with a release to perform integration and testing activities. Third, it has delivered certain business applications that are producing benefits today. These applications include: * Customer Communications 2001, to improve telephone call management, call routing, and customer self-service applications; * Customer Relationship Management Examination, to provide off-the- shelf software to IRS revenue agents to allow them to accurately compute complex corporate transactions; and: * Internet Refund/Fact of Filing, to improve customer self-service by providing to taxpayers via the Internet instant refund status information and instructions for resolving refund problems. Fourth, IRS took steps to align the pace of the program with the maturity of IRS's controls and management capacity, including reassessing its portfolio of planned projects. Nevertheless, IRS continued to face challenges to fully develop and implement its modernization management capacity. Last June we reported that IRS had not yet fully implemented a strategic approach to ensuring that it has sufficient human capital resources for implementing BSM, nor had it fully implemented management controls in such areas as configuration management, estimating costs and schedules, and employing performance-based contracting methods.[Footnote 11] We made several recommendations to address those issues. Our analysis has shown that weak management controls contributed directly to the cost, schedule, and/or performance shortfalls experienced by most projects. Given that the tasks associated with those projects that are moving beyond design and into development are by their nature more complex and risky and that IRS's fiscal year 2004 BSM expenditure plan supports progress toward the later phases of key projects and continued development of other projects, systems modernization projects likely will encounter additional cost and schedule shortfalls. IRS will need to continue to assess the balance between the pace of the program and the agency's ability to manage it. Projects Continue to Incur Cost Increases and Schedule Delays: Based on IRS's expenditure plans, BSM projects have consistently cost more and taken longer to complete than originally estimated. Table 1 shows the life cycle variance in cost and schedule estimates for completed and ongoing BSM projects. These variances are based on a comparison of IRS's initial and revised cost and schedule estimates to complete initial operation[Footnote 12] or full deployment[Footnote 13] of the projects. Table 1: IRS BSM Project Cost/Schedule Variance Summary: Project: Completed Projects; Security and Technology Infrastructure Release 1; Cost variance (in thousands): +$7,553; Reported/revised: estimated cost: (in thousands): $41,287; Schedule variance (in months): +5; Reported/revised estimated completion date: 1/31/02; (initial operation). Project: Completed Projects; Customer Communications 2001; Cost variance (in thousands): +5,310; Reported/revised: estimated cost: (in thousands): 46,420; Schedule variance (in months): +9; Reported/revised estimated completion date: 2/26/02; (full deployment). Project: Completed Projects; Customer Relationship Management Exam; Cost variance (in thousands): -1,938; Reported/revised: estimated cost: (in thousands): 7,375; Schedule variance (in months): +3; Reported/revised estimated completion date: 9/30/02; (full deployment). Project: Completed Projects; Human Resources Connect Release 1; Cost variance (in thousands): +200; Reported/revised: estimated cost: (in thousands): 10,200; Schedule variance (in months): 0; Reported/revised estimated completion date: 12/31/02; (initial operation). Project: Completed Projects; Internet Refund/Fact of Filing; Cost variance (in thousands): +12,923; Reported/revised: estimated cost: (in thousands): 26,432; Schedule variance (in months): +14; Reported/revised estimated completion date: 9/26/03; (full deployment). Project: Ongoing Projects[A]; Modernized e-File Release 1; Cost variance (in thousands): +17,057; Reported/revised: estimated cost: (in thousands): 46,303; Schedule variance (in months): +4.5; Reported/revised estimated completion date: 3/31/04; (initial operation). Project: Ongoing Projects[A]; e-Services; Cost variance (in thousands): +86,236; Reported/ revised: estimated cost: (in thousands): 130,281; Schedule variance (in months): +18; Reported/revised estimated completion date: 4/ 30/05; (full deployment). Project: Ongoing Projects[A]; CADE Release 1; Cost variance (in thousands): +36,760; Reported/revised: estimated cost: (in thousands): 97,905; Schedule variance (in months): +30b; Reported/revised estimated completion date: 6/30/05[B]; (full deployment). Project: Ongoing Projects[A]; Integrated Financial System Release 1; Cost variance (in thousands): +53,916; Reported/revised: estimated cost: (in thousands): 153,786; Schedule variance (in months): TBD[B]; Reported/ revised estimated completion date: TBD[B]; (full deployment). Project: Ongoing Projects[A]; Custodial Accounting Project Release 1; Cost variance (in thousands): +72,058; Reported/revised: estimated cost: (in thousands): 119,219; Schedule variance (in months): TBD[B]; Reported/ revised estimated completion date: TBD[B]; (full deployment). Project: Ongoing Projects[A]; Customer Account Management Release 1; Cost variance (in thousands): TBD[C]; Reported/revised: estimated cost: (in thousands): TBD[C]; Schedule variance (in months): TBD[C]; Reported/ revised estimated completion date: TBD[C]. Source: GAO analysis of data contained in IRS's BSM expenditure plans. [A] Projects ongoing as of 9/30/03. [B] Project schedules for CADE, the Integrated Financial System, and the Custodial Accounting Project are currently under review. [C] To be determined. Work on the Customer Account Management project was suspended following the completion of preliminary design activities. No further work is planned until at least fiscal year 2005. [End of table] As the table indicates, the cost and schedule estimates for full deployment of the e-Services project have increased by just over $86 million and 18 months, respectively. In addition, the estimated cost for the full deployment of CADE release 1 has increased by almost $37 million, and project completion has been delayed by 30 months. In addition to the modernization management control deficiencies discussed above, our work has shown that the increases and delays were caused, in part, by: * inadequate definitions of systems requirements. As a result, additional requirements have been incorporated into ongoing projects. * increases in project scope. For example, the e-Services project has changed significantly since the original design. The scope was broadened by IRS to provide additional benefits to internal and external customers. * cost and schedule estimating deficiencies. IRS has lacked the capability to effectively develop reliable cost and schedule estimates. * underestimating project complexity. This factor has contributed directly to the significant delays in the CADE release 1 schedule. * competing demands of projects for test facilities. Testing infrastructure capacity is insufficient to accommodate multiple projects when testing schedules overlap. * project interdependencies. Delays with one project have had a cascading effect and have caused delays in related projects. These schedule delays and cost overruns impair IRS's ability to make appropriate decisions about investing in new projects, delay delivery of benefits to taxpayers, and postpone resolution of material weaknesses affecting other program areas. Producing reliable estimates of expected costs and schedules is essential to determining a project's cost-effectiveness. In addition, it is critical for budgeting, management, and oversight. Without this information, the likelihood of poor investment decisions is increased. Schedule slippages delay the provision of modernized systems' direct benefits to the public. For example, slippages in CADE will delay IRS's ability to provide faster refunds and respond to taxpayer inquiries on a timely basis. Delays in the delivery of modernized systems also affect the remediation of material internal management weaknesses. For example, IRS has reported a material weakness associated with the design of the master files. CADE is to build the modernized database foundation that will replace the master files. Continuing schedule delays will place resolution of this material weakness further out into the future. In addition, the Custodial Accounting Project is intended to address a financial material weakness and permit the tracking from submission to disbursement of all revenues received from individual taxpayers. This release has yet to be implemented, and a revised schedule has not yet been determined. Finally, the Integrated Financial System is intended to address financial management weaknesses. When IRS submitted its fiscal year 2003 BSM expenditure plan, release 1 of the Integrated Financial System was scheduled for delivery on October 1, 2003. However, it has yet to be implemented, and additional cost increases are expected. Internal and Independent Assessments of BSM Have Identified Significant Weaknesses and Risks: Given the continued cost overruns and schedule delays experienced by these BSM projects, IRS and CSC launched internal and independent assessments during 2003 of the health of BSM as whole, as well as CADE. Table 2 describes these assessments. Table 2: BSM Assessments Undertaken During 2003: Subject: Root cause analysis; Organization conducting assessment: IRS; Purpose: To review data from historical documents and interviews to determine root causes for schedule delays and cost increases. Subject: PRIME review; Organization conducting assessment: Bain and Company; Purpose: To identify root causes of breakdown in CSC's business processes and engagement model and provide recommended solutions. Subject: IRS Office of Procurement Assessment; Organization conducting assessment: Acquisition Solutions, Inc.; Purpose: To assess the efficiency and effectiveness of the IRS procurement organization structure, employment of best practices, management and administration, staffing, and to briefly review BSM contracting. Subject: CADE assessment; Organization conducting assessment: SEI; Purpose: To provide an independent technical assessment of CADE program history and the feasibility of future plans. Source: IRS: [End of table] The IRS root cause analysis, PRIME review, and the Office of Procurement assessment revealed several significant weaknesses that have driven project cost overruns and schedule delays, and also provided a number of actionable recommendations for IRS and CSC to address the identified weaknesses and reduce the risk to BSM. Deficiencies identified are consistent with our prior findings and include: * poorly defined requirements, * low program productivity levels, * project scope creep, * IRS/PRIME role confusion, * immature management processes, * ineffective integration across IRS, and: * insufficient applications and technology engineering. As noted, CADE release 1 has experienced significant reported cost overruns and schedule delays throughout its life cycle, and has yet to be delivered. SEI's independent technical assessment of CADE pointed to four primary factors that have caused the project to get off track and resulted in such severe cost and schedule impairments: (1) the complexity of CADE release 1 was not fully understood; (2) the initial business rules engine effort stalled; (3) both IRS and PRIME technical and program management were ineffective in key areas, including significant breakdowns in developing and managing CADE requirements; and (4) the initially contentious relationship between IRS and PRIME hindered communications. SEI also warned that CADE runs the risk of further trouble with later releases due to unexplored/unknown requirements; security and privacy issues that have not been properly evaluated (e.g., online transactions are different from the way IRS does business today); dependence on an unproven business rules engine[Footnote 14] software product; and the critical, expensive, and lengthy business rules harvesting[Footnote 15] effort that has not yet been started. SEI offered several recommendations to address current CADE issues and reduce project risk in the future. IRS Is Acting to Resolve Issues Identified in the BSM Assessments: Based on these assessments, IRS identified a total of 46 specific issues for resolution in the following six areas, and developed a BSM action plan comprising individual action plans to address each issue: * Organization and Roles. Immediate steps are needed to clarify IRS/ PRIME roles and responsibilities and clearly define decision-making authorities. * Key Skills & Strengthening the Team. Strengthened skills and capabilities are needed in such key areas as project management and systems engineering. * Technology-Architecture & Engineering. More focus is needed to improve current systems architecture integration. * Technology-Software Development Productivity & Quality. Improvements in product quality and productivity are essential to strengthening software delivery performance. * Acquisition. Contracting and procurement practices require major streamlining to improve overall contract management. * CADE. Delivery of CADE release 1 will require aggressive focus and attention, and a business rules engine solution requires additional evaluation. These 46 issue action plans were assigned completion dates and an IRS or PRIME owner was assigned to take the lead in implementing each plan. IRS and PRIME each also assigned a senior-level executive to drive the execution of the issue action plans, identify and help mitigate implementation hindrances or roadblocks, and ensure successful completion of all planned actions. To assess the efficacy of the BSM action plan, MITRE was tasked with conducting an independent analysis and provided feedback to IRS on the effectiveness of the specific issue action plans to address the associated findings/recommendations and correct any problems found. IRS has reported making steady progress with implementing the BSM action plan. According to the IRS BSM program office, as of late January 2004, 27 of the 46 issue action plans have been completed. Examples of completed actions include (1) making business owners and program directors accountable for project success; (2) assigning teams to investigate and resolve problem areas on key projects such as CADE, the Integrated Financial System, and e-Services; (3) aligning critical engineering talent to the most critical projects; (4) increasing the frequency of CADE program reviews; and (5) issuing a firm fixed-price contracting policy. Significant further work remains to complete implementation of the remaining 19 open issue action tasks. Bain & Company--which conducted the independent review of PRIME--has been hired to facilitate the implementation of various issue action plans within the Organization and Roles challenge area, while IRS has also contracted with SEI to conduct further periodic reviews of the CADE project. Additionally, the IRS Oversight Board recently issued a report[Footnote 16] on its own independent analysis of the BSM program, which made several observations and recommendations that are consistent with those discussed here. IRS has conducted an analysis of this report to reconcile the board's recommendations with those that are currently being addressed in the BSM action plan. As a result, IRS plans to open two additional issues and action plans to address (1) rationalizing and streamlining oversight of the BSM program, and (2) determining and maintaining a manageable portfolio of projects. IRS expects to complete the majority of the BSM action plan by end of April of this year, and fully implement any remaining open actions by the end of the calendar year. Further, during 2003, the Treasury Inspector General for Tax Administration performed several reviews related to management of the BSM program and for specific BSM projects. These reviews identified several issues, including those related to compliance with the defined management and project development processes, full implementation of disciplined project testing processes and procedures, IRS's cost and schedule estimation process, and contract management. IRS management reaffirmed their commitment to fully implement key management and project development processes. Concluding Observations: IRS's multibillion-dollar BSM program is critical to agency's successful transformation of its manual, paper-intensive business operations and fulfilling its restructuring activities. The agency has made important progress in establishing long-overdue modernization management capabilities and in acquiring foundational system infrastructure and some applications that have benefited the agency and the public. However, our reviews, those of the Treasury inspector general, and the recently completed internal and independent assessments of the BSM program clearly demonstrate that significant challenges and serious risks remain. IRS acknowledges this and is acting to address them. To successfully address these challenges and risks and to modernize its systems, IRS needs to continue to strengthen BSM program management by continuing efforts to: * balance the scope and pace of the program with the agency's capacity to handle the workload, and: * institutionalize the management processes and controls necessary to resolve the deficiencies identified by the reviews and assessments. Commitment of appropriate resources and top management attention are critical to resolving the identified deficiencies. In addition, continuing oversight by the Congress, OMB, and others, as well as ongoing independent assessments of the program, can assist IRS in strengthening the BSM program. Meeting these challenges and improving performance are essential if IRS and the PRIME contractor are to successfully deliver the BSM program and ensure that BSM does not suffer the same fate as previous IRS modernization efforts. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the subcommittee may have at this time. Contacts and Acknowledgments: For information about this testimony, please contact me at (202) 512- 3317 or by e-mail at daceyr@gao.gov. Individuals making key contributions to this testimony include Bernard R. Anderson, Michael P. Fruitman, Timothy D. Hopkins, and Gregory C. Wilshusen. FOOTNOTES [1] U.S. General Accounting Office, High-Risk Series: An Overview, GAO/ HR-95-1 (Washington, D.C.: February 1995). [2] U.S. General Accounting Office, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.: January 2003). [3] P.L. 108-199, Div. F, Title II, Jan. 23, 2004. IRS uses the appropriated totals to cover contractor costs related to the BSM program. IRS funds internal costs for managing BSM with another appropriation. These costs are not tracked separately for BSM-related activities. [4] The other five legislative conditions are that the expenditure plan (1) meets Office of Management and Budget's (OMB) capital planning and investment control review requirements; (2) complies with IRS's enterprise architecture; (3) conforms with IRS's enterprise life cycle methodology; (4) is approved by IRS, Treasury, and OMB; and (5) complies with federal acquisition rules, requirements, guidelines, and system acquisition management practices. [5] The current system--referred to by IRS as the master files-- contains taxpayer account and return data. There are master files for individuals, businesses, and employer retirement plans. A nonmaster file for taxpayer data also exists that cannot be stored in the other master files due to data format and space limitations. [6] GAO/HR-95-1. [7] U.S. General Accounting Office, Tax Systems Modernization: Management and Technical Weaknesses Must Be Corrected If Modernization Is to Succeed, GAO/AIMD-95-156 (Washington, D.C.: July 26, 1995) and Tax Systems Modernization: Blueprint Is a Good Start, But Not Yet Sufficiently Complete to Build or Acquire Systems, GAO/AIMD/GGD-98-54 (Washington, D.C.: Feb. 24, 1998). [8] U.S. General Accounting Office, Tax Systems Modernization: Results of Review of IRS' March 7, 2000, Expenditure Plan, GAO/AIMD-00-175 (Washington, D.C.: May 24, 2000) and Tax Systems Modernization: Results of Review of IRS' August 2000 Interim Spending Plan, GAO-01-91 (Washington, D.C.: Nov. 8, 2000). [9] U.S. General Accounting Office, Business Systems Modernization: IRS Needs to Better Balance Management Capacity with Systems Acquisition Workload, GAO-02-356 (Washington, D.C.: Feb. 28, 2002). [10] Carnegie Mellon University's Software Engineering Institute has developed criteria, known as the Software Acquisition Capability Maturity Model,' for determining organizations' software acquisition management effectiveness or maturity. A Level 2 organization has established its basic project management processes in the following key process areas: acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, evaluation, and transition to support. [11] U.S. General Accounting Office, Business Systems Modernization: IRS Has Made Significant Progress in Improving Its Management Controls, but Risks Remain, GAO-03-768 (Washington, D.C.: June 27, 2003) [12] Initial operation refers to the point at which a project is authorized to begin enterprisewide deployment. [13] Full deployment refers to the point at which enterprisewide deployment has been completed and a project is transitioned to operations and support. [14] A business rules engine translates business rules, or processing criteria (e.g., income tax refunds of $x or more are held for administrative review), into executable computer code which processes transactions related to a tax form, and selects and executes correct rules based on the tax year and tax form. [15] Business rules harvesting refers to the process of extracting, defining, and documenting tax processing criteria from a variety of sources, including IRS subject matter experts, legacy system source code, the tax code, and various other paper documents. [16] IRS Oversight Board Special Report, Independent Analysis of IRS Business Systems Modernization, December 2003.