Business Systems Modernization
Internal Revenue Service's Fiscal Year 2010 Expenditure Plan
Gao ID: GAO-10-539 May 10, 2010
The Internal Revenue Service's (IRS) Business Systems Modernization (BSM) program is a multi-billion dollar, high risk, highly complex effort that involves the development and delivery of a number of modernized systems that are intended to replace the agency's aging business and tax processing systems. As required, IRS submitted its fiscal year 2010 expenditure plan in November 2009 to the House and Senate appropriations committees, requesting approximately $254 million from the BSM account. GAO's objectives in reviewing the expenditure plan were to (1) determine whether it satisfies the applicable legislative conditions, (2) determine IRS's progress in implementing prior expenditure plan review recommendations, and (3) provide additional observations about the plan and the BSM program. To accomplish the objectives, GAO analyzed the plan, reviewed related documentation, and interviewed IRS officials.
IRS's expenditure plan satisfies five of the six legislative conditions, and partially satisfies the condition to comply with acquisition rules, requirements, guidelines, and systems acquisition management practices used by the federal government. IRS has initiated an effort to improve its software acquisition and development practices, but does not expect to have changes in place until November 2010, at the earliest. IRS has addressed two of GAO's prior recommendations to improve its management capabilities and controls. Specifically, IRS has completed a plan with specific time frames for implementing the initiatives supporting its information technology human capital strategy and has defined procedures for determining when to grant conditional milestone exits. However, work remains in order to fully implement GAO recommendations to develop long-term plans for completing the BSM and developing a quantitative measure of scope. GAO made the following observations about the expenditure plan and the BSM program: (1) GAO's analysis of reported project costs and completion dates shows that 6 of the 10 project milestones planned for fiscal year 2009 were completed early or within 10 percent of cost and schedule estimates and 3 milestones were completed on schedule but were more than 10 percent over planned cost. IRS did not include underlying causes for these cost variances in its expenditure plan. Further, GAO was not able to determine cost and schedule variances for a milestone of the Modernized e-File--the system intended to provide a single standard for filing electronic tax returns--because IRS had not identified planned cost and schedule information for it in the fiscal year 2009 expenditure plan. IRS also did not report completing this milestone in its expenditure plan, and Congress therefore was not provided with information on the system's progress. (2) IRS began development of a new strategy for managing individual taxpayer accounts to address several challenges confronting the Customer Account Data Engine, which was intended to replace the antiquated Individual Master File containing the repository of individual taxpayer information. While much has been done to define the strategy's transition states--or key phases--IRS has not identified time frames for completing key planning activities for fiscal year 2010 for the second transition state. (3) IRS has identified several risks associated with defining and implementing the new strategy (e.g., the ability to deliver capabilities could be jeopardized if the scope is not rigorously managed) and has classified these risks into five categories. IRS reported that it has developed mitigation strategies for the risks that it has identified. (4) Information security weaknesses continue to affect IRS's modernization environment. As GAO recently reported, IRS continues to have weaknesses in its information security controls. Additionally, while IRS reported that it had corrected about 40 percent of previously reported weaknesses, GAO found that it had not fully implemented the remedial actions it had reported for at least a third of those that it considered corrected.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director:
David A. Powner
Team:
Government Accountability Office: Information Technology
Phone:
No phone on record
GAO-10-539, Business Systems Modernization: Internal Revenue Service's Fiscal Year 2010 Expenditure Plan
This is the accessible text file for GAO report number GAO-10-539
entitled 'Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2010 Expenditure Plan' which was released on May 10, 2010.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
United States Government Accountability Office:
GAO:
May 2010:
Business Systems Modernization:
Internal Revenue Service's Fiscal Year 2010 Expenditure Plan:
GAO-10-539:
GAO Highlights:
Highlights of GAO-10-539, a report to congressional committees.
Why GAO Did This Study:
The Internal Revenue Service‘s (IRS) Business Systems Modernization
(BSM) program is a multi-billion dollar, high risk, highly complex
effort that involves the development and delivery of a number of
modernized systems that are intended to replace the agency‘s aging
business and tax processing systems. As required, IRS submitted its
fiscal year 2010 expenditure plan in November 2009 to the House and
Senate appropriations committees, requesting approximately $254
million from the BSM account.
GAO‘s objectives in reviewing the expenditure plan were to (1)
determine whether it satisfies the applicable legislative conditions,
(2) determine IRS‘s progress in implementing prior expenditure plan
review recommendations, and (3) provide additional observations about
the plan and the BSM program. To accomplish the objectives, GAO
analyzed the plan, reviewed related documentation, and interviewed IRS
officials.
What GAO Found:
IRS‘s expenditure plan satisfies five of the six legislative
conditions, and partially satisfies the condition to comply with
acquisition rules, requirements, guidelines, and systems acquisition
management practices used by the federal government. IRS has initiated
an effort to improve its software acquisition and development
practices, but does not expect to have changes in place until November
2010, at the earliest.
IRS has addressed two of GAO‘s prior recommendations to improve its
management capabilities and controls. Specifically, IRS has completed
a plan with specific time frames for implementing the initiatives
supporting its information technology human capital strategy and has
defined procedures for determining when to grant conditional milestone
exits. However, work remains in order to fully implement GAO
recommendations to develop long-term plans for completing the BSM and
developing a quantitative measure of scope. GAO made the following
observations about the expenditure plan and the BSM program:
* GAO‘s analysis of reported project costs and completion dates shows
that 6 of the 10 project milestones planned for fiscal year 2009 were
completed early or within 10 percent of cost and schedule estimates
and 3 milestones were completed on schedule but were more than 10
percent over planned cost. IRS did not include underlying causes for
these cost variances in its expenditure plan. Further, GAO was not
able to determine cost and schedule variances for a milestone of the
Modernized e-File-”the system intended to provide a single standard
for filing electronic tax returns-”because IRS had not identified
planned cost and schedule information for it in the fiscal year 2009
expenditure plan. IRS also did not report completing this milestone in
its expenditure plan, and Congress therefore was not provided with
information on the system‘s progress.
* IRS began development of a new strategy for managing individual
taxpayer accounts to address several challenges confronting the
Customer Account Data Engine, which was intended to replace the
antiquated Individual Master File containing the repository of
individual taxpayer information. While much has been done to define
the strategy‘s transition states-”or key phases”-IRS has not
identified time frames for completing key planning activities for
fiscal year 2010 for the second transition state.
* IRS has identified several risks associated with defining and
implementing the new strategy (e.g., the ability to deliver
capabilities could be jeopardized if the scope is not rigorously
managed) and has classified these risks into five categories. IRS
reported that it has developed mitigation strategies for the risks
that it has identified.
* Information security weaknesses continue to affect IRS‘s
modernization environment. As GAO recently reported, IRS continues to
have weaknesses in its information security controls. Additionally,
while IRS reported that it had corrected about 40 percent of
previously reported weaknesses, GAO found that it had not fully
implemented the remedial actions it had reported for at least a third
of those that it considered corrected.
What GAO Recommends:
GAO is recommending that the Commissioner of Internal Revenue take
several actions to improve program management capabilities and
controls, including ensuring that underlying causes for project cost
and schedule variances are consistently provided in the expenditure
plan. In commenting on a draft of this report, IRS stated it would
review the recommendations and provide a detailed corrective action
plan to address them.
View [hyperlink, http://www.gao.gov/products/GAO-10-539] or key
components. For more information, contact David A. Powner at (202) 512-
9286 or pownerd@gao.gov.
[End of section]
Contents:
Letter:
Conclusions:
Recommendations for Executive Action:
Agency Comments:
Appendix I: Briefing Slides from the March 9, 2010, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
Appendix II: Comments from the Internal Revenue Service:
Appendix III: GAO Contact and Staff Acknowledgments:
Abbreviations:
AMS: Accounts Management Services:
BSM: Business Systems Modernization:
CADE: Customer Account Data Engine:
CADE 2: Customer Account Data Engine 2:
CIO: Chief Information Officer:
CMMI: Capability Maturity Model Integration:
CTO: Chief Technology Officer:
EA: enterprise architecture:
ELC: enterprise life cycle:
IMF: Individual Master File:
INF: infrastructure:
IPM: integrated production model:
IRS: Internal Revenue Service:
LOE: level of effort:
MCL: maintaining current levels:
MeF: Modernized e-File:
MER: Milestone Exit Review:
MITS: Modernization and Information Technology Services:
MV&S: Modernization Vision and Strategy:
OMB: Office of Management and Budget:
PMO: Program Management Office:
SEI: Software Engineering Institute:
TIGTA: Treasury Inspector General for Tax Administration:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
May 10, 2010:
The Honorable Richard J. Durbin:
Chairman:
The Honorable Susan Collins:
Ranking Member:
Subcommittee on Financial Services and General Government:
Committee on Appropriations:
United States Senate:
The Honorable José E. Serrano:
Chairman:
The Honorable Jo Ann Emerson:
Ranking Member:
Subcommittee on Financial Services and General Government:
Committee on Appropriations:
House of Representatives:
As required, the Internal Revenue Service (IRS) submitted its fiscal
year 2010 expenditure plan in November 2009 to the House and Senate
appropriations committees, requesting approximately $254 million from
the Business Systems Modernization (BSM) account, which funds IRS's
efforts to modernize its business and tax processing systems.[Footnote
1] Our objectives in reviewing the plan were to (1) determine whether
the plan satisfies the applicable legislative conditions,[Footnote 2]
(2) determine IRS's progress in implementing our prior
recommendations, and (3) provide any other observations about the plan
and IRS's BSM program.
This report transmits the information we provided to congressional
appropriations subcommittee staffs during our March 9, 2010, briefing
and provides the recommendations that we made to the Commissioner of
Internal Revenue. The full briefing materials, including our scope and
methodology, are included as appendix I.
We conducted this performance audit from November 2009 to March 2010
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our
findings and conclusions based on our audit objectives.
In summary, we made the following major points:
* IRS's fiscal year 2010 plan satisfies five of the six legislative
conditions, and partially satisfies the condition to comply with
acquisition rules, requirements, guidelines, and systems acquisition
management practices used by the federal government.[Footnote 3] IRS
has not fully established disciplined practices for software
acquisition.[Footnote 4] IRS has initiated an effort to improve its
software acquisition and development practices, but does not expect to
have disciplined processes in place until November 2010, at the
earliest.
* IRS has addressed two of our prior recommendations to improve its
management capabilities and controls, including our recommendation to
complete a plan with specific time frames for implementing the
initiatives supporting IRS's information technology human capital
strategy and define procedures for determining when to grant
conditional milestone exits. However, work remains to fully implement
our recommendations to develop long-term plans for completing BSM and
develop a quantitative measure of scope.
* Of 10 project milestones[Footnote 5] planned for fiscal year 2009, 6
were completed early or within 10 percent of cost and schedule
estimates and 3 were completed on schedule but were more than 10
percent over cost. For 1 of the milestones, we could not determine
cost or schedule variances because IRS had not identified planned cost
and schedule information in the fiscal year 2009 expenditure plan. A
release[Footnote 6] of the Customer Account Data Engine[Footnote 7]
(CADE) intended to implement legislative changes for filing season
2010 completed the detailed design phase on cost and schedule; by
contrast, the release of the Accounts Management Services (AMS) system
[Footnote 8] intended, among other things, to provide for the
conversion of the Correspondence Imaging System (a legacy system) to a
new platform for inventory management, completed the development phase
127 percent over cost. In its expenditure plan, IRS attributed the
variances for the milestones over planned cost to the need to fund the
projects in excess of planned amounts. However, the agency did not
include underlying causes for the variances in the plan. Finally, we
were not able to determine cost or schedule variances of a milestone
of Modernized e-File[Footnote 9] release 6.1, because IRS had not
identified planned cost and schedule information for it in the fiscal
year 2009 expenditure plan. IRS also did not report completing this
milestone in its expenditure plan, and Congress therefore was not
provided with information on progress in delivering functionality.
* IRS began development of a new strategy for managing individual
taxpayer accounts, but time frames for completing key planning
activities scheduled to occur during fiscal year 2010 have not yet
been defined. In August 2008, IRS began defining the strategy to
address several challenges confronting CADE, including that the
approach to develop the system was more complex and taking longer than
initially anticipated, and also take advantage of the availability of
new technologies. IRS expects the strategy, generally referred to as
CADE 2, to deliver benefits, including faster refunds for all
individual taxpayers, in two transition states--or key phases--
beginning in filing season 2012.[Footnote 10] While much has been done
to define these transition states, IRS has not identified time frames
for completing key planning activities during fiscal year 2010 for the
second transition state.[Footnote 11]
* IRS has identified several risks associated with defining and
implementing CADE 2 (e.g., the ability to deliver capabilities could
be jeopardized if the scope is not rigorously managed). IRS has
classified these risks into five categories: delivery, program,
people, technology and complexity, and management. The Department of
the Treasury's Inspector General for Tax Administration (TIGTA) also
recently identified several challenges that IRS needs to address to
effectively manage identified risks including, among other things,
developing contingency plans in the event that CADE 2 cannot be fully
implemented. IRS reported that it has developed mitigation strategies
for the risks it has identified and stated that it found TIGTA's
assessment to be valid.
* Information security weaknesses continue to affect IRS's
modernization environment. In November 2009[Footnote 12] and March
2010,[Footnote 13] we reported that, while IRS continued to make
progress in correcting previously reported information security
weaknesses, weaknesses in internal controls over information security
continue to place IRS systems at risk. Additionally, while IRS had
informed us that it corrected about 40 percent of the previously
reported weaknesses, we found that it had not fully implemented the
remedial actions it reported for at least a third of those that it
considered corrected. Further, in August 2009,[Footnote 14] TIGTA
reported that while IRS had taken steps to address several CADE system
security vulnerabilities it had identified in a previous audit, some
had been fully resolved and others could not be resolved until actions
were completed to ensure controls are effectively in place or have
been approved as deviations to IRS policy. IRS is taking steps to
address recommendations from GAO and TIGTA and has stated that it
expects CADE 2 to fully address the security weaknesses that are
currently confronting CADE. While current and planned actions to
improve its security posture are positive steps, IRS's modernization
environment will continue to be at risk until the agency has fully
addressed its information security weaknesses.
Conclusions:
During fiscal year 2009, IRS continued to deliver BSM projects,
although work on planned releases of CADE and AMS was either modified
or suspended pending completion of efforts to define the agency's new
strategy to manage individual taxpayer accounts. IRS generally made
progress in addressing outstanding recommendations from our prior
expenditure plan reviews. However, the expenditure plan explanations
for significant project cost variances did not always provide
information on root causes, limiting Congress's insight into areas
that need improvement. Further, because IRS did not report one
completed project milestone for which it had not identified specific
plans in the fiscal year 2009 expenditure plan, Congress did not
receive information on progress in delivering key functionality.
Finally, while much has been done to define the transition states of
the CADE 2 strategy for managing individual taxpayer accounts,
specific time frames for addressing key planning activities for the
second transition state, including defining core requirements, have
not been defined. Having these time frames would guide progress in
completing activities that are foundational to the transition state.
Recommendations for Executive Action:
To improve the program management capabilities and controls that are
critical to the effective management of the BSM program, we are
recommending that the Commissioner of Internal Revenue direct the IRS
Chief Technology Officer to take the following three actions:
1. Ensure that explanations of project cost and schedule variances
provided in the expenditure plan consistently include underlying
causes.
2. For individual milestones that have been combined, report available
performance information in the expenditure plan to provide Congress
with information on progress in delivering functionality.
3. Define specific time frames for CADE 2 transition state 2 planning
activities, including defining a core set of requirements, to guide
progress.
Agency Comments:
IRS's Deputy Commissioner for Operations Support provided written
comments on a draft of this report (reprinted in app. II). He stated
that IRS appreciated that the report recognizes progress made to
improve its program management capabilities and controls. He also
stated that IRS would review the recommendations to ensue its actions
include assuring that underlying causes for project cost and schedule
variances are consistently provided in the expenditure plan.
Additionally, IRS stated that it would provide the detailed corrective
action plan addressing each of the recommendations.
We are sending copies of this report to the Chairmen and Ranking
Members of the Senate and House committees and subcommittees that have
appropriations, authorization, and oversight responsibilities for IRS.
We are also sending copies to the Commissioner of Internal Revenue,
the Secretary of the Treasury, the Chairman of the IRS Oversight
Board, and the Director of the OMB. In addition, the report will be
available at no charge on the GAO Web site at [hyperlink,
http://www.gao.gov].
Should you and your offices have questions on matters discussed in
this report, please contact me at (202) 512-9286 or at
pownerd@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. GAO staff who made key contributions to this report are listed
in appendix III.
Signed by:
David. A. Powner:
Director, Information Technology Management Issues:
[End of section]
Appendix I: Briefing Slides from the March 9, 2010, Briefing to the
Senate and House Appropriations Subcommittee Staffs:
Review of IRS's Fiscal Year 2010 Business Systems Modernization
Expenditure Plan:
Briefing for Staff Members of the:
Subcommittee on Financial Services and General Government, Committee
on Appropriations, U.S. Senate:
and the:
Subcommittee on Financial Services and General Government, Committee
on Appropriations, House of Representatives:
March 9, 2010:
Contents:
Introduction and Objectives;
Scope and Methodology;
Results in Brief;
Background Results;
Conclusions;
Recommendations for Executive Action;
Agency Comments and Our Evaluation;
Appendixes:
* I: Description of Business Systems Modernization Projects and
Program-Level Initiatives;
* II: Additional Detail on IRS's Fiscal Year 2010 BSM Expenditure Plan;
* III: IRS-Reported Project Cost and Schedule for Projects Scheduled
for Completion in Fiscal Year 2009.
Introduction and Objectives:
The Internal Revenue Service's (IRS) Business Systems Modernization
(BSM) program is a multi-billion-dollar, high-risk, highly complex
effort that involves the development and delivery of a number of
modernized tax administration and internal management systems, as well
as core infrastructure projects, that are intended to replace the
agency's aging business and tax processing systems and provide
improved and expanded service to taxpayers and internal business
efficiencies for IRS. Initiated in fiscal year 1999, BSM is IRS's
current effort to modernize its systems. IRS contracted with Computer
Sciences Corporation as the prime systems integration support
contractor to assist with designing, developing, and integrating the
new set of information systems comprised by BSM. In fiscal year 2006,
IRS developed a new Modernization Vision and Strategy (MV&S) in
response to our recommendation to fully revisit the vision and
strategy for the BSM program and develop a new set of long-term goals,
strategies, and plans consistent with the budgetary outlook and IRS's
management capabilities.[Footnote 15] The MV&S represented a new
approach to modernizing IRS's information technology environment. For
example, while at the outset the BSM program assumed complete
replacement of existing systems, the MV&S among other things provides
for leveraging existing systems where appropriate. Other principles of
the MV&S include involving joint business and IT leadership throughout
the process, and delivering smaller, incremental releases more
frequently.
Prompted by several challenges confronting the Customer Account Data
Engine (CADE)”including that the approach to develop the system was
more complex and taking longer than initially anticipated”the IRS
Commissioner initiated a study of IRS's IT systems modernization
efforts from an overall portfolio perspective, which included
operations of existing systems, new system developments, and
information security. The results of the study led to the decision to
refocus modernization efforts on the accelerated completion of the
modernized taxpayer account database that has been under development
since 2002. The resulting strategy, generally referred to as CADE 2,
is expected to deliver key benefits beginning in filing season 2012.
IRS has reported that CADE 2 is central to its vision for ongoing
improvements to its tax administration systems. Specifically, through
CADE 2, IRS expects to (1) accelerate delivery of a relational
taxpayer account database from at least 7 years under the initial
approach to approximately 2 years and (2) more quickly move to a
single tax processing environment (instead of the two environments
that currently exist). It is expected that CADE 2 will result in
faster refunds, improved customer service, elimination of notices
based on out-of-date information, faster resolution of taxpayer
account issues, and better online tools and services for taxpayers.
The Consolidated Appropriations Act, 2010,[Footnote 16] provides
appropriations for IRS for fiscal year 2010, including for BSM. The
act prohibits IRS from obligating funds (excluding labor costs) for
the BSM program until IRS submits a modernization expenditure plan to
the relevant congressional appropriations committees.[Footnote 17]
This plan must:
* meet the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB);
* comply with IRS's enterprise architecture;[Footnote 18]
* conform with IRS's enterprise life cycle methodology;[Footnote 19]
* comply with federal acquisition rules, requirements, guidelines, and
systems acquisition management practices;
* be approved by IRS, the Department of the Treasury, and OMB; and
* be reviewed by GAO.
Since mid-1999, IRS has submitted a series of expenditure plans for
BSM appropriations. To date, IRS has received about $2.8 billion for
the BSM effort.
On November 4, 2009, IRS submitted its fiscal year 2010 expenditure
plan to the Subcommittees on Financial Services and General Government
of the Senate and House of Representatives Committees on
Appropriations, seeking release of approximately $254 million from the
BSM account.[Footnote 20]
As agreed with IRS's appropriations subcommittees, our objectives were
to:
* determine whether IRS's fiscal year 2010 expenditure plan satisfies
the applicable legislative conditions;
* provide an update on IRS's progress in implementing our prior
expenditure plan review recommendations; and;
* provide any other observations about the expenditure plan and IRS's
BSM program.
[End of section]
Scope and Methodology:
To accomplish our objectives, we:
* reviewed the fiscal year 2010 expenditure plan submitted by IRS in
November 2009;
* analyzed the plan for compliance with the applicable legislative
conditions;
* interviewed IRS program and project management officials to
corroborate our understanding of the plan and other BSM activities;
* analyzed available evidence on recent agency efforts to implement
our prior recommendations, including progress on improving its
modernization management controls and capabilities;
* reviewed and analyzed modernization program review and project
management briefings and related documentation to assess program and
project status and associated issues and risks;
* reviewed program management reports to assess the progress IRS has
made in completing actions and implementing program management
improvements; and;
* reviewed related reports by the Treasury Inspector General for Tax
Administration (TIGTA).
To assess the reliability of the cost and schedule information
contained in this expenditure plan, we interviewed IRS officials in
order to gain an understanding of the data and discussed our use of
the data in this briefing. In addition, we confirmed that information
in the plan was consistent with information contained in internal IRS
briefings and other governance process artifacts. We did not, however,
assess the accuracy and reliability of the information contained in
these documents.
We conducted this performance audit from November 2009 to March 2010
in Washington, D.C., in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
IRS's fiscal year 2010 expenditure plan satisfies five of the six
legislative conditions, and partially satisfies the condition to
comply with the acquisition rules, requirements, guidelines, and
systems acquisition management practices used by the federal
government. IRS has not fully established disciplined practices for
software acquisition.[Footnote 21] While IRS has initiated an effort
to improve its software acquisition and development practices, it
stated that it does not expect to have these in place until November
2010 at the earliest.
IRS has implemented two of our four previous recommendations to
improve its management capabilities and controls. Specifically, IRS
has completed a plan with specific time frames for implementing the
initiatives supporting its IT human capital strategy and has defined
procedures for determining when to grant conditional milestone exits.
However, steps remain to implement our recommendations to (1) develop
long-term plans for completing BSM and consolidating and retiring
legacy systems and (2) develop a quantitative measure of progress in
delivering systems' planned functionality (scope). Regarding the long-
term plans for completing BSM, IRS began working on a new strategy in
2008, and, at the conclusion of our review, provided us with key
planning documents. Regarding the quantitative measure of progress for
delivering planned functionality, IRS expects to have a measure
developed by the end of this month. Fully developing long-term plans
and developing a quantitative measure will help IRS in managing and
controlling BSM.
We have four observations related to the BSM program and fiscal year
2010 expenditure plan:
* Of 10 project milestones[Footnote 22] planned for fiscal year 2009,
6 were completed within 10 percent of cost and schedule estimates or
early, and 3 were completed on schedule but more than ten percent over
cost. For 1 of the milestones, we could not determine cost or schedule
variances because IRS had not identified planned cost and schedule
information in the fiscal year 2009 expenditure plan. A release
[Footnote 23] of CADE intended to implement legislative changes for
filing season 2010 completed the detailed design phase on cost and
schedule; by contrast, the release of the Account Management Services
intended, among other things, to provide for the conversion of the
Correspondence Imaging System to a new platform for inventory
management, completed the development phase127 percent over cost. In
its expenditure plan, IRS attributed the variances for the milestones
over planned cost to the need to fund the projects in excess of
planned amounts. However, the agency did not include underlying causes
for the variances in the plan. Finally, we were not able to determine
cost or schedule variances of a milestone of Modernized e-File,
release 6.1, because IRS had not identified planned cost and schedule
information for it in the fiscal year 2009 expenditure plan. IRS also
did not report completing this milestone in its expenditure plan, and
Congress therefore was not provided with information on progress in
delivering functionality.
* IRS began development of a new modernization strategy, but time
frames for completing key planning activities to be completed during
fiscal year 2010 have not yet been defined. In August 2008, IRS began
to define a new strategy for managing individual taxpayer accounts
that was to address several challenges confronting its Customer
Account Data Engine and also take advantage of the availability of new
technologies. IRS expects the strategy, generally referred to as CADE
2, to deliver benefits, including faster refunds for all individual
taxpayers, in two transition stages beginning in filing season 2012.
While much has been done to define these stages, IRS has not
identified time frames for completing key planning activities during
fiscal year 2010 for the second transition stage.
* CADE 2 faces several risks. IRS has identified several risks
associated with defining and implementing CADE 2 (e.g., the ability to
deliver capabilities could be jeopardized if the scope is not
rigorously managed). IRS has classified these risks into five
categories: delivery, program, people, technological and complexity,
and management. Treasury's Inspector General for Tax Administration
also recently identified several challenges that IRS needs to address
to effectively manage identified risks, including, among other things,
developing contingency plans in the event that CADE 2 cannot be fully
implemented. IRS reported that it has developed mitigation strategies
for the risks it has identified and stated that it found TIGTA's
assessment to be valid.
* Information security weaknesses continue to affect IRS's
modernization environment. In November 2009, we reported that while
IRS continued to make progress in correcting previously reported
information security weaknesses, weaknesses in internal controls over
information security continue to place IRS systems at risk.
Additionally, while IRS had informed us that it corrected about 40
percent of the previously reported weaknesses, we found that it had
not fully implemented the remedial actions it reported for at least a
third of those that it considered corrected. Further, in August 2009,
TIGTA reported that while IRS had taken steps to address several CADE
system security vulnerabilities it had identified in a previous audit,
some had been fully resolved and others could not be resolved until
actions are completed to ensure controls were effectively in place or
had been approved as deviations to IRS policy. IRS is taking steps to
address recommendations from GAO and TIGTA and has stated that it
expects to fully address the security weaknesses that are currently
confronting CADE in Transition State 2 of CADE 2. While current and
planned actions to improve its security posture are positive steps,
IRS's modernization environment will continue to be at risk until the
agency has fully addressed its information security weaknesses.
[End of section]
Results in Brief:
We are recommending that IRS:
* consistently include underlying causes in the explanations of
project cost and schedule variances provided in the expenditure plan;
* for individual milestones that have been combined, report available
performance information in the expenditure plan to provide Congress
with information on progress in delivering functionality; and;
* define time frames for completing key planning activities for a key
transition stage of CADE 2.
In e-mail comments and subsequent oral comments from the IRS's Chief
Technology Officer (CTO) on a draft of these briefing slides, the CTO
agreed with much of the information presented but disagreed with two
of our findings and with two of our recommendations. Specifically, he
disagreed with our finding that IRS partially complies with the
acquisition rules, requirements, guidelines, and systems acquisition
management practices used by the government, stating that there is no
requirement for federal agencies to use the cited practices. While not
required, it is recognized that, without these practices, software
acquisition processes are typically ad hoc and chaotic. The CTO also
disagreed with our finding that IRS had not fully implemented our
recommendation to develop a longterm plan for BSM, stating that it
believed that it had addressed this by providing the Modernization
Vision and Strategy (MV&S) in fiscal year 2006. We acknowledge IRS's
recent update of the MV&S with the CADE 2 strategy and plan to review
recently provided key planning documents to determine if IRS has now
fully implemented this recommendation.
Regarding our recommendation to ensure that the explanations of
project cost and schedule variances provided in the expenditure plan
include underlying causes, IRS stated that the expenditure plan
consistently provides narrative explanations of all project segment
cost and schedule variances, in addition to the attribution of those
variances. Our point is that the underlying causes for the cost
variances for three AMS milestones were not in the plan, in accordance
with IRS's own guidance, although IRS subsequently provided us with
these causes in response to our queries. Regarding our recommendation
to report on project milestones delivered for which specific cost and
schedule estimates were not identified in the previous year's
expenditure plan (due to milestones being combined), the CTO commented
that, when milestones are combined within a project segment, IRS
generally does not develop or track specific cost and schedule
estimates for the individual project milestones and that, given this,
only the overall cost and schedule estimate for the combined milestone
segment is reported in the expenditure plan. However, in the case of
MeF, IRS developed and tracked some of this information but did not
report it. Reporting this information would improve the transparency
of IRS's progress in delivering functionality. IRS also provided
technical comments which we have addressed as appropriate.
Since 1999, we have reviewed and reported on numerous BSM expenditure
plans. In particular, we have reported on program management
capabilities and controls that are critical to the effective
management of the BSM program. They include:
* cost and schedule estimates: IRS did not have effective procedures
for validating contractor-developed cost and schedule estimates;
[Footnote 24]
* requirements development and management: IRS did not have adequate
policies and procedures in place to guide its system modernization
projects in developing and managing requirements;[Footnote 25]
* post-implementation reviews: post-implementation reviews conducted
were incomplete and did not follow IRS procedures;[Footnote 26]
* quantitative measures of progress in scope: IRS expenditure plans
did not have a quantitative measure of progress in meeting project
scope expectations;[Footnote 27] and;
* conditional milestone exits: IRS did not have documented procedures
for determining when projects were allowed to proceed to the next
milestone with outstanding issues remaining to be addressed (i.e.,
conditional milestone exits).[Footnote 28]
We have made recommendations aimed at strengthening IRS's program
management controls and capabilities. Over the years, IRS has
addressed several of these recommendations. However, more work remains
for key capabilities and controls to be fully institutionalized or
implemented.
[End of section]
Background:
As previously noted, the BSM program is driven by IRS's Modernization
Vision and Strategy (MV&S).[Footnote 29] However, the CADE 2 strategy
that is currently being defined will redefine the approach for
elements of the MV&S.
IRS's Modernization and Information Technology Services (MITS)
organization has primary responsibility for managing and delivering
the BSM program. Headed by a Chief Technology Officer[Footnote 30] who
is supported by, among others, the Deputy Chief Information Officer
(CIO) for Strategy/Modernization and the Chief Information Officer,
MITS is comprised of eight Associate CIO-level organizations,
including:
* Applications Development, which delivers applications for the MV&S
and other applications to support the filing season and maintains
legacy systems;
* Enterprise Services, which sets enterprise technology and process
standards to promote compatibility and common practices across the IT
organization;
* Strategy and Planning, which was established in August 2009 to
facilitate the alignment of information technology and business
through strategic planning and financial management practices that
provide visibility into the overall demand for supply, and value of IT
investments; and;
* CADE 2 Program Management Office, which was established in July 2009
to oversee the implementation of CADE 2.
IRS's fiscal year 2010 expenditure plan describes the agency's efforts
to develop modernized systems and supporting infrastructure.17 They
include:
* continuing ongoing program-level initiatives (e.g., architecture and
integration and program management) and core infrastructure projects
(e.g., infrastructure shared services),
* continuing two tax administration project releases to their next
milestones, and,
* continuing to define and starting to implement the new strategy for
managing individual taxpayer accounts.
Key tax administration projects include:
* Modernized e-File (MeF), which is to provide a single standard for
filing electronic tax returns;
* Customer Account Data Engine (CADE),18 which was intended to provide
the modernized database foundation to replace the existing Individual
Master File (IMF) processing system, containing the repository of
individual taxpayer information. It will continue with daily
processing of tax returns for approximately 40 million taxpayers and
implementing new tax law changes; and;
* CADE 2, which is IRS's new revised approach intended to provide the
modernized database foundation and leverage applications, database
structures, files, and business logic from both CADE and IMF19 to
provide a daily processing capability for moving all individual
taxpayer accounts to a faster refund cycle and address IRS's long-term
modernization plans and goals.
CADE 2 will also include projects such as:
* Accounts Management Services (AMS),[Footnote 34] which is intended
to enhance customer support by providing applications that enable IRS
employees to access, validate, and update individual taxpayer accounts
on demand; and;
* Integrated Production Model (IPM), which is intended to serve as a
central repository for corporate data and make those data available to
several client systems.
Details on these and other BSM projects and program-level initiatives
identified in the fiscal year 2010 plan are provided in appendix 1.
Table 1 shows a financial summary of the plan.
Table 1: Summary of IRS's Fiscal Year 2010 BSM Expenditure Plan[A]:
Tax administration projects:
Modernized e-File;
Amount (in thousands): $50,000.
Current CADE;
Amount (in thousands): $38,000.
Customer Account Data Engine 2[B]:
Amount (in thousands): $47,654.
Subtotal”tax administration projects:
Amount (in thousands): $135,654.
Core infrastructure projects:
Development, Integration, and Testing Environments:
Amount (in thousands): $14,500.
Infrastructure Shared Services:
Amount (in thousands): $17,500.
Subtotal”core infrastructure projects:
Amount (in thousands): $32,000.
Architecture, integration, and management:
Architecture and Integration:
Amount (in thousands): $13,745.
Business Integration:
Amount (in thousands): $4,206.
Business Rules and Requirements Management:
Amount (in thousands): $3,160.
Management Processes:
Amount (in thousands): $3,539.
Federally Funded Research and Development Center:
Amount (in thousands): $7,396.
Project Management:
Amount (in thousands): $2,954.
Subtotal”architecture, integration, and management:
Amount (in thousands): $35,000.
Management Reserve:
Amount (in thousands): $5,020.
BSM Capital Total:
Amount (in thousands): $207,674.
BSM Labor Total:
Amount (in thousands): $44,666.
Maintaining Current Levels (MCL)[C]:
Amount (in thousands): $1,334.
Total:
Amount (in thousands): $253,674.
Source: GAO analysis of IRS data.
[A] See appendix II for additional details on the plan. According to
IRS's Chief Technology Officer, the agency is currently preparing an
update to the expenditure plan to address the higher enacted level
(about $264 million) for the BSM appropriation.
[B] The amount for CADE 2 includes $2.6 million for the Integrated
Production Model project.
[C] Maintaining Current Levels (MCL) is the inflationary factor for
the BSM labor cost.
[End of table]
[End of section]
Results: Legislative Conditions:
Objective 1: IRS's fiscal year 2010 BSM expenditure plan fully
satisfies five of the six legislative conditions, and partially
satisfies the condition that the plan comply with the acquisition
rules, requirements, guidelines, and systems acquisition management
practices used by the federal government.
Table 2: Status of Fiscal Year 2010 Expenditure Plan Provisions for
Satisfying Legislative Conditions[Footnote 35]:
Legislative conditions:
1. Meets OMB capital planning and investment control review
requirements;
Status: Satisfied.
2. Complies with IRS's enterprise architecture (EA);
Status: Satisfied.
3. Conforms with IRS's enterprise life cycle (ELC) methodology;
Status: Satisfied.
4. Complies with the acquisition rules, requirements, guidelines, and
systems acquisition management practices used by the federal
government;
Status: Partially satisfied.
5. Approved by IRS, the Department of the Treasury, and OMB;
Status: Satisfied.
6. Reviewed by GAO;
Status: Satisfied.
Source: GAO analysis of IRS data.
[End of table]
1. Meets OMB capital planning and investment control review
requirements:
OMB requires agencies to develop capital planning and investment
control review processes that help ensure that projects are being
implemented at an acceptable cost and within reasonable and expected
time frames, and that they are contributing to observable improvements
in mission performance. The BSM expenditure plan met this condition.
Specifically, as noted in the plan, IRS has established a structured
governance and decision-making process framework that includes various
levels of governing bodies to manage its projects under a standardized
approach. The framework includes policies and procedures to select,
control, and evaluate investments that are generally consistent with
OMB capital planning and investment control review requirements. IRS
also recently developed additional procedures to augment its
governance and decision-making processes:
* In November 2008, the agency developed an Enterprise Governance
Authority and Operations Directive that describes a set of guiding
principles and roles and responsibilities for IRS governance functions.
* In April 2009, IRS issued an Enterprise Control Authority and
Operations Directive that provides requirements, guiding principles,
roles, and responsibilities for institutionalizing a comprehensive set
of IRS enterprise control processes and a Tiered Program Management
Escalation Guide that provides information for institutionalizing a
comprehensive set of enterprise escalation guidelines.
IRS has also conducted training of governance board coordinators and
secretariats as well as ongoing work groups to provide a venue for
sharing lessons learned and internal best practices. In addition,
officials stated that IRS has established a single repository to house
the data for its Governance IT portfolio. We recently initiated a
review to assess IRS's capital planning and investment control
practices against best practices identified in our IT Investment
Management Framework.
2. Complies with IRS's enterprise architecture:
IRS's BSM expenditure plan provides for compliance with the enterprise
architecture (EA). Specifically, OMB requires that IRS document and
submit an initial EA that is consistent with the principles identified
within OMB Circular A-130. Additionally, IRS is required to submit
updates to OMB when significant changes to the EA occur. Consistent
with this requirement, IRS has developed a number of documents,
including its Enterprise Transition Plan, which provides information
about IRS's overall plan to evolve information technology and
facilitate the investment decision-making process. In addition, IRS
has outlined general processes that projects are to follow in order to
ensure their compliance with the IRS EA. Specifically these processes
discuss the activities and documentation required to ensure compliance
with the EA. For example, at milestone 3”which is the phase where a
project's preliminary design is developed”IRS requires projects to
submit an EA compliance checklist which is used to help ensure that
the project design has been checked for compliance.
IRS's BSM expenditure plan also identifies funding for continued
definition and implementation of the EA. For example, the plan
identifies funding needed for:
* performing architecture, engineering, and integration activities to
ensure that the IRS EA provides the information and guidance necessary
for modernization projects;
* supporting the performance of EA compliance certification
activities; and;
* finalizing and publishing updates to the EA based on change requests.
Additionally, in September 2009, IRS updated its Enterprise Transition
Plan to include a number of enhancements. For example, the plan
reflects the latest decisions made regarding the new strategy for
managing individual taxpayer accounts and includes improvements for
the integration of infrastructure and security services and privacy
strategies. IRS has also developed a Preliminary Solution Architecture
for the new strategy that discusses the current processes used to
handle taxpayer accounts and the target architecture, such as
requirements for accepting and validating taxpayer account
information. Additionally, IRS's 2009 Enterprise Architecture provided
information on the processes associated with creating taxpayer
identification numbers, updating accounts and taxpayer information,
posting tax returns, and providing account information to downstream
processes. IRS has also developed a Customer Account Data Engine
Preliminary Program Roadmap which defines the approach for delivering
CADE 2.
3. Conforms with IRS's enterprise life cycle methodology:
The BSM expenditure plan conforms to IRS's enterprise life cycle
methodology (ELC), which defines a set of processes that are to be
used throughout the program's life cycle, including processes for
managing system investments, configuration, and risks. Specifically,
the plan calls for the following, as required by the ELC management
program:
* continuing to provide centralized guidance, administration,
mitigation, and closure of risks and issues throughout the life cycle
of each project;
* maintaining and enhancing the ELC (consistent with this, IRS has
developed a Milestone Exit Review procedure for inclusion in the ELC
to more effectively determine whether projects have met the necessary
conditions to exit a milestone and to prevent premature exit of
milestones); and;
* incorporating requirements for industry best practices into the ELC
to help ensure consistent systems development processes.
4. Complies with the acquisition rules, requirements, guidelines, and
systems acquisition management practices used by the federal
government[Footnote 36]:
The plan partially complies with best practices for software
development/acquisition because IRS does not yet have in place
disciplined practices as called for by Carnegie Mellon University's
Software Engineering Institute (SEI);[Footnote 37] however, IRS is
taking steps to implement SEI's Capability Model Integration (CMMI®)
[Footnote 38] processes. The quality of software is governed largely
by the quality of the processes involved in developing or acquiring it
and maintaining it. SEI, recognized for its expertise in software
processes, has developed models and methods that define and determine
organizations' software process maturity, including the CMMI® model
used to develop processes needed for software development and
acquisition and specific practices that agencies should follow to
mature these processes. IRS officials stated that, in June 2009, the
agency initiated a CMMI® implementation project to improve its
software acquisition and development practices by conducting a gap
analysis”which compares actual performance with potential performance”
and performing benchmarking activities. As a result of these
activities, IRS developed process improvement recommendations,
including, among other things, updating the existing project
management plan template, expanding performance monitoring, and
establishing a communications management plan. Additionally, according
to IRS officials, the agency developed a governance structure to
oversee the implementation of these recommendations. IRS officials
also stated that a sample of projects from across the Applications
Development organization will be used to pilot the CMMI® changes, and
mentoring teams will be established to coach and provide training to
the pilot projects to ensure institutionalization of the newly created
and modified process assets.
IRS stated it has a number of reviews planned throughout calendar year
2010 to assess progress in improving its practices and expects to have
CMMI level 2[Footnote 39] practices, that is, disciplined processes,
by November 2010 at the earliest. Until IRS has these processes in
place, it will run the risk of encountering problems in meeting its
performance, schedule, and cost objectives for the BSM program.
5. Approved by IRS, the Department of the Treasury, and OMB:
The expenditure plan was reviewed and approved by IRS on August 11,
2009; Treasury on September 10, 2009; and OMB on October 8, 2009.
6. Reviewed by GAO:
We completed review of the plan in March 2010.
Results: Prior Recommendation Status:
Objective 2: IRS has implemented two of our previous recommendations
to improve its modernization management controls and capabilities, but
steps remain to fully implement the remaining recommendations.
IRS implemented our recommendations to complete a plan with specific
time frames for implementing the initiatives supporting its human
capital strategy and to define procedures for determining when to
grant conditional milestone exits. However, steps remain to fully
implement the remaining recommendations, including developing a
quantitative measure of progress in meeting project scope expectations.
Table 3: Status of IRS's Progress in Implementing Prior GAO
Recommendations:
Prior GAO recommendation: Human capital strategy: Complete a plan with
specific time frames for implementing the initiatives supporting IRS's
IT human capital strategy.
Status: Implemented.
Prior GAO recommendation: Conditional milestone exits: Define
procedures for determining when to grant conditional milestone exits.
Status: Implemented.
Prior GAO recommendation: Modernization vision and strategy: Fully
revisit the vision and strategy for the BSM program and develop a new
set of long-term goals, strategies, and plans that are consistent with
the budgetary outlook and IRS's management capabilities.
Status: In progress.
Prior GAO recommendation: Quantitative measures of progress in meeting
scope expectations”Ensure that future expenditure plans include a
quantitative measure of progress in meeting project scope expectations.
Status: In progress.
Source: GAO analysis of IRS data.
[End of table]
Human Capital Strategy:
In March 2008, we reported that IRS had developed a human capital
strategy for its Application Development organization that addressed
hiring critical personnel, employee training, leadership development,
and workforce retention and identified several initiatives it planned
to undertake in these areas. However, the agency did not have a
specific plan, including time frames, for addressing these
initiatives. Accordingly, we recommended that the agency develop such
a plan.[Footnote 40] IRS agreed with our recommendation, and, in
response, identified a timeline for addressing these initiatives,
including addressing the IT corporate hiring challenge, succession
planning, and coaching and mentoring, in its Applications Development
Strategic Plan for 2007-2011 and its 2008-2010 Modernization
Information Technology Services Corporate Strategies document. IRS
officials also noted that human capital initiatives are planned (and
therefore updated) on an annual basis. Recently, IRS's Human Capital
Management Branch developed the MITS Recruitment and Training
Strategies and Projected Activity document for fiscal years 2010
through 2013 to further address staffing issues within the MITS
organization, including staffing associated with the new strategy for
modernizing individual taxpayer accounts. Effectively performing these
activities should allow IRS to acquire and retain the staff resources
it needs to effectively support BSM.
Results: Conditional Milestone Exits:
In March 2009, we reported that IRS's use of conditional milestone
exits (whereby projects are allowed to continue with outstanding
issues needing to be addressed) was not supported by documented
procedures and, as a result, the conditional exit process could
potentially be used to mask cost and schedule overruns and result in
projects exiting milestones prematurely. Accordingly, we recommended
that such procedures be defined. IRS agreed with our recommendation
and, in response, developed a Milestone Exit Review (MER) Procedure to
emphasize the prevention of premature milestone exits with outstanding
issues. The MER procedure describes the activities required for a
project to enter and exit the MER process. It also requires that the
governance board members review the project's cost, schedule,
performance, risks, and conditions, in addition to the MER artifacts,
to determine whether to (1) grant a conditional exit, (2) grant an
unconditional exit, (3) disapprove the exit, (4) recommend suspending
the project, or (5) terminate the project. By developing this
procedure, IRS has reduced the likelihood that the conditional exit
process will be used to mask cost and schedule overruns or result in
projects exiting milestones prematurely.
Results: Prior Recommendation Status:
Modernization Vision and Strategy:
In July 2005, we recommended that IRS fully revisit the vision and
strategy for the BSM program and develop a new set of long-term goals,
strategies, and plans consistent with the budgetary outlook and IRS's
management capabilities.[Footnote 41] We also noted that the vision
and strategy should include time frames for consolidating and retiring
legacy systems. IRS agreed with our recommendation, and, in response,
developed an initial cycle of its Modernization Vision and Strategy
(MV&S) in fiscal year 2006[Footnote 42] to guide IT investment
decisions during fiscal years 2007 through 2011. IRS also developed a
high-level strategy and 5-year schedule for retiring and consolidating
systems, which it began implementing.[Footnote 43]
In 2008, IRS began working on a new strategy, referred to as CADE 2
that, among other things, addresses the management of individual
taxpayer accounts as well as several long-term goals to enhance IRS's
systems. Specifically, the strategy's initial phase is to create a
modernized taxpayer database and to move the processing of individual
taxpayer accounts from a weekly processing cycle to a daily processing
cycle by the January 2012 filing tax season. In support of this new
strategy, in July 2009, IRS developed a Preliminary Solution
Architecture document which describes the characteristics of the
strategy in both business and technical terms. IRS also developed a
Preliminary Program Roadmap which defines the approach for delivering
the new strategy and provides general time frames for delivering key
phases known as transition states. IRS also established a program
management office and defined a program management framework that
would guide the strategy from initiation to completion. IRS provided
us with key planning documents for the new strategy, including cost
and schedule estimates and final Solution Architecture and Program
Roadmap documents, at the conclusion of our review. We plan to review
these documents in a CADE 2 review we have underway and determine if
IRS has implemented our recommendation.
Quantitative Measure of Progress in Meeting Scope Expectations:
In February 2007, we recommended that IRS ensure that future
expenditure plans include a quantitative measure of progress in
delivering systems' planned functionality (scope).[Footnote 44] We
also recommended that, in developing this measure, IRS consider using
earned value management[Footnote 45] since this is a proven technique
required by OMB for measuring cost, schedule, and functional
performance (i.e., scope of work) against plans. While IRS agreed with
our recommendation to develop a quantitative measure of progress in
meeting scope expectations, it stated at the time that it did not
believe earned value management would provide this measure, given the
manner in which the technique was being used at the agency. Instead
IRS proposed a two-step approach to address our recommendation.
[Footnote 46] As an initial step, IRS developed a qualitative measure
that indicated the difference between a project release's planned and
delivered capabilities and began using it in the fiscal year 2008
expenditure plan. In March 2008, we reported that, as a second step,
IRS planned to leverage its requirements management tools to assign
quantitative values to the capabilities in order to develop a
quantitative measure of scope in the fiscal year 2009 plan. IRS did
not have the measurement of scope ready for the fiscal year 2009
expenditure plan as planned but stated that it was continuing to
develop the metric and that a schedule for implementation and
inclusion into the annual expenditure plan would depend on the outcome
of pilot efforts. IRS stated that it is still in the process of
analyzing the results of pilots conducted in August 2008 and February
2009 and plans to present a finalized process to its Application
Development organization by March 31, 2010. Fully implementing a
quantitative measure of progress in delivering systems' planned
functionality will help IRS in managing and controlling BSM.
Results: Observations:
Objective 3: Observations about IRS's BSM Program and Expenditure Plan:
Observation 1: Of 10 project milestones[Footnote 47] planned for
fiscal year 2009, 6 were completed within 10 percent of cost and
schedule estimates or early, and 3 were completed on schedule but more
than ten percent over cost. For 1 of the milestones, we could not
determine cost or schedule variances because IRS had not identified
planned cost and schedule information in the fiscal year 2009
expenditure plan.
Our analysis of IRS's reported planned and actual milestone costs and
completion dates showed that six milestones were completed within 10
percent of cost and schedule estimates or early and three were
completed on schedule but more than ten percent over cost, although
they were within ten percent of schedule estimates. Release 5 of CADE,
intended to implement legislative changes associated with filing
season 2010, completed detailed design (milestone 4a) at planned cost
and on schedule; the release of AMS which is intended, among other
things, to provide for the conversion of the Correspondence Imaging
System to a new platform for inventory management, completed
development 127 percent over planned cost. We were not able to
determine cost or schedule variances of a milestone of MeF, release
6.1, because IRS had not identified planned cost and schedule
information for it.[Footnote 48]
Figure 1 depicts the detailed cost and schedule variances of the
project milestones that were completed during fiscal year 2009.
Figure 1: Cost and Schedule Variances for Project Milestones Completed
in Fiscal Year 2009:
[Refer to PDF for image: vertical bar graph]
Program: CADE;
Release: 4.2;
Milestone: 4;
Cost variance: 2.1%;
Schedule variance: -20.3%.
Program: CADE;
Release: 5;
Milestone: 2-3;
Cost variance: 0;
Schedule variance: 0.
Program: CADE;
Release: 5;
Milestone: 4a;
Cost variance: 0;
Schedule variance: 0.
Program: AMS;
Release: 1.2;
Milestone: 5;
Cost variance: 0;
Schedule variance: 0.5%.
Program: AMS;
Release: 1.3;
Milestone: 4b;
Cost variance: 126.7%;
Schedule variance: 8.5%.
Program: AMS;
Release: 1.3;
Milestone: 5;
Cost variance: 296.6%;
Schedule variance: -0.7%.
Program: AMS;
Release: 2.1;
Milestone: 4a;
Cost variance: 29.2%;
Schedule variance: 0.
Program: AMS;
Release: 2.1;
Milestone: 4b;
Cost variance: -10.4%;
Schedule variance: 0.
Program: IPM;
Release: 4;
Milestone: 4b;
Cost variance: 0;
Schedule variance: 0.9%.
Source: GAO analysis of IRS data.
[End of figure]
The following provides details for the six milestones that were
completed within ten percent of cost and schedule estimates or early:
CADE:
* Release 4.2, milestone 4: this release, intended to process decedent
and surviving spouse returns, credit elect processing, receipt
processing, criminal investigation refund hold, and last name changes,
completed the development, test, and integration phase at a cost of
$28,848,000”about 2 percent over the estimated cost”and about 10 weeks
(or 20 percent) earlier than planned. It should be noted, however,
that according to the fiscal year 2010 expenditure plan, some
functionality--the credit election processing and criminal
investigation refund hold--was not completed as planned and was
deferred to a subsequent release. When we followed up with IRS
officials, they stated that the functionality that was deferred
represented only some final testing that needed to be completed;
however, without a quantitative measure of the scope, both planned and
delivered, at each milestone, it is difficult to assess the impact of
these deferrals. As noted earlier, IRS is continuing to work toward
developing such a metric in response to our previous recommendation.
* Release 5, milestone 3: this release, intended to implement
legislative changes associated with filing season 2010 and also
complete the credit elect and refund hold capabilities that were
deferred from the previous release, was reported to have completed
preliminary design on March 17, 2009, within ten percent of cost and
schedule estimates. (In our fiscal year 2009 BSM expenditure plan
report, we noted that the initial plan for completing this milestone
was September 30, 2008, and that, at that time, the milestone was
already 10 percent over schedule. We also noted that IRS had reported
stopping work on release 5 of CADE pending the results of its review
of long-term plans for BSM. While IRS reported that the milestone was
completed on March 17, 2009, 30 percent later than planned, the agency
subsequently rebaselined the schedule for milestone 3 to show a March
17, 2009, completion date in response to strategic changes being made
for the program). IRS reported spending $6.025 million to complete
this preliminary design phase, which represents a cost variance of
zero.
* Release 5, milestone 4a, completed the detailed design phase on
April 30, 2009, and at a cost of $11.5 million as planned.
AMS:
* Release 1.2, milestone 5: this release, which was intended to
include a new inventory and workflow that automates the assignment,
research, resolution, and closure for entity and account transcripts,
completed system deployment at planned cost and on schedule.
* Release 2.1, milestone 4b: this release, intended to provide, among
other things, enhanced views of tax return information and
correspondence images for taxpayer accounts as well as the ability to
view and edit taxpayer name and contact information, completed
development on schedule and about 10 percent under the budgeted cost.
IPM:
* Release 4, milestone 4b: this release, intended to add new data
sources (including data fields from the Individual Master File and the
Information Returns Master File), completed development at planned
cost and on schedule on December 16, 2008.
The following provides details on the three AMS milestones that were
significantly over cost but on schedule:
* Release 1.3, milestone 4b: this release, which is intended, among
other things, to provide for the conversion of the Correspondence
Imaging System to a new platform for inventory management, completed
development 127 percent over planned cost.
* Release 1.3, milestone 5, completed deployment 297 percent over
planned cost.
* Release 2.1, milestone 4a: this release, which, as previously noted,
is intended to provide, among other things, enhanced views of tax
return information and correspondence images for taxpayer accounts as
well as the ability to view/edit taxpayer name and contact
information, completed detailed design 29 percent over planned cost.
IRS's explanation of the cost variances for these AMS milestones in
the expenditure plan did not include the underlying cause for these
variances, as called for in IRS's own guidance. In the plan, IRS
attributed the variances to the need to fund the projects in excess of
planned amounts. When we followed up with IRS, it attributed the cost
increases for these milestones to the number of software and
infrastructure activities required to migrate to the system's long-
term platform. IRS stated that, while these activities were initially
estimated as part of the overall program, they had to be accomplished
in this release in order to implement a usable solution that could
then be used to implement the incremental changes in subsequent
releases. Reporting on these underlying causes of variances in the
expenditure plan in a consistent manner would provide Congress with
insight into specific areas needing improvement.
The following provides information on the milestone for which we could
not calculate cost and schedule variances:
* IRS completed detailed design (milestone 4a) for release 6.1 of MeF,
intended to include the rollout of electronic versions of Form 1040
and 22 other schedules, including Schedules A, B, and D, on December
4, 2008. IRS, however, did not report this milestone in the
expenditure plan because it had not identified specific cost and
schedule estimates for it in the fiscal year 2009 expenditure plan.
Rather, IRS had reported estimates for combined milestones 4a to 5.
While IRS has stated that its ELC allows for combining milestones to
provide flexibility, the ELC also cautions that such combinations
should be used to a limited extent since it poses greater risk than
having separate milestones. This is because a longer period of time
elapses, more work is performed, and more expense is incurred before
the project receives management scrutiny. While we agree, consistent
with IRS's policy, that combined milestones should be used to a
limited extent, not reporting on individual milestones in the
expenditure plan reduces transparency by not disclosing information on
progress in delivering functionality to Congress in a timely manner.
It is important to note that the deployment of Release 6.1 of MeF
represents a change in strategy whose net effect on the performance of
the project is difficult to assess. Specifically, in response to
schedule delays due to added complexities and requirements, IRS
developed a new deployment strategy whereby the deployment of the 1040
series of forms is expected to be completed up to 2 years later than
planned under the initial strategy and at a cost of nearly $50 million
more. However, a quantitative measure of progress in meeting scope
expectations, which as previously noted, IRS expects to develop by the
end of this month, would help more accurately assess the impact of
this new strategy.
Observation 2: IRS has begun development of its new modernization
strategy, but time frames for completing key planning activities for
Transition State 2 have not yet been defined.
IRS expects CADE 2, among other things, to:
* establish a solid data foundation for the future by leveraging
relational database processing capability;
* address financial material weaknesses;
* improve the agency's security and privacy posture by addressing
identified weaknesses;
* continue the focus on moving away from 1960s technology (i.e., aging
infrastructure and applications and sequential flat-file processing);
and;
* demonstrate progress toward achieving long-term viability.
In June 2009, IRS developed a CADE Program Management Office (PMO)
Operating Model and Roadmap that identified high-level milestones for
completing key activities associated with the development of the CADE
2 PMO. IRS has completed activities associated with standing up the
PMO and developing the PMO operating model. For example, IRS assigned
key program leadership positions; defined PMO requirements, scope, and
objectives; and defined the organizational structures and PMO staffing
needs. In July 2009, IRS established the CADE 2 PMO to guide the
implementation of the new strategy.
IRS has identified two key phases, referred to as "transition states,"
for delivering the new strategy. The key objectives of these
transition states are summarized below:
Table 4: Summarization of CADE 2 Transition States:
Transition State 1:
1. Build an enterprise data model and establish the CADE 2 database
that will house data on individual taxpayers and their accounts.
2. Enhance core IMF functionality, modify supporting systems and
applications, and make required changes to upstream and downstream
systems to support daily processing.
3. Make progress toward addressing financial material weaknesses by
establishing a plan to create a baseline and identifying changes
needed for Federal Financial Management System Requirements
compliance.
Transition State 2:
1. Core applications will directly access and update the CADE 2
database.
2. Address financial and security material weaknesses.
3. Restructure core tax processing applications by either leveraging
current tax applications or building new ones.
4. Establish a single processing system - eliminating dual operating
environments.
Source: GAO Analysis of IRS data.
[End of table]
It is expected that CADE 2 will result in faster refunds, improved
customer service, elimination of notices based on out-of-date
information, faster resolution of taxpayer account issues, and better
online tools and services for taxpayers. IRS currently estimates CADE
2 costs for Transitions States 1 and 2 through fiscal year 2014 at
about $700 million.
IRS has made progress in defining the transition states. For example,
in addition to the Preliminary Solution Architecture[Footnote 49] and
Preliminary Program Roadmap[Footnote 50] mentioned earlier, IRS
baselined the business and technical requirements for Transition State
1 at the end of January 2010. Further, IRS has begun developing four
different prototypes to test the feasibility of technologies and
solution approach and gain confidence in system viability and
performance. These prototypes, three of which are expected to be
completed in fiscal year 2010 and the last one when the target state
is reached, will test the following: (1) Java's performance,
scalability, and ability to handle high-performance batch processing;
(2) moving taxpayer information on IMF from weekly to daily
processing; (3) the penalty and interest calculation's ability to meet
performance requirements; and (4) end-to-end performance for each of
the major transition states and the target state.
IRS has taken several actions to increase the likelihood that CADE 2
will be successfully defined and implemented. For example, key
business stakeholders have been involved in defining the overall
vision and specific requirements; a program management office has been
established to manage the program; a governance framework involving
MITS and business representatives at multiple levels has been
developed to oversee the program; independent assessments have been
performed to validate IRS's approach and make recommendations for
improvements as appropriate; and, as previously noted, efforts to
improve IRS's software development and acquisition practices have been
initiated.
For Transition State 2, IRS plans to set up a team to work on
requirements, design principles, a framework for applications and
infrastructure, engineering analysis, and prototypes during fiscal
year 2010. However, it has yet to define associated time frames for
completing these key planning activities. These time frames are
critical to guiding progress in laying the groundwork for achieving
the transition state's objectives of (1) using the CADE 2 database to
feed downstream systems; (2) addressing financial and security
material weaknesses; (3) restructuring core tax processing
applications by either leveraging current or building new tax
applications; and (4) eliminating dual operating environments.
Observation 3: CADE 2 faces several risks.
IRS has identified many risks associated with defining and
implementing CADE 2. The agency has classified these risks into five
categories:
* Delivery (e.g., the ability to deliver capabilities could be
jeopardized if the scope is not rigorously managed);
* Program (e.g., managing expectations in order to have adequate time
for due diligence);
* People (e.g., staffing of the program management office to
authorized staffing levels);
* Technology and complexity (e.g., successful processing of individual
tax returns could be jeopardized if the target solution does not meet
system performance requirements for peak volume and required
throughput with reasonable capacity);
* Management (e.g., the ability to achieve Transition State 1 could be
affected if the new collaborative operating model is not implemented
successfully).
IRS has defined and reports that it is implementing mitigation
strategies for each risk identified.[Footnote 51] For example, IRS has
stated that it will develop a knowledge transfer plan, a resource and
staffing plan, and a training plan to update the skill set of current
IRS employees to address the "critical skill constraints" risk, which
it defines as having a limited number of people with the requisite
knowledge and skills in current systems.
In December 2009,[Footnote 52] TIGTA identified several challenges
that IRS needs to address to effectively manage identified risks,
including, among other things, implementing a governance structure for
the Program Management Office to provide oversight and direction for
the implementation of CADE 2, and developing contingency plans in the
event that CADE 2 cannot be fully implemented. In its comments on
TIGTA's report, IRS stated that it found the assessment to be valid.
Observation 4: Information Security weaknesses continue to affect
IRS's modernization environment.
IRS continues to have information security weaknesses that affect its
modernization environment. In November 2009,[Footnote 53] we reported
that while IRS continued to make progress in correcting previously
reported information security weaknesses, previously identified and
newly identified weaknesses in internal controls over information
security continue to place IRS systems at risk. For example, managers
did not always provide timely review of employee access to sensitive
data center areas as required to ensure that access is limited only to
employees who need it to perform their jobs. Additionally, while IRS
had informed us that it had corrected about 40 percent of the
previously reported weaknesses, we found that it had not fully
implemented the remedial actions it reported for at least a third of
those weaknesses that it considered corrected. In written comments on
our report, IRS stated that improving information security continues
to be a priority and noted accomplishments it made in this area during
fiscal year 2009. For example, IRS stated that it limited access to a
reduced number of authorized staff and implemented controls to enforce
the use of strong passwords in accordance with Internal Revenue Manual.
Further, in August 2009,[Footnote 54] TIGTA reported that while IRS
had taken steps to address 16 CADE system security vulnerabilities it
had identified in a previous audit, only 10 had been fully resolved
and the remaining 6 could not be resolved until controls were
effectively in place or had been approved as deviations to IRS policy.
These vulnerabilities increase the risks that (1) management will pay
less attention to unresolved problems, (2) resources required to fix
problems will not be allocated, (3) vulnerabilities will not be
corrected in a timely fashion, and (4) the Office of Management and
Budget will be unable to obtain an accurate status of IRS security
weaknesses. As a result, TIGTA recommended that IRS take actions to
ensure CADE and mainframe computer system owners (1) appropriately
enter and track system vulnerabilities on control systems and (2)
verify that corrective actions are fully implemented before they are
considered and reported as resolved. IRS agreed with TIGTA's
recommendations and stated that the cybersecurity organization will
continue to improve the process to ensure that system owners comply
with IRS policy to enter and track all system vulnerabilities in IRS
control systems.
In addition to the steps that IRS is taking to address security
recommendations from GAO and TIGTA, IRS has stated that, in Transition
State 2, CADE 2 will fully address the security weaknesses that are
currently confronting CADE. While actions to address the identified
report findings will help to improve its security posture, IRS's
modernization environment will continue to be at risk until the agency
fully implements its security programs.
[End of section]
Conclusions:
During fiscal year 2009, IRS continued to deliver BSM projects,
although work on planned releases of CADE and AMS was either modified
or suspended pending completion of efforts to define the agency's new
strategy to manage individual taxpayer accounts. IRS generally made
progress in addressing outstanding recommendations from our prior
expenditure plan reviews. However, the expenditure plan explanations
for significant project cost variances did not always provide
information on root causes, limiting Congress's insight into areas
needing improvement. Further, because IRS did not report one completed
project milestone for which it had not identified specific plans in
the fiscal year 2009 expenditure plan, Congress did not receive
information on progress in delivering key functionality. Finally,
while much has been done to define the Transition States”or key phases”
of the CADE 2 strategy for managing individual taxpayer accounts,
specific time frames for addressing key planning activities for
Transition State 2, including defining core requirements, have not
been defined. Having these time frames would guide progress in
completing activities that are foundational to the transition state.
[End of section]
Recommendations for Executive Action:
To improve the program management capabilities and controls that are
critical to the effective management of the BSM program, we are
recommending that the Commissioner of Internal Revenue direct the
Chief Technology Officer to take the following three actions:
* ensure that explanations of project cost and schedule variances
provided in the expenditure plan consistently include underlying
causes;
* for individual milestones that have been combined, report available
performance information in the expenditure plan to provide Congress
with information on progress in delivering functionality; and;
* define specific time frames for CADE 2 Transition State 2 planning
activities, including defining a core set of requirements to guide
progress.
[End of section]
Agency Comments and Our Evaluation:
In e-mail comments and subsequent oral comments on a draft of these
briefing slides, the IRS's Chief Technology Officer (CTO) generally
agreed with much of the information presented but disagreed with two
of our findings and with two of our recommendations. Specifically, he
disagreed with our finding that IRS partially complies with the
acquisition rules, requirements, guidelines, and systems acquisition
management practices used by the government, stating that there is no
requirement for federal agencies to use the cited practices. We have
previously reported that to effectively manage major IT programs,
organizations must use sound acquisition and management processes to
minimize risks and thereby maximize chances for success. Such
processes have been identified by leading organizations such as the
Software Engineering Institute, the Chief Information Officers
Council, and in our prior work analyzing best practices in industry
and government. In particular, the CMMI model defines a suite of key
acquisition process control areas that are necessary to manage system
acquisitions in a rigorous and disciplined fashion. We are focusing on
level-2 practices because it is recognized that, without them,
processes are typically ad hoc and chaotic. Since IRS is not yet level-
2 compliant, the agency partially complies with the acquisition rules,
requirements, guidelines, and systems acquisition management practices
used by the government.
IRS also disagreed with our finding that it has not fully implemented
our recommendation to develop a long-term plan for BSM, stating that
it believed that it had addressed this by providing the Modernization
Vision and Strategy (MV&S) in fiscal year 2006. We have previously
reported that the MV&S did not fully address our recommendation.
[Footnote 55] We acknowledge IRS's recent update of the MV&S with the
CADE 2 strategy. As previously stated, we received the key planning
documents associated with this strategy at the conclusion of our
review and plan to review them as part of a review of CADE 2 that is
currently underway.
Regarding our recommendation to ensure the explanations of project
cost and schedule variances provided in the expenditure plan include
underlying causes, IRS stated that the expenditure plan consistently
provides narrative explanations of all project segment cost and
schedule variances, in addition to the attribution of those variances.
While we agree with this statement, our point is that the underlying
causes for the cost variances for three AMS milestones were not in the
plan, in accordance with IRS's own guidance. IRS, however, provided us
this information when we followed up with the agency.
Regarding our recommendation to report on project milestones delivered
for which specific cost and schedule estimates were not identified in
fiscal year 2009 the expenditure plan (due to milestones being
combined), the CTO commented that, when milestones are combined within
a project segment, IRS generally does not develop or track specific
cost and schedule estimates for the individual project milestones and
that since milestone-specific information is not available, only the
overall cost and schedule estimate for the combined milestone segment
is reported in the expenditure plan. However, in the case of MeF, IRS
developed and tracked schedule information for milestone 4a but did
not report it. Reporting this information would improve the
transparency of IRS's progress in delivering functionality. IRS also
provided technical comments which we have addressed as appropriate.
[End of section]
Appendix I: Description of BSM Projects and Program-Level Initiatives:
Tax administration projects:
Proposed modernization initiative: Modernized e-File;
Description: Is to provide a single standard for filing electronic tax
returns. Initial releases will address large corporations, small
business, and tax-exempt organizations. Its ultimate goal is the
conversion of IRS's 1040 e-file program.
Proposed modernization initiative: Current Customer Account Data
Engine (CADE);
Description: Is to build the modernized database foundation to replace
the existing Individual Master File (IMF) processing system that
contains the repository of individual taxpayer information.
Proposed modernization initiative: Customer Account Data Engine 2
(CADE 2):
Description: Is intended to leverage Current CADE and the IMF, which
contain the repository of individual taxpayer information, to provide
timely access to authoritative individual taxpayer account information
and enhance IRS's ability to address technology, security, financial
material weaknesses, and long-term architectural planning and viability.
Core infrastructure projects:
Proposed modernization initiative: Development, Integration, and
Testing Environments;
Description: Is to provide oversight for laboratory environments that
support evaluation, development, and testing of components from
multiple projects: (1) Virtual Development Environment provides a
software development environment and a standardized set of tools, and
(2) Enterprise Integration and Test Environment provides an
integration and testing environment for all projects.
Proposed modernization initiative: Infrastructure Shared Services;
Description: Is to deliver, in incremental releases over multiple
years, a fully integrated, shared IT infrastructure to include
hardware, software, shared applications, data, telecommunications,
security, and an enterprise approach to systems and operations
management.
Architecture, integration, and management:
Proposed modernization initiative: Architecture and integration;
Description: Is to ensure that systems solutions meet IRS business
needs and that the development projects are effectively integrated
into the business environment.
Proposed modernization initiative: Business integration;
Description: Is to ensure that IRS's BSM program is aligned with the
business units' vision and delivers the desired business results. It
provides support to key activities such as transition management,
business rules enterprise management, and requirements development and
management operations.
Proposed modernization initiative: Business rules and requirements
management;
Description: Is to provide support to business process analysis and
redesign by harvesting and managing an enterprise set of business
rules and developing business requirements.
Proposed modernization initiative: Management processes;
Description: Is to provide sustaining support for program-level
management processes, including quality assurance, risk management,
program control and process management, and enterprise life cycle
maintenance and enhancements.
Proposed modernization initiative: Federally funded research and
development center;
Description: Is to provide program management and systems engineering
support.
Proposed modernization initiative: Program management;
Description: Is to ensure programs achieve their objectives by
providing the management information and IT infrastructure that
supports risk management, project cost and schedule estimating,
financial management, and procurement management for the prime
contracts and associated task orders.
Source: GAO analysis of IRS data.
[End of table]
[End of Appendix I]
Appendix II: Additional Detail on IRS's Fiscal Year 2010 BSM
Expenditure Plan:
Tax administration projects:
Proposed modernization initiative: Modernized e-File (MeF);
Release[A]: 6.2;
Milestone/type of activity[B]: 3-5;
Amount Requested (In thousands): $17,000.
Proposed modernization initiative: MeF;
Release[A]: 7;
Milestone/type of activity[B]: 3-4a;
Amount Requested (In thousands): $33,000.
Subtotal”MeF project:
Amount Requested (In thousands): $50,000.
Proposed modernization initiative: Current Customer Account Data
Engine (CADE);
Release[A]: 6.2;
Milestone/type of activity[B]: 4b;
Amount Requested (In thousands): $22,000.
Proposed modernization initiative: Current CADE;
Release[A]: operations and maintenance;
Milestone/type of activity[B]: Level of Effort (LOE);
Amount Requested (In thousands): $16,000.
Subtotal”Current CADE project:
Amount Requested (In thousands): $38,000.
Proposed modernization initiative: CADE 2;
Release[A]: Infrastructure;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $11,519.
Proposed modernization initiative: CADE 2;
Release[A]: Program Management Office;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $4,846.
Proposed modernization initiative: CADE 2;
Release[A]: Engineering and Analysis;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $9,100.
Proposed modernization initiative: CADE 2;
Release[A]: Transition State 1;
Milestone/type of activity[B]: LOE.
Amount Requested (In thousands): $17,594;
Proposed modernization initiative: CADE 2;
Release[A]: Transition State 2;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $1,941.
Proposed modernization initiative: CADE 2;
Release[A]: Integrated Production Model;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $2,654.
Subtotal”CADE 2 project:
Amount Requested (In thousands): $47,654.
Subtotal”tax administration projects:
Amount Requested (In thousands): $135,654.
Core infrastructure projects:
Proposed modernization initiative: Development, integration, and
testing environment;
Milestone/type of activity[B]: Infrastructure (INF);
Amount Requested (In thousands): $14,500.
Proposed modernization initiative: Infrastructure Shared Services;
Milestone/type of activity[B]: INF;
Amount Requested (In thousands): $17,500.
Subtotal”core infrastructure projects:
Amount Requested (In thousands): $32,000.
Architecture, integration, and management:
Proposed modernization initiative: Architecture and integration;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $13,745.
Proposed modernization initiative: Business integration;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $4,206.
Proposed modernization initiative: Business rules and Requirements
Management;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $3,160.
Proposed modernization initiative: Management processes;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $3,539.
Proposed modernization initiative: Federally funded research and
development center;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $7,396.
Proposed modernization initiative: Program management;
Milestone/type of activity[B]: LOE;
Amount Requested (In thousands): $2,954.
Subtotal”architecture, integration, and management:
Amount Requested (In thousands): $35,000.
Management reserve:
Amount Requested (In thousands): $5,020.
BSM Capital Total:
Amount Requested (In thousands): $207,674.
BSM Labor Total:
Amount Requested (In thousands): $44,666.
Maintaining Current Levels:
Amount Requested (In thousands): $1,334
Total fiscal year 2010 BSM program:
Amount Requested (In thousands): $253,674.
Source: GAO analysis of IRS data.
[A] Releases are software versions that provide a subset of the total
planned project functionality.
[B] Milestones correspond to phases within IRS's enterprise life cycle
(0 ” vision and strategy/enterprise architecture, 1” project
initiation, 2 ” domain architecture, 3 ” preliminary design, 4a ”
detailed design, 4b ” system development, 5 ” system deployment).
According to IRS, level of effort activities generally support the
overall management of the program, such as contracting or risk
management. They do not follow the ELC methodology nor do they
directly create end user benefits. They do require the contractor to
provide a specified level of effort, over a stated period, on work
stated in general terms. Infrastructure projects follow many aspects
of the ELC but differ from development projects in that they (1) do
not have a separate business case, though they have definable costs
and general broad benefits; (2) operate based on the support needs of
the project, rather than end-user requirements; (3) cannot make
changes that are independent from the projects they support, that is,
the infrastructure projects must synchronize changes with the
application projects and assess the impact; and (4) project teams have
no direct control over external changes (e.g., a new requirement for
an application project) that will drive cost fluctuations.
[End of table]
[End of Appendix II]
Appendix III: Reported Cost and Schedule for Projects Scheduled for
Completion in Fiscal Year 2009:
This table shows the projects completed in fiscal year 2009.
Project segment: AMS; Release 1.2; Milestone 5;
Estimated completion date and funding (in thousands): 11/11/08; $1,060;
Milestone exit and cost (in thousands): 11/13/08; $1,060;
Change (%): 1 day (0.5%); $0 (0%);
IRS explanation of change: Exit was completed one day later than
planned due to the scheduling of a Customer Service Executive Steering
Committee meeting.
Project segment: AMS; Release 1.3; Milestone 4b;
Estimated completion date and funding (in thousands): 11/11/08; $3,747;
Milestone exit and cost (in thousands): 12/05/08; $8,494;
Change (%): 16 days (8.5%); $4,747 (126.7%);
IRS explanation of change: Technical complexity of the configurations
and development of the environment resulted in approximately a 3-week
delay in exiting this milestone. Additionally, cost variance was due
to development costs significantly exceeding estimates and required
realignment of AMS project funds to continue funding the development
of this release.
Project segment: AMS; Release 1.3; Milestone 5;
Estimated completion date and funding (in thousands): 05/31/09; $1,006;
Milestone exit and cost (in thousands): 05/28/09; $3,990;
Change (%): -1 day (-0.7%); $2,984 (296.6%);
IRS explanation of change: Completed one day earlier than planned.
Additionally, cost variance was due to development costs significantly
exceeding estimates and required realignment of AMS project funds to
continue funding the development of this release.
Project segment: AMS; Release 2.1; Milestone 4a;
Estimated completion date and funding (in thousands): 12/09/08; $2,522;
Milestone exit and cost (in thousands): 12/09/08; $3,258;
Change (%): 0 days (0%); $736 (29.2%);
IRS explanation of change: Variance is due to the need for additional
funding to complete software and infrastructure design activities.
Project segment: AMS; Release 2.1; Milestone 4b;
Estimated completion date and funding (in thousands): 08/05/09; $4,402;
Milestone exit and cost (in thousands): 08/05/09; $3,946;
Change (%): 0 days (0%); -$456 (-10.4%);
IRS explanation of change: Variance is due to slightly less funding
needed for development activities than original planned amounts.
Project segment: CADE; Release 4.2; Milestone 4;
Estimated completion date and funding (in thousands): 03/31/09;
$28,265;
Milestone exit and cost (in thousands): 01/15/09; $28,848;
Change (%): -51 days (-20.3%); $583 (2.1%);
IRS explanation of change: Schedule variance resulted from exiting
this milestone 10 weeks earlier than originally planned. However, some
functionality deferred to subsequent release. Cost variance resulted
from the need to fund development activities related to additional
unplanned requirements and legislative changes associated with the
filing season.
Project segment: CADE; Release 5; Milestones 2-3;
Estimated completion date and funding (in thousands): 03/17/09; $6,025;
Milestone exit and cost (in thousands): 03/17/09; $6,025;
Change (%): 0 days (0%); $0 (0%).
IRS explanation of change: Note: This planned exit date represents a
rebaseline of an earlier estimate of 9/30/08.
Project segment: CADE; Release 5; Milestone 4a;
Estimated completion date and funding (in thousands): 04/30/09;
$11,500;
Milestone exit and cost (in thousands): 04/30/09; $11,500;
Change (%): 0 days (0%); $0 (0%).
IRS explanation of change: Note: This planned exit date represents a
rebaseline of an earlier estimate of 11/30/08.
Project segment: IPM; Release 4; Milestone 4b;
Estimated completion date and funding (in thousands): 12/15/08; $563;
Milestone exit and cost (in thousands): 12/16/08; $563;
Change (%): 1 day (0.9%); $0 (0%);
IRS explanation of change: [Empty].
Source: GAO Analysis of IRS data.
Note: Variances for projects through milestone 3 are based on rough
order of magnitude estimates. Post-milestone-3 variances are based on
more specific estimates.
IRS also completed additional milestones for IPM. However, we are not
reporting on these because funding for them was not requested in the
fiscal year 2009 expenditure plan.
[End of table]
[End of Appendix III]
[End of Briefing slides]
[End of section]
Appendix II: Comments from the Internal Revenue Service:
Department Of The Treasury:
Deputy Commissioner:
Internal Revenue Service:
Washington, D.C. 20224:
April 27, 2010:
Mr. David A. Powner:
Director, Information Technology Management Issues:
U.S. Government Accountability Office:
441 G Street, N.W.
Washington, DC 20548:
Dear Mr. Powner:
I reviewed the Government Accountability Office draft report titled
"Business Systems Modernization: Internal Revenue Service's Fiscal
Year 2010 Expenditure Plan," (Government Accountability Office 10-
539). We appreciate that your draft report recognizes the progress
that the Internal Revenue Service has made to improve our program
management capabilities and controls.
We will review the three new recommendations the Government
Accountability Office reported to ensure our actions include assuring
that underlying causes for project cost and schedule variances are
consistently provided in the expenditure plan. We will provide the
detailed corrective action plan addressing each of the recommendations
with our response to the final report.
We appreciate your continued support and the assistance and guidance
from your staff.
If you have any questions or would like to discuss our response in
more detail, please contact Terence V. Milholland, Chief Technology
Officer, at (202) 6226800.
Sincerely,
Signed by:
Mark A. Ernst:
Deputy Commissioner, Operations Support:
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
David A. Powner, (202) 512-9286 or pownerd@gao.gov:
Staff Acknowledgments:
In addition to the individual named above, Sabine R. Paul, Assistant
Director; Neil Doherty; Mary D. Fike; Nancy Glover; Lee McCracken;
Paul B. Middleton; and Krzysztof Pasternak made key contributions to
this report.
[End of section]
Footnotes:
[1] BSM funds (except labor costs) are unavailable until IRS submits a
modernization expenditure plan to the congressional appropriations
committees and obtains their approval. See the Consolidated
Appropriations Act, 2010, Pub. L. No. 111-117, Division C, Title I,
Dec. 16, 2009, 123 Stat. 3034, 3164.
[2] This plan must (1) meet the Office of Management and Budget's
(OMB) capital planning and investment control review requirements; (2)
comply with IRS's enterprise architecture; (3) conform with IRS's
enterprise life cycle methodology; (4) comply with federal acquisition
rules, requirements, guidelines, and systems acquisition management
practices; (5) be approved by IRS, the Department of the Treasury, and
OMB; and (6) be reviewed by GAO. These conditions for BSM funding
availability have been in effect for several years, including the
immediately preceding fiscal year. At the time of this report, the
latest appropriation was provided under the Consolidated
Appropriations Act, 2010, Pub. L. No. 111-117, Division C, Title I,
Dec. 16, 2009.
[3] For this condition, we did not determine whether the expenditure
plan comports with the Federal Acquisition Regulation or other federal
requirements beyond those encompassed by the Software Engineering
Institute's Capability Maturity Model Integration (CMMI).
[4] We are referring to the practices defined in the CMMI model. CMMI
is registered in the U.S. Patent and Trademark Office by Carnegie
Mellon University's Software Engineering Institute. It is the process
model that describes how to develop the processes needed for software
development and specific practices that organizations should follow.
[5] IRS's Enterprise Life Cycle Guidance defines seven milestones,
each occurring at the end of one of the phases of the life cycle.
Milestone 0-at the end of vision and strategy or enterprise
architecture; 1-project initiation; 2-domain architecture; 3-
preliminary design; 4-development, test, and integration; and 5-system
deployment. The development, test, and integration phase is sometimes
split into two phases, each corresponding to a different milestone: 4a-
detailed design and 4b-system development.
[6] Releases are software versions that provide a subset of the total
planned project functionality.
[7] CADE was intended to replace the antiquated Individual Master File
containing the repository of individual taxpayer information. It is
currently being used to provide for daily processing of tax returns
for approximately 40 million taxpayers.
[8] AMS is intended to enhance customer support by providing
applications that enable IRS employees to access, validate, and update
individual taxpayer accounts on demand. While IRS has stated that AMS
will also be part of the new strategy for managing individual taxpayer
accounts that is currently being implemented, it has not requested any
funding for this project for fiscal year 2010.
[9] Modernized e-file is the system intended to provide a single
standard for filing electronic tax returns.
[10] IRS has stated that it does not yet have any plans for
modernizing the Business Master File, which stores tax data and
related information on business taxpayers. IRS officials, however,
have told us that they expect to be able to replicate the CADE 2
approach to modernize the Business Master File.
[11] We recently initiated a review of CADE 2.
[12] GAO, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial
Statements, [hyperlink, http://www.gao.gov/products/GAO-10-176]
(Washington, D.C.: Nov. 10, 2009).
[13] After we provided our expenditure plan review results to the
subcommittees, we issued a report focusing on IRS's information
security program: GAO, Information Security: IRS Needs to Continue to
Address Significant Weaknesses, [hyperlink,
http://www.gao.gov/products/GAO-10-355] (Washington, D.C.: Mar. 19,
2010).
[14] TIGTA, Customer Account Data Engine Release 4 Includes Most
Planned Capabilities and Security Requirements for Processing
Individual Tax Account Information, 2009-20-100 (Washington, D.C.,
Aug. 28, 2009).
[15] GAO, Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2005 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO-05-774] (Washington, D.C.: July 22,
2005).
[16] Consolidated Appropriations Act, 2010, Pub. L No. 111-117,
Division C, Title I, Dec. 16, 2009, 123 Stat. 3034, 3164.
[17] These funds support IRS's efforts to modernize its business
systems. Other systems efforts, including the maintenance of legacy
applications, are supported by funding that is not subject to the BSM
program legislative conditions.
[18] An enterprise architecture is an institutional blueprint that
defines how an enterprise operates today, in both business and
technology terms, and how it intends to operate in the future. An
enterprise architecture also includes a road map for transitioning
between these environments.
[19] IRS refers to its life cycle management program as the enterprise
life cycle (ELC).
[20] The amount appropriated for the BSM program for fiscal year 2010
was approximately $264 million.
[21] We are referring to the practices defined in the Capability
Maturity Model Integration (CMMI®) model. CMMI is registered in the
U.S. Patent and Trademark Office by Carnegie Mellon University's
Software Engineering Institute. It is the process model that describes
how to develop the processes needed for software development and
specific practices that organizations should follow.
[22] IRS's Enterprise Life Cycle Guidance defines seven milestones,
each occurring at the end of one of the phases of the life cycle.
Milestone 0--at the end of vision and strategy/enterprise
architecture, 1--project initiation, 2--domain architecture, 3--
preliminary design, 4--development, test, and integration, 5--system
deployment. The development, test, and integration phase is sometimes
split into two phases, each corresponding to a different milestone:
4a--detailed design and 4b--system development.
[23] Releases are software versions that provide a subset of the total
planned project functionality.
[24] GAO, Business Systems Modernization: IRS Has Made Significant
Progress in Improving Its Management Controls, but Risks Remain,
[hyperlink, http://www.gao.gov/products/GA0-03-768] (Washington, D.C.:
June 27, 2003).
[25] GAO, Business Systems Modernization: IRS Needs to Complete Recent
Efforts to Develop Polices and Procedures to Guide Requirements
Development and Management, [hyperlink,
http://www.gao.gov/products/GAO-06-310] (Washington, D.C.: Mar. 20,
2006).
[26] GAO, Business Systems Modernization: IRS's Fiscal Year 2004
Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO-05-46]
(Washington, D.C.: Nov. 17, 2004).
[27] GAO, Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2007 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO-07-247] (Washington, D.C.: Feb. 15,
2007).
[28] GAO, Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2009 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GA0-09-281] (Washington, D.C.: Mar. 11,
2009).
[29] An initial cycle of the MV&S was completed in fiscal year 2006,
and the strategy was updated a year later. IRS, Internal Revenue
Service: IT Modernization Vision & Strategy (Washington, D.C: October
2007).
[30] IRS's Chief Technology Officer, who was appointed in November
2008, reports to the Deputy Commissioner for Operations Support.
[31] Efforts to maintain and enhance legacy applications are funded
from a different source not subject to the BSM expenditure plan
appropriations restriction.
[32] CADE refers to the prime contract development efforts that began
in 2002 to replace the legacy Master File and to date have resulted in
a series of five CADE releases and sub-releases. IRS refers to the
system as "Current CADE" in its expenditure plan.
[33] IRS has stated that it does not yet have any plans for
modernizing the Business Master File, which stores tax data and
related information on business taxpayers. IRS officials, however,
have told us that they expect to be able to replicate the CADE 2
approach to modernize the Business Master File.
[34] While IRS has stated that AMS will also be part of CADE 2, it has
not requested any funding for this project for fiscal year 2010.
[35] See Consolidated Appropriations Act, 2010, Pub. L. No. 111-117,
Division C, Title I, Dec. 16, 2009, 123 Stat. 3034, 3164.
[36] These key process areas are acquisition planning, solicitation,
requirements development and management, project management, contract
tracking and oversight, evaluation, and transition to support. For
this condition, we did not determine whether the expenditure plan
comports with the Federal Acquisition Regulation or other federal
requirements beyond those encompassed by the Software Engineering
Institute's Capability Maturity Model.
[37] SEI is a federally funded research and development center
operated by Carnegie Mellon University and sponsored by the Department
of Defense. Its objective is to provide leadership in software
engineering and in the transition of new software engineering
technology into practice.
[38] CMMI is registered in the U.S. Patent and Trademark Office by
Carnegie Mellon University. The CMMI® is SEI's model that describes
how to develop the processes needed for software development and
specific practices that organizations should follow.
[39] The CMMI® ranks organizational maturity according to five levels.
Maturity levels 2 through 5 require verifiable existence and use of
certain key process areas. CMMI level 2, known as the 'managed" level
is characterized by processes that, among other things are planned and
executed in accordance with policy; provide adequate resources; ensure
the designated work products are under the appropriate levels of
configuration management; involve relevant stakeholders; and are
monitored, controlled, and reviewed.
[40] GAO, Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2008 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO-08-420] (Washington, D.C.: Mar. 7,
2008).
[41] [hyperlink, http://www.gao.gov/products/GA0-05-774].
[42] IRS's MV&S initiative is intended to be an annual process through
which the agency integrates the strategic plans, business concepts of
operations, IT planning roadmaps, and proposed investments into a set
of integrated strategies and investment proposals for each domain and
ultimately into a proposed IT investment portfolio.
[43] IRS, Applications Development: 5-Year Plan, "A systems view"
Projects ” Programs ” Retirements & Consolidations.
[44] GAO, Business Systems Modernization: Internal Revenue Service's
Fiscal Year 2007 Expenditure Plan, [hyperlink,
http://www.gao.gov/products/GAO-07-247] (Washington, D.C.: Feb. 15,
2007).
[45] Earned value management is a project management tool that
integrates the investment scope of work with schedule and cost
elements for investment planning and control. This method compares the
value of work accomplished during a given period with that of the work
expected in the period. Differences between accomplishments and
expectations are measured in both cost and schedule variances.
[46] In December 2007, the Associate Chief Information Officer for
Applications Development stated that IRS uses earned value management
to measure progress in completing ELC deliverables, not in delivering
functionality, and consequently the agency's application of earned
value management does not provide a quantitative measure of progress
in meeting scope expectations.
[47] IRS's Enterprise Life Cycle Guidance defines seven milestones,
each occurring at the end of one of the phases of the life cycle.
Milestone 0--at the end of vision and strategy/enterprise
architecture, 1--project initiation, 2--domain architecture, 3--
preliminary design, 4--development, test, and integration, 5--system
deployment. The development, test, and integration phase is sometimes
split into two phases, each corresponding to a different milestone:
4a--detailed design and 4b--system development.
[48] In the fiscal year 2009 expenditure plan, IRS requested funding
for six milestones of AMS. IRS subsequently suspended these milestones
pending completion of work to redefine its strategy for managing
individual taxpayer accounts.
[49] This document describes the characteristics of the new strategy
in both business and technical terms. IRS provided us a final version
at the conclusion of our review.
[50] This document defines a high-level approach for delivering the
new strategy and describes high-level milestones for delivering the
transition states. IRS provided us a final version at the conclusion
of our review.
[51] We did not determine the effectiveness of IRS's methodology for
identifying and mitigating risks but plan to do so in a review we have
underway of IRS's CADE 2 strategy.
[52] TIGTA, Reengineering Individual Tax Return Processing Requires
Effective Risk Management, 2010-20-001 (Washington, D.C., Dec. 7,
2009).
[53] GAO, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial
Statements, [hyperlink, http://www.gao.gov/products/GA0-10-176]
(Washington, D.C.: Nov. 10, 2009).
[54] TIGTA, Customer Account Data Engine Release 4 Includes Most
Planned Capabilities and Security Requirements for Processing
Individual Tax Account Information, 2009-20-100 (Washington, D.C.,
August 28, 2009).
[55] [hyperlink, http://www.gao.gov/products/GAO-09-281].
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548: