Electronic Records Archives
The National Archives and Records Administration's Fiscal Year 2006 Expenditure Plan Gao ID: GAO-06-906 August 18, 2006Since 2001, the National Archives and Records Administration (NARA) has been working to acquire the Electronic Records Archives (ERA) system, which is intended to address critical issues in the creation, management, and use of federal electronic records. As required by law, the agency submitted its fiscal year 2006 expenditure plan to the congressional appropriations committees, seeking the release of about $22 million for the development of the system. GAO's objectives in reviewing the expenditure plan were to (1) determine the extent to which the expenditure plan satisfied the legislative conditions specified in the appropriations act; (2) determine the extent to which NARA has implemented GAO's prior recommendations; and (3) provide any other observations about the expenditure plan and the ERA acquisition. We reviewed the expenditure plan and analyzed it against the legislative conditions and assessed NARA's progress in addressing prior recommendations.
NARA's fiscal year 2006 expenditure plan fully satisfies three of the six legislative conditions and partially satisfies the remaining conditions. The agency continues to make progress in addressing prior GAO recommendations: the agency has fully implemented three of five and has partially implemented the remaining two. The agency has (1) strengthened information security by developing a program that includes agencywide assessments of information security risks; (2) developed and implemented a document review process to ensure that recommendations from reviewers are addressed and incorporated into acquisition policies and plans; and (3) improved federal records management by implementing strategies to raise agencies' awareness of records management principles, functions, and programs. However, while NARA has completed the development of an enterprise architecture, it lacks an agencywide board for reviewing information technology projects for conformance to the architecture, including projects that are interdependent with ERA. In addition, the agency revised four out of five key policies and plans to comply with industry standards. At the time of our briefing, the Risk Management Plan was under revision. It was completed in July 2006. Until the agency fully addresses all prior recommendations, risks remain to the successful implementation of the system. NARA's expenditure plan does not contain the level and scope of information needed by Congress to understand the agency's plans and commitments relative to system capabilities, benefits, schedules, and costs. For example, it does not fully describe how the infrastructure elements that are to be procured will fit into the overall system design. Until the agency improves future expenditure plans to include information on system capabilities, benefits, schedules, and costs, Congress will not have the information needed to oversee plans and progress on the acquisition of the system. We performed our work at NARA's College Park, Maryland, location in accordance with generally accepted government auditing standards.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-06-906, Electronic Records Archives: The National Archives and Records Administration's Fiscal Year 2006 Expenditure Plan
This is the accessible text file for GAO report number GAO-06-906
entitled 'Electronic Records Archives: The National Archives and
Records Administration's Fiscal Year 2006 Expenditure Plan' which was
released on August 18, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
August 2006:
Electronic Records Archives:
The National Archives and Records Administration's Fiscal Year 2006
Expenditure Plan:
GAO-06-906:
GAO Highlights:
Highlights of GAO-06-906, a report to congressional committees
Why GAO Did This Study:
Since 2001, the National Archives and Records Administration (NARA) has
been working to acquire the Electronic Records Archives (ERA) system,
which is intended to address critical issues in the creation,
management, and use of federal electronic records. As required by law,
the agency submitted its fiscal year 2006 expenditure plan to the
congressional appropriations committees, seeking the release of about
$22 million for the development of the system.
GAO‘s objectives in reviewing the expenditure plan were to (1)
determine the extent to which the expenditure plan satisfied the
legislative conditions specified in the appropriations act; (2)
determine the extent to which NARA has implemented GAO‘s prior
recommendations; and (3) provide any other observations about the
expenditure plan and the ERA acquisition. We reviewed the expenditure
plan and analyzed it against the legislative conditions and assessed
NARA‘s progress in addressing prior recommendations.
What GAO Found:
NARA‘s fiscal year 2006 expenditure plan fully satisfies three of the
six legislative conditions and partially satisfies the remaining
conditions (see table).
Table: Fiscal Year 2006 Expenditure Plan: Compliance with Legislative
Conditions:
Legislative Conditions: 1. Meet OMB capital planning and investment
control review requirements; Status: Partially satisfied.
Legislative Conditions: 2. Comply with NARA‘s enterprise architecture;
Status: Partially satisfied.
Legislative Conditions: 3. Conform to NARA‘s enterprise life cycle
methodology; Status: Partially satisfied.
Legislative Conditions: 4. Comply with acquisition rules, requirements,
guidelines, and system acquisition management practices of the federal
government; Status: Satisfied.
Legislative Conditions: 5. Approval by NARA and OMB; Status: Satisfied.
Legislative Conditions: 6. Review by GAO; Status: Satisfied.
Source: GAO.
[End of Table]
The agency continues to make progress in addressing prior GAO
recommendations: the agency has fully implemented three of five and has
partially implemented the remaining two. The agency has (1)
strengthened information security by developing a program that includes
agencywide assessments of information security risks; (2) developed and
implemented a document review process to ensure that recommendations
from reviewers are addressed and incorporated into acquisition policies
and plans; and (3) improved federal records management by implementing
strategies to raise agencies‘ awareness of records management
principles, functions, and programs. However, while NARA has completed
the development of an enterprise architecture, it lacks an agencywide
board for reviewing information technology projects for conformance to
the architecture, including projects that are interdependent with ERA.
In addition, the agency revised four out of five key policies and plans
to comply with industry standards. At the time of our briefing, the
Risk Management Plan was under revision. It was completed in July 2006.
Until the agency fully addresses all prior recommendations, risks
remain to the successful implementation of the system.
NARA‘s expenditure plan does not contain the level and scope of
information needed by Congress to understand the agency‘s plans and
commitments relative to system capabilities, benefits, schedules, and
costs. For example, it does not fully describe how the infrastructure
elements that are to be procured will fit into the overall system
design. Until the agency improves future expenditure plans to include
information on system capabilities, benefits, schedules, and costs,
Congress will not have the information needed to oversee plans and
progress on the acquisition of the system. We performed our work at
NARA‘s College Park, Maryland, location in accordance with generally
accepted government auditing standards.
What GAO Recommends:
GAO recommends that the Archivist of the United States ensure that
future expenditure plans include a sufficient level and scope of
information for Congress to effectively oversee the program. In
commenting on a draft of this report, the Archivist of the United
States agreed with the results and recommendation.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-906].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda D. Koontz at (202)
512-6240 or koontzl@gao.gov.
[End of Section]
Contents:
Letter:
Recommendation for Executive Action:
Agency Comments:
Appendixes:
Appendix I: Briefing Slides:
Appendix II: Comments from the National Archives and Records
Administration:
Appendix III: GAO Contacts and Staff Acknowledgments:
Abbreviations:
ERA: Electronic Records Archives:
IT: information technology:
NARA: National Archives and Records Administration:
OMB: Office of Management and Budget:
August 18, 2006:
The Honorable Christopher S. Bond:
Chairman:
The Honorable Patty Murray:
Ranking Minority Member:
Subcommittee on Transportation, Treasury, the Judiciary, Housing and
Urban Development, and Related Agencies:
Committee on Appropriations:
United States Senate:
The Honorable Joe Knollenberg:
Chairman:
The Honorable John W. Olver:
Ranking Minority Member:
Subcommittee on Transportation, Treasury, and Housing and Urban
Development, the Judiciary, and District of Columbia, and Independent
Agencies:
Committee on Appropriations:
House of Representatives:
As required by law, the National Archives and Records Administration
(NARA) submitted its fiscal year 2006 expenditure plan in March 2006 to
congressional appropriations committees, seeking the release of about
$22 million for the development of the Electronic Records Archives
(ERA). ERA is a major information system that is intended to address
critical issues in creating, managing, and using federal electronic
records and automating the records management and archiving life cycle.
Our objectives in reviewing the plan were to (1) determine whether the
plan satisfied the conditions specified in the law,[Footnote 1] (2)
determine the extent to which NARA has implemented our prior
recommendations, and (3) provide any other observations about the
expenditure plan and the ERA acquisition.
In May 2006, we transmitted a copy of our briefing to your staff and
briefed staff from the Senate Appropriations Subcommittee on
Transportation, Treasury, the Judiciary, Housing and Urban Development,
and Related Agencies on the results of our review. This report
transmits the materials we used at the briefing and provides the
recommendation that we made to the Archivist of the United States. The
full briefing materials, including our scope and methodology, are
reprinted as appendix I.
In summary, we made the following major points:
* NARA's fiscal year 2006 expenditure plan has fully satisfied three of
the six legislative conditions. The agency's plan (1) has complied with
acquisition rules, requirements, guidelines, and system acquisition
management practices of the federal government; (2) was approved by
NARA and the Office of Management and Budget (OMB); and (3) was
reviewed by GAO. The agency has partially satisfied the three remaining
conditions by (1) meeting OMB's capital planning and investment control
review requirements for the ERA acquisition, but has not appointed a
group to regularly review ERA and other ongoing information technology
(IT) investments, including those that have interdependencies with ERA;
(2) developing and implementing a procedure to ensure that ERA complies
with the agency's enterprise architecture, but has not established a
board to assess IT projects agencywide, including those that have
interdependencies with ERA, to ensure conformity to the EA; and (3)
implementing procedures to ensure ERA conforms to the agency's life
cycle methodology, but has not yet fully established an agencywide risk
management capability.
* NARA continues to make progress in addressing our prior
recommendations. The agency has fully implemented three of five
recommendations and has partially implemented the remaining two. The
agency has (1) strengthened information security by developing a
program that includes agencywide assessments of information security
risks and an enterprise architecture that addresses information
security issues agencywide; (2) developed and implemented a document
review process to ensure that recommendations from independent
verification and validation reviews are addressed and incorporated into
acquisition policies and plans; and (3) improved federal records
management by implementing strategies to raise agencies' awareness of
records management principles, functions, and programs and by
monitoring the performance of agencies' records management programs and
practices. The agency has partially implemented two other
recommendations that are essential for the successful management of the
acquisition. It has (1) completed the development of an enterprise
architecture, but lacks a board for reviewing IT projects agencywide,
including projects that are interdependent with ERA and (2) revised
four out of five key policies and plans to comply with industry
standards. At the time of our briefing, the remaining document--the
Risk Management Plan--was under revision with an expected completion
date of June 2006. The Risk Management Plan was subsequently completed
in July 2006.
* NARA's expenditure plan provides only general information on how the
$22 million is to be spent and does not fully describe, for example,
how the infrastructure elements that are to be procured will fit into
the overall system design. The legislative requirement for submitting
an ERA expenditure plan to the appropriations committees is intended to
provide lawmakers with a sufficient understanding of the system
acquisition in order to permit effective oversight and to allow for
informed decision making about the use of appropriated funds. To
achieve these objectives, the plan needs to disclose a sufficient level
and scope of information to understand what system capabilities and
benefits are to be delivered, by when, at what cost, and the progress
being made against the commitments that were made in prior expenditure
plans. Without this complete information, Congress does not have the
information needed to oversee plans and progress on the acquisition of
the ERA system.
Recommendation for Executive Action:
To reduce the risks associated with NARA's efforts to acquire ERA, we
recommend that the Archivist of the United States ensure that future
expenditure plans include a sufficient level and scope of information
to enable Congress to understand what system capabilities and benefits
are to be delivered, by when, and at what cost, and report on the
progress being made against the commitments that were made in prior
expenditure plans.
Agency Comments:
In written comments on a draft of this report, the Archivist of the
United States agreed with the results and recommendation. In addition,
he stated that the agency has submitted an action plan to relevant
congressional committees documenting how it plans to satisfy the
legislative conditions that we identified as partially implemented. He
also noted that NARA has proposed to the committees that the agency
submit an addendum to its expenditure plan that would provide more
detailed information on the allocation of funds, infrastructure
elements, workflow capability, and business applications in the ERA
system.
We are sending copies of this report to the Archivist of the United
States. We will make copies available to others on request. In
addition, the report will be available at no charge on the GAO Web site
at [Hyperlink, http://www.gao.gov/].
If you or your staff have any questions concerning this report, please
call me at 202-512-6240; I can also be reached by e-mail at
koontzl@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. GAO staff who made major contributions to this report are
listed in appendix III.
Signed by:
Linda D. Koontz:
Director, Information Management Issues:
[End of section]
Appendix I: Briefing Slides:
Electronic Records Archives: The National Archives and Records
Administration's Fiscal Year 2006 Expenditure Plan:
Briefing for Staff Members of the:
Subcommittee on Transportation, Treasury, the Judiciary, Housing and
Urban Development, and Related Agencies:
Senate Committee on Appropriations:
and the:
Subcommittee on Transportation, Treasury, and Housing and Urban
Development, the Judiciary, District of Columbia, and Independent
Agencies:
House Committee on Appropriations[Footnote 2]:
May 26, 2006:
Introduction:
Objectives, Scope, and Methodology Results in Brief:
Background Legislative Conditions Implementation of Prior
Recommendations * Enterprise Architecture:
Information Security:
Document Review Process:
Acquisition Policies and Plans:
Records Management:
Observation on the ERA Expenditure Plan:
Conclusions:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
The mission of the National Archives and Records Administration (NARA)
is to ensure "ready access to essential evidence" for the public, the
President, Congress, and the courts. NARA is responsible for oversight
of records management and archiving, which increasingly involves
dealing with documents that are electronically created and stored.
Accordingly, the Archivist of the United States plans to develop the
Electronic Records Archives (ERA) to address critical issues in the
creation, management, and use of federal electronic records. ERA is a
major information system that NARA envisions will have the ability to
preserve and provide access to massive volumes of all types and formats
of electronic records. Overall, the system is to automate the records
management and archiving life cycle. Specifically, ERA is to consist
of:
infrastructure elements, including hardware and operating systems;
business applications that will provide for scheduling electronic
records, accessioning, preserving and storing records; and:
public access provided by a Web browser and the public Internet.
In 2001, NARA hired a contractor to develop policies and plans using
the standards of the Institute of Electrical and Electronics Engineers,
Inc., (IEEE) to guide the overall acquisition of an electronic records
system.
In December 2003, the agency released a request for proposals for the
design of ERA. In August 2004, NARA awarded two firm fixed-price
contracts [Footnote 3] for the design phase totaling about $20 million-
one to Harris Corporation and the other to Lockheed Martin Corporation.
On September 8, 2005, NARA announced the selection of Lockheed Martin
Corporation to build the ERA system.
NARA's fiscal year 2006 appropriations act[Footnote 4] provides that
the agency must submit an expenditure plan before obligating fiscal
2006 funds for the ERA program. The plan must:
meet the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB), including
Circular A-11;
comply with NARA's enterprise architecture;
conform with NARA's enterprise life cycle methodology;
comply with the acquisition rules, requirements, guidelines, and system
acquisition management practices of the federal government;
be approved by NARA and OMB; and be reviewed by GAO.
On March 16, 2006, NARA submitted its 2006 expenditure plan to the
relevant House and Senate appropriations subcommittees, seeking release
of about $22 million for the development contract with Lockheed Martin.
Since June 2002, we have completed several reports assessing NARA's
efforts to acquire the ERA system[Footnote 5]. In these reports, we
made a total of 10 recommendations; 5 have been implemented while the
following remained to be addressed at the beginning of this review.
Develop an enterprise architecture.
Improve information security in order to address the lack of (1) a
capability to assess agencywide information security risks and (2) a
security architecture that addresses information security issues
agencywide.
Design and implement a process to ensure that recommendations from
verification and validation reviews are addressed and incorporated into
ERA's acquisition policies and plans.
Revise five key ERA program policies and plans to conform to IEEE
standards.
Develop a documented strategy for (1) raising agency senior management
awareness of and commitment to records management principles,
functions, and programs and (2) conducting systematic inspections of
agency records management programs to (a) periodically assess agency
progress in improving records management programs and (b) evaluate the
efficacy of NARA's governmentwide guidance.
Objectives, Scope, and Methodology:
As agreed, our objectives were to:
determine the extent to which NARA's fiscal year 2006 expenditure plan
satisfies the legislative conditions specified in NARA's appropriations
act,
determine the extent to which NARA has implemented our prior
recommendations, and:
provide any other observations about the expenditure plan and the ERA
acquisition.
To assess compliance with legislative conditions, we:
reviewed the fiscal year 2006 expenditure plan submitted by NARA in
March 2006 and analyzed the plan against the legislative conditions to
identify any variances;
reviewed and analyzed NARA's processes to ensure the ERA system
acquisition conforms to the agency's enterprise architecture;
reviewed NARA's fiscal year 2006 A-11, section 300 submission to OMB
and identified and analyzed NARA's responses to determine the extent to
which the agency has complied with OMB's capital planning and
investment control requirements; and:
reviewed the systems development life cycle policy that the agency is
using to guide the ERA acquisition and analyzed relevant items for
compliance.
To determine the extent to which NARA has implemented prior
recommendations, we:
evaluated the agency's enterprise architecture plans and products and
conducted interviews of senior NARA officials to determine the status
of the agency's efforts to develop an enterprise architecture;
reviewed Federal Information Security Management Act (FISMA) reports
and NARA's security program plan, security architecture, and system
security plans; interviewed senior NARA officials and Office of
Inspector General (OIG) auditors to determine the status of the
agency's efforts to strengthen information security;
reviewed key ERA policies and plans and independent verification and
validation reports on the policies and plans and interviewed ERA
officials to determine what progress the program had made in addressing
our recommendation that policies and plans conform to industry
standards;
assessed the program's process for reviewing and finalizing policies
and plans and interviewed ERA officials responsible for the review
process to determine the extent to which the review process was
developed and implemented; and:
interviewed NARA officials and reviewed documents to determine the
progress the agency has made in addressing our recommendation to raise
awareness among senior federal officials of the importance of federal
records management and increase their commitment to federal records
management; and to conduct systematic inspections of agency records
management programs to (a) periodically assess agency progress in
improving records management programs and (b) evaluate the efficacy of
NARA's governmentwide guidance.
To develop our observation on the ERA expenditure plan and acquisition,
we:
assessed the completeness of the cost and schedule information
contained in the expenditure plan and interviewed NARA officials in
order to gain an understanding of the data.
We performed our work from December 2005 to May 2006 at NARA's College
Park, Maryland, location in accordance with generally accepted
government auditing standards.
Results in Brief:
Legislative Conditions:
NARA's fiscal year 2006 expenditure plan fully satisfies three of the
six legislative conditions. The plan partially satisfies the
legislative conditions that ERA meet OMB's capital planning and
investment control review requirements, conform to the enterprise
architecture, and comply with the requirements of the systems
development life cycle.
Prior Recommendations:
NARA has fully implemented three of five prior GAO recommendations and
partially implemented the remaining two.
Table 1: Summary Status of NARA's Progress in Implementing Prior
Recommendations:
Prior recommendation: 1. Enterprise architecture;
Status: partially implemented;
Progress: NARA has completed a baseline, target, and a plan for
transitioning from the baseline to the target architecture. However,
the agency lacks a board for reviewing IT projects agencywide,
including projects that are interdependent with ERA.
Prior recommendation: 2. Information security;
Status: implemented;
Progress: NARA has developed a program that includes agencywide
assessments of information security risks and an enterprise
architecture that addresses information security issues agencywide.
Prior recommendation: 3. Document review process;
Status: implemented;
Progress: A document review process has been developed and implemented
to ensure that recommendations from independent verification and
validation reviews are addressed and incorporated into acquisition
policies and plans.
Prior recommendation: 4. Acquisition program policies and plans;
Status: partially implemented;
Progress: NARA has revised four out of five key policies and plans to
comply with IEEE standards. According to NARA officials, the remaining
document-the Risk Management Plan-is currently under revision.
plans;5. Federal records management;
Status: implemented;
Progress: NARA has implemented strategies to raise agencies' awareness
of records management principles, functions, and programs and to
monitor the performance of agencies' records management programs and
practices.
Source: GAO.
[End of table]
Observations on the ERA Expenditure Plan and Program:
NARA's expenditure plan does not contain the level and scope of
information needed for Congress to understand its plans and commitments
relative to system capabilities, benefits, schedules, and costs.
We are making a recommendation to NARA to improve the utility of future
expenditure plans.
In commenting on a draft of these briefing slides, the Archivist
generally agreed with the contents and our recommendation.
Background ERA Expenditure Plan:
NARA's fiscal year 2006 expenditure plan includes a description of
plans to complete initial operating capability of the ERA
system[Footnote 6] by September 2007. Table 2 shows the schedule of
planned activities.
Table 2: Summary of Planned Activities:
Milestone: Develop ERA through initial operating capability;
Start date: October 1, 2005;
Completion date: August 7, 2006.
Milestone: Establish ERA system infrastructure;
Start date: June 5, 2006;
Completion date: November 24, 2006.
Milestone: Provide business applications for appraisal, scheduling,
limited preservation, and internal dissemination of electronic records;
Start date: August 17, 2006;
Completion date: September 30, 2006.
Milestone: Complete initial operating capability;
Start date: [Empty];
Completion date: September 7, 2007.
Source: GAO.
[End of table]
Successfully acquiring the ERA system also involves the management of
interdependent IT projects. The current environment consists of a
number of legacy systems that do not adequately fulfill mission needs,
comprehensively address the entire life cycle management of records, or
support all of NARA's evolving business processes. These legacy systems
will be subsumed into the new system.
NARA's fiscal year 2006 expenditure plan for the ERA program also
includes a summary of funding to complete initial operating capability
of the ERA system.
Table 3: Summary of NARA's Fiscal Year 2006 ERA Expenditure Plan:
Project category: Program management;
Amount: $12,019,698.
Project category: Research and development;
Amount: 3,500,000.
Project category: Site deployment;
Amount: 1,980,000.
Project category: Development contract - Lockheed Martin;
Amount: 21 ,780,000.
Project category: Independent verification and validation [Footnote 7];
Amount: 1,549,909.
Project category: Total;
Amount: $40,829,607.
Source: NARA 2006 Expenditure Plan.
[End of table]
Of these funds, NARA cannot obligate the $21,780,000 for the
development contract with Lockheed Martin until Congress reviews and
approves the expenditure plan. Congress released the remaining funds
when NARA's appropriations bill was signed in November 2005.
Legislative Conditions:
NARA has fully satisfied three of the six legislative conditions and
partially satisfied three.
Table 4: Fiscal Year 2006 Expenditure Plan Provisions for Satisfying
Legislative Conditions:
Legislative condition: 1. Meet OMB capital planning and investment
control review requirements;
Status: Partially satisfied;
Progress: NARA meets OMB's capital planning and investment control
review requirements for the ERA acquisition. It identified funding
required for acquiring ERA and conducts regular reviews of the program.
However, while NARA has appointed a group comprised of senior managers
that meets weekly to review ERA, the agency does not regularly review
other ongoing IT investments, including those that have
interdependencies with ERA.
Legislative condition: 2. Comply with NARA's enterprise architecture;
Status: Partially satisfied;
Progress: NARA has developed and implemented a procedure to ensure that
ERA complies with the agency's enterprise architecture (EA). However,
while the chief technology officer reviews and approves ERA's
conformance to the agency's EA, NARA has not yet established a board to
assess IT projects agencywide, including those that have
interdependencies with ERA, to ensure they conform to the EA.
Legislative condition: 3. Conform to NARA's enterprise life cycle
methodology;
Status: Partially satisfied;
Progress: ERA conforms to the life cycle methodology. For example, the
plan includes descriptions of the incremental approach the agency has
adopted for acquiring ERA and the program performs risk and performance
management. However, NARA has not yet fully established an agencywide
risk management capability. While it has established a Risk Review
Board and assigned a chairperson to it, identified risks, and is
developing processes, it has not yet completed a risk management plan
or strategy.
Legislative condition: 4. Comply with acquisition rules, requirements,
guidelines, and system acquisition management practices of the federal
government;
Status: Satisfied;
Progress: NARA satisfied this provision by (1) conducting internal
assessments in 2002 and 2004 that used the Software Engineering
Institute's (SEI)[Footnote 8] SA-CMM[Footnote 9] methods to determine
the maturity of ERA's system policies, processes, and practices; (2)
implemented a process to address the assessment's recommendations; and
(3) is planning to commission an independent standard CMMI[Footnote 10]
appraisal methodology for process improvement (SCAMP)[Footnote 11]
appraisal of ERA in FY 2007.
Legislative condition: 5. Approval by NARA and OMB;
Status: Satisfied;
Progress:
* OMB-March 14, 2006.
* NARA -March 16, 2006.
Legislative condition: 6. Review by GAO;
Status: Satisfied;
Progress:
* GAO - May 26, 2006, briefing to NARA's appropriations subcommittees.
Source: GAO.
[End of table]
NARA recognizes the weaknesses associated with the legislative
conditions. According to its Chief Information Officer, the agency:
intends to establish a group to assess IT projects' compliance with the
EA,
plans to establish a process for regular reviews by management of
ongoing IT investments, and
has begun to establish an agencywide risk management capability.
Implementation of Prior Recommendations Enterprise Architecture:
In our June 2002 report, we recommended that NARA strengthen its IT
management capabilities by developing an EA. An EA provides a
description-in useful models, diagrams, and narrative-of the mode of
operation for an agency. It describes the agency in logical terms, such
as interrelated business locations and users, and in IT operational
terms, such as hardware, software, data, communications, and
information security attributes and standards. It provides these
perspectives both for the baseline and target environments as well as a
plan for transitioning from the baseline to the target. Furthermore,
the agency should establish an architecture review board that meets
regularly to evaluate projects' compliance with the EA.
The agency has established baseline and target architectures that
include:
* business process definitions and flows for interrelated activities;
* IT defined in operational terms including hardware, software, data,
and security; and
* a plan to transition from the baseline to the target architecture.
However, as previously noted, the agency lacks a review board for
ensuring that IT projects conform to the EA.
Until a board is established, the agency lacks assurance that projects
are fully consistent with the architecture.
Implementation of Prior Recommendations Information Security:
In our June 2002 report, we recommended that the agency improve
information security because it lacked a program for assessing
agencywide information security risks and an EA that addresses security
issues across the agency.
NARA has strengthened information security by:
improving its information security program plan, performing agencywide
assessments of information security risks, and developing plans of
action and milestones for identified weaknesses and:
developing its EA to encompass information security and providing
documentation that identifies and specifies NARA's requirements for IT
security management, processes, and technologies across the agency.
Because of several assessments that identified numerous security
weaknesses, the Archivist declared information security a material
weakness in fiscal year 2000. According to the Archivist, corrective
actions taken since then to address these weaknesses were completed in
fiscal year 2005, and information security is no longer considered a
material weakness. However, in its annual FISMA reports, the OIG has
identified numerous NARA IT security weaknesses.
While the agency has addressed our specific recommendation, NARA will
need to continue to be vigilant in identifying and addressing
information security weaknesses.
Implementation of Prior Recommendations Document Review Process:
In our September 2004 report, we reported that the program lacked a
process to ensure that the results of verification and validation
reviews of policies and plans were incorporated into final versions. We
recommended that the Archivist direct the ERA program director to
design and implement a process to ensure that recommendations from
verification and validation reviews are addressed and incorporated into
acquisition policies and plans. We noted that such a process reduces
the risk that acquisition policies and plans do not meet industry
standards. Without a documented process, NARA cannot ensure that
reviewers' comments are integrated into the final versions.
NARA has developed and implemented standard operating procedures to
ensure that reviewers' recommendations are addressed in the final
versions of ERA's acquisition policies and plans. Specifically,
acquisition policies and plans are assessed by an independent
verification and validation contractor, who reviews them against
applicable industry standards and prepares a report with results and
recommendations. After the policies and plans have been revised and
recommendations incorporated, they are returned to the independent
verification and validation contractor to ensure that all
recommendations have been incorporated. NARA recently applied these
procedures in its revisions to key ERA policies and plans, including
the acquisition strategy and configuration management plan.
By ensuring that independent verification and validation comments are
addressed and incorporated into final versions of its policies and
plans, NARA has increased assurance that it now has compliant
acquisition policies and plans to guide its efforts.
Implementation of Prior Recommendations Acquisition Policies and Plans:
We previously reported that ERA had developed key acquisition policies
and plans to guide its acquisition, but that the documents did not
fully conform to the IEEE standards selected by the agency. These
policies and plans are essential for managing the acquisition and
providing critical guidance to the contractor who will be developing
the system. As a result, we recommended that ERA revise these policies
and plans to conform to industry standards.
NARA has revised these four of five key acquisition policies and plans
to comply with IEEE standards
Acquisition Strategy:
Configuration Management Plan
Quality Management Plan:
Program Management Plan:
The revised acquisition policies and plans have been reviewed by an
independent verification and validation contractor. According to these
reviews, these documents are compliant with IEEE standards.
According to the Director of the ERA Program Support Division, the
remaining document-the risk management plan-is currently under revision
and should be completed by June 2006.[Footnote 12]
By revising these key ERA policies and plans to meet industry
standards, NARA has strengthened the guidance it needs to acquire the
ERA system.
Implementation of Prior Recommendations Records Management:
We previously reported that records management was generally afforded
low priority by federal agencies and that NARA lacked strategies to
address the low priority given to records functions and to monitor the
performance of records management programs and practices on an ongoing
basis. We recommended that the Archivist develop documented strategies
for:
raising senior management awareness of and commitment to records
management principles, functions, and programs and:
conducting systematic inspections of agency records management programs
to (1) periodically assess agency progress in improving records
management programs and (2) evaluate the efficacy of NARA's
governmentwide guidance.
NARA has implemented our recommendation by:
briefing agency leaders on the importance of records and information
management and providing guidance and support on electronic records to
senior agency officials;
assessing agency records management programs by (1) conducting cross-
government studies to identify and analyze records management best
practices; (2) developing governmentwide recommendations and guidance
on these practices; and (3) developing a plan to undertake agency
inspections based on a risk-based model, government studies, or reports
from the media; and:
conducting a survey of agency federal records officers that determined
that the officers were generally satisfied with the utility of NARA
guidance products.
In addition, NARA plans to broaden the survey to include electronic
records guidance, records management training, and scheduling and
appraisal services.
The plans and strategies implemented by NARA should raise agencies'
awareness of records management principles, functions, and programs.
Observations on the ERA Expenditure Plan and Acquisition ERA
Expenditure Plan:
The legislative requirement to submit an expenditure plan for ERA to
the appropriations committees is intended to provide lawmakers with a
sufficient understanding of the system acquisition to permit effective
oversight and to allow for informed decision making about the use of
appropriated funds. For this to occur, however, these plans need to
disclose a sufficient level and scope of information to understand what
system capabilities and benefits are to be delivered, by when, at what
cost, and what progress is being made against the commitments that were
made in prior expenditure plans.
NARA's expenditure plan does not contain the level and scope of
information needed for Congress to understand its plans and commitments
relative to system capabilities, benefits, schedules, and costs. More
specifically, the plan provides only general information on how the $22
million, for which it is requesting release, is to be spent. According
to the plan, these funds are to enable the development contractor,
Lockheed Martin, to:
* Provide the infrastructure for systems operations, including
security, systems management, common services, and limited storage
capabilities. This is to enable receiving, storing, and maintaining the
integrity of electronic records being ingested into ERA. The plan also
notes that a key element of this infrastructure is an "automated
workflow capability."
* Initiate work on business applications needed to support records
appraisal, scheduling, limited preservation, and limited internal
dissemination.
However, the spend plan does not contain details on, for example:
how the $22 million requested is to be allocated among planned tasks;
the infrastructure elements-including software and hardware-that are to
be procured or how these will fit into the overall system design;
what is meant by an "automated workflow capability" and its
relationship to system requirements and benefits; and:
the portion of the work on business applications that will be completed
during fiscal year 2006 with the funds requested.
We also note that the schedule provided in the expenditure plan has
changed since the plan was submitted to the appropriations committees.
Specifically, while the plan indicates that the review and approval of
the infrastructure design was to be completed by May 23, 2006, NARA
officials stated that the current plan is to conduct a series of
reviews that will result in approval of both the infrastructure and
business applications designs by August 7, 2006.
NARA officials stated that they had attempted to use another agency's
plans as models in developing their own. They also indicated that they
have more detailed information on their plans-including a list of the
equipment to be procured-but did not include it because they believed
it was too detailed.
A listing of specific equipment would be of limited value; however, the
plan does not provide sufficient information on system capabilities,
benefits, schedules or costs to fully inform the Congress on what is
being acquired. Without this information, Congress does not have the
information needed to oversee plans and progress on the acquisition of
the system.
Conclusions:
NARA's expenditure plan satisfies three of six legislative conditions
and the agency has continued to make significant progress in
implementing our recommendations. The agency plans to address
outstanding issues. If NARA complies with the legislative conditions
and implements our recommendations, the agency should be better
positioned to successfully acquire the ERA system.
NARA has not included a sufficient level and scope of information on
infrastructure elements, automated workflow capability, and business
applications to be completed in fiscal year 2006 so that Congress will
be able to understand what system capabilities and benefits are to be
delivered, by when, and at what cost. Without sufficient detail in
future expenditure plans, Congress may be hampered in its ability to
effectively oversee the program.
Recommendation for Executive Action:
We recommend that the Archivist of the United States ensure that future
expenditure plans include a sufficient level and scope of information
so that Congress will be able to understand what system capabilities
and benefits are to be delivered, by when, and at what cost, and what
progress is being made against the commitments that were made in prior
expenditure plans.
Agency Comments and Our Evaluation:
In written comments on a draft of our briefing slides, the Archivist of
the United States generally agreed with the contents and our
recommendation. He stated that he was pleased to note the recognition
of the progress made towards implementing our recommendations and
indicated that the agency would make every effort to complete those
identified as being partially implemented.
Regarding the information provided in this year's spend plan, the
Archivist said that providing more detail to Congress was inappropriate
because (1) funding had fallen far short of expectations, (2) the
agency and its contractor were replanning ERA to match available
resources, and (3) the plan's details had not been finalized. However,
NARA's spend plan did not provide information on these developments.
Without this information, it is difficult for Congress to discern from
the expenditure plan that NARA is significantly revising ERA's cost,
schedule, and performance goals. Nonetheless, the Archivist agreed that
NARA would provide additional information in future expenditure plans,
as we recommended.
The Archivist also stated that, because of substantial corrective
actions completed in fiscal year 2005, information security is no
longer considered to be a material weakness. We have clarified this in
our briefing. However, information security must continue to be a
priority as the agency increases reliance on its IT infrastructure for
records management and archiving of electronic information.
National Archives at College Park:
8601 Adelphi Road:
College Park, Maryland 20740-6001:
Government Accountability Office:
Director of Information Issues:
Ms. Linda Koontz:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Koontz:
We thank you for the opportunity to review and comment on the draft
presentation entitled Electronic Records Archive: The National Archives
and Records Administration's Fiscal Year 2006 Expenditure Plan before
it is briefed to the staff members of the Subcommittee on
Transportation, Treasury, the Judiciary, Housing and Urban Development
and Related Agencies, Senate Committee on Appropriations and the
Subcommittee on Transportation, Treasury, Housing and Urban
Development, the Judiciary, District of Columbia, and Independent
Agencies, House Committee on Appropriations. We are pleased to note the
recognition of the progress made towards implementing five of the ten
recommendations provided by GAO in their reports since June 2002.
We also appreciate the insight into the progress remaining to be made
towards addressing the five GAO recommendations discussed in the
presentation, as well as the recommendations for future expenditure
plans. To ensure successful implementation of the Electronic Records
Archives (ERA) system we will make every effort to complete those
recommendations identified in your presentation as "Partially
Implemented". As you point out in your presentation, NARA is already
working towards implementing the solutions to your recommendations.
We would like to clarify the observations provided on the ERA
Expenditure Plan and Acquisition. GAO noted that the ERA Expenditure
Plan does not contain sufficiently detailed information on the
allocation of funds, the infrastructure elements, workflow capability
and work on business applications in the ERA system. While NARA had
such information at the time the plan was submitted, it would have been
inappropriate to include it. Such information was most fully
articulated in Lockheed Martin's proposal for addressing NARA's
requirements; however, the costs of addressing those requirements at
the pace laid out in NARA's instructions to the contractor far exceeded
expected resource levels. This necessitated a re-plan of all details
about what would be built when. While NARA and the contractor reached a
high level agreement on this quickly, revision of detailed plans is
still in progress. Detailed re-planning requires not only addressing
each element, but also assessing feasibility of each change and the
cost, schedule, and engineering impacts on other elements of the plan.
NARA and Lockheed expect to complete agreement on revised detailed
plans by July. NARA will be happy to provide detailed information in
future expenditure plans, as recommended by GAO.
While the effort involved in the re-planning has required some
adjustments in the system development effort, all major milestones in
system development since the award of the contract option in September
2005 have been met on time. The schedule change noted in GAO's
observation will enable us to meet the next major milestone of
completing the Critical Design Review as scheduled in August 2006.
Finally, we would like to clarify the statement on slide 18 pertaining
to our past material weakness in information security identified by
NARA in our Fiscal Year 2000 Federal Managers' Financial Integrity Act
(FMFIA) Assurance Report to the President. The slide states that
information security continues to be a material weakness. The Archivist
of the United States reported in the FY 2005 Performance and
Accountability Report, that because of the substantial corrective
actions completed last year, the information technology security
material weakness was resolved during FY 2005.
Again, we thank you for this opportunity and look forward to our future
interactions as we continue the ERA acquisition process.
Sincerely,
Signed by:
Allen Weinstein:
Archivist of the United States:
[End of section]
Appendix II: Comments from the National Archives and Records
Administration:
National Archives at College Park:
8601 Adelphi Road College Park, Maryland 20740-6001:
Jul 18 2006:
Government Accountability Office:
Director of Information Issues:
Ms. Linda Koontz:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Koontz:
We thank you for the opportunity to review and comment on the proposed
report entitled Electronic Records Archive: The National Archives and
Records Administration 's Fiscal Year 2006 Expenditure Plan before the
report is issued. As mentioned in our letter of May 22,2006, we are
pleased to note the recognition of the progress made towards
implementing five of the ten recommendations provided by GAO in their
reports since June 2002 and the insight into the progress remaining to
be made towards addressing the five GAO recommendations discussed in
the presentation, as well as the recommendations for future expenditure
plans.
We are making every effort to complete those recommendations identified
in your report as "Partially Implemented" as well as the concerns
regarding the Electronic Records Archives (ERA) Expenditure Plan. The
same concerns were raised by the Committees on Appropriations in their
letter of June 22, 2006.
In response to the letter from the Committees, we are providing an
action plan on fully satisfying the three legislative conditions
identified as "Partially Implemented". We are also proposing submission
of an addendum to the existing ERA Expenditure Plan that would provide
more detail information on the allocation of funds, the infrastructure
elements, workflow capability and work on business applications in the
ERA system identified in your report. This information will be
available on September l, 2006 after we have reached an agreement with
Lockheed Martin on their proposed re-plan for the expected resource
levels.
While the effort involved in the re-planning has required some
adjustments in the system development effort, all major milestones in
system development since the award of the contract option in September
2005 have been met on time. The schedule change noted in GAO's
observation will enable us to meet the next major milestone of
completing Increment 1 of the project.
Finally, we appreciate your clarification on slide 18 pertaining to our
past material weakness in information security. The Archivist of the
United States reported in the FY 2005 Performance and Accountability
Report that because of the substantial corrective actions completed
last year, the information technology security material weakness was
resolved during fiscal year 2005. However, understanding the importance
of information security in the Federal government, we will continue to
be vigilant in identifying and addressing information security
weaknesses in the future.
Again, we thank you for this opportunity and look forward to our future
interactions as we continue the ERA acquisition process.
Sincerely,
Signed By:
Allen Weinstein:
Archivist of the United States:
[End of section]
Appendix III: GAO Contacts and Staff Acknowledgments:
GAO Contact:
Linda Koontz, (202) 512-6240:
Staff Acknowledgments:
In addition to the contact named above, Naba Barkakati, Timothy Case,
Mike Dolak, Nancy Glover, Mary Hatcher, Jacqueline Mai, and Amos
Tevelow made key contributions to this report.
(310770):
FOOTNOTES
[1] NARA's fiscal year 2006 appropriations act provides that the agency
must submit an expenditure plan before obligating fiscal 2006 funds for
the ERA program. The plan must (1) meet the capital planning and
investment control review requirements established by the Office of
Management and Budget (OMB), including Circular A-11; (2) comply with
NARA's enterprise architecture; (3) conform with NARA's enterprise life
cycle methodology; (4) comply with the acquisition rules, requirements,
guidelines, and system acquisition management practices of the federal
government; (5) be approved by NARA and OMB; and (6) be reviewed by
GAO. See P.L. No. 109-115, November 30, 2005, Div. A, Title VI, 119
Stat. 2486.
[2] A technical clarification was added on p. 20.
[3] According to the Federal Acquisition Regulation, a firm fixed-
price contract provides for a price that is not subject to any
adjustment on the basis of the contractor's cost experience in
performing the contract. This type of contract places maximum risk and
full responsibility for all costs and resulting profit or loss on the
contractor(s).
[4] P.L. 109-115, November 30, 2005, Div. A, Title VI, 119 Stat. 2486.
[5] GAO, Information Management. Challenges in Managing and Preserving
Electronic Records, GAO-02-586 (Washington, D.C.: June 17, 2002); GAO,
Records Management. National Archives and Records Administration's
Acquisition of Major System Faces Risks, GAO-03-880 (Washington, D.C.:
Aug. 22, 2003); GAO, Records Management. Planning for the Electronic
Records Archives Has Improved, GAO-04-927 (Washington, D.C.: Sept. 23,
2004); and GAO, Information Management: Acquisition of the Electronic
Records Archives is Progressing, GAO-05-802 (Washington, D.C.: July 15,
2005).
[6] A senior ERA official indicated that these dates were tentative and
would not be finalized until August 7, 2006, when Lockheed Martin and
NARA complete the design.
[7] NARA contracted with Northrop Grumman to perform independent
verification and validation on policies and plans produced by the ERA
program and contractual deliverables produced by Lockheed Martin.
[8] SEI is a federally funded research and development center operated
by Carnegie Mellon University and sponsored by the Department of
Defense. Its objective is to provide leadership in software engineering
and in the transition of new software engineering technology into
practice.
[9] SA-CMM: Identifies key process areas that are essential to
effectively managing software-intensive system acquisitions.
[10] CMMI is registered in the U.S. Patent and Trademark Office by
Carnegie Mellon University. The CMMI is SEI's process model that
describes how to develop the processes needed for software development
and specific practices that organizations should follow.
[11] SCAMPI (SM) is a service mark of Carnegie Mellon University. It is
a method used for appraising organizations using CMMI.
[12] The Risk Management Plan was subsequently completed in July 2006.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
