oversight

Information Technology: Departmental Leadership Crucial to Success of Investment Reforms at Interior

Published by the Government Accountability Office on 2003-09-12.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to the Subcommittee on Interior
                 and Related Agencies, Committee on
                 Appropriations, House of
                 Representatives

September 2003
                 INFORMATION
                 TECHNOLOGY
                 Departmental
                 Leadership Crucial to
                 Success of Investment
                 Reforms at Interior




GAO-03-1028
                 a
                                                September 2003


                                                INFORMATION TECHNOLOGY

                                                Departmental Leadership Crucial to
Highlights of GAO-03-1028, a report to          Success of Investment Reforms at
Chairman and Ranking Minority Member
of the Subcommittee on Interior and             Interior
Related Agencies, House Committee on
Appropriations




The Department of the Interior is
                                                The Department of the Interior has limited capability to manage its IT
responsible for diverse and
complex missions ranging from                   investments. Based on GAO’s IT Investment Management (ITIM)
managing America’s public lands,                Framework, which measures the maturity of an organization’s investment
mineral and water resources, and                management processes, the department is carrying out few of the activities
wildlife to providing satellite data            that support critical foundational processes (see table below). As an initial
to the military and scientific                  step to improve its investment management capability, the department has
communities. To fulfill these                   issued a Capital Planning and Investment Control Guide, which describes
responsibilities, Interior invests              its approach to IT investment management. However, it has thus far
over $850 million annually—about                implemented few of the processes described in its own guide. In addition, it
6 percent of its total annual                   has yet to develop an adequate approach to identify existing projects and
budget—in communications and                    systems. In order to ensure strong investment management at all levels, the
computing projects and systems.
                                                department has also specified a requirement for certifying bureau-level
Interior’s Office of the Secretary
and its Chief Information Officer               investment processes, but certification has not yet begun. Finally, in order to
(CIO) are responsible for                       strengthen the CIO’s ability to manage IT investments at all levels, the
overseeing processes for managing               Secretary of the Interior has issued an order establishing the authority of the
these investments to ensure that                bureau-level CIOs; however, the order has not been fully implemented.
funds are expended in the most
cost-effective way in support of the            In order to improve investment management processes, an organization
agency’s mission needs. GAO was                 needs to develop and implement a coherent plan, supported by senior
asked to evaluate (1) departmental              management, which defines and prioritizes enhancements to its investment
capabilities for managing the                   processes. While Interior has undertaken a number of initiatives designed to
agency’s information technology                 improve its investment management processes, the department has not yet
(IT) investments and (2) the
                                                developed a unified, comprehensive plan to achieve its objective of
department’s actions and plans to
improve these capabilities.                     establishing effective investment management processes, nor has it
                                                committed the resources to successfully implement the necessary reforms.
                                                Without a well-defined process improvement plan and controls for
                                                implementing it, Interior will continue to be challenged in its ability to make
To strengthen the department’s                  informed and prudent investment decisions.
investment management capability,
GAO recommends that the
                                                Interior’s Current IT Investment Management Capabilities
Secretary of the Interior direct                 ITIM critical          Purpose                                                 Percentage of key
Interior’s CIO to develop and                    process                                                                        practices executed
implement a plan aimed at                        IT investment board     To define and establish the governing board(s)
addressing the weaknesses                        operation               responsible for selecting, controlling, and                     33
discussed in this report, including a                                    evaluating investments
timetable and specific milestones                IT project and          To regularly determine each IT project's progress
for implementation of appropriate                system identification   toward cost and schedule milestones, using
                                                                                                                                          0
investment management processes                                          established criteria, and to take corrective actions
                                                                         when milestones are not achieved
at all levels of the agency. In                  IT project oversight    To create and maintain an IT project and system
commenting on a draft of this                                                                                                             9
                                                                         inventory to assist in managerial decision-making
report, Interior concurred with                  Business needs          To ensure that each IT program and project
GAO’s recommendations.                           identification          supports the organization's business needs and                  25
                                                                         meets users' needs
www.gao.gov/cgi-bin/getrpt?GAO-03-1028.          Proposal selection      To ensure that an established, structured process
                                                                                                                                         33
                                                                         is used to select new IT proposals
To view the full product, including the scope
and methodology, click on the link above.       Source: GAO.
For more information, contact Linda Koontz at
(202) 512-6240 or koontzl@gao.gov.
Contents



Letter                                                                                                      1
                             Results in Brief                                                               1
                             Background                                                                     3
                             Scope and Methodology                                                         11
                             Interior’s Capacity to Effectively Manage IT Investments
                                Is Limited                                                                 12
                             Department’s Efforts to Improve Investment Management Processes
                                and Oversight Are Fragmented and Inadequate                                34
                             Conclusions                                                                   36
                             Recommendations                                                               37
                             Agency Comments and Our Evaluation                                            38


Appendixes
              Appendix I:    Bureau Missions, Functions, and IT Investments                                40
             Appendix II:    Comments from the Department of the Interior                                  44
             Appendix III:   GAO Contact and Staff Acknowledgments                                         46
                             GAO Contact                                                                   46
                             Acknowledgments                                                               46


Tables                       Table 1: Stage 2 Critical Processes—Building the Investment
                                      Foundation                                                           13
                             Table 2: Status of Stage 2 Critical Processes                                 15
                             Table 3: Investment Board Operation                                           18
                             Table 4: IT Project and System Identification                                 21
                             Table 5: IT Project Oversight                                                 23
                             Table 6: Business Needs Identification                                        26
                             Table 7: Proposal Selection                                                   28
                             Table 8: Stage 3 Critical Processes—Developing a Complete
                                      Investment Portfolio                                                 29
                             Table 9: Status of Stage 3 Critical Processes                                 30


Figures                      Figure 1: Interior’s Organizational Structure                                  4
                             Figure 2: The Five Stages of Maturity within ITIM                              9




                             Page i              GAO-03-1028 Interior’s Governance of IT Investment Management
Contents




Abbreviations

ALMRS        Automated Land and Mineral Record System
BIA          Bureau of Indian Affairs
BLM          Bureau of Land Management
CIO          Chief Information Officer
CPIC         Capital Planning and Investment Control
IT           Information Technology
ITIM         Information Technology Investment Management
MMS          Minerals Management Service
NBC          National Business Center
NPS          National Park Service
OCIO         Office of Chief Information Officer
OIG          Office of the Inspector General
OMB          Office of Management and Budget
OSM          Office of Surface Mining Reclamation and Enforcement
PMB          Policy, Management and Budget
SAIC         Science Applications International Corporation
TAAMS        Trust Asset and Accounting Management System
USBR         United States Bureau of Reclamation
USFWS        United States Fish and Wildlife Service
USGS         United States Geological Survey



 This is a work of the U.S. government and is not subject to copyright protection in the
 United States. It may be reproduced and distributed in its entirety without further
 permission from GAO. However, because this work may contain copyrighted images or
 other material, permission from the copyright holder may be necessary if you wish to
 reproduce this material separately.




Page ii                  GAO-03-1028 Interior’s Governance of IT Investment Management
A
United States General Accounting Office
Washington, D.C. 20548



                                    September 12, 2003                                                                   Leter




                                    The Honorable Charles H. Taylor
                                    Chairman
                                    The Honorable Norman D. Dicks
                                    Ranking Minority Member
                                    Subcommittee on Interior and Related Agencies
                                    Committee on Appropriations
                                    House of Representatives

                                    The Department of the Interior is responsible for diverse and complex
                                    missions ranging from managing America’s public lands, mineral and water
                                    resources, and wildlife to providing satellite data to the military and
                                    scientific communities. To fulfill these responsibilities, Interior invests over
                                    $850 million annually—about 6 percent of its total annual budgetary
                                    resources—in communications and computing projects and systems. The
                                    Secretary of the Interior and Interior’s Chief Information Officer (CIO) are
                                    responsible for overseeing processes for managing these investments at all
                                    levels of the organization to ensure that funds are expended in the most
                                    cost-effective way in support of the agency’s mission needs.

                                    This report is one of two in response to your request that we evaluate the
                                    Department of the Interior’s information technology investment
                                    management capabilities.1 As agreed with your offices, our objectives were
                                    to evaluate (1) departmental capabilities for managing the agency’s
                                    information technology (IT) investments, including its ability to effectively
                                    oversee bureau processes, and (2) the department’s actions and plans to
                                    improve these capabilities.



Results in Brief                    The Department of the Interior has limited capacity to effectively manage
                                    its planned and ongoing IT investments. Over the past few years, Interior
                                    has undertaken several initiatives to better understand its current
                                    capabilities and to implement the organizational processes required for the
                                    department to exercise its responsibility to select, control, and evaluate IT
                                    investments. For example, the department has issued a Capital Planning
                                    and Investment Control (CPIC) Guide, which describes its approach to IT

                                    1
                                     U.S. General Accounting Office, Bureau of Land Management: Plan Needed to Sustain
                                    Progress in Establishing IT Investment Management Capabilities, GAO-03-1025
                                    (Washington, D.C.: Sept. 12, 2003).




                                    Page 1                  GAO-03-1028 Interior’s Governance of IT Investment Management
investment management. In addition, in order to support the
implementation of effective investment management practices throughout
the department, the Secretary has issued an order aligning bureau CIOs
with the department CIO and specifying that the bureau CIOs will have
authority over IT expenditures within their bureaus. This order
acknowledges that effective bureau processes are necessary to support
effective investment management throughout the department. However,
efforts to implement the CPIC Guide and the secretarial order have not
moved forward as specified in implementing memoranda. Interior has
much to accomplish before it can have confidence that its mix of IT
investments best meets its mission and business needs.

• The first step toward establishing effective investment management is
  to put in place foundational, project-level control and selection
  processes. Interior has implemented few of these processes. While the
  CPIC Guide describes the approach Interior intends to take, and the
  department-level boards have begun operating, few other key practices
  have been instituted at this time. Until processes are established that
  enable executives to select and oversee investments using reliable
  information, they cannot be assured that they are consistently selecting
  and managing IT investments that meet Interior’s needs and priorities.

• The second major step toward effective investment management is to
  continually assess proposed and ongoing projects as an integrated and
  competing portfolio of investment options. Interior officials
  acknowledge that the agency has made little progress in managing
  investments as a complete portfolio. As a result, Interior executives are
  unable to adequately assess the relative merits of investment proposals
  and make trade-offs among options.

Interior has undertaken a number of initiatives designed to improve its
investment management processes; however, it has not coordinated these
efforts, nor has it assigned the resources to effectively carry them out.
Without a well-defined process improvement plan and controls for
implementing it, it is unlikely that the agency will establish a mature
investment management capability. As a result, Interior will continue to be
challenged in its ability to make informed and prudent investment
decisions in managing its IT investments to meet its mission objectives.

To strengthen the department’s investment management capability, we are
making a number of recommendations aimed at addressing the weaknesses
discussed in this report. In addition, we are recommending that the



Page 2               GAO-03-1028 Interior’s Governance of IT Investment Management
                              department develop and implement a plan that includes (1) provisions to
                              improve investment management practices agencywide and (2) a timetable
                              and milestones for certifying bureau CPIC processes and for implementing
                              the secretarial order aligning CIO authorities and responsibilities.

                              In commenting on a draft of this report, the Department of the Interior
                              concurred with our recommendations and identified actions that it plans to
                              take to improve IT investment management processes throughout the
                              department. Among other things, the department stated that it intends to
                              develop and implement a comprehensive plan, approved by its senior
                              investment decision-making board, to address specific weaknesses that we
                              identified in its foundational investment management practices and to
                              move to strengthen the role of the CIO in oversight and resource allocation.



Background

Interior Has Diverse          The Department of the Interior, created by Congress in 1849, is a
Missions and IT Investments   multitiered organization that currently employs approximately 70,000
                              people in about 2,400 locations throughout the United States. The Secretary
                              of the Interior heads the agency, which comprises approximately 30 offices
                              and committees and eight bureaus. Five Assistant Secretaries support the
                              Secretary of the Interior at the department level. One of these is
                              responsible for Policy, Management and Budget. The others are responsible
                              for mission-related matters including Land and Minerals Management,
                              Indian Affairs, Fish and Wildlife and Parks, and Water and Science.

                              At the next level of the organization, eight bureaus,2 aligned with these
                              Assistant Secretaries, are responsible for achieving Interior’s diverse
                              missions. Interior’s missions include managing approximately 500 million
                              acres of land—about one-fifth of the total U.S. land mass—and about 1.8
                              billion acres of the Outer Continental Shelf; fulfilling the government’s trust
                              responsibility to American Indians and Alaska Natives; conserving and
                              protecting fish and wildlife; offering recreational opportunities; managing
                              the National Park System; providing stewardship of energy and mineral
                              resources; fostering the sound use of land and water resources; helping


                              2
                               Interior uses the term “bureau” to refer to bureaus and offices and, in some instances, to its
                              departmental offices.




                              Page 3                     GAO-03-1028 Interior’s Governance of IT Investment Management
                                            with the management of the National Fire Plan; ensuring the reclamation
                                            and restoration of surface mining sites; and providing scientific
                                            information on resource, natural hazard, and earth science issues. Figure 1
                                            shows how Interior is organized.



Figure 1: Interior’s Organizational Structure




                                            Information technology (IT) investments play a vital role in Interior’s ability
                                            to fulfill its missions. Given the diversity of these missions and operating
                                            environments, the character of these investments also varies substantially.



                                            Page 4                GAO-03-1028 Interior’s Governance of IT Investment Management
For example, the department uses a land mobile radio infrastructure to
support geographically dispersed public safety and protection missions.
These missions include law enforcement on federal and tribal lands, urban
and wildland firefighting, seismic monitoring, wildlife tracking
management of national parks, and water reclamation activities. In
contrast, Interior’s Minerals Management Service owns systems that track
oil and gas production on public lands and maintains records on royalties
that are due to the federal government and to American Indian tribes.
Interior’s bureaus and associated program offices propose, fund, and
manage these kinds of investments, while certain departmental offices—
such as the Offices of Financial Management and Personnel Policy—
propose and manage other systems that support administrative functions.
Interior’s National Business Center is responsible for managing and
operating departmental information systems on a fee-for-service basis and
for providing other kinds of administrative support, such as facilities
management.

In fiscal year 2003, Interior invested over $850 million in IT—about 6
percent of its total budget. While the Secretary of the Interior has the
ultimate responsibility for managing these investments—including
overseeing and guiding the development, management, and use of
information resources and information technology throughout the
department—Interior’s CIO is responsible for providing leadership and
oversight for IT investment management processes throughout the agency.
To that end, Interior’s CIO serves as the chair of the department’s IT
Management Council, which oversees “major” investments in IT.3 About
2,255 of Interior’s staff of about 70,000 are classified as IT professionals.
Thirty-four staff provided direct support to the CIO in the department’s
Office of the CIO during fiscal year 2003.

Appendix I provides additional information about each bureau’s missions,
functions, staffing, and total expenditures on IT for fiscal year 2003.


3
 Major information technology investments include those with total life cycle costs greater
than $35 million; financial systems with a life cycle cost greater than $500,000; multiple
bureau and/or agency projects; investments mandated by legislation or executive order or
identified by the Secretary as critical; those reported as major on Exhibit 53 reports
submitted to OMB; those requiring a common infrastructure investment; department
strategic- and mandatory-use systems; those that differ significantly from or affect
department infrastructure, architecture, or standards and guidelines; high risk investments
as determined by OMB, GAO, Congress and/or the CIO; investments that directly support
the President’s Management Agenda items of “high executive visibility;” and those that are
related to electronic government or that use E-business technologies.




Page 5                    GAO-03-1028 Interior’s Governance of IT Investment Management
Reviews Identified Need for   Prior reviews of IT projects performed at Interior over the past decade—by
Improving IT Investment       GAO and the Office of Management and Budget (OMB) as well as Interior’s
                              Office of the Inspector General (OIG)—have revealed significant
Management                    weaknesses in IT investment management practices at both the department
                              and the bureau levels. Over the last several years, we have issued a series of
                              reports on Interior’s major IT investments and associated management
                              practices. In April and July of 1999, we reported that Interior had not
                              followed sound management practices in the early stages of its effort to
                              acquire the Trust Asset and Accounting Management System,4 a system
                              designed to manage Indian assets and land records. We also reported that,
                              as a result of poor planning, Interior could not ensure that the system
                              would meet financial management needs cost effectively or mitigate
                              system development risks adequately. In September 2000, we reported that
                              Interior still needed to address significant remaining risks.5 Among other
                              things, we recommended that Interior take steps to strengthen its software
                              development and acquisition processes and that it regularly assess the
                              progress being made in implementing this system.




                              4
                               U.S. General Accounting Office, Indian Trust Funds: Interior Lacks Assurance That Trust
                              Improvement Plan Will Be Effective, GAO/AIMD-99-53 (Washington, D.C.: Apr. 28, 1999)
                              and U.S. General Accounting Office, Indian Trust Funds: Challenges Facing Interior’s
                              Implementation of New Trust Asset and Accounting Management System, GAO/T-AIMD-
                              99-238 (Washington, D.C.: July 14, 1999).
                              5
                               U.S. General Accounting Office, Indian Trust Funds: Improvements Made in Acquisition
                              of New Asset and Accounting System But Significant Risks Remain, GAO/AIMD-00-259
                              (Washington, D.C.: Sept. 15, 2000).




                              Page 6                   GAO-03-1028 Interior’s Governance of IT Investment Management
Between 1995 and 2001, we reported on Interior’s efforts to acquire a land
and mineral case processing system called Automated Land and Mineral
Record System(ALMRS)/Modernization and raised concerns about the
Bureau of Land Management’s (BLM) and the prime contractor’s abilities to
complete, integrate, and test the new software system and complete the
current schedule. 6 Among other things, we recommended that BLM take
steps to strengthen its IT investment management processes and systems
acquisition capabilities. ALMRS was terminated in 1999, but many of the
management weaknesses we had identified remained. In 2000 and 2001, we
reported that BLM had been working to implement our recommendations,
and we further recommended that BLM develop a plan to integrate all of
the corrective actions necessary to implement our recommendations and
establish a schedule for completing them.

In August 2002, Interior’s OIG reported that the department did not have a
process to ensure that IT capital investments or projects focused on
departmental mission objectives or federal government goals and
initiatives—principally because of its decentralized approach to IT
investment management.7 The OIG further stated that only 20 investment
projects—representing over 24 percent of the total—were subject to
departmental review and approval in fiscal years 2002 and 2003 through
submission of capital asset plans. Therefore, about $1 billion in Interior IT
investment projects were not subject to department-level review and
approval during those 2 years.




6
 U.S. General Accounting Office, Land Management Systems: Progress and Risks in
Developing BLM’s Land and Mineral Record System, GAO/AIMD-95-180 (Washington, D.C.:
Aug. 31, 1995); U.S. General Accounting Office, Land Management Systems: BLM Faces
Risks in Completing the Automated Land and Mineral Records System, GAO/AIMD-97-42
(Washington, D.C.: Mar. 19, 1997); U.S. General Accounting Office, Land Management
Systems: Information on BLM’s Automated Land and Mineral Record System Release 2
Project, GAO/AIMD-97-109R (Washington, D.C.: June 6, 1997); U.S. General Accounting
Office, Land Management Systems: Major Software Development Does Not Meet BLM’s
Business Needs, GAO/AIMD-99-135 (Washington, D.C.: Apr. 30, 1999); U.S. General
Accounting Office, Land Management Systems: Status of BLM’s Actions to Improve
Information Technology Management, GAO/AIMD-00-67 (Washington, D.C.: Feb. 24, 2000);
and U.S. General Accounting Office, Land Management Systems: BLM’s Actions to
Improve Information Technology Management, GAO-01-282 (Washington, D.C.: Feb. 27,
2001).
7
 U.S. Department of the Interior, Advisory Report, Developing the Department of the
Interior’s Information Technology Capital Investment Process: A Framework for Action,
No. 2002-I-0038, August 2002.




Page 7                  GAO-03-1028 Interior’s Governance of IT Investment Management
                         Consistent with these reports, OMB reported in the President’s fiscal year
                         2003 budget that Interior was putting large sums of public funds at high risk
                         for failure and that it had not complied with applicable legislative
                         requirements that were established in the Paperwork Reduction Act of
                         1995 and the Clinger-Cohen Act of 1996.8 OMB also reported that the
                         department had not been able to adequately identify major projects within
                         its IT portfolio or to demonstrate through adequate business cases the need
                         for all of the major projects that it did identify. In addition, out of the 23
                         federal agencies included in the fiscal year 2003 budget supplemental
                         document entitled Performance Information for Major IT Investments,
                         the Department of the Interior was one of only two agencies that were
                         unable to provide the type of information on the actual performance of
                         their IT investments. In the Presidentís fiscal year 2004 budget, OMB
                         reported that Interior had made significant strides toward more fully
                         identifying its IT investments and strengthening the business cases that it
                         developed for major IT projects, although 20 of its 35 initial submissions
                         remained on OMB’s at-risk list.9



Information Technology   Our IT Investment Management (ITIM) maturity framework,10 issued in
Investment Management    May 2000, is a useful tool that can help Interior to improve its IT investment
                         management capabilities. The ITIM framework can be used to determine
Maturity Framework
                         both the status of an agency’s current IT investment management
                         capabilities and what additional steps need to be taken to put more
                         effective processes in place. The ITIM framework establishes a hierarchical
                         set of five maturity stages. Each stage builds upon the lower stages and
                         represents increased capabilities toward achieving both stable and
                         effective (and thus mature) IT investment management processes. Except
                         for the first stage—which largely reflects ad hoc, undefined, and
                         undisciplined decision and oversight processes—each maturity stage is


                         8
                          The Paperwork Reduction Act of 1995 requires each agency to define its information needs
                         and develop strategies, systems, and capabilities to support programs and to improve
                         productivity, efficiency, and effectiveness. The Clinger-Cohen Act requires agencies to link
                         IT investments to agency accomplishments and establish a process to select, manage, and
                         control IT investments.
                         9
                          Office of Management and Budget, Analytical Perspectives Budget of the United States
                         Government, Fiscal Year 2004.
                         10
                          U.S. General Accounting Office, Information Technology Investment Management: A
                         Framework for Assessing and Improving Process Maturity (Exposure Draft), GAO/AIMD-
                         10.1.23 (Washington, D.C.: May 2000).




                         Page 8                    GAO-03-1028 Interior’s Governance of IT Investment Management
composed of critical processes that are essential to satisfying the
requirements of that stage. These critical processes are defined by key
practices that include organizational commitments (e.g., policies and
procedures), prerequisites (e.g., resource allocation), and activities (e.g.,
implementing procedures). Key practices are the specific conditions that
must be in place and tasks that must be performed for an organization to
effectively implement the necessary critical processes.

Figure 2 shows the five ITIM stages and a brief description of each stage.



Figure 2: The Five Stages of Maturity within ITIM




While the ITIM framework defines critical processes and key practices in
general terms, our work at multitiered organizations, such as the Postal
Service and the Department of Justice,11 showed that specific roles and


11
 U.S. General Accounting Office, United States Postal Service: Opportunities to
Strengthen IT Investment Management Capabilities, GAO-03-3 (Washington, D.C.: Oct. 15,
2002) and U.S. General Accounting Office, Information Technology: Justice Plans to
Improve Oversight of Agency Projects, GAO-03-135 (Washington, D.C.: Nov. 22, 2002).




Page 9                  GAO-03-1028 Interior’s Governance of IT Investment Management
responsibilities may vary by organizational tier. For example, in such
organizations, department-level management has overall responsibility for
a process, while component-level management is responsible for ensuring
that applicable requirements defined by the department are met and that
operational units such as program offices take primary responsibility for
performing the day-to-day activities that are described by ITIM, in
accordance with management expectations. In such an environment, the
presence of well-established and managed processes at lower levels of the
organization can provide a level of assurance to the department concerning
the quality and reliability of proposals for new investments, information
reported on the actual performance of projects, and budget requests.

In an agency like Interior, in which organizations at different levels execute
various aspects of IT investment management, it is essential that top
agency management establish and oversee processes throughout the
agency to ensure that effective investment management practices are being
adhered to. Over the past decade, Congress has enacted a series of laws
that require centralized management and performance reporting to ensure
that agencies can demonstrate that they are making the best funding
decisions to support their mission needs. The Clinger-Cohen Act of 1996
specifically requires that the head of each agency designate a CIO to
implement a process that maximizes the value and assesses and manages
the risk of IT investments. Under the Clinger-Cohen Act, the Department of
the Interior’s CIO has the ultimate responsibility for ensuring the cost-
effectiveness of decisions made by program managers to expend funds on
IT in support of the agency’s mission needs. Therefore, even though
individual bureaus have CIOs or similar officers, the department’s CIO
must monitor and evaluate the performance of its IT investment portfolio
as a whole and report to the Secretary on compliance with applicable laws
and policies.




Page 10               GAO-03-1028 Interior’s Governance of IT Investment Management
Scope and     To determine the department’s capabilities for managing its information
              technology (IT) investments, including its ability to effectively oversee
Methodology   bureau processes, we used several different criteria. To evaluate the
              underlying investment management processes we used our Information
              Technology Investment Management: A Framework for Assessing and
              Improving Process Maturity, Exposure Draft (ITIM Framework).12 We
              applied the framework as it is described in the exposure draft, except that
              we used a revised version of the IT Asset Inventory critical process, called
              IT Project and System Identification, after discussion with departmental
              officials at the beginning of this engagement. This revised critical process
              has been used in our evaluations since June 2001. At the start of our
              evaluation, we requested that the department conduct a self-assessment
              using the ITIM as criteria. Using this self-assessment and the supporting
              documentation as a starting point, we worked with Interior officials to
              further support their conclusions. Based on the department’s
              acknowledgement that it had only executed two of the key practices in
              Stage 3, we did not independently assess the capabilities at this stage or at
              Stages 4 and 5 of the framework. In our evaluation, an ITIM key practice
              was rated as “executed” only when we found sufficient evidence that the
              practice was already in place at the time of the review. We rated all other
              key practices as “not executed.”

              To gain additional insight into the department’s ability to oversee its
              components’ IT investment management processes, we reviewed
              documentation and conducted interviews on the department’s efforts to
              put the necessary management structures in place, whether the department
              had clearly defined what was expected of the bureaus, and whether it held
              the bureaus accountable to the necessary standards. In order to evaluate
              the success of the department’s oversight activities, we also assessed the
              capabilities of Interior’s components. To determine the capabilities of the
              components, we collected documentation describing bureau CPIC and
              investment management processes and spoke with responsible officials at
              eight bureaus (the Bureau of Indian Affairs, the Bureau of Land
              Management, the Bureau of Reclamation, the Minerals Management
              Service, the National Park Service, the Office of Surface Mining




              12
               U.S. General Accounting Office, Information Technology Investment Management: A
              Framework for Assessing and Improving Process Maturity (Exposure Draft), GAO/AIMD-
              10.1.23 (Washington, D.C.: May 2000).




              Page 11                GAO-03-1028 Interior’s Governance of IT Investment Management
                         Reclamation and Enforcement, the U.S. Fish and Wildlife Service, and the
                         U.S. Geological Survey) and the National Business Center.

                         To assess Interior’s plans for improving its IT investment management
                         processes—including oversight of bureau processes—and to identify
                         potential barriers to their implementation, we obtained and evaluated
                         documents showing what management actions had been taken and what
                         initiatives had been planned by the department. In addition, we interviewed
                         officials in the Offices of Acquisition and Property Management, Budget,
                         and the Chief Information Officer.

                         We conducted our work at Interior’s headquarters offices in Washington,
                         D.C.; bureaus headquarters offices in Arlington, Virginia; Reston, Virginia;
                         and Lakewood, Colorado; and at the National Business Center in
                         Englewood, Colorado, from November 2002 through July 2003, in
                         accordance with generally accepted government auditing standards.



Interior’s Capacity to   In order to have the capabilities to effectively manage IT investments, a
                         department should (1) have basic, project-level control and selection
Effectively Manage IT    practices in place and (2) manage its projects as a portfolio of investments,
Investments Is Limited   treating them as an integrated package of competing investment options
                         and pursuing those that best meet the department’s strategic goals,
                         objectives, and mission. These practices may be executed at various
                         organizational levels of the agency—including the bureau level—although
                         overall responsibility for their success remains at the department level.

                         The Department of the Interior is executing only 7 of the 38 key practices
                         that are required by the ITIM framework to establish a foundation for IT
                         investment management and only 2 of the 38 key practices required to
                         manage investments as a portfolio. In addition, the department’s ability to
                         oversee the successful implementation and execution of the required
                         practices is limited, although a number of initiatives have been undertaken
                         to address this issue. However, efforts to implement the reform initiatives
                         have not moved forward as specified in implementing memoranda.13 Until
                         Interior successfully implements stable investment management practices


                         13
                            U.S. Department of the Interior, “Follow-on Guidance on Implementation of Secretarial
                         Order Requirements,” Memorandum from W. Hord Tipton (Jan. 31, 2003) and U.S.
                         Department of the Interior, “Capital Asset Investment Management Clarification,”
                         Memorandum from P. Lynn Scarlett (Mar. 13, 2003).




                         Page 12                   GAO-03-1028 Interior’s Governance of IT Investment Management
                          throughout the department, it will lack essential management controls over
                          its IT investments, and it will be unable to ensure that the mix of
                          investments it is pursuing is the best to meet the department’s strategic
                          goals, objectives, and mission.



Department Demonstrates   At the ITIM framework’s Stage 2 level of maturity, an organization has
Few Capabilities for IT   attained repeatable, successful investment control processes and basic
                          selection processes at the project level. Through these processes, the
Investment Management
                          organization can identify expectation gaps early and take appropriate steps
                          to address them. According to the ITIM framework, critical processes at
                          Stage 2 include (1) defining investment board operations, (2) collecting
                          information about existing investments, (3) developing project-level
                          investment control processes, (4) identifying the business needs for each
                          IT project, and (5) developing a basic process for selecting new IT
                          proposals. Table 1 describes the purpose for each of the Stage 2 critical
                          processes.



                          Table 1: Stage 2 Critical Processes—Building the Investment Foundation

                          Critical process            Description
                          IT investment board         To define and establish the governing board(s) responsible
                          operation                   for selecting, controlling, and evaluating investments.
                          IT project oversight        To regularly determine each IT project's progress toward
                                                      cost and schedule milestones, using established criteria,
                                                      and to take corrective actions when milestones are not
                                                      achieved.
                          IT project and system       To create and maintain an IT project and system inventory
                          identification              to assist in managerial decision making.
                          Business needs              To ensure that each IT program and project supports the
                          identification              organization's business needs and meets users' needs.
                          Proposal selection          To ensure that an established, structured process is used
                                                      to select new IT proposals.
                          Source: GAO.


                          In a multitiered organization like Interior, the department is responsible for
                          providing leadership and oversight for foundational critical processes by
                          ensuring that written policies and procedures are established, repositories
                          of information are created that support IT investment decision making,
                          resources are allocated, responsibilities are assigned, and all of the
                          activities are properly carried out where they may be most effectively



                          Page 13                 GAO-03-1028 Interior’s Governance of IT Investment Management
executed. In such an organization, the CIO is specifically responsible for
ensuring that the organization is effectively managing its IT investments at
every level. If Interior’s bureaus do not have investment management
processes in place that adequately support the department’s investment
management process, its CIO must take action to ensure that the
department is expending funds on IT investments that will fulfill its mission
needs.

The department is executing 7 of the 38 key practices associated with Stage
2 critical processes (or about 18 percent), primarily as a result of issuing
the IT and Construction Capital Planning and Investment Control
(CPIC) Guide in December 2002 and assigning responsibility for IT
investment management functions to three oversight boards. Among other
things, the CPIC Guide clearly describes the structure of the department’s
IT investment review boards and how authority is to be aligned among
bureau- and department-level boards; it assigns responsibility to the boards
for its proposal selection process.

However, the department has not executed most of the crucial key
practices at the Stage 2 level. For example, information about the expected
and actual cost and schedule for Interior’s IT projects, which could form
the basis for selection decisions, is not being provided to the investment
review boards. In addition, the department has few capabilities for
overseeing IT projects and ensuring that business needs are adequately
identified. Finally, in July 2003 Interior had not yet implemented most of
the investment management processes that it describes in its CPIC Guide,
and thus the members of its boards lacked direct experience in the
execution of ITIM critical processes.

Table 2 summarizes the status of the department’s Stage 2 critical
processes, showing how many associated key practices the agency has
executed. The department’s actions toward implementing each of the
critical processes are discussed in the sections that follow.




Page 14               GAO-03-1028 Interior’s Governance of IT Investment Management
                                Table 2: Status of Stage 2 Critical Processes

                                                                                Total required
                                                             Key practices          by critical    Percentage of key
                                Critical process                 executed             process     practices executed
                                IT investment board                       2                  6                    33
                                operation
                                IT project and system                     0                  7                     0
                                identification
                                IT project oversight                      1                 11                     9
                                Business needs                            2                  8                    25
                                identification
                                Proposal selection                        2                  6                    33
                                Cumulative                                7                 38                    18
                                Source: GAO.



Boards Are Operating but Have   To help ensure executive management accountability and adequate
Limited Experience              oversight for IT capital planning and investment decisions, an organization
                                should establish a governing board or boards with responsibility for
                                selecting, controlling, and evaluating IT investments. According to the ITIM
                                framework, effective operation of an IT investment board requires, among
                                other things, that (1) board members have both IT and business knowledge,
                                (2) board members understand the investment board’s policies and
                                procedures and exhibit core competencies in using the agency’s IT
                                investment policies and procedures, (3) the organization’s executives and
                                line managers support and carry out board decisions, (4) the organization
                                develop organization-specific process guidance that includes policies and
                                procedures to direct the board’s operations, and (5) the investment board
                                operates according to written policies and procedures. (The full list of key
                                practices is provided later in table 3.)

                                The department is executing two of the six key practices needed for its IT
                                investment boards to operate effectively, as specified in the ITIM
                                framework. Interior’s new CPIC Guide provides a conceptual framework
                                for the operation of IT investment boards and a description of a five-phase
                                investment process. It also specifies the membership of Interior’s IT
                                investment boards in a way that should ensure the integration of technical
                                and business knowledge as well as the appointment of senior-level
                                executives to the boards.

                                In its new CPIC Guide, Interior provides a conceptual overview of the
                                department- and bureau-level review boards that are now responsible for


                                Page 15                 GAO-03-1028 Interior’s Governance of IT Investment Management
overseeing IT investments. At the department level, these boards and their
decision thresholds include the following:

• the Management Excellence Council, which is responsible for validating
  recommendations made to it by the Management Initiatives Team on IT
  investments;

• the Management Initiatives Team, which is responsible for reviewing,
  evaluating, and approving investments that are expected to cost $35
  million or more, and other investments that are otherwise considered to
  be major; and

• the IT Management Council, which is responsible for reviewing,
  evaluating, and approving IT investments that are expected to cost
  between $5 million and $35 million.

The Management Excellence Council, chaired by the Secretary of the
Interior and comprising Assistant Secretaries and bureau heads, was
created to provide leadership, direction, and accountability in meeting the
administration’s goals and to provide overall direction for and oversight of
the department’s management reform activities. Its IT investment
management activities include validating the Management Initiatives
Team’s recommendations and recommending strategic investments for the
Secretary’s approval. The Management Initiatives Team, chaired by the
Assistant Secretary for Policy, Management and Budget and comprising
Deputy Assistant Secretaries and Deputy Bureau Directors, was
established to support the Management Excellence Council in its broad
activities. In the context of IT investment management, the Management
Initiatives Team’s responsibilities include articulating investment strategy,
validating scoring by the IT Management Council, and resolving duplication
of effort. The IT Management Council, chartered in the CPIC Guide, is
cochaired by the department CIO and a rotating cochair who is elected by
IT Management Council annually; it is composed of the bureau CIOs and
representatives from several departmental offices. The IT Management
Council is responsible for scoring potential investments against a
predetermined set of criteria, maintaining the planning process and the
investment portfolio, and identifying duplication of effort.

The department has taken steps to ensure that investment boards are
established at the bureau level also. For example, Interior’s CPIC Guide
requires that investment review boards be established by each of its
bureaus to provide oversight for IT investments that are funded by Interior.



Page 16               GAO-03-1028 Interior’s Governance of IT Investment Management
This multilayered review of investments is designed to increase the
likelihood that Interior’s IT investments will meet mission needs.

However, at the time that we concluded our work in July 2003, the
department could not assert that board members exhibited core
competencies in using the IT investment approach because department
level boards had very limited experience with IT proposal selection
processes. Until the department implements an effective IT investment
board process that is well established and understood throughout the
agency, executives cannot be adequately assured that decisions made by
the boards are being well supported and carried out by its executives and
line managers or that each board is operating according to established
policies and procedures.

Table 3 summarizes our ratings for each key practice and the specific
evidence that supports the ratings.




Page 17              GAO-03-1028 Interior’s Governance of IT Investment Management
Table 3: Investment Board Operation

Type of practice   Key practice             Rating         Summary of evidence
Organizational     1. An organization-      Executed       The department issued a Capital Planning and Investment Control Guide
commitments        specific IT investment                  (CPIC) Guide in December 2002 that defined department- and bureau-
                   process guide is                        level IT investment boards and specified their authorities, procedures,
                   created to direct each                  membership, roles, and responsibilities.
                   board's operations.
                   2. Organization         Not executed    The CPIC Guide describes a number of controls or processes for
                   executives and line                     ensuring that executives and line managers carry out the decisions of the
                   managers support and                    IT investment boards. These include entry and exit criteria for five
                   carry out IT investment                 investment management phases defined in the CPIC Guide and a
                   board decisions.                        description of how CPIC and budget processes are to be linked. However,
                                                           at the time of our review these boards had limited experience and their
                                                           activities focused on OMB budget reporting.
Prerequisites      1. Adequate resources    Not executed   The department indicated in its self-assessment that this key practice had
                   are provided for                        not been executed.
                   operating each IT
                   investment board.
                   2. Board members        Not executed    The department’s IT investment boards are composed of departmental
                   understand the                          and bureau office executives who are capable of making investment
                   investment board's                      board decisions. However, at the time of this review, Interior’s department-
                   policies and                            level boards had limited experience with the processes described in its
                   procedures and exhibit                  new CPIC Guide.
                   core competencies in
                   using the IT investment
                   approach through
                   training, education, or
                   experience.
Activities         1. Each IT investment Executed          Interior has three department-level IT investment boards, including the IT
                   board is created and                    Management Council, the Management Initiatives Team, and the
                   defined with board                      Management Excellence Council. The IT Management Council reviews IT
                   membership integrating                  investments from a technical perspective for all three boards, and its
                   both IT and business                    members include both IT and business representatives. The Management
                   knowledge.                              Initiatives Team includes representatives from the bureaus, as well as the
                                                           department’s Offices of the Chief Information Officer, Financial
                                                           Management, and Planning and Performance Management. Finally, the
                                                           Management Excellence Council is made up of Assistant Secretaries
                                                           responsible for Interior’s programs and the heads of its bureaus.
                   2. Each IT investment Not executed      Although the department issued a CPIC Guide in December 2002 that
                   board operates                          contains written policies and procedures for the organization’s IT
                   according to written                    investment management process, Interior’s IT investment boards had not
                   policies and                            yet fully implemented these at the time of this review.
                   procedures in the
                   organization-specific IT
                   investment process
                   guide.
Source: GAO.




                                             Page 18                 GAO-03-1028 Interior’s Governance of IT Investment Management
No Project and System Inventory   Agency boards, managers, and staff at all levels who are responsible for
Exists to Support Investment      decisions about IT investment management must have at their disposal
Decision Making                   information about existing investments as well as new ones that are being
                                  proposed. Besides the fundamental business justification for each of the
                                  individual investments, decision makers must also consider the interaction
                                  of each continuing or proposed project with other projects that comprise
                                  the agency’s overall IT environment. In addition, opportunities to
                                  consolidate projects or systems and avoid redundant investments may be
                                  found when proposals are evaluated in this context. The information that
                                  could be used in this analysis includes current and planned system
                                  functions, physical location, organizational owners, and how funds are
                                  being expended toward acquiring, maintaining, and deploying these assets.

                                  A project and system inventory can take many forms and does not have to
                                  be centrally located or consolidated. The guiding principles for developing
                                  the inventory are that the information maintained should be both
                                  accessible—located where it is of the most value to investment decision
                                  makers—and relevant to the management processes and decisions that are
                                  being made. In multitiered organizations, information from an IT project
                                  and system inventory should be accessible and relevant to the decision
                                  processes of boards at all levels of the organization that are responsible for
                                  ITIM activities. An IT project and system inventory is also essential to
                                  successfully implementing certain other critical processes, including IT
                                  Project Oversight and Proposal Selection, and developing a comprehensive
                                  IT investment portfolio.

                                  According to the ITIM framework,14 organizations at the Stage 2 level of
                                  maturity allocate adequate resources for tracking IT projects and systems,
                                  designate responsibility for managing the project and system identification
                                  process, and develop related written policies and procedures. Resources
                                  required for this purpose typically include managerial attention to the
                                  process; staff; supporting tools, such as an inventory database; inventory
                                  reporting, updating, and query tools; and a method for communicating
                                  inventory changes to affected parties. Stage 2 organizations also maintain
                                  information on their IT projects and systems in one or more inventories
                                  according to written procedures, recording changes in data as required,


                                  14
                                   For this critical process, we used a revised version of the IT Asset Inventory critical
                                  process included in the Exposure Draft of the ITIM framework. We discussed the revision
                                  with departmental officials at the start of this engagement, and they agreed to use it as the
                                  basis for our review of Interior’s IT investment management capabilities.




                                  Page 19                   GAO-03-1028 Interior’s Governance of IT Investment Management
and maintaining historical records. Access to this information is provided
on demand to decision makers and other affected parties. (The full list of
key practices is provided in table 4.)

However, the department is not executing any of the seven key practices in
this critical process. It does not have any written standards or existing
repositories of information on Interior’s IT investments that meet ITIM
standards, and it has not assigned responsibility or allocated resources for
this purpose. In April 2003, departmental officials indicated that they are
planning to use the Exhibit 53 report they prepared for OMB as their IT
project and system inventory. However, according to the same officials, the
current Exhibit 53 report for Interior does not constitute a comprehensive
list of its IT investments. Moreover, this report does not include
information on actual project cost and schedule or other information
needed to support IT investment decisions.

Developing an adequate project and system inventory has only recently
become a priority at Interior. As a result, Interior’s IT investment boards do
not currently have the information they need to make well-informed
decisions regarding selecting, controlling, and evaluating investment
decisions. Without information from such an inventory, the department-
and bureau-level boards cannot ensure that duplication among existing and
proposed IT investments is eliminated. In addition, the boards cannot
compare actual project performance with expectations and determine
whether corrective actions should be taken.

Table 4 summarizes our ratings for each key practice.




Page 20               GAO-03-1028 Interior’s Governance of IT Investment Management
Table 4: IT Project and System Identification

Type of
practice         Key practice                                    Rating         Summary of evidence
Organizational   1. The organization has written policies     Not executed      The department indicated that it plans to use its Exhibit
commitments      and procedures for identifying its IT                          53 report to OMB as its IT project and system inventory.
                 projects and systems and collecting, in an                     While the Exhibit 53 is designed to list all of Interior’s IT
                 inventory, information about the IT projects                   projects and systems, this report does not contain
                 and systems that is relevant to the                            sufficient information to constitute an IT project and
                 investment management process.                                 system inventory as described by the ITIM framework.
                                                                                Therefore, any of the department’s current policies and
                                                                                procedures on the Exhibit 53 do not meet the
                                                                                requirements of this key practice.
                 2. An official is assigned responsibility for   Not executed   Although the department has assigned responsibility for
                 managing the IT project and system                             preparing the Exhibit 53 to the Office of the Budget, the
                 identification process and ensuring that                       Exhibit 53 does not provide sufficient information to
                 the inventory meets the needs of the                           support the investment management process as
                 investment management process.                                 described in the ITIM framework.
Prerequisite     1. Adequate resources are provided for          Not executed   The department indicated in its self-assessment that this
                 identifying IT projects and systems and                        key practice had not been executed.
                 collecting relevant information into an
                 inventory.
Activities       1. The organization's IT projects and           Not executed   The department indicated in its self-assessment that it
                 systems are identified, and specific                           intends to merge several inventories of IT projects and
                 information about them is collected in an                      systems into the Exhibit 53 in order to develop a
                 inventory.                                                     comprehensive list of investments. However, the Exhibit
                                                                                53 does not include all of the kinds of information that are
                                                                                required to support IT investment management decisions.
                 2. Changes to IT projects and systems are Not executed         The department does not have an adequate inventory in
                 identified, and change information is                          which changes to information on IT projects and systems
                 maintained in the inventory.                                   can be identified.
                 3. Information from the inventory is            Not executed   The department plans to use the Exhibit 53 as its
                 available on demand to decision makers                         investment inventory, but this document does not include
                 and other affected parties.                                    the necessary information to constitute an adequate IT
                                                                                project and system inventory, according to the ITIM
                                                                                framework.
                 4. The IT project and system inventory and Not executed        The department does not maintain an IT project and
                 its information records are maintained to                      system inventory with records that could contribute to
                 contribute to future investment selections                     future IT investment board decisions.
                 and assessments.
Source: GAO.



Department Lacks Fundamental                    According to the ITIM framework, effective project oversight requires,
Capabilities for IT Project                     among other things, (1) having written policies and procedures for project
Oversight                                       management; (2) developing and maintaining an approved management
                                                plan for each IT project; (3) having written policies and procedures for
                                                oversight of IT projects; (4) making up-to-date cost and schedule data for



                                                Page 21                   GAO-03-1028 Interior’s Governance of IT Investment Management
each project available to the oversight boards; (5) reviewing each project’s
performance by regularly comparing actual cost and schedule data to
expectations; (6) ensuring that corrective actions for each under-
performing project are documented, agreed to, implemented, and tracked
until the desired outcome is achieved; and (7) using information from the
IT projects and systems inventory. (The complete list of key practices is
provided in table 5.) For all IT projects, performance reviews should be
conducted at least at each major life cycle milestone. In an organization
such as Interior, it is essential that the department provide leadership and
oversight of IT project management even though the day-to-day
management of IT investments may be handled by bureau-level staff and
the National Business Center.

The department is executing 1 of the 11 key practices in this critical
process by operating department-level IT investment boards. However, the
other 10 key practices are not being executed, such as those requiring the
development of written policies and procedures for project management or
management oversight of IT projects. Moreover, the department currently
has no consistent way of knowing the extent to which project management
plans are being developed, approved, maintained, and reviewed. As a
result, the department has no mechanisms for ensuring that up-to-date
information on actual costs and schedule are being provided to the IT
investment boards. Finally, Interior lacks an IT projects and systems
inventory to capture performance information that can be used by its
boards in the investment decision process.

According to Interior officials, the department is not executing many of the
key practices for Stage 2 IT project oversight because it currently relies on
the bureaus to perform these management functions. However, since the
department has not developed policies and procedures for the bureaus to
follow in conducting IT project oversight, Interior is running the risk that
under performing projects will not be reported to the appropriate IT
investment board. In the absence of effective board oversight, Interior
executives do not have adequate assurance that projects are being
developed on schedule and within budget.

Table 5 summarizes our ratings for each key practice and the evidence that
supports the ratings.




Page 22               GAO-03-1028 Interior’s Governance of IT Investment Management
Table 5: IT Project Oversight

Type of practice   Key practice                  Rating         Summary of evidence
Organizational     1. The organization has       Not executed   The department has not developed any written policies and
commitments        written policies and                         procedures for IT project management.
                   procedures for IT project
                   management.
                   2. The organization has       Not executed   The department has not developed any written policies and
                   written policies and                         procedures for management oversight of IT projects.
                   procedures for
                   management oversight of
                   IT projects.
Prerequisites      1. Adequate resources are Not executed       The department indicated in its self-assessment that this key practice
                   provided to assist the                       had not been executed.
                   board(s) in overseeing IT
                   projects.
                   2. Each IT project has and Not executed      The department does not have any guidance or requirements for
                   maintains an approved                        developing, approving, or maintaining IT project plans to ensure that
                   project management plan                      these exist and that they include cost and schedule controls. The
                   that includes cost and                       department also lacks a reporting mechanism to determine which
                   schedule controls.                           existing IT projects may now have such a plan.
                   3. An IT investment board     Executed       The department’s IT Management Council, Management Initiatives
                   is operating.                                Team, and Management Excellence Council began operating in
                                                                support of the new CPIC processes in July 2002 and reviewing Exhibit
                                                                300 reports for IT investments during the fiscal year 2004 budget
                                                                formulation process.
                   4. Information from the IT    Not executed   The department does not have an IT project and system inventory.
                   project and system
                   inventory is used by the IT
                   investment board as
                   applicable.




                                               Page 23                GAO-03-1028 Interior’s Governance of IT Investment Management
(Continued From Previous Page)
Type of practice   Key practice                    Rating         Summary of evidence
Activities         1. Each project’s up-to-        Not executed   Up-to-date cost and schedule data for all IT investments had not been
                   date cost and schedule                         provided to the department’s boards at the time of our review. The
                   data are provided to the                       boards did, however, receive information on major investments shown
                   appropriate IT investment                      in the Exhibit 300 reports that are prepared annually for OMB.
                   board.
                   2. Using established            Not executed   At the time of our review, Interior’s IT investment boards did not
                   criteria, the IT investment                    oversee the performance of all IT projects because information on
                   board oversees each IT                         actual cost and schedule for some investments was not available for
                   project's performance                          review.
                   regularly by comparing
                   actual cost and schedule
                   data to expectations.
                   3. The IT investment board Not executed        At the time of our review, Interior’s department-level IT investment
                   performs special reviews of                    boards had not performed special reviews of any IT projects.
                   projects that have not met
                   predetermined
                   performance standards.
                   4. Appropriate corrective       Not executed   Since the department level boards had not conducted reviews of IT
                   actions for each under-                        project performance, corrective actions had not been defined.
                   performing project are
                   defined, documented, and
                   agreed to by the IT
                   investment board and the
                   project manager.
                   5. Corrective actions are       Not executed   Corrective actions for underperforming IT projects had not been
                   implemented and tracked                        defined by department-level IT investment boards at the time of our
                   until the desired outcome                      review.
                   is achieved.
Source: GAO.



Department Is Not Able to                        Defining business needs for each project helps to ensure that projects
Clearly Link IT Investments to                   support the organization’s mission goals and meet users’ needs. This
Business Needs                                   critical process creates the link between the organization’s business
                                                 objectives and its IT management strategy. According to our ITIM
                                                 framework, effectively identifying business needs requires, among other
                                                 things, (1) defining the organization’s business needs or stated mission
                                                 goals, (2) identifying users for each project who will participate in the
                                                 project’s development and implementation, (3) training IT staff adequately
                                                 in identifying business needs, and (4) defining business needs for each
                                                 project. (The complete list of key practices is provided in table 6.)

                                                 The department is responsible for providing leadership and oversight for
                                                 the identification and documentation of business needs for IT investments
                                                 by issuing written guidance for this critical process and executing the
                                                 associated key practices. However, given that knowledge of the actual



                                                 Page 24                GAO-03-1028 Interior’s Governance of IT Investment Management
business needs of Interior’s departmental offices and programs resides in
the sponsors of IT investments, much of the work of identifying business
processes must necessarily be performed at those levels of the
organization.

The department is executing two of the eight key practices for this critical
process by defining mission goals in strategic planning documents and by
ensuring that appropriately trained individuals identify the needs for its IT
projects. However, the department is not executing the remaining key
practices, such as those that involve ensuring that adequate resources are
being provided and identifying all of its IT projects and systems in an
inventory. As a result, the department could not identify specific users and
business needs for all of Interior’s IT investments at the time of our review.

In April 2003, the department provided training in linking projects to
Interior’s IT strategic plan, but written policies and procedures for business
needs identification have not been formalized. Also, the Exhibit 300 reports
on IT investments that the department produces for OMB in support of the
President’s budget—and which it identifies as the mechanism for capturing
business needs—are not required for nonmajor IT investments. Because
nonmajor projects comprised approximately 67 percent of Interior’s
projects and 45 percent of its total IT expenditures in fiscal year 2003,
business needs were not captured for many of Interior’s projects. The
department was also unable to demonstrate that identified users
participated in project management throughout a project’s life cycle.

Office of Chief Information Officer (OCIO) officials explained that the
department has not provided oversight of the process of identifying
business needs, because it has historically relied on its IT investment
sponsors to determine the business needs of the investments. However,
until the department provides adequate leadership and oversight for this
critical process that is well established and understood throughout the
agency, executives cannot be adequately assured that sponsors of IT
investments are consistently and objectively identifying user needs and
linking investment proposals to the agency’s strategic goals.

Table 6 summarizes our ratings for each key practice and the evidence that
supports the ratings.




Page 25               GAO-03-1028 Interior’s Governance of IT Investment Management
Table 6: Business Needs Identification

Type of practice   Key practice                       Rating     Summary of evidence
Organizational     1. The organization has written    Not        Written policies and procedures for identifying business needs have
commitment         policies and procedures for        executed   not been formally approved, although training has been initiated
                   identifying the business needs                which includes identifying business needs for major projects, to
                   (and the associated users) of                 familiarize individuals with the preparation of OMB Exhibit 300s.
                   each IT project.
Prerequisites      1. Adequate resources are         Not         The department indicated in its self-assessment that this key
                   provided for identifying business executed    practice had not been executed.
                   needs and associated users.
                   2. The organization has defined Executed      The department issued a Strategic Plan for FY 2000–2005 and a
                   business needs or stated                      draft Strategic Plan for FY 2003–2008. Both of these documents
                   mission goals.                                contain information on Interior’s stated mission goals and business
                                                                 needs.
                   3. IT staff are trained in         Executed   Since individuals responsible for identifying business needs and
                   business needs identification.                preparing Exhibit 300 reports work in departmental and bureau
                                                                 offices that sponsor IT investments, their work experience gives
                                                                 them sufficient knowledge regarding the business needs of those
                                                                 units. In addition, the department has provided supplemental
                                                                 training in business needs identification for major projects.
                   4. IT projects and systems are     Not        The department indicated in its self-assessment that this key
                   identified in the IT project and   executed   practice had not been executed. The department does not have an
                   system inventory.                             IT project and system inventory.

Activities         1. The business needs for each Not            Business needs are identified for major projects in Exhibit 300
                   IT project are clearly identified executed    reports that are prepared annually for OMB. However, these reports
                   and defined.                                  are not prepared for nonmajor IT investments.
                   2. Specific users are identified   Not        Exhibit 300 reports include a section for identifying users of IT
                   for each IT project.               executed   systems. However, these are not prepared for nonmajor IT
                                                                 investments.
                   3. Identified users participate in Not        The department indicated in its self-assessment that this key
                   project management throughout executed        practice had not been executed. In addition, the department lacks
                   a project’s life cycle.                       written policies and procedures for IT project management that
                                                                 could help ensure that users participate in project management
                                                                 throughout a project’s life cycle.
Source: GAO.



Selection Process Is Established,             Selecting new IT proposals requires an established and structured process
but Boards Lack Implementation                to ensure informed decision making and management accountability.
Experience                                    According to our ITIM framework, this critical process requires, among
                                              other things, (1) making funding decisions for new IT proposals according
                                              to an established process, (2) providing adequate resources for proposal
                                              selection activities, (3) using an established proposal selection process,
                                              (4) analyzing and ranking new IT proposals according to established
                                              selection criteria—including cost and schedule criteria—and



                                              Page 26                GAO-03-1028 Interior’s Governance of IT Investment Management
(5) designating an official to manage the proposal selection process. While
initial selection decisions may be made at the bureau level, the department
should have in place clear, established criteria for selection and guidance
regarding the structure and content of IT proposals. (The complete list of
key practices is provided in table 7.)

The department is executing two of the six key practices for this critical
process by identifying the IT Management Council cochairs as the
responsible authorities for the proposal selection process and by using the
CPIC Guide’s funding process to make decisions on IT proposals. These
achievements notwithstanding, the department has yet to implement most
key practices—such as using established criteria to analyze each
investment and prioritizing these investments accordingly. The CPIC Guide
does contain requirements that address several of the objectives of the
critical process for proposal selection, such as establishing a consistent
approach to assessing the costs and benefits of proposed investments and
developing clear performance expectations with quantifiable performance
measures. If implemented, the CPIC Guide would satisfy many of the
requirements of the key practices in this critical process.

Until now, the department has focused on other aspects of its IT investment
management process, such as the review of OMB Exhibit 300s for each
major project, without using the selection criteria that are defined in the
CPIC Guide. Moreover, while fundamental processes for proposal
selection are described in the CPIC Guide, these had not been fully
implemented at the time of our review. In the meantime, Interior’s bureaus
have retained responsibility for selecting IT investments—without benefit
of departmental review. Until the department implements the key practices
described in the ITIM framework, and they are well established and
understood throughout the agency, Interior cannot be adequately assured
that it is consistently and objectively developing and selecting proposals
that best meet the needs and priorities of the agency.

Table 7 summarizes our ratings for the proposal selection critical process.




Page 27              GAO-03-1028 Interior’s Governance of IT Investment Management
Table 7: Proposal Selection

Type of practice     Key practice                         Rating         Summary of evidence
Organizational       1. Executives and managers follow Not executed The department’s CPIC Guide established a selection
commitments          an established selection process.              process for IT investments. However, because the
                                                                    department only began implementing this process in 2002,
                                                                    to formulate its request for fiscal year 2004 funding,
                                                                    executives and managers have not yet fully implemented the
                                                                    selection process.
                     2. An official is designated to      Executed       The department’s self-assessment states that the cochairs
                     manage the proposal selection                       of the IT Management Council review board are designated
                     process.                                            as the responsible officials for the proposal selection
                                                                         process.
Prerequisite         1. Adequate resources are            Not executed The department indicated in its self-assessment that this key
                     provided for proposal selection                   practice had not been executed.
                     activities.
Activities           1. The organization uses a           Not executed The department’s CPIC Guide established a structured
                     structured process to develop new                 process for developing IT proposals. However, the
                     IT proposals.                                     department had not implemented this process at the time of
                                                                       our review.
                     2. Executives analyze and prioritize Not executed The department’s CPIC Guide established criteria for
                     new IT proposals according to                     prioritizing IT proposals. However, the department had not
                     established selection criteria.                   used these criteria to prioritize new IT proposals at the time
                                                                       of our review.

                     3. Executives make funding           Executed       The department’s CPIC Guide established a process for
                     decisions for new IT proposals                      making funding decisions for IT proposals, which the
                     according to an established                         department used in its 2004 budget formulation process.
                     process.
Source: GAO.




Department Is Not                           An IT investment portfolio is an integrated, agencywide collection of
Managing Interior IT                        investments that are assessed and managed collectively based on common
                                            criteria. Managing investments within the context of such a portfolio is a
Investments as a Portfolio
                                            conscious, continuous, and proactive approach to expending limited
                                            resources on an organization’s competing initiatives in light of the relative
                                            benefits expected from these investments. Taking an agencywide
                                            perspective enables an organization to consider its investments
                                            comprehensively, so that collectively the investments optimally address the
                                            organization’s missions, strategic goals, and objectives. Managing IT
                                            investments with a portfolio approach also allows an organization to
                                            determine priorities and make decisions about which projects to fund
                                            based on analyses of the relative organizational value and risks of all




                                            Page 28                   GAO-03-1028 Interior’s Governance of IT Investment Management
projects, including projects that are proposed, under development, and in
operation.

According to the ITIM framework, Stage 3 maturity includes (1) defining
portfolio selection criteria, (2) engaging in project-level investment
analysis, (3) developing a complete portfolio based on the investment
analysis, (4) maintaining oversight over the investment performance of the
portfolio, and (5) aligning the authority of the IT investment boards.

Table 8 summarizes the purposes of each of the critical processes in
Stage 3.



Table 8: Stage 3 Critical Processes—Developing a Complete Investment Portfolio

Critical process                  Description
Authority alignment of IT         To ensure that IT investments are selected and managed by
investment boards                 the appropriate investment board.
Portfolio selection criteria      To ensure that the organization develops and maintains IT
definition                        portfolio selection criteria that support its mission,
                                  organizational strategies, and business priorities.
Investment analysis               To ensure that all IT investments are consistently analyzed
                                  and prioritized according to the organization’s portfolio
                                  selection criteria.
Portfolio development             To ensure that an optimal IT investment portfolio with
                                  manageable risks and returns is selected and funded.
Portfolio performance             To ensure that each IT investment portfolio achieves its
oversight                         cost, benefit, schedule, and risk expectations.
Source: GAO.


The department provided evidence that it is executing 2 of the 38 key
practices for Stage 3 by establishing and maintaining in its CPIC Guide
written policies and procedures and associated criteria for aligning the
decision-making authority of its IT investment review boards. In its self-
assessment, Interior did not claim to be fully executing any other Stage 3
key practices.

At the time of our review, the department’s efforts to implement ITIM were
in the initial stages, since the CPIC Guide had been issued in December
2002. Moreover, OCIO efforts at IT management reform had to compete for
resources with other ongoing priorities. Until now, Interior has focused its
improvement activities in the preselect and select phases described by its
CPIC Guide. Until the department fully implements the foundational



Page 29                        GAO-03-1028 Interior’s Governance of IT Investment Management
                             critical processes in Stage 2 and then the critical processes for portfolio
                             management in Stage 3, it will lack the capability to consider Interior’s
                             investments in a comprehensive manner and determine whether it has the
                             mix of IT investments that best meet the agency’s mission needs and
                             priorities.

                             Table 9 summarizes the status of the department’s Stage 3 critical
                             processes, showing how many associated key practices the agency has
                             executed.



                             Table 9: Status of Stage 3 Critical Processes

                                                                                    Total required
                                                                 Key practices          by critical    Percentage of key
                             Critical process                        executed             process     practices executed
                             Authority alignment of IT                        2                  7                    29
                             investment boards
                             Portfolio selection criteria                     0                  6                     0
                             definition
                             Investment analysis                              0                  7                     0
                             Portfolio development                            0                  9                     0
                             Portfolio performance                            0                  9                     0
                             oversight
                             Cumulative                                       2                 38                     5
                             Source: GAO.




Department Has Limited       The ability of a department-level CIO to effectively oversee IT investment
Ability to Oversee IT        management processes throughout the agency depends on the existence of
                             appropriate management structures with adequate authorities and
Investments in the Bureaus
                             sufficient guidance. To its credit, Interior has taken several crucial initial
                             steps to make this possible; it conducted a study of existing organizational
                             structures, issued a secretarial order providing broad authorities to its
                             CIOs, and issued a capital planning and investment control guide that
                             provided a conceptual framework for improvements to the IT investment
                             management process. However, Interior’s CIO has taken limited action to
                             ensure that the secretarial order was implemented and that other required
                             improvements to the process were made. The department had envisioned a
                             certification process through which it would hold bureaus accountable for
                             improving their investment management capabilities, but it has yet to
                             implement this concept. Until sound management structures and a



                             Page 30                        GAO-03-1028 Interior’s Governance of IT Investment Management
                                certification process are in place, the department’s ability to oversee the
                                bureaus’ practices for investment management will be limited.

Department and Bureau CIOs      Under the Clinger-Cohen Act of 1996, the CIO of each agency is responsible
Are Not Positioned to Provide   for effectively managing all of the agency’s IT resources.15 To comply with
Leadership for IT Investment    the act, Interior’s CIO is responsible for ensuring that the bureaus are
Processes                       implementing effective investment management processes that are
                                appropriately aligned with the department’s processes. Our report on
                                Maximizing the Success of Chief Information Officers16 describes the
                                principles of successful CIO management in leading organizations. In such
                                organizations, the CIO has been positioned for success, having been
                                assigned clearly defined roles, responsibilities, and accountabilities.
                                Because Interior has multiple levels of IT investment management
                                authority, it is especially critical that the roles, responsibilities, and
                                accountabilities of all the CIOs be clearly defined.

                                In 2002, Interior contracted with Science Applications International
                                Corporation (SAIC) to study the department and bureau CIO organizations
                                and determine whether it was in compliance with the requirements of the
                                Clinger-Cohen Act. SAIC concluded that, in the current environment,
                                Interior’s CIO did not have adequate power—or the leverage of a formal
                                structure with clear lines of authority and control of resources—to carry
                                out its responsibilities under the act. The study pointed to a general lack of
                                authority and resource control at the bureau level as well, which further
                                inhibited the CIO’s ability to function. According to SAIC, in most of the
                                bureaus, the CIOs lacked the authority to effect change among their
                                subordinate IT staff and decision areas because they cannot allocate or
                                withdraw funds and do not control hiring, training, or performance
                                appraisals. On the basis of these findings, SAIC recommended that Interior
                                establish formal lines of authority from the department’s CIO to the bureau
                                CIOs and to IT staff at lower levels.




                                15
                                 The fiscal year 1997 Omnibus Consolidated Appropriations Act, Pub. L. 104-208, renamed
                                both Divisions D and E of the 1996 DOD Authorization Act, Pub. L. 104-106, the Clinger-
                                Cohen Act of 1996.
                                16
                                 U.S. General Accounting Office, Maximizing the Success of Chief Information Officers:
                                Learning From Leading Organizations, GAO-01-376G (Washington, D.C.: Mar. 1, 2001).




                                Page 31                  GAO-03-1028 Interior’s Governance of IT Investment Management
On the basis of the SAIC study, and because of its desire to comply with the
Clinger-Cohen Act, Interior issued Secretarial Order 3244,17 which
acknowledged that authority and control over management of IT resources
had not been fully established or coordinated in the department, resulting
in significant variability among bureaus and offices in implementing IT
functions and setting funding priorities. To rectify this situation, the order
provides broad authorities to all of Interior’s CIOs. Among other things, the
order requires all bureaus18 to standardize their IT functional areas to
achieve continuity of responsibility and accountability throughout the
department. Specifically, the order calls for establishing a function
described as technology management, which encompasses IT investment
management.19

The order assigns approval authority and management responsibility for all
IT assets to bureau CIOs. On the basis of the order, every Interior
organization with 5,000 or more employees must have a separate CIO
position at the Senior Executive Service level. The individual in this
position must be a fully participating member of the executive
leadership/management teams and must report to the Deputy Director or
Director of the bureau. For any office that reports directly to the Secretary
or the Deputy Secretary of the Interior, the department’s CIO will serve as
the CIO if those offices have not designated one. Consistent with the
Clinger-Cohen Act, the order states that the department’s CIO is
responsible for approving all IT expenditures.

Interior’s CIO issued specific direction to the bureaus in November 2002
and in January 2003, indicating how to implement Secretarial Order 3244
and establishing a process for monthly status reporting, which was to begin
on January 31, 2003. However, at the time of our review, only two bureaus


17
 U.S. Department of the Interior, Standardization of Information Technology Functions
and Establishment of Funding Authorities, Office of the Secretary Order No. 3244
(Washington, D.C.: Nov. 12, 2002).
18
 For purposes of this order, “bureaus and offices” refers collectively to the bureaus of the
department, the Secretarial Offices, and the immediate offices of the Secretary and the
Deputy Secretary.
19
  Secretarial Order 3244 requires that each bureau CIO organization include the following IT
management functions: technology, security, information management,
telecommunications, inventory and asset management, strategic planning, project
management, and IT career and skills management. Technology management is defined to
include enterprise architecture, capital planning and investment control processes, and IT
acquisition.




Page 32                   GAO-03-1028 Interior’s Governance of IT Investment Management
                                    had provided the required monthly status reports, and none of the bureaus
                                    had fully implemented the order. This lack of responsiveness is consistent
                                    with concerns described in the SAIC report that Interior’s CIO currently
                                    lacks adequate support from bureau CIOs to ensure that departmental
                                    efforts at improving IT investment management will be effectively
                                    implemented.

Department Does Not Follow          According to the Clinger-Cohen Act and Interior’s own CPIC Guide, the
Through with Certification of the   department should take steps to ensure that Interior's bureaus implement
Bureaus’ IT Investment              effective capital planning and investment control processes. To execute
Management Processes                this responsibility according to project management best practices, the
                                    department should clearly define its expectations for these processes and
                                    then hold the bureaus accountable to the standards it has established.

                                    At the time of our review, the department had specified initial expectations
                                    for the bureaus’ processes. On January 15, 2003, the department CIO issued
                                    a memorandum that called for the bureaus to immediately begin
                                    implementing more formal IT processes, using the CPIC Guide. The
                                    department held training sessions in which bureaus were informed that the
                                    Exhibit 300s they provide to the department for review as part of the
                                    annual budget formulation process must first be reviewed by their own IT
                                    investment review boards. The department emphasized during these
                                    sessions that the bureaus should work on making their Exhibit 53 reports
                                    on IT investments more complete and reliable. Although the Exhibit 53
                                    reports do not include adequate information for IT investment management
                                    purposes—according to the ITIM framework—improving the reports will
                                    bring Interior one step closer to identifying and tracking IT projects and
                                    systems. This is a critical aspect of the investment management process
                                    that will provide better visibility of all IT projects to the department.

                                    Despite this initial instruction on its expectations, the department has yet
                                    to fully implement a certification process through which it can hold
                                    bureaus accountable for their IT investment management processes. With
                                    the issuance of its CPIC Guide in December 2002, the department began to
                                    define some criteria for certification of these processes. The guide states
                                    that, at a minimum, a bureau’s investment review board must maintain a
                                    documented description or charter outlining the bureau’s CPIC process and
                                    the roles and responsibilities of the board, the bureau offices, and any other
                                    entities that are involved in CPIC. In addition, the guide outlines other
                                    departmental expectations—such as six steps that need to be
                                    accomplished in the short term, along with establishing a bureau-level
                                    investment review board—but it does not explicitly state whether these are



                                    Page 33               GAO-03-1028 Interior’s Governance of IT Investment Management
                          required for certification. During our interviews with staff from Interior’s IT
                          Portfolio Management Division, officials confirmed that the certification
                          process is still only a concept at Interior and that it has not been well
                          defined. More specifically, the department has not established a date for
                          the certification to begin or specified what corrective action will be taken if
                          a bureau fails to be certified. Implementation of an effective certification
                          process will provide the department with a mechanism for ensuring that
                          the bureaus are operating in a manner that is consistent with the policies
                          and procedures it establishes for ITIM key practices.

                          Departmental officials confirmed that at the time of our review, OCIO
                          efforts were concentrated on providing training for the preparation of
                          bureau Exhibit 300 reports, discussed above, rather than on implementing
                          the CPIC Guide’s provisions for a certification process. Until the
                          department focuses resources on defining and enforcing standards for
                          certifying bureau processes, the risk is high that bureaus may implement IT
                          investment management processes that do not sufficiently support the
                          departmental investment management process. Only by institutionalizing
                          effective processes at both the department and the bureau levels can
                          Interior ensure that it is optimizing its investments in IT and effectively
                          assessing and managing the risks of these investments.



Department’s Efforts to   Achieving successful reform of IT management requires an organization to
                          develop a complete and well-prioritized plan for systematically correcting
Improve Investment        weaknesses in its existing capabilities. To properly focus and target this
Management Processes      plan, an organization should first fully identify and assess current strengths
                          and weaknesses (i.e., create an investment management capability
and Oversight Are         baseline). As we have previously reported,20 this plan should, at a
Fragmented and            minimum, (1) specify measurable goals, objectives, milestones, and needed
Inadequate                resources and (2) clearly assign responsibility and accountability for
                          accomplishing well-defined tasks. The plan should also be documented and
                          approved by agency leadership. In implementing such a plan, it is important
                          that the organization measure and report progress against planned
                          commitments and take appropriate corrective action to address deviations.

                          In order to develop a focus for its reform efforts, Interior has made several
                          attempts to document existing conditions and identify weaknesses in its

                          20
                           U.S. General Accounting Office, Information Technology: DLA Needs to Strengthen Its
                          Investment Management Capability, GAO-02-314 (Washington, D.C.: Mar. 15, 2002).




                          Page 34                 GAO-03-1028 Interior’s Governance of IT Investment Management
organization. Between 2001 and 2003, OCIO hired three different
contractors to perform studies of existing IT projects and systems,
organizational reporting relationships and functions, and IT investment
management practices. The META Group performed the first study, after
which the SAIC study, described earlier, was completed to assess the
earlier results. G&B Solutions was then contracted to further elaborate and
validate the earlier work, focusing on technical solutions and CIO
authorities. In a separate effort in 2002, the department directed the
bureaus to rate themselves in a number of areas that correspond to areas
evaluated by OMB in the budget process. Further, on January 15, 2003,
OCIO issued a memorandum that required bureaus to submit descriptions
of their capital planning and investment control processes and IT
investment board charters and to perform self-assessments of their IT
investment management capabilities. However, the effectiveness of this
particular effort was limited because no specific instructions were given on
how to perform the self-assessments; this will lead to difficulties in
comparing results across bureaus.

The Department of the Interior has indicated that it intends to create a
comprehensive reform plan with target goals and measurement criteria,
but this plan has not been fully developed. In November 2002, the
department created a Program Management Office to implement IT
management reforms by pulling together various improvement efforts and
prioritizing them. However, as of July 2003, the Program Management
Office did not have a formal charter or a budget, and its manager did not
have a clearly defined role. In addition, this individual’s attention was being
diverted away from issues of IT investment management to address other
concerns, such as Interior’s court-ordered efforts to resolve issues with the
Indian Trust Fund and related information security problems.

The lack of clear accountability and responsibility for improvement efforts
that an office such as this would have provided has resulted in initiatives
that are not well integrated and do not support a unified plan. For example,
no steps have been taken to integrate the requirements of Secretarial Order
3244 for CIO organizations with the bureau certification process
established in the CPIC Guide. In addition, the multiple efforts to develop
an understanding of current conditions and identify weaknesses in the
existing organization, described above, have not yielded a coherent view,
despite the expenditure of considerable resources.

Without committing to a plan that allows it to systematically prioritize,
sequence, and evaluate improvement efforts, Interior jeopardizes its ability



Page 35               GAO-03-1028 Interior’s Governance of IT Investment Management
              to establish mature investment processes, which include selection and
              control capabilities that would result in greater certainty about the
              outcomes of future IT investments.



Conclusions   The Department of the Interior lacks most of the fundamental IT
              investment management practices necessary to effectively and efficiently
              manage its IT resources. Only by effectively and efficiently managing these
              resources can the department gain opportunities to further leverage its IT
              investments and make better allocation decisions among many investment
              alternatives. Recent moves by senior executives to define an IT investment
              management approach—and to align the IT investment decision review
              process with the CIOs at both the department and bureau levels—
              demonstrate Interior’s realization that reform is necessary. Nonetheless,
              the department still finds itself without many of the capabilities it needs to
              ensure that Interior’s mix of IT investments best meets the agency’s mission
              and business priorities.

              Interior’s ability to guide and oversee investment practices throughout the
              agency is limited by its lack of mature investment management processes.
              The department has recognized that it needs to oversee bureau activities,
              and it has begun to establish the authority of bureau CIOs to manage IT
              investments and to implement certification of standard investment
              processes in the bureaus. However, until the department is able to ensure
              mature investment management capabilities at all levels, its ability to
              wisely select and effectively manage IT investments will be limited.

              Interior’s success in resolving the weaknesses described in this report will
              depend on the department’s ability to plan and execute the implementation
              of robust investment management and related practices throughout the
              agency. However, the department’s efforts have suffered from a lack of
              unified planning, clear implementation guidance, supporting resources,
              and follow-up on requirements that have been established by the CIO. Until
              the department develops a comprehensive plan, supported by top
              management, that delineates performance expectations for process
              improvements, Interior’s prospects will remain limited for successfully
              developing the management capabilities that are necessary to make
              prudent decisions that maximize the benefits and minimize the risks of its
              IT investments.




              Page 36               GAO-03-1028 Interior’s Governance of IT Investment Management
Recommendations   To strengthen Interior’s capabilities for IT investment management and
                  address the weaknesses discussed in this report, we recommend that the
                  Secretary of the Interior direct Interior’s CIO to do the following:

                  • Develop a unified, comprehensive plan for implementing
                    departmentwide improvements to the IT investment management
                    process that are based on the Stage 2 and Stage 3 critical processes of
                    our ITIM framework.

                  • Ensure that the plan focuses first on the weaknesses that this report
                    identifies in the Stage 2 critical processes, before addressing those
                    associated with higher stages of ITIM maturity, because Stage 2
                    processes collectively provide the foundation for building a mature IT
                    investment management process. Specifically:

                     • Establish a timetable for the IT Management Council, Management
                       Initiatives Team, and Management Excellence Council to begin
                       operating according to the guidance described in the CPIC Guide.

                     • Develop and issue policies and procedures to guide the IT project
                       oversight as described by our ITIM framework, including the review
                       of actual performance information against expected performance by
                       the investment boards and the implementation of corrective actions
                       when performance falls below acceptable levels. Implement these
                       policies and procedures to accomplish the purpose of project
                       oversight.

                     • Develop and issue policies and procedures to guide the project and
                       system identification processes as described by the ITIM framework,
                       including the specification of information required by the investment
                       management process, the sources of such information, and the
                       methods for collecting and retaining this information. Implement
                       these policies and procedures to accomplish the purpose of IT
                       project and system identification.

                     • Develop and issue policies and procedures to guide the identification
                       of business needs as described by the ITIM framework, including the
                       identification of business needs for all projects and the inclusion of
                       users in project management throughout a project’s life cycle.
                       Implement these policies and procedures to accomplish the purpose
                       of identifying business needs.



                  Page 37              GAO-03-1028 Interior’s Governance of IT Investment Management
                         • Establish a timetable for implementing IT proposal selection as
                           described by Interior’s CPIC Guide.

                      • Ensure that the plan next focuses on Stage 3 critical processes, which
                        are necessary for portfolio management, because, along with the Stage 2
                        foundational processes, these processes are necessary for effective
                        management of IT investments.

                      • To further strengthen the department’s ability to oversee bureau
                        investment management processes so that it may ensure that
                        investment management is effectively carried out throughout the
                        organization, the plan should also

                         • establish a timetable and specific implementation milestones for
                           Secretarial Order 3244, and

                         • describe acceptable criteria for certification of bureau CPIC
                           processes and establish a time frame for the certification of these
                           processes at all bureaus.

                      • Ensure that the plan establishes a baseline of the agency’s capabilities,
                        specifies measurable goals and time frames, and establishes review
                        milestones.

                      • Establish a well-defined management structure for directing and
                        controlling the unified plan with clear authority and responsibility.

                      • Ensure that the Management Excellence Council, which holds
                        responsibility for department management reform activities, approves
                        the plan.

                      • Implement the approved plan and report on progress made against the
                        plan’s goals and time frames to the Secretary of the Interior every 6
                        months.



Agency Comments and   The Department of the Interior’s Assistant Secretary for Policy,
                      Management and Budget provided written comments on a draft of this
Our Evaluation        report (reprinted in appendix II). In these comments, the Department of the
                      Interior concurred with our recommendations and identified actions that it
                      plans to take to improve IT investment management processes throughout
                      the department. Specifically, it intends to leverage lessons learned in BLM’s



                      Page 38               GAO-03-1028 Interior’s Governance of IT Investment Management
implementation of the ITIM framework to accelerate the maturing of
department practices. It also intends to develop and implement a
comprehensive plan, approved by the Management Excellence Council, to
address specific weaknesses that we identified in its foundational
investment management practices and to move to full implementation of
Secretarial Order 3244.

In response to the department’s comments, we removed all descriptions of
national critical infrastructure or Trust. In its comments the department
also provided us with additional information that reflects the ongoing
progress it is making in implementing more mature investment
management practices. As we have described in this report, Interior’s
progress has been evident and is ongoing. In particular, the establishment
of the ITMC and the release of the CPIC Guide have provided an
organizational point of focus and a set of procedures to guide IT investment
management. This has enabled the department to begin to implement new
practices with a departmentwide scope. The information the department
provided to us in its comments on the completed evaluation reflects the
continuing implementation of plans described in this report. We strongly
support this ongoing progress, and we will reflect the successful execution
of key practices in following up on our recommendations.


We are sending copies of this report to interested committees of Congress,
to the Secretary of the Department of the Interior, and to the Chief
Information Officer of the Department of the Interior. Copies will be made
available to others upon request. In addition, the report will be made
available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions regarding this report, please contact me at
202-512-6240 or at koontzl@gao.gov. Additional GAO contact and staff
acknowledgments are listed in appendix III.
.




Linda D. Koontz
Director, Information Management Issues




Page 39              GAO-03-1028 Interior’s Governance of IT Investment Management
Appendix I

Bureau Missions, Functions, and IT                                                                                                           Appendx
                                                                                                                                                   ies




Investments                                                                                                                                   Append
                                                                                                                                                   x
                                                                                                                                                   Ii




Dollars in millions
                                        IT          Budget        FTEs
                                        Investments authority     FY 2003
Bureau            Mission               FY 2003a    FY 2003b      estimate     Description
Bureau of      To fulfill BIA's trust   $32.6          $2,252.0   9,667        BIA provides federal services to approximately 1.4 million
Indian Affairs responsibilities and                                            American Indians and Alaska Natives who are members
(BIA)          promote self-                                                   of 562 federally recognized tribes in the 48 contiguous
               determination on                                                United States and in Alaska. The bureau administers
               behalf of Tribal                                                43,450,267 acres of tribally owned land, 11,000,000 acres
               Governments,                                                    of individually owned land, and 443,000 acres of federally
               American Indians,                                               owned land held in trust status. The bureau’s mission is to
               and Alaska Natives.                                             promote and support tribes on their future path through
                                                                               self-determination and to reduce administration by the
                                                                               bureau in nontrust areas.
Bureau of         To sustain the health, $88.2         $1,660.0   10,739       BLM administers over 264 million surface acres of public
Land              diversity, and                                               land, about one-eighth of the land in the U.S., and
Management        productivity of the                                          approximately 700 million acres of federal subsurface
(BLM)             public lands for the                                         mineral estate. Most of these lands are in the West and
                  use and enjoyment of                                         Alaska, and they are dominated by extensive grasslands,
                  present and future                                           forests, high mountains, arctic tundra, and deserts. BLM is
                  generations.                                                 responsible for the management and use of a variety of
                                                                               resources on these lands, including energy and minerals,
                                                                               timber, forage, wild horse and burro populations, fish and
                                                                               wildlife habitat, recreation sites, wilderness areas, and
                                                                               archeological and historical sites. BLM balances the goals
                                                                               of providing opportunities for environmentally responsible
                                                                               recreation and commercial activities; preserving natural
                                                                               and cultural heritage resources; reducing threats to public
                                                                               health, safety, and property; providing land, resource, and
                                                                               title information; providing economic and technical
                                                                               assistance to Indian tribes and island communities;
                                                                               understanding and planning for the condition and use of
                                                                               the public lands; and restoring at-risk resources and
                                                                               maintaining functioning systems.




                                                 Page 40                  GAO-03-1028 Interior’s Governance of IT Investment Management
                                                Appendix I
                                                Bureau Missions, Functions, and IT
                                                Investments




(Continued From Previous Page)
Dollars in millions
                                        IT          Budget         FTEs
                                        Investments authority      FY 2003
Bureau            Mission               FY 2003a    FY 2003b       estimate     Description
U.S. Fish and     To work with others    $3.5         $1,281.0     8,928        USFWS is the primary federal agency responsible for the
Wildlife          to conserve, protect,                                         protection, conservation, and renewal of fish, wildlife,
Service           and enhance fish,                                             plants, and their habitats. It manages migratory bird
(USFWS)           wildlife, plants and                                          populations, restores interjurisdictional fisheries,
                  their habitats for the                                        conserves and restores wildlife habitat, administers the
                  continuing benefit of                                         Endangered Species Act, and assists foreign
                  the American people.                                          governments with their conservation efforts. USFWS
                                                                                oversees the Federal Aid in Fish and Wildlife Restoration
                                                                                Programs, which distribute hundreds of millions of dollars
                                                                                earned from excise taxes on fishing and hunting
                                                                                equipment to state fish and wildlife agencies. USFWS is
                                                                                the steward for nearly 93 million acres of public lands,
                                                                                including 529 refuges of the National Wildlife Refuge
                                                                                System, and it manages 67 national fish hatcheries for the
                                                                                restoration of the nation's fishery resources. USFWS also
                                                                                works closely with partnership activities for assisting
                                                                                voluntary habitat development and fostering aquatic
                                                                                conservation for fish and wildlife habitat on nonfederal
                                                                                lands.
Minerals          To manage the         $29.6         $170.0       1,747        MMS manages the nation's natural gas, oil, and other
Management        mineral resources on                                          mineral resources on the Outer Continental Shelf. The
Service           the Outer Continental                                         agency also collects, accounts for, and disburses more
(MMS)             Shelf in an                                                   than $5 billion per year in revenues from federal offshore
                  environmentally                                               mineral leases and from onshore mineral leases on
                  sound and safe                                                federal and Indian lands. MMS includes two major
                  manner and to timely                                          programs, Offshore Minerals Management and Minerals
                  collect, verify, and                                          Revenue Management. Offshore Minerals Management
                  distribute mineral                                            manages the mineral resources on the Outer Continental
                  revenues from                                                 Shelf and has three regions: Alaska, the Gulf of Mexico,
                  federal and Indian                                            and the Pacific. Minerals Revenue Management collects,
                  lands.                                                        accounts for, and distributes revenues associated with
                                                                                mineral production from leased federal and Indian lands.




                                                Page 41                    GAO-03-1028 Interior’s Governance of IT Investment Management
                                                Appendix I
                                                Bureau Missions, Functions, and IT
                                                Investments




(Continued From Previous Page)
Dollars in millions
                                        IT          Budget         FTEs
                                        Investments authority      FY 2003
Bureau            Mission               FY 2003a    FY 2003b       estimate   Description
National Park To preserve               $36.3         $2,354.0     20,369     NPS manages 379 parks and various historic
Service       unimpaired the                                                  preservation, conservation and recreation programs, and
(NPS)         natural and cultural                                            hosts 287 million visitors annually. The National Park
              resources and values                                            System encompasses approximately 83.6 million acres in
              of the national park                                            over three hundred areas, of which more than 4.3 million
              system for the                                                  acres remain in private ownership. There are three
              enjoyment,                                                      principal categories used in classification: natural areas,
              education, and                                                  historical areas, and recreational areas. NPS's four goal
              inspiration of this and                                         categories are to preserve park resources; to provide for
              future generations.                                             the public enjoyment and visitors’ experience of parks; to
              The Park Service                                                strengthen and preserve natural and cultural resources
              cooperates with                                                 and enhance recreational opportunities managed by
              partners to extend                                              partners; and to ensure organizational effectiveness in
              the benefits of                                                 supporting NPS's mission.
              natural and cultural
              resource
              conservation and
              outdoor recreation
              throughout this
              country and the
              world.
Office of         To carry out the      $1.3          $279.0       630        OSM is the lead federal agency for carrying out the
Surface           requirements of the                                         mandates of the Surface Mining Control and Reclamation
Mining            Surface Mining                                              Act, whose goal is to protect society and the environment
(OSM)             Control and                                                 from the adverse effects of surface coal mining
                  Reclamation Act in                                          operations. OSM’s mission goal of Environmental
                  cooperation with                                            Restoration addresses mining that occurred prior to the
                  states and tribes.                                          passage of Surface Mining Control and Reclamation Act
                                                                              in 1977, while its goal of Environmental Protection
                                                                              addresses mining since 1977. Environmental Restoration
                                                                              is accomplished through the Abandoned Mine Land
                                                                              Program, whose main purpose is to restore a safe and
                                                                              clean environment. As part of this, the Appalachian Clean
                                                                              Streams Initiative supports local efforts to eliminate
                                                                              environmental and economic impacts of acid mine
                                                                              drainage from abandoned coal mines. Environmental
                                                                              Protection focuses on current coal mining and is
                                                                              accomplished with the Surface Mining Program, which
                                                                              oversees 4.4 million acres of surface coal mines in 26
                                                                              states and on the lands of three Indian tribes. The
                                                                              principal means of delivering environmental protection is
                                                                              through 24 primacy states that receive federal grant
                                                                              funding.




                                                Page 42                  GAO-03-1028 Interior’s Governance of IT Investment Management
                                                                  Appendix I
                                                                  Bureau Missions, Functions, and IT
                                                                  Investments




(Continued From Previous Page)
Dollars in millions
                                                         IT          Budget            FTEs
                                                         Investments authority         FY 2003
Bureau                Mission                            FY 2003a    FY 2003b          estimate      Description
U.S. Bureau           To manage, develop, $9.8                          $855.0         5,628         USBR has developed and manages a limited natural
of                    and protect water                                                              water supply in the 17 western states. USBR works to
Reclamation           and related                                                                    meet the increasing water demands while protecting the
(USBR)                resources in an                                                                environment and the public's investment. USBR has 348
                      environmentally and                                                            reservoirs with a total storage capacity of 245 million acre-
                      economically sound                                                             feet of water, 58 hydroelectric power plants, and over 300
                      manner in the                                                                  recreation sites. USBR is the nation’s second largest
                      interest of the                                                                producer of hydroelectric power in the western United
                      American public.                                                               States, generating more than 40 billion kilowatt hours of
                                                                                                     energy annually. USBR is the nation's largest water
                                                                                                     wholesaler; its water usage includes irrigation for one out
                                                                                                     of every five western farmers (140,000)—about 10 million
                                                                                                     acres of irrigated land; 10 trillion gallons of municipal,
                                                                                                     rural, and industrial water for over 31 million people;
                                                                                                     habitat support for wildlife refuges, migratory waterfowl,
                                                                                                     fish, and threatened and endangered species; and
                                                                                                     irrigation projects and potable water supplies for Indian
                                                                                                     tribes. USBR provides flood control benefits and drought
                                                                                                     contingency planning and assistance, and it provides
                                                                                                     water-based recreation activities for about 90 million
                                                                                                     visitors a year.
U.S.                  The USGS serves                    $198.6         $867.0         9,397         USGS is the nation’s principal natural science and
Geological            the nation by                                                                  information agency. USGS conducts research, monitoring,
Survey                providing reliable                                                             and assessments to contribute to understanding the
(USGS)                scientific information                                                         natural world—lands, water, and biological resources.
                      to describe and                                                                USGS provides reliable, impartial information in the form
                      understand the                                                                 of maps, data, and reports containing analyses and
                      Earth; minimize loss                                                           interpretations of water, energy, mineral and biological
                      of life and property                                                           resources, land surfaces, marine environments, geologic
                      from natural                                                                   structures, natural hazards, and dynamic processes of the
                      disasters; manage                                                              Earth; this information is used to understand, respond to,
                      water, biological,                                                             and plan for changes in the environment. USGS
                      energy, and mineral                                                            describes, documents, and gains understanding of natural
                      resources; and                                                                 hazards and their risks through the study of earthquakes,
                      enhance and protect                                                            volcanoes, landslides, geomagnetic field changes, floods,
                      our quality of life.                                                           droughts, coastal erosion, tsunamis, wild land fire, and
                                                                                                     wildlife disease. Environmental and natural resources
                                                                                                     activities deal with physical, chemical, biological, and
                                                                                                     geological processes in nature and the impact of human
                                                                                                     actions on natural systems through studies including data
                                                                                                     collection, long-term assessments, ecosystems analysis,
                                                                                                     and the forecasting of future changes.
Total                                                    $399.9         $9,718.0       67,105
Source: Department of the Interior (data), GAO (presentation).
                                                                  a
                                                                  Department of the Interior’s Exhibit 53, Agency IT Investment Portfolio for fiscal year 2003.
                                                                  b
                                                                  Department of the Interior, Fiscal Year 2004: The Interior Budget in Brief.




                                                                  Page 43                      GAO-03-1028 Interior’s Governance of IT Investment Management
Appendix II

Comments from the Department of the
Interior                                                                            Appendx
                                                                                          Ii




              Page 44   GAO-03-1028 Interior’s Governance of IT Investment Management
Appendix II
Comments from the Department of the
Interior




Page 45                GAO-03-1028 Interior’s Governance of IT Investment Management
Appendix III

GAO Contact and Staff Acknowledgments                                                             Appendx
                                                                                                        iI




GAO Contact       Lester Diamond, (202) 512-7957, diamondl@gao.gov



Acknowledgments   In addition to the individual named above, William G. Barrick, Joanne
                  Fiorino, Peggy A. Hegg, Alison Jacobs, Mary Beth McClanahan, and Nik
                  Rapelje made key contributions to this report.




(310356)          Page 46             GAO-03-1028 Interior’s Governance of IT Investment Management
GAO’s Mission            The General Accounting Office, the audit, evaluation and investigative arm of
                         Congress, exists to support Congress in meeting its constitutional responsibilities
                         and to help improve the performance and accountability of the federal government
                         for the American people. GAO examines the use of public funds; evaluates federal
                         programs and policies; and provides analyses, recommendations, and other
                         assistance to help Congress make informed oversight, policy, and funding
                         decisions. GAO’s commitment to good government is reflected in its core values of
                         accountability, integrity, and reliability.


Obtaining Copies of      The fastest and easiest way to obtain copies of GAO documents at no cost is
                         through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and          text files of current reports and testimony and an expanding archive of older
                         products. The Web site features a search engine to help you locate documents
Testimony                using key words and phrases. You can print these documents in their entirety,
                         including charts and other graphics.
                         Each day, GAO issues a list of newly released reports, testimony, and
                         correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site
                         daily. The list contains links to the full-text document files. To have GAO e-mail this
                         list to you every afternoon, go to www.gao.gov and select “Subscribe to
                         e-mail alerts” under the “Order GAO Products” heading.


Order by Mail or Phone   The first copy of each printed report is free. Additional copies are $2 each. A check
                         or money order should be made out to the Superintendent of Documents. GAO
                         also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single
                         address are discounted 25 percent. Orders should be sent to:
                         U.S. General Accounting Office
                         441 G Street NW, Room LM
                         Washington, D.C. 20548
                         To order by Phone:     Voice: (202) 512-6000
                                                TDD: (202) 512-2537
                                                Fax: (202) 512-6061


To Report Fraud,         Contact:
                         Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in      E-mail: fraudnet@gao.gov
Federal Programs         Automated answering system: (800) 424-5454 or (202) 512-7470



Public Affairs           Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
                         U.S. General Accounting Office, 441 G Street NW, Room 7149
                         Washington, D.C. 20548
United States                  Presorted Standard
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300
Address Service Requested