oversight

Information Resources: Army Should Limit New Initiatives Until Management Program Is Implemented

Published by the Government Accountability Office on 1990-06-29.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

.I IllI@’ 1!)!)(I
                                 INFORMATION
                                 RESOURCES
                                 Army Should Limit
                                 New Initiatives Until
                                 Management Program
                                 Is Implemented

                                                                                               f




                                                                                      141898




                                      RESTRICTED--      Not to be released outside the
                                      General Accounting Of&e unless speciflcally
                                      approved by the Office of Congressional
                                      Relations.
                                                                         RELEASED
~-                           .=..-A               s4wwt
                                                    -.-...-... .-.-....-
                                                                   -...---,,-.,,---- - ,.,,
                                                                                        -.,,
(;A( 1/ ‘I M?‘IS( :-9O-tW4
       United States
GAO    General Accounting Office
       Washington, D.C. 20548

       Information Management and
       Technology Division

       B-239369

       June 29,199O

       The Honorable John P. Murtha
       Chairman, Subcommittee on Defense
       Committee on Appropriations
       House of Representatives

       Dear Mr. Chairman:

       This report responds to your September 5,1989, request that we review the Department of
       the Army’s management of automated data processing at its major commands and
       installations.

       As agreed with your office, unless you publicly announce this report’s contents earlier, we
       plan no further distribution of it until 30 days from the date of this letter. At that time, we
       will send copies to interested parties and make copies available to others upon request.

       This report was prepared under the direction of Samuel W. Bowlin, Director of Defense and
       Security Information Systems, who can be reached at (202) 275-4649. Other major
       contributors are listed in appendix II.

       Sincerely yours,




  t-   Ralph V. Carlone     ”
       Assistant Comptroller General
Executive Summary


                   The Army’s increasing reliance on information resources to fulfill its
Purpose            mission is reflected in its automation budget, which grew from $1.6 bil-
                   lion in fiscal year 1984 to the $2.9 billion requested for fiscal year 1991.
                   In recent years, a number of audit reports have criticized various
                   aspects of Army information resources management. At the request of
                   the Chairman, Subcommittee on Defense, House Committee on Appropri-
                   ations, GAOreviewed Army management of its information resources to
                   determine how effectively it monitors and controls automation at the
                   major command and installation levels.


                   Prior to 1984, primary management of Army information resources
Background         rested with the principal user of the information. Under this structure,
                   little centralized control existed. Rather, individual users defined their
                   particular information requirements, developed software, procured nec-
                   essary hardware and communications, and linked these elements
                   together to form information systems, usually fulfilling narrowly
                   defined needs.

                   With the establishment of the Army Information Resources Management
                   Program in 1984, the Army initiated a major change in the way it man-
                   aged information resources. Under the program, the Army views infor-
                   mation as a corporate resource. The objectives of the program are to
                   establish a common management and planning structure to ensure that
                   all Army information requirements are identified, validated, and priori-
                   tized; unnecessarily redundant information systems are eliminated; and
                   an orderly transition from the present to the future computer environ-
                   ment is planned. To accomplish these objectives, the program requires
                   that each Army activity (1) develop an information architecture to
                   serve as the basic frame of reference for all information management
                   decisions; and (2) prepare an Information Management Plan of priori-
                   tized initiatives, While the Army established target dates for some of the
                   program’s required actions, such as developing policies, no target date
                   was established for development of the information architecture, which
                   is the most important component. However, the Army initially expected
                   to have the program’s infrastructure implemented by the end of 1985.


                   The Army’s efforts to improve management and acquisition of its infor-
Results in Brief   mation resources have not been successful. The Army has not fully
           Y       implemented its Information Resources Management Program and does
                   not have in place an effective control process for managing information
                   initiatives. As a result, it cannot assure that the systems it procures and


                   Page 2                    GAO/IMTEGOO-58 Army Information   Resources Management
                          Executive Summary




                          develops will conform to an Army-wide architecture once one is speci-
                          fied, that the systems are based on valid requirements, or that they
                          comply with pertinent automated data processing policies and regula-
                          tions. In recognition of these and other problems, the Army identified a
                          number of material internal control weaknesses in the area of informa-
                          tion management in its 1989 annual statement required by the Federal
                          Manager’s Financial Integrity Act,

                          The Army has recently undertaken a number of efforts to correct infor-
                          mation resources management deficiencies. GAOis concerned, however,
                          that- given past experience and the magnitude of these efforts-it
                          may take longer than Army officials recognize or have reported to Con-
                          gress to resolve the deficiencies. GAOis also concerned that the Army’s
                          optimistic estimates may result in premature and overstated claims of
                          problem resolution.


Principal Findings

                          The Army’s lack of commitment to implementing its Information
Key Program Prov,isions   Resources Management Program has resulted in little progress in
Not Implemented           achieving the program’s objectives. While the Army initially expected
                          the program to be implemented by the end of 1986, the Army did not
                          adequately pursue the development of the information architecture-
                          the key to the program’s success. Architecture development has been
                          hindered at all levels in the Army by (1) the lack of a complete Army
                          headquarters architecture to serve as a guide for major commands and
                          installations to follow, (2) a lack of specific implementation guidance
                          and milestones, (3) local commanders’ lack of commitment to the pro-
                          gram, and (4) an emphasis on new systems initiatives over architecture
                          development. Without an information architecture, the Army’s primary
                          objective-to ensure that its information systems are compatible and
                          interoperable-remains      unfulfilled.

                          GAOalso found that the Information    Management Plan process has not
                          been effectively implemented at, the major command and installation
                          levels. Specifically, the Army does not assure that the identified infor-
                          mation initiatives are based on valid requirements and submitted to
                          Army headquarters for review and approval. As a result, Information




                          Page 3                    GAO/IMTEG90-68 Army Information   Resources Management
                             Executive Summary




                             Management Plans developed at major commands and installations typi-
                             cally are little more than collections of consolidated procurement
                             requests-of little value in guiding long-term automation decisions.


Corrective Actions May       The Army has recently begun special efforts to correct deficiencies iden-
Require More Time and        tified and improve its management of information resources. In Sep-
                             tember 1989, the Army developed a Corrective Action Plan, which
Oversight Than Planned       consolidates its information resources management deficiencies and the
                             corrective actions proposed by various Army units. Although Army offi-
                             cials reported to Congress that these activities will be completed by the
                             end of 1990, given the magnitude of the efforts involved, this time
                             frame does not appear to be realistic.

                             GAOalso found that no one at Army headquarters is centrally reviewing
                             the Corrective Action Plan to ensure that proposed solutions are ade-
                             quate. GAO'Swork indicates that some Army units have submitted ques-
                             tionable claims of completed actions, claims that may not be justified.


                             In order to strengthen its information resource management, GAOrecom-
Recommendations              mends that the Secretary of Defense direct that the Secretary of the
                             Army

                         . establish specific milestones for the development of a fully integrated,
                           requirements-based, Army-wide information architecture and the imple-
                           mentation of an effective planning and control structure.
                         . limit new information management initiatives to those mandated by
                           Congress or those necessary to fulfill legal requirements until a fully
                           integrated, requirements-based information architecture is developed
                           and an effective control structure is implemented;
                         l institute strong central direction and control over actions currently
                           underway to implement and correct problems with the Army Informa-
                           tion Resources Management Program, and establish and report to the
                           Congress on realistic time frames for their completion,


                             At the Chairman’s request, GAOdid not obtain official agency comments
Agency Comments              on a draft of this report. However, GAOdid discuss the results of its
                             audit with agency officials and they generally agreed with the informa-
            ”                tion presented.




                             Page 4                   GAO/IMTECSO-58 Army Information   Resources Management
Y




    Page 6   GAO/IMTEC90-56 Army Information   Resources Management
Contents


Executive Summary                                                                                      2

Chapter 1                                                                                              8
Introduction            The Army Information Resources Management Program
                        Past Audit Reports Indicate Little Progress Toward
                                                                                                       8
                                                                                                       9
                            Meeting Army Information Resources Management
                            Program Objectives
                        Army Reported Material Information Management                                  9
                            Internal Control Weaknesses
                        Objective, Scope, and Methodology                                             10

Chapter 2                                                                                             12
Army Information        The Army Has Not Completed the Basic Building Block
                            for Implementing the Program-The Information
                                                                                                      13
Resources                   Architecture
Management Program      The Army’s Process for Monitoring and Controlling                             16
Not Fully                   Automation Initiatives Is Ineffective

Implemented
Chapter 3                                                                                             20
Corrective Actions      Army Actions to Correct Control Deficiencies
                        Army Officials May Have Underestimated the Time
                                                                                                      20
                                                                                                      21
Will Require Time and       Required to Implement Current Initiatives
Oversight               Corrective Actions May Be Overstated in Terms of                              22
                            Anticipated Early Accomplishments

Chapter 4                                                                                             23
Conclusions and         Conclusions
                        Recommendations
                                                                                                      23
                                                                                                      23
Recommendations
Appendixes              Appendix I: Army Efforts to Correct Information                               26
                            Resources Management Deficiencies
                        Appendix II: Major Contributors to This Report                                30




                        Page 6                   GAO/IMTJX-SO-68 Army Information   Resources Management
Contents




Abbreviations

E'ORSCOMForces Command
GAO     General Accounting Office
IMTEC   Information Management and Technology Division
IRM     information resources management
ODISC4 Office of the Director of Information Systems for Command,
                Control, Communications and Computers
TRADOC Training and Doctrine Command


Page 7                     GAO/IMTEG90-58 Army Information   Resources Management
Chapter 1                                                                                                -
Introduction


                           The Army’s increasing reliance on information resources to fulfill its
                           mission is reflected in its automation budget, which grew from $1,6 bil-
                           lion in fiscal year 1984 to the $2.9 billion requested for fiscal year 1991.
                           This dependence extends to virtually every facet of Army operations.


                           Prior to 1984, primary management of Army information resources
The Army Information       rested with the principal user of the information. Under this structure,
Resources                  little centralized control existed. Rather, individual information users
Management Program         defined their particular requirements, developed software, procured
                           necessary hardware and communications, and linked these elements
                           together to form information systems, usually fulfilling narrowly
                           defined needs.

                           With the establishment of the Army Information Resources Management
                           (IRM) Program in 1984, the Army initiated a major change in the way it
                           managed information resources. The Army created the Office of the
                           Assistant Chief of Staff for Information Management, currently the
                           Office of the Director of Information Systems for Command, Control,
                           Communications and Computers (ODISC4),to be responsible for this pro-
                           gram. Under the new program, the Army defines information as a corpo-
                           rate resource that should be managed as such. The objective is to
                           “ensure the integration, sharing, standardization, interoperability, time-
                           liness and validity of information provided Army decision makers, . . .”

                           To meet this objective, the Army (1) defined specific management
                           responsibilities from headquarters down to the installation level, and
                           (2) established an approach under which information requirements
                           would be identified and met. This approach

                       l requires the establishment and development of information management
                         goals and objectives;
                       l requires the use of formal information planning studies to identify infor-
                         mation requirements and flows;
                       l provides structured analyses of external guidance and assigned missions
                         to determine information needs;
                       l requires the development and use of an information architecture, which
                         is the blueprint explaining the structure of and communications among
                         an organization’s information technology resources;
                       l creates a requirements-approval process;
                       . requires life cycle management of information systems, from initial
                         development until final disposition; and



                           Page 8                    GAO/IMTEGSO-68 Army Information   Resources Management
                        Chapter 1
                        Introduction




                    .   identifies a steady, recurring rate of capital investment to upgrade or
                        replace existing capabilities.

                        The keystone of the program at each level is the information architec-
                        ture. The first step in developing the architecture involves an informa-
                        tion requirements study to identify what information is needed.
                        Subsequent steps define how information needs will be satisfied. Army
                        organizations at the various levels are concurrently developing informa-
                        tion architectures, Army integration of these individual architectures is
                        to result in an Army-wide information architecture and a plan for
                        moving from the existing to the future information systems
                        environment.


                        Over 100 audits and investigations of Army IRM have been performed
Past Audit Reports      since the inception of the program. These reviews were conducted by
Indicate Little         entities including the Department of Defense Inspector General, the
Progress Toward         Department of the Army Inspector General, the Army Audit Agency,
                        and the House Appropriations Committee’s Surveys and Investigations
Meeting Army            staff. At the time of our review, over 200 of the issues they identified
Information Resources   were still unresolved. Reports resulting from the reviews indicate that
                        the planning and control structure defined by the Army IRM Program has
Management Program      not been fully implemented.
Objectives

                        In its 1989 annual statement required by the Federal Managers’ Finan-
Army Reported           cial Integrity Act, the Army identified six unresolved material internal
Material Information    control weaknesses in the area of information management:
Management Internal     deficiencies in asset visibility and reporting of automated data
Control Weaknesses ’    processing equipment,
                    .   poor life cycle management procedures,
                    .   inadequate control of commercial software accountability and
                        acquisition,
                    .   inadequate controls for the information mission area,
                    .   inadequate definition of information requirements in the Information
                        Management Plan process, and
                    .   inadequate plans for the continuity of automated data processing
                        operations.

                        In April 1990 0~1~01reported that it was in the process of revising poli-
                        cies, developing internal control checklists, conducting compliance


                        Page 9                    GAO/IMTEC90-58   Army Information   Resources Management
                                                                                                      ,
                         Chapter 1
                         Introduction




                         reviews, and taking other actions to resolve the control weaknesses indi-
                         cated. The Army expects to correct all of these weaknesses by Sep-
                         tember 1990.


                         On September 5, 1989, the Chairman, Subcommittee on Defense, House
Objective, Scope,and     Committee on Appropriations, asked that we review the Army’s man-
Methodology              agement of its automated data processing base operations. Our objective
                         was to determine how effectively the Army monitors and controls auto-
                         mation at its major command and installation levels. We focused our
                         work on implementation of the Army IRM Program, which we identified
                         as the fundamental prescription for Army information management
                         policy and responsibilities. This program requires the development of an
                         information architecture and the establishment of a planning and con-
                         trol mechanism to ensure that automation initiatives are based on valid
                         requirements, conform to the information architecture, minimize dupli-
                         cation, and comply with pertinent automated data processing policies
                         and regulations.

                         To accomplish our objective, we reviewed IRM efforts at the headquar-
                         ters, major command, and installation levels. We sought to determine
                         whether these organizations had developed required information archi-
                         tectures and implemented internal control structures and processes to
                         ensure that information initiatives meet the stated objectives. We con-
                         fined our review to Army automation in the sustaining base environ-
                         ment, which involves information used to manage Army resources and
                         installations and deploy and sustain fighting forces. We did not review
                         automation in the strategic or tactical environments.

                         To obtain background information and past assessments of Army IRM,
                         we reviewed prior Department of Defense Inspector General, Depart-
                         ment of the Army Inspector General, Army Audit Agency, and congres-
                         sional reports. We analyzed relevant laws, regulations, documents, and
                         other data to develop criteria for Army IRM. We also reviewed recent
                         internal control reports to learn about internal control weaknesses that
                         the Army has identified and the status of its efforts to address those
                         weaknesses, We interviewed officials and gathered supporting documen-
                         tation at a variety of offices and agencies within the service. More spe-
                         cifically, we visited ODISC~at Army headquarters in Washington, D.C., to

                       . obtain information on the establishment of the Army IRM Program,
                       . learn about the IRM organization and control structure,



                         Page 10                  GAO/IMTEG90-68 Army Information   Resources Management
  Chaptex 1
  Introduction




. obtain the current status of policy and guidance to implement the
  program,
. determine the status of information architecture development and inte-
  gration actions,
. learn about Army headquarters management and control of information
  initiatives submitted by the major commands and installations, and
. determine how approved information initiatives are funded and how
  software development is managed.

  Also at Army headquarters, we visited the Office of the Assistant Secre-
  tary of the Army for Financial Management and the Army Corps of
  Engineers to learn about methodologies comparable to the Army Infor-
  mation Engineering methodology for architecture development. We vis-
  ited the Information Systems Software Command at Fort Belvoir,
  Virginia, to learn about management and potential integration of Army-
  wide software systems.

  Further, we visited the Information Systems Command at Fort
  Huachuca, Arizona, to determine its role in implementing Army IRM
  policy. We visited the Training and Doctrine Command (TMLKMZ)in Fort
  Monroe, Virginia; Forces Command (FORSCOM)in Fort McPherson,
  Georgia; and their respective installations at Fort Sill, Oklahoma; Fort
  Knox, Kentucky; Fort Campbell, Kentucky; and Fort Hood, Texas. Our
  purpose at these major commands and installations was to determine
  their compliance in developing information architectures and validating
  information initiatives in accordance with headquarters policy direction.

  We conducted our review between September 1989 and April 1990, in
  accordance with generally accepted government auditing standards. As
  the Chairman requested, we did not obtain formal written comments
  from the Department of the Army on a draft of this report.




  Page 11                   GAO/IMTEG90-68 Army Information   Resources Management
                                                                                              .   I        1H.
Chapter 2                                                                                             f.
Army Information ResourcesManagement                                                                       !
Program Not F’ully Implemented

             The Army has not fully implemented major provisions of its IRM Pro-
             gram. More specifically, the Army has not yet completed a require-
             ments-based information architecture to guide future information
             initiatives. According to the program, the Army information architec-
             ture is the framework that defines the relationships of all elements
             involved in IRM. The architecture is supposed to be used to establish
             goals and objectives; develop policy, doctrine, and planning guidance;
             evaluate information initiatives and identify supporting resource
             requirements; and manage architectural configurations.

             The importance of an information architecture to guide system develop-
             ment was highlighted in our recent report on meeting the government’s
             technology challenge:

             Information systems are one of the most important tools for effectively accom-
             plishing the organization’s mission. . . [Tlhese systems should be developed as part
             of an overall architecture or plan . . . a blueprint explaining the structure of and
             communications among an organization’s information technology resources-hard-
             ware, software, and people. It is the foundation upon which an agency builds, modi-
             fies, and expands its organizational operations.

             The architecture should drive all major technology purchases. Rather than simply
             buying information technology without a clear plan for how it will fit into the
             agency’s overall strategy, leaders need a comprehensive plan that will dictate the
             equipment and resources required. This should reduce the likelihood of acquiring
             inappropriate or duplicate technology and ensure that the technology can be inte-
             grated with existing systems. Developing a collection of independent information
             systems with no underlying foundation or architecture is unacceptable.’

             The Army also has not established an effective process for monitoring
             and controlling information initiatives. As a result, it cannot consist-
             ently assure that its automation initiatives are based on valid require-
             ments, conform to an Army information architecture, minimize
             duplication, and comply with pertinent automated data processing poli-
             cies and regulations.




             ‘Meeting the Government’sTechnologyChallenge: Results of a GAO Symposium (GAO/
             I=-90-23,    Feb. 1990).



             Page 12                        GAO/DMTEC-9048 Army Information      Resources Management
                            Chapter 2
                            Army Information Resources Management
                            Program Not F’uliy Implemented




                            The Army’s architecture development has been hindered because 0~1~~4
The Army Has Not            has not completed the Army headquarters architecture-the       necessary
Completed the Basic         basis for architecture development at the major command and installa-
Building Block for          tion levels. Further, specific policy and implementation guidance to
                            assist the major commands and installations is incomplete; local com-
Implementing the            manders have lacked commitment to developing information architec-
Program-The                 tures; and Army officials place higher priority on the development of
                            new systems than on building architectures to guide them.
Information
Architecture

The Army’s Information      The mandated Army information architecture is one based on defined
Architecture: What Is It?   building blocks and specified components. Target implementation dates
                            were established for some portions of the program, such as the transfer
                            of assets and the development of policy. No target date was established,
                            however, for development of the Army information architecture-the
                            part of the program that was to be the “basic frame of reference for all
                            management decisions.” The architecture is supposed to define the
                            interrelationships among all information management components, and
                            be the basis for identifying, integrating, validating, and prioritizing
                            requirements to meet mission needs.

                            The Army’s IRM program establishes certain requirements for architec-
                            ture development. Specifically, the Director, ODISC4,is responsible for
                            developing the headquarters-level architecture and providing it as a
                            guide for development of all other information architectures in the
                            Army. Other Army entities (headquarters, functional proponents, major
                            commands, and installations) are to concurrently develop individual
                            information architectures in reference to the architecture at the next
                            higher level. Once all are developed, ODISC~will integrate them into the
                            overall or capstone Army information architecture.

                            We found that required information architectures have not been com-
                            pleted at any level in the Army. The headquarters version has not been
                            completed, providing no guide for lower echelons to follow in developing
                            their architectures. In addition, most headquarters staff agencies, major
                            commands, and installations visited have not completed their individual
                            information architectures.




                            Page 13                      GAO/IMTEG90-68 Army Information   Resources Management
                           Chapter 2
                           Army Information Resources Management
                           Program Not Fully Implemented




Architecture Development   The Army has neither exercised effective management nor provided
Hindered by Ineffective    adequate guidance to facilitate architecture development. By not com-
                           pleting the headquarters architecture to serve as a basis for command
Management and Guidance    and installation architectures and by not providing specific implementa-
                           tion guidance, 0~1~~4has not enforced required architecture develop-
                           ment. In the absence of effective management, guidance, and milestones,
                           local commanders have lacked commitment to complying with IRM pro-
                           gram requirements that they develop information architectures.

                           Much of the policy and specific implementation guidance on architecture
                           development is incomplete or outdated and, according to officials at sev-
                           eral Army units we visited, has hampered efforts to conduct information
                           requirements studies and develop information architectures. While very
                           general guidance in the form of the Army IRM program (Army regulation
                           26-l) is available, detailed guidance on development is still being
                           drafted.

                           Also in draft form at this time is the Army information engineering
                           methodology, which is supposed to specify the process for Army units
                           to follow in completing information requirements studies and developing
                           architectures. It has been under development since 1986; publication is
                           now expected in September 1990.

                           According to officials at several commands, the draft methodology is
                           large, complex, and difficult to use. We questioned why the Army will
                           not use simpler methodologies being developed by the Army Corps of
                           Engineers and the Office of the Assistant Secretary of the Army for
                           Financial Management. ODISC4officials responded that the Army is
                           working to condense this methodology and collaborate with the other
                           efforts before deciding which methodology to use.

                           As a result of the lack of guidance, major commands and installations
                           are relying on a best guess of how the Army wants them to develop
                           architectures. For example, FORSCOM   has done significant work toward
                           developing its architecture, but an official stated that they cannot
                           afford further investment without the overall Army architecture to
                           guide them.

                           While the senior official for Army information management (the
                           Director, 0~1~~4) is responsible for setting and ensuring compliance with
                           Army-wide policy for the IRM program, in practice local commanders
                           determine whether to follow such policy. For example, Fort Knox, a
                           TRADOCinstallation, has decided not to prepare a requirements study or


                           Page 14                      GAO/IMTEGSO-58 Army Information   Resources Management
Chapter 2
Army Information Resources Management
Program Not Fuily Implemented




develop an information architecture at this time. Foe Campbell, a FOR-
SCOM  installation, has initiated an information requirements study and
intends to develop an architecture. ODISC~officials acknowledge that
Army commanders lack commitment to having their commands develop
information architectures.

The problem, then, is that no one is enforcing information architecture
development, according to an official in the ODISC~Architecture Direc-
torate. As a result, the architecture may not be completed for a long
time. This official believes that the farther the Army proceeds with sys-
tems development without a guiding architecture, the more expensive
and difficult it will be to ultimately bring all of these systems under one
integrated framework. Another official suggested that information
architecture development may be enforced by linking it to the career
progression of Army leadership or by reducing funding for organiza-
tions that do not comply.

Architecture development is also not properly emphasized. The Army
has not developed a schedule that includes the tasks necessary to com-
plete an Army information architecture. Further, it has emphasized
developing new systems over completing the information architectures
needed to guide their development.

When the Army began implementing the IRM program, the service estab-
lished milestone dates for some portions, such as the transfer of assets
and the development of policy. The Army did not, however, establish
milestone dates for development of the information architecture. An
official of the Architecture Directorate said that ODISC4has not estab-
lished a due date for major command information architecture submis-
sions because they have been hindered by factors such as lack of staff,
resources, and funds. This official added that headquarters would like
to more firmly enforce architecture development, but lacks the
authority to do so.

Army officials we interviewed felt that information architecture devel-
opment is lagging and that they must forge ahead with new systems
development because of legitimate needs that should be addressed. Of
course, one reason that architecture development may be lagging could
be the relatively low priority it has consistently been afforded. Indi-
vidual major commands and installations are also emphasizing the
development of new systems over architecture development.




Page 15                      GAO/IMTEC-9068 Army Information   Resources Management
                          Chapter 2
                          Army Information Resources Management
                          Program Not Fully Implemented




                          Although architectures, the fundamental portion of the Army IRM pro-
                          gram, are supposed to guide automation initiatives, neither Army head-
                          quarters, major commands, nor installations we visited have delayed
                          system development or procurement because of the lack of an informa-
                          tion architecture. Army headquarters officials stated that they never
                          seriously considered a moratorium on new systems development in
                          order to implement the IRM program requiring architecture development.


                          The Army’s ability to manage automation initiatives is jeopardized by
The Army’s Process        the lack of an effective information management planning process. As a
for Monitoring and        result, the Army cannot ensure that initiatives are based on valid
Controlling               requirements, will conform to the Army-wide information architecture
                          once it is developed, minimize duplication, and comply with pertinent
Automation Initiatives    information management policies and regulations.
Is Ineffective
                          The Information Management Plan process is the component of the IRM
                          program for identifying and validating information requirements and is
                          the basis for the Army information architecture. The process requires
                          that information initiatives be validated at the major command and
                          installation levels and forwarded to Army headquarters for review,
                          approval, and incorporation in the Information Management Master
                          Plan before they can be considered for funding. According to the pro-
                          gram, the master plan is supposed to be used to effect the Army’s evolu-
                          tion from its current to future environment.


Existing Information      What are being called Information Management Plans at the major com-
Management Plans Are of   mand and installation levels are of little value in guiding long-term auto-
                          mation decisions. At the installations we visited, plans were typically a
Little Value in Guiding   collection of procurement requests consolidated under the umbrella of a
Long-Term Automation      very broad individual Information Management Plan initiative. At every
Decisions                 installation visited, the individual initiatives were not supported by a
                          plan of how they would facilitate movement from the current to the
                          future environment.

                          At the major command level, the individual initiatives that comprise the
                          installation Information Master Plans are consolidated and major com-
                          mand initiatives are added. The major commands also lacked a strategy
                          for moving to the future configuration.

                          Information Management Plan initiatives are typically based on short-
                          term procurement requests that officials at ODISC~and the Information


                          Page 16                      GAO/IMTEC-SO-68 Army Information   Resources Management
                              Chapter 2
                              Army Information Ihources Management
                              Program Not Fully Implemented




                              Systems Command characterized as “wish lists” of automation wants.
                              Once Information Management Plan initiatives are approved, major
                              commands and installations use them as procurement justification,


Information Initiatives Are   The Army does not fully comply with its IRM program’s mandate that
Approved and                  requirements leading to information initiatives be validated. At the
                              installation level, the validation of requirements seems to be at the dis-
Implemented Without           cretion of the directors of information management. At Fort Knox, the
Adequate Requirements         director of information management has delegated the requirements val-
Validation, Approval, or      idation function to the users. However, the users do not validate
Monitoring                    requirements, but check to ensure that the equipment ordered is com-
                              patible with what is to be used at the installation level. At Fort Sill,
                              according to the director of information management, no attempt is
                              made to validate automation requirements submitted by installation
                              users. In contrast, at both Fort Campbell and Fort Hood, the director of
                              information management does attempt to ensure that automation
                              requests submitted by users are based on valid needs.

                              At the two major commands visited, the review and validation processes
                              for automation initiatives were also ineffective. At TRADOC,installation-
                              submitted initiatives are reviewed to determine whether the initiatives
                              are compatible with the existing technical configuration. TRADOCofficials
                              depend on the installation director of information management to deter-
                              mine if initiatives are based on valid requirements, yet there is no con-
                              trol mechanism in place to ensure that the director fulfills this function.

                              FORSCOM   likewise has no process guiding the review, validation, or moni-
                              toring of installation procurements, even though during fiscal year 1989,
                              FORSCOM   and its installations had over $45 million in automation
                              procurements individually valued at over $25,000. The responsibility
                              for such oversight was delegated to the installation-level directors of
                              information management in 1987.

                              Despite the fact that FORSCOM'S  automation procurements are supposed
                              to be routed through its director of information management for review
                              and approval, this was not always done, according to our review of a
                              sample of individual fiscal year 1988 and 1989 procurements.




                              Page 17                      GAO/IMTEX-90-68 Army Information   Resources Management
                                                                                                                           ,
                                Chapter 2
                                Army Information Resources Management
                                Program Not Fully Implemented




ODISC4Does Not Validate         The chief of the ODISC4office responsible for controlling Information
Initiatives Submitted by        Management Plan initiatives submitted by major commands said the
                                review process is not totally effective. The IRM program requires that
Major Commands                  Army headquarters review automation initiatives to ensure that they do
                                not duplicate another initiative or an ongoing effort, and are consistent
                                with overall Army IRM program goals.

                                We found, however, that ODISC4’Sprocess could not ensure that initia-
                                tives submitted by major commands and installations were based on
                                requirements analyses or were traceable back to missions or functions.
                                Additionally, 0~1x4 could not ensure that automation initiatives would
                                ultimately conform to the Army information architecture. Finally, initia-
                                tives were not tied to the budget process. Therefore, once approved,
                                they could be used to justify procurements for an indefinite period of
                                time.


Major Automation Projects       In the absence of an Army-wide information architecture and an effec-
May Not Support Program         tive information management planning process, the Army has no assur-
                                ante that its computers, communications networks, or data base
Objectives
                                management systems will fulfill its IRM goal for an open system architec-
                                ture supportable by several different vendors’ equipment and software.
                                Moreover, our work suggests that several major ongoing Army initia-
                                tives may have to be redone to conform to the overall architecture once
                                developed. For example:

                            l   Earlier this year we reported that the Army was uncertain about the
                                computers on which its standard information systems would operate.”
                                With this uncertainty, continued development of major systems could
                                have led to substantial conversion costs or limited competitive procure-
                                ments. On the basis of our report, the Congress withheld funding for
                                several Army standard systems until the service developed a strategy
                                showing how these systems would move from the present to the future
                                operating environment. During the course of our work we noted that
                                while several of the systems under development were redirected to
                                operate on nonproprietary platforms, others were too far along to be
                                redirected.
                            l   At TRADOCwe found that a proprietary operating environment (hard-
                                ware, operating systems, and communications network protocols) has
                                been mandated for all of its installations.

                                “AIW Budget: Potential Reductions to Army Automation Initiatives   (GAO/IMTECB09,Nov.20,
                                1989).



                                Page 18                           GAO/IMTEGSO-68 Army Information       Resources Management
  chapter 2
  Army Iuf’ormatlon Resources Mauagement
  Program Not Fully Implemented




. The Army is in the process of issuing a servicewide contract for a data
  base management system that will only operate in a specific operating
  environment.




  Page 19                       GAO/IMTEG90-68 Army Information   Resources Management
Chapter 3

Corrective Actions Will Require Time
and Oversight

                    The Army has recently undertaken a number of efforts to correct identi-
                    fied deficiencies and improve its management of information resources.
                    We are concerned, however, that given the magnitude of the efforts, it
                    may take longer than the Army realizes or has reported to Congress to
                    effectively implement revised policies and procedures. We are also con-
                    cerned that a desire to show progress may result in premature or over-
                    stated claims that identified problems are corrected.


                    In a February 13, 1990, letter, the Army Vice Chief of Staff reiterated
Army Actions to     support for the IRM program and advised the major commands of efforts
Correct Control     they must undertake to strengthen oversight, eliminate duplication, and
Deficiencies        establish strong internal controls. Actions that the Army has under-
                    taken to improve IRM include

                    establishing a Corrective Action Plan to organize, track, and resolve all
                    deficiencies identified in past audit reports;
                    revising Army Major Automated Information System Review Committee
                    guidelines to increase information systems oversight;
                    rechartering the Architecture Control Committee to improve informa-
                    tion management;
                    revising the Information Management Plan process and developing gui-
                    dance to improve Army effectiveness in identifying and validating new
                    information requirements;
                    developing Information Mission Area Modernization Plans to prioritize
                    systems initiatives in the currently constrained budget environment;
                    sending assistance teams to major commands to help them comply with
                    IRM POliCy;
                    establishing a Management and Oversight Improvement Program to inte-
                    grate and eliminate duplication of initiatives to resolve IRM deficiencies;
                    establishing the Army Data Management and Standards Program, to
                    provide a single approach to data-element standardization throughout
                    the Army; and
                  . developing the Army Strategy for Sustaining Base Automation, which
                    describes the direction that Army IRM will follow through the 1990s.

                    A discussion of these actions is included in appendix I. We were unable
                    to evaluate these actions or their impact because they were in their ini-
                    tial stages when we completed our audit work. However, we did make
                    the following observations.




                    Page 20                   GAO/IMTEGSO-68 Army Information   Resources Management
                           Chapter 3
                           Corrective Actions Will Require Time
                           and Oversight




                           The initiatives that the Army has recently undertaken build on the
Army Officials May         efforts begun in 1984 to implement the IRM program. At that time, the
Have Underestimated        A  rmy began to realign resources, revise policy, develop an information
the Time Required to       architecture, and institute control mechanisms to support the informa-
                           tion management reorganization. Now, not only is the Army still
Implement Current          working to fully implement those efforts, it is also working to correct
Initiatives                problems with the portions of the program that have been implemented.
                           And at the same time, the Army must maintain its existing operations
                           while it is continuing with new systems development.

                           Army officials estimate that action to correct deficiencies will be com-
                           pleted by the end of this year. For example:

                       l All Corrective Action Plan issues are scheduled to be resolved by
                         December 1990.
                       . Final publication of Army guidance on the revised Information Manage-
                         ment Plan process is expected in July 1990.
                       l An interim Army Information Mission Area Modernization Plan has
                         been developed until major commands and Army staff agencies have
                         time to develop and submit their own individual modernization plans
                         this December in preparation for the next budget cycle.
                       . The Army Strategy for Sustaining Base Automation calls for complete
                         information management policy by December 31, 1990.

                           Despite the Army’s estimate, past experience indicates that this activity
                           may well take longer than the Army has reported to Congress to com-
                           plete. For example, when the Army IRM program was initiated in May
                            1984, the service projected that the information management infrastruc-
                           ture would be completed by October 1985. Some 4 l/2 years later, the
                           program is nowhere near full implementation. According to the 0~1~~4
                           policy division chief, some of the realignments necessary to institute the
                           program were never completed, and policy development and revision is
                           still underway. The Information Management Plan process was partially
                           implemented, but it never became a fully effective mechanism for identi-
                           fying and validating information requirements. While development of
                           the Army-wide information architecture is ongoing, officials with whom
                           we spoke estimated that it may require 15 to 20 years to become
                           effective.




                           Page 2 1                        GAO/IMTEG90-68 Army Information   Resources Management
                       Chapter 3
                       Corrective Actions Will Require Time
                       and Oversight




                       Our review of the Army’s initiatives indicates that claims of completed
Corrective Actions     actions need to be assessed with caution to ensure that they are justi-
May Be Overstated in   fied. While the Corrective Action Plan is a step in the right direction, no
Terms of Anticipated   one at Army headquarters is centrally reviewing its tasks and mile-
                       stones for issue correction to ensure their accuracy, completeness, or
Early                  feasibility. As a result, Army units have submitted questionable solu-
Accomplishments        tions for Corrective Action Plan issue resolution. For example, the Army
                       reported that the issue concerning development of the Army-wide infor-
                       mation architecture is resolved because the policy for doing so has been
                       prepared. It seems obvious to us that the indicated action is only the
                       initial step in resolving the problem; the Army information architectures
                       still need to be developed and integrated.

                       In another instance, the Army asserted that it has planned its future
                       automation environment to guide all Army information systems devel-
                       opment. Army officials told us, however, that the planned automation
                       environment is not based on an in-depth analysis of Army information
                       requirements, as required by Defense and Army policy. As such, these
                       actions by no means constitute final or adequate problem resolution.

                       The Army has also revised its policy to require that major commands
                       conduct oversight reviews of information systems. However, according
                       to an Army official, no one from headquarters will participate in these
                       major command reviews because they will be too numerous. In our
                       opinion, such reviews will require headquarters participation to ensure
                       achievement of overall Army goals, particularly since the Army has not
                       developed its Army-wide information architecture. Additionally, the
                       combined monetary investment at this level is substantial, and thus war-
                       rants headquarters oversight.

                       Finally, while Army regulation 25-9 gives ODISC4the responsibility to
                       enforce the Army Data Management and Standards Program, Army offi-
                       cials said that ODISC~does not have the funds with which to do so. These
                       officials stated that, in the past, the lack of resources has been a major
                       contributor to ineffective attempts to standardize data in the Army.
                       They said that, as a result, there is currently no timetable or assurance
                       of having data standardized.




                       Page 22                         GAO/IMTECSO-58 Army Information   Resources Management
Chapter 4

Conclusionsand Recommendations


                      The Army’s IRM program is ambitious; on paper, it appears sound. Meant
Conclusions           to provide a defined management and planning structure to help achieve
                      Army-wide information management goals, it can only, however, be
                      effective if it is implemented. Key provisions of the program still remain
                      to be implemented.

                      The program’s basic building block is the information architecture. A
                      tool with which to judge information requirements on the basis of mis-
                      sion needs, its development has been hampered at all levels within the
                      Army. The lack of a headquarters architecture, no specific lower-ech-
                      elon implementation guidance, the lack of local commander commitment
                      to developing architectures, and an emphasis on developing new sys-
                      tems over a standard architecture have relegated the accomplishment of
                      this basic tool to less-than-top priority.

                      Further, because of a lack of controls, the information management
                      planning process for ensuring that initiatives are based on valid require-
                      ments is ineffective. As a result, the Army cannot assure that the sys-
                      tems it is acquiring will conform to an overall Army information
                      architecture, are based on valid requirements, are not duplicative, and
                      comply with pertinent automated data processing policies and
                      regulations.

                      Yet the Army’s information technology budget continues to grow; in 6
                      years it has almost doubled.

                      It appears likely that, if strongly managed and fully implemented, Army
                      actions now underway to correct IRM deficiencies could solve many of
                      the current problems. We are concerned, however, that given the magni-
                      tude of the efforts, established time frames for fully achieving these
                      goals may not be realistic, Further, an understandable desire to demon-
                      strate progress may result in premature or overstated claims that identi-
                      fied problems are fully corrected when such is not the case.


                      In order to strengthen its information resource management, we recom-
Recommendations       mend that the Secretary of Defense direct the Secretary of the Army to
                      take the following actions:

                  l   Establish specific milestones for the development of a fully integrated,
                      requirements-based information architecture and the implementation of
                      an effective planning and control structure.



                      Page 23                   GAO/IMTEC90-68   Army Information   Resources Management
    Chapter 4
    Conclueiolup and Recommendatlona




l Limit new information management initiatives to those mandated by
  Congress or necessary to fulfill legal requirements until such time as a
  fully integrated, requirements-based information architecture is devel-
  oped and an effective control structure is implemented.
. Institute strong central direction and control over actions currently
  underway to implement and correct problems with the Army IRM Pro-
  gram, and establish and report to the Congress realistic time frames for
  their completion.




    Page 24                        GAO/IMTEG90H)-58Army Information   Resources Management
Page 26   GAO/MTEG9O-58   Army Information   Resources Management
                                                                                               (I




Appendix I                                                                                          .

Army Efforts to Correct Information Resources
ManagementDeficiencies

                        The Director, ODISC~, established the Corrective Action Plan in Sep-
The Corrective Action   tember 1989 to systematically organize, track, and resolve information
Plan                    management deficiencies identified in various audit reports in the past
                        few years. The Director appointed a task force within the Plans Division
                        of ODISC4to have overall responsibility for the Corrective Action Plan
                        project. The task force reviewed the source documents and tasked 191
                        of the total 228 Corrective Action Plan issues to various Army organiza-
                        tions for resolution. The task force prioritized the issues, with all sched-
                        uled for completion by the end of December 1990. Overall progress of
                        issue resolution is managed through periodic in-process reviews for the
                        Director and Vice-Director.


                        The Army recently revised its Major Automated Information System
Revision of Army        Review Committee guidelines to strengthen the Army control process
Major Automated         and increase oversight of information systems. The Committee reviews
Information System      major or special-interest automation systems to ensure that they will
                        provide cost-effective solutions to mission needs, comply with appli-
Review Committee        cable standards and policy, and conform to information architectures.
Guidelines Increases    Milestone approval resulting from Committee reviews provides a requi-
                        site endorsement for initiatives that compete for funding.
Information Systems
Oversight               Army Regulation 25-3, Army Life Cycle Management of Information
                        Systems, published in November 1989, outlines policies and responsibili-
                        ties for Army development, review, and approval of information sys-
                        tems. The regulation

                        establishes the Army Committee threshold at $10 million in program
                        costs,
                        prohibits Army units from fragmenting requirements into separate
                        projects to avoid oversight and approval,
                        requires that projects with program costs below $10 million and above
                        $2.5 million be subjected to reviews at the major command level, and
                        requires that information systems with program costs under $2.5 million
                        be reviewed, approved, and managed at the major command level unless
                        the major command delegates authority to a lower-echelon activity.

                        In addition to Army Regulation 25-3, revisions are being made to several
                        Department of Defense and Army regulations and pamphlets to docu-
                        ment the changes to the Committee process and life cycle management.
                        Army officials expect that all such guidance will be completed by the
                        end of 1990.



                        Page 26                   GAO/IMTECSO-58 Army Information   Resources Management
       ,
   .
                       Appendix I
                       Army Efforts to Correct Information
                       Resources Management Deficiencies




                       In January 1990 the Army revised the Architecture Control Committee
Architecture Control   charter and expanded its responsibilities and membership to provide
Committee              stronger information management, guidance, and control. The Com-
Rechartered to         mittee resolves architecture issues and is responsible for reviewing,
                       evaluating, and making recommendations to the Director, ODISC4, con-
Improve Information    cerning information architectures, Information Management Plan initia-
Management and         tives, modernization plans, and policy guidance. The Director has
Control                replaced the Vice-Director as chairman to increase the authority of the
                       committee. In addition, the Army has expanded committee membership
                       to include representatives of all major commands.


                       The Army recently revised the Information Management Plan (now
Revision of the        called the Requirements Statement) process to improve Army effective-
Information            ness in identifying and validating new information requirements. ODISC4
Management Plan        is developing Army Regulation 25-2, the Information Mission Area Plan-
                       ning Process, to guide Army organizations on the revised process, This
Process                new “how to” guidance will require that information initiatives be vali-
                       dated against functional proponent architectures and an organization’s
                       information model, provide specific criteria and instructions for require-
                       ments validation, and outline a plan for coding and tracking expendi-
                       tures on information initiatives,

                       This guidance is scheduled for final publication in July 1990. Another
                       corrective action concerning the planning process requires that informa-
                       tion initiatives more than 3-years old be revalidated.


                       ODISCX now   requires major commands and Army staff agencies to
Information Mission    develop modernization plans that prioritize initiatives for moving to the
Area Modernization     objective configuration in a fiscally constrained environment. ODISC4 will
Plans                  integrate the individual plans to comprise the Army-wide Information
                       Mission Area Modernization Plan. This plan will do what was not done
                       in the past: tie Information Management Plan initiatives to the budget
                       process and limit systems to the minimum necessary to achieve mission-
                       essential capabilities. Managers will use the plan to program funds in
                       the budget process,




                       Page 27                          GAO/IMTEGSO-St3 Army Information   Resources Management
                                                                                                                   .
                                 Appendix I
                                 Army Efforts to Correct Information
                                 Resources Management Deficiencies




                     The Director, ODISC4,created the Information Mission Area Assistance
Information Mission  Team to visit major commands and help them comply with higher level
Area Assistance Team d’irec t’Ives and guidance within the Information Mission Area frame-
                                 work. Depending upon the needs of the activity visited, the team is com-
                                 prised of technical, management, and functional experts to advise local
                                 officials on various areas of information management. According to
                                 ODISC4officials, team visits began in March 1990.


                                 The Director established the Automated Information System Manage-
Management and                   ment and Oversight Improvement Plan in January 1990 to identify, inte-
Oversight                        grate, and eliminate duplication of initiatives to resolve Army IRM
Improvement Program              deficiencies. The plan is also to help ensure that management direction
                                 is being followed on a sustained basis. The Director will conduct quar-
                                 terly reviews to determine which completed initiatives require follow-up
                                 management, provide resources to manage and track initiatives for com-
                                 pliance, and identify and assign new initiatives to be managed in accor-
                                 dance with the plan.


                                 The Army established policy on its Data Management and Standards
Army Data                        Program in September 1989. The specific objectives of the program are
Management and                   to
Standards Program            . manage data effectively throughout their life cycle;
                             . establish data architectures that support the Army’s information
                               requirements;
                             l promote data independent of applications development;
                             l maintain and control data in data bases so they are accessible to many
                               applications;
                             . provide a single approach to data-element standardization throughout
                               the Army; and
                             l gain acceptance of Army standard data elements by such agencies as the
                               Department of Defense, the Joint Chiefs of Staff, and the North Atlantic
                               Treaty Organization.

                                 Army Regulation 25-9 designates the Director as the senior policy offi-
                                 cial for data management, with responsibility for setting policy and
                                 enforcing the development and use of standard elements within the
                                 Army. The regulation specifies that heads of agencies and commanders
                                 incorporate data management in their Information Management Plans
                                 and initiatives. The regulation also calls for a data encyclopedia of stan-
                                 dard data elements and their attributes.


                                 Page 28                         GAO/IMTEGSO-68 Army Information   Resources Management
                    Appendix I
                    Army Efforts to Correct Information
                    Resources Management Deficiencies




                    The Army Strategy for Sustaining Base Automation describes the direc-
Army Strategy for   tion that the Army will follow through the 1990s to provide information
Sustaining Base     services to maintain force readiness at minimum cost. The strategy is
Automation          “composed of linked and mutually supporting management, technical,
                    standards, and security strategies that describe the collective efforts
                    necessary to modernize existing sustaining base automation systems in a
                    constrained fiscal environment.” Many of these efforts have already
                    been discussed above. Others include moving to an open systems archi-
                    tecture, and executing the contract to replace the Army Standard Infor-
                    mation Management System with the Sustaining Base Information
                    Service in 1992.

                    The strategy is intended to compare the current sustaining base automa-
                    tion environment with the future environment. It lays out an objective
                    configuration for building the sustaining base architecture, incorpo-
                    rating the Information Mission Area principles. It also outlines an imple-
                    mentation/management strategy for achieving these sustaining base
                    principles.




                    Page 29                          GAO/IMTEC90-68 Army Information   Resources Management
Appendix II
                                                                                                   .
Major Contributors to This Report


                       Thomas J. Howard, Assistant Director
Information            Wiley E. Poindexter, Jr., Assignment Manager
Management and         Sondra F. McCauley, Evaluator
Technology Division,
Washington, DC.
                       Phillip E. Rutar, Evaluator-in-Charge
Cincinnati Regional    Robert L. Williams, Jr., Evaluator
Office

                       Connie W. Sawyer, Jr., Regional Assignment Manager
Norfolk Regional
Office

                       Carl L. Higginbotham, Regional Assignment Manager
Atlanta Regional       Eva Z. Margolies, Evaluator
Office




              .




(LIO41)6)              Page 30                   GAO/IMTEC90-68 Army Information   Resources Management
‘I’ht~rt~
    is25”0
       tliscotir~t~
            on
             orders
            it  for
siugltb ;itltlwss.
                     100 or more wpiw   Iwtilctt   lo a
---