.I IllI@’ 1!)!)(I INFORMATION RESOURCES Army Should Limit New Initiatives Until Management Program Is Implemented f 141898 RESTRICTED-- Not to be released outside the General Accounting Of&e unless speciflcally approved by the Office of Congressional Relations. RELEASED ~- .=..-A s4wwt -.-...-... .-.-....- -...---,,-.,,---- - ,.,, -.,, (;A( 1/ ‘I M?‘IS( :-9O-tW4 United States GAO General Accounting Office Washington, D.C. 20548 Information Management and Technology Division B-239369 June 29,199O The Honorable John P. Murtha Chairman, Subcommittee on Defense Committee on Appropriations House of Representatives Dear Mr. Chairman: This report responds to your September 5,1989, request that we review the Department of the Army’s management of automated data processing at its major commands and installations. As agreed with your office, unless you publicly announce this report’s contents earlier, we plan no further distribution of it until 30 days from the date of this letter. At that time, we will send copies to interested parties and make copies available to others upon request. This report was prepared under the direction of Samuel W. Bowlin, Director of Defense and Security Information Systems, who can be reached at (202) 275-4649. Other major contributors are listed in appendix II. Sincerely yours, t- Ralph V. Carlone ” Assistant Comptroller General Executive Summary The Army’s increasing reliance on information resources to fulfill its Purpose mission is reflected in its automation budget, which grew from $1.6 bil- lion in fiscal year 1984 to the $2.9 billion requested for fiscal year 1991. In recent years, a number of audit reports have criticized various aspects of Army information resources management. At the request of the Chairman, Subcommittee on Defense, House Committee on Appropri- ations, GAOreviewed Army management of its information resources to determine how effectively it monitors and controls automation at the major command and installation levels. Prior to 1984, primary management of Army information resources Background rested with the principal user of the information. Under this structure, little centralized control existed. Rather, individual users defined their particular information requirements, developed software, procured nec- essary hardware and communications, and linked these elements together to form information systems, usually fulfilling narrowly defined needs. With the establishment of the Army Information Resources Management Program in 1984, the Army initiated a major change in the way it man- aged information resources. Under the program, the Army views infor- mation as a corporate resource. The objectives of the program are to establish a common management and planning structure to ensure that all Army information requirements are identified, validated, and priori- tized; unnecessarily redundant information systems are eliminated; and an orderly transition from the present to the future computer environ- ment is planned. To accomplish these objectives, the program requires that each Army activity (1) develop an information architecture to serve as the basic frame of reference for all information management decisions; and (2) prepare an Information Management Plan of priori- tized initiatives, While the Army established target dates for some of the program’s required actions, such as developing policies, no target date was established for development of the information architecture, which is the most important component. However, the Army initially expected to have the program’s infrastructure implemented by the end of 1985. The Army’s efforts to improve management and acquisition of its infor- Results in Brief mation resources have not been successful. The Army has not fully Y implemented its Information Resources Management Program and does not have in place an effective control process for managing information initiatives. As a result, it cannot assure that the systems it procures and Page 2 GAO/IMTEGOO-58 Army Information Resources Management Executive Summary develops will conform to an Army-wide architecture once one is speci- fied, that the systems are based on valid requirements, or that they comply with pertinent automated data processing policies and regula- tions. In recognition of these and other problems, the Army identified a number of material internal control weaknesses in the area of informa- tion management in its 1989 annual statement required by the Federal Manager’s Financial Integrity Act, The Army has recently undertaken a number of efforts to correct infor- mation resources management deficiencies. GAOis concerned, however, that- given past experience and the magnitude of these efforts-it may take longer than Army officials recognize or have reported to Con- gress to resolve the deficiencies. GAOis also concerned that the Army’s optimistic estimates may result in premature and overstated claims of problem resolution. Principal Findings The Army’s lack of commitment to implementing its Information Key Program Prov,isions Resources Management Program has resulted in little progress in Not Implemented achieving the program’s objectives. While the Army initially expected the program to be implemented by the end of 1986, the Army did not adequately pursue the development of the information architecture- the key to the program’s success. Architecture development has been hindered at all levels in the Army by (1) the lack of a complete Army headquarters architecture to serve as a guide for major commands and installations to follow, (2) a lack of specific implementation guidance and milestones, (3) local commanders’ lack of commitment to the pro- gram, and (4) an emphasis on new systems initiatives over architecture development. Without an information architecture, the Army’s primary objective-to ensure that its information systems are compatible and interoperable-remains unfulfilled. GAOalso found that the Information Management Plan process has not been effectively implemented at, the major command and installation levels. Specifically, the Army does not assure that the identified infor- mation initiatives are based on valid requirements and submitted to Army headquarters for review and approval. As a result, Information Page 3 GAO/IMTEG90-68 Army Information Resources Management Executive Summary Management Plans developed at major commands and installations typi- cally are little more than collections of consolidated procurement requests-of little value in guiding long-term automation decisions. Corrective Actions May The Army has recently begun special efforts to correct deficiencies iden- Require More Time and tified and improve its management of information resources. In Sep- tember 1989, the Army developed a Corrective Action Plan, which Oversight Than Planned consolidates its information resources management deficiencies and the corrective actions proposed by various Army units. Although Army offi- cials reported to Congress that these activities will be completed by the end of 1990, given the magnitude of the efforts involved, this time frame does not appear to be realistic. GAOalso found that no one at Army headquarters is centrally reviewing the Corrective Action Plan to ensure that proposed solutions are ade- quate. GAO'Swork indicates that some Army units have submitted ques- tionable claims of completed actions, claims that may not be justified. In order to strengthen its information resource management, GAOrecom- Recommendations mends that the Secretary of Defense direct that the Secretary of the Army . establish specific milestones for the development of a fully integrated, requirements-based, Army-wide information architecture and the imple- mentation of an effective planning and control structure. . limit new information management initiatives to those mandated by Congress or those necessary to fulfill legal requirements until a fully integrated, requirements-based information architecture is developed and an effective control structure is implemented; l institute strong central direction and control over actions currently underway to implement and correct problems with the Army Informa- tion Resources Management Program, and establish and report to the Congress on realistic time frames for their completion, At the Chairman’s request, GAOdid not obtain official agency comments Agency Comments on a draft of this report. However, GAOdid discuss the results of its audit with agency officials and they generally agreed with the informa- ” tion presented. Page 4 GAO/IMTECSO-58 Army Information Resources Management Y Page 6 GAO/IMTEC90-56 Army Information Resources Management Contents Executive Summary 2 Chapter 1 8 Introduction The Army Information Resources Management Program Past Audit Reports Indicate Little Progress Toward 8 9 Meeting Army Information Resources Management Program Objectives Army Reported Material Information Management 9 Internal Control Weaknesses Objective, Scope, and Methodology 10 Chapter 2 12 Army Information The Army Has Not Completed the Basic Building Block for Implementing the Program-The Information 13 Resources Architecture Management Program The Army’s Process for Monitoring and Controlling 16 Not Fully Automation Initiatives Is Ineffective Implemented Chapter 3 20 Corrective Actions Army Actions to Correct Control Deficiencies Army Officials May Have Underestimated the Time 20 21 Will Require Time and Required to Implement Current Initiatives Oversight Corrective Actions May Be Overstated in Terms of 22 Anticipated Early Accomplishments Chapter 4 23 Conclusions and Conclusions Recommendations 23 23 Recommendations Appendixes Appendix I: Army Efforts to Correct Information 26 Resources Management Deficiencies Appendix II: Major Contributors to This Report 30 Page 6 GAO/IMTJX-SO-68 Army Information Resources Management Contents Abbreviations E'ORSCOMForces Command GAO General Accounting Office IMTEC Information Management and Technology Division IRM information resources management ODISC4 Office of the Director of Information Systems for Command, Control, Communications and Computers TRADOC Training and Doctrine Command Page 7 GAO/IMTEG90-58 Army Information Resources Management Chapter 1 - Introduction The Army’s increasing reliance on information resources to fulfill its mission is reflected in its automation budget, which grew from $1,6 bil- lion in fiscal year 1984 to the $2.9 billion requested for fiscal year 1991. This dependence extends to virtually every facet of Army operations. Prior to 1984, primary management of Army information resources The Army Information rested with the principal user of the information. Under this structure, Resources little centralized control existed. Rather, individual information users Management Program defined their particular requirements, developed software, procured necessary hardware and communications, and linked these elements together to form information systems, usually fulfilling narrowly defined needs. With the establishment of the Army Information Resources Management (IRM) Program in 1984, the Army initiated a major change in the way it managed information resources. The Army created the Office of the Assistant Chief of Staff for Information Management, currently the Office of the Director of Information Systems for Command, Control, Communications and Computers (ODISC4),to be responsible for this pro- gram. Under the new program, the Army defines information as a corpo- rate resource that should be managed as such. The objective is to “ensure the integration, sharing, standardization, interoperability, time- liness and validity of information provided Army decision makers, . . .” To meet this objective, the Army (1) defined specific management responsibilities from headquarters down to the installation level, and (2) established an approach under which information requirements would be identified and met. This approach l requires the establishment and development of information management goals and objectives; l requires the use of formal information planning studies to identify infor- mation requirements and flows; l provides structured analyses of external guidance and assigned missions to determine information needs; l requires the development and use of an information architecture, which is the blueprint explaining the structure of and communications among an organization’s information technology resources; l creates a requirements-approval process; . requires life cycle management of information systems, from initial development until final disposition; and Page 8 GAO/IMTEGSO-68 Army Information Resources Management Chapter 1 Introduction . identifies a steady, recurring rate of capital investment to upgrade or replace existing capabilities. The keystone of the program at each level is the information architec- ture. The first step in developing the architecture involves an informa- tion requirements study to identify what information is needed. Subsequent steps define how information needs will be satisfied. Army organizations at the various levels are concurrently developing informa- tion architectures, Army integration of these individual architectures is to result in an Army-wide information architecture and a plan for moving from the existing to the future information systems environment. Over 100 audits and investigations of Army IRM have been performed Past Audit Reports since the inception of the program. These reviews were conducted by Indicate Little entities including the Department of Defense Inspector General, the Progress Toward Department of the Army Inspector General, the Army Audit Agency, and the House Appropriations Committee’s Surveys and Investigations Meeting Army staff. At the time of our review, over 200 of the issues they identified Information Resources were still unresolved. Reports resulting from the reviews indicate that the planning and control structure defined by the Army IRM Program has Management Program not been fully implemented. Objectives In its 1989 annual statement required by the Federal Managers’ Finan- Army Reported cial Integrity Act, the Army identified six unresolved material internal Material Information control weaknesses in the area of information management: Management Internal deficiencies in asset visibility and reporting of automated data Control Weaknesses ’ processing equipment, . poor life cycle management procedures, . inadequate control of commercial software accountability and acquisition, . inadequate controls for the information mission area, . inadequate definition of information requirements in the Information Management Plan process, and . inadequate plans for the continuity of automated data processing operations. In April 1990 0~1~01reported that it was in the process of revising poli- cies, developing internal control checklists, conducting compliance Page 9 GAO/IMTEC90-58 Army Information Resources Management , Chapter 1 Introduction reviews, and taking other actions to resolve the control weaknesses indi- cated. The Army expects to correct all of these weaknesses by Sep- tember 1990. On September 5, 1989, the Chairman, Subcommittee on Defense, House Objective, Scope,and Committee on Appropriations, asked that we review the Army’s man- Methodology agement of its automated data processing base operations. Our objective was to determine how effectively the Army monitors and controls auto- mation at its major command and installation levels. We focused our work on implementation of the Army IRM Program, which we identified as the fundamental prescription for Army information management policy and responsibilities. This program requires the development of an information architecture and the establishment of a planning and con- trol mechanism to ensure that automation initiatives are based on valid requirements, conform to the information architecture, minimize dupli- cation, and comply with pertinent automated data processing policies and regulations. To accomplish our objective, we reviewed IRM efforts at the headquar- ters, major command, and installation levels. We sought to determine whether these organizations had developed required information archi- tectures and implemented internal control structures and processes to ensure that information initiatives meet the stated objectives. We con- fined our review to Army automation in the sustaining base environ- ment, which involves information used to manage Army resources and installations and deploy and sustain fighting forces. We did not review automation in the strategic or tactical environments. To obtain background information and past assessments of Army IRM, we reviewed prior Department of Defense Inspector General, Depart- ment of the Army Inspector General, Army Audit Agency, and congres- sional reports. We analyzed relevant laws, regulations, documents, and other data to develop criteria for Army IRM. We also reviewed recent internal control reports to learn about internal control weaknesses that the Army has identified and the status of its efforts to address those weaknesses, We interviewed officials and gathered supporting documen- tation at a variety of offices and agencies within the service. More spe- cifically, we visited ODISC~at Army headquarters in Washington, D.C., to . obtain information on the establishment of the Army IRM Program, . learn about the IRM organization and control structure, Page 10 GAO/IMTEG90-68 Army Information Resources Management Chaptex 1 Introduction . obtain the current status of policy and guidance to implement the program, . determine the status of information architecture development and inte- gration actions, . learn about Army headquarters management and control of information initiatives submitted by the major commands and installations, and . determine how approved information initiatives are funded and how software development is managed. Also at Army headquarters, we visited the Office of the Assistant Secre- tary of the Army for Financial Management and the Army Corps of Engineers to learn about methodologies comparable to the Army Infor- mation Engineering methodology for architecture development. We vis- ited the Information Systems Software Command at Fort Belvoir, Virginia, to learn about management and potential integration of Army- wide software systems. Further, we visited the Information Systems Command at Fort Huachuca, Arizona, to determine its role in implementing Army IRM policy. We visited the Training and Doctrine Command (TMLKMZ)in Fort Monroe, Virginia; Forces Command (FORSCOM)in Fort McPherson, Georgia; and their respective installations at Fort Sill, Oklahoma; Fort Knox, Kentucky; Fort Campbell, Kentucky; and Fort Hood, Texas. Our purpose at these major commands and installations was to determine their compliance in developing information architectures and validating information initiatives in accordance with headquarters policy direction. We conducted our review between September 1989 and April 1990, in accordance with generally accepted government auditing standards. As the Chairman requested, we did not obtain formal written comments from the Department of the Army on a draft of this report. Page 11 GAO/IMTEG90-68 Army Information Resources Management . I 1H. Chapter 2 f. Army Information ResourcesManagement ! Program Not F’ully Implemented The Army has not fully implemented major provisions of its IRM Pro- gram. More specifically, the Army has not yet completed a require- ments-based information architecture to guide future information initiatives. According to the program, the Army information architec- ture is the framework that defines the relationships of all elements involved in IRM. The architecture is supposed to be used to establish goals and objectives; develop policy, doctrine, and planning guidance; evaluate information initiatives and identify supporting resource requirements; and manage architectural configurations. The importance of an information architecture to guide system develop- ment was highlighted in our recent report on meeting the government’s technology challenge: Information systems are one of the most important tools for effectively accom- plishing the organization’s mission. . . [Tlhese systems should be developed as part of an overall architecture or plan . . . a blueprint explaining the structure of and communications among an organization’s information technology resources-hard- ware, software, and people. It is the foundation upon which an agency builds, modi- fies, and expands its organizational operations. The architecture should drive all major technology purchases. Rather than simply buying information technology without a clear plan for how it will fit into the agency’s overall strategy, leaders need a comprehensive plan that will dictate the equipment and resources required. This should reduce the likelihood of acquiring inappropriate or duplicate technology and ensure that the technology can be inte- grated with existing systems. Developing a collection of independent information systems with no underlying foundation or architecture is unacceptable.’ The Army also has not established an effective process for monitoring and controlling information initiatives. As a result, it cannot consist- ently assure that its automation initiatives are based on valid require- ments, conform to an Army information architecture, minimize duplication, and comply with pertinent automated data processing poli- cies and regulations. ‘Meeting the Government’sTechnologyChallenge: Results of a GAO Symposium (GAO/ I=-90-23, Feb. 1990). Page 12 GAO/DMTEC-9048 Army Information Resources Management Chapter 2 Army Information Resources Management Program Not F’uliy Implemented The Army’s architecture development has been hindered because 0~1~~4 The Army Has Not has not completed the Army headquarters architecture-the necessary Completed the Basic basis for architecture development at the major command and installa- Building Block for tion levels. Further, specific policy and implementation guidance to assist the major commands and installations is incomplete; local com- Implementing the manders have lacked commitment to developing information architec- Program-The tures; and Army officials place higher priority on the development of new systems than on building architectures to guide them. Information Architecture The Army’s Information The mandated Army information architecture is one based on defined Architecture: What Is It? building blocks and specified components. Target implementation dates were established for some portions of the program, such as the transfer of assets and the development of policy. No target date was established, however, for development of the Army information architecture-the part of the program that was to be the “basic frame of reference for all management decisions.” The architecture is supposed to define the interrelationships among all information management components, and be the basis for identifying, integrating, validating, and prioritizing requirements to meet mission needs. The Army’s IRM program establishes certain requirements for architec- ture development. Specifically, the Director, ODISC4,is responsible for developing the headquarters-level architecture and providing it as a guide for development of all other information architectures in the Army. Other Army entities (headquarters, functional proponents, major commands, and installations) are to concurrently develop individual information architectures in reference to the architecture at the next higher level. Once all are developed, ODISC~will integrate them into the overall or capstone Army information architecture. We found that required information architectures have not been com- pleted at any level in the Army. The headquarters version has not been completed, providing no guide for lower echelons to follow in developing their architectures. In addition, most headquarters staff agencies, major commands, and installations visited have not completed their individual information architectures. Page 13 GAO/IMTEG90-68 Army Information Resources Management Chapter 2 Army Information Resources Management Program Not Fully Implemented Architecture Development The Army has neither exercised effective management nor provided Hindered by Ineffective adequate guidance to facilitate architecture development. By not com- pleting the headquarters architecture to serve as a basis for command Management and Guidance and installation architectures and by not providing specific implementa- tion guidance, 0~1~~4has not enforced required architecture develop- ment. In the absence of effective management, guidance, and milestones, local commanders have lacked commitment to complying with IRM pro- gram requirements that they develop information architectures. Much of the policy and specific implementation guidance on architecture development is incomplete or outdated and, according to officials at sev- eral Army units we visited, has hampered efforts to conduct information requirements studies and develop information architectures. While very general guidance in the form of the Army IRM program (Army regulation 26-l) is available, detailed guidance on development is still being drafted. Also in draft form at this time is the Army information engineering methodology, which is supposed to specify the process for Army units to follow in completing information requirements studies and developing architectures. It has been under development since 1986; publication is now expected in September 1990. According to officials at several commands, the draft methodology is large, complex, and difficult to use. We questioned why the Army will not use simpler methodologies being developed by the Army Corps of Engineers and the Office of the Assistant Secretary of the Army for Financial Management. ODISC4officials responded that the Army is working to condense this methodology and collaborate with the other efforts before deciding which methodology to use. As a result of the lack of guidance, major commands and installations are relying on a best guess of how the Army wants them to develop architectures. For example, FORSCOM has done significant work toward developing its architecture, but an official stated that they cannot afford further investment without the overall Army architecture to guide them. While the senior official for Army information management (the Director, 0~1~~4) is responsible for setting and ensuring compliance with Army-wide policy for the IRM program, in practice local commanders determine whether to follow such policy. For example, Fort Knox, a TRADOCinstallation, has decided not to prepare a requirements study or Page 14 GAO/IMTEGSO-58 Army Information Resources Management Chapter 2 Army Information Resources Management Program Not Fuily Implemented develop an information architecture at this time. Foe Campbell, a FOR- SCOM installation, has initiated an information requirements study and intends to develop an architecture. ODISC~officials acknowledge that Army commanders lack commitment to having their commands develop information architectures. The problem, then, is that no one is enforcing information architecture development, according to an official in the ODISC~Architecture Direc- torate. As a result, the architecture may not be completed for a long time. This official believes that the farther the Army proceeds with sys- tems development without a guiding architecture, the more expensive and difficult it will be to ultimately bring all of these systems under one integrated framework. Another official suggested that information architecture development may be enforced by linking it to the career progression of Army leadership or by reducing funding for organiza- tions that do not comply. Architecture development is also not properly emphasized. The Army has not developed a schedule that includes the tasks necessary to com- plete an Army information architecture. Further, it has emphasized developing new systems over completing the information architectures needed to guide their development. When the Army began implementing the IRM program, the service estab- lished milestone dates for some portions, such as the transfer of assets and the development of policy. The Army did not, however, establish milestone dates for development of the information architecture. An official of the Architecture Directorate said that ODISC4has not estab- lished a due date for major command information architecture submis- sions because they have been hindered by factors such as lack of staff, resources, and funds. This official added that headquarters would like to more firmly enforce architecture development, but lacks the authority to do so. Army officials we interviewed felt that information architecture devel- opment is lagging and that they must forge ahead with new systems development because of legitimate needs that should be addressed. Of course, one reason that architecture development may be lagging could be the relatively low priority it has consistently been afforded. Indi- vidual major commands and installations are also emphasizing the development of new systems over architecture development. Page 15 GAO/IMTEC-9068 Army Information Resources Management Chapter 2 Army Information Resources Management Program Not Fully Implemented Although architectures, the fundamental portion of the Army IRM pro- gram, are supposed to guide automation initiatives, neither Army head- quarters, major commands, nor installations we visited have delayed system development or procurement because of the lack of an informa- tion architecture. Army headquarters officials stated that they never seriously considered a moratorium on new systems development in order to implement the IRM program requiring architecture development. The Army’s ability to manage automation initiatives is jeopardized by The Army’s Process the lack of an effective information management planning process. As a for Monitoring and result, the Army cannot ensure that initiatives are based on valid Controlling requirements, will conform to the Army-wide information architecture once it is developed, minimize duplication, and comply with pertinent Automation Initiatives information management policies and regulations. Is Ineffective The Information Management Plan process is the component of the IRM program for identifying and validating information requirements and is the basis for the Army information architecture. The process requires that information initiatives be validated at the major command and installation levels and forwarded to Army headquarters for review, approval, and incorporation in the Information Management Master Plan before they can be considered for funding. According to the pro- gram, the master plan is supposed to be used to effect the Army’s evolu- tion from its current to future environment. Existing Information What are being called Information Management Plans at the major com- Management Plans Are of mand and installation levels are of little value in guiding long-term auto- mation decisions. At the installations we visited, plans were typically a Little Value in Guiding collection of procurement requests consolidated under the umbrella of a Long-Term Automation very broad individual Information Management Plan initiative. At every Decisions installation visited, the individual initiatives were not supported by a plan of how they would facilitate movement from the current to the future environment. At the major command level, the individual initiatives that comprise the installation Information Master Plans are consolidated and major com- mand initiatives are added. The major commands also lacked a strategy for moving to the future configuration. Information Management Plan initiatives are typically based on short- term procurement requests that officials at ODISC~and the Information Page 16 GAO/IMTEC-SO-68 Army Information Resources Management Chapter 2 Army Information Ihources Management Program Not Fully Implemented Systems Command characterized as “wish lists” of automation wants. Once Information Management Plan initiatives are approved, major commands and installations use them as procurement justification, Information Initiatives Are The Army does not fully comply with its IRM program’s mandate that Approved and requirements leading to information initiatives be validated. At the installation level, the validation of requirements seems to be at the dis- Implemented Without cretion of the directors of information management. At Fort Knox, the Adequate Requirements director of information management has delegated the requirements val- Validation, Approval, or idation function to the users. However, the users do not validate Monitoring requirements, but check to ensure that the equipment ordered is com- patible with what is to be used at the installation level. At Fort Sill, according to the director of information management, no attempt is made to validate automation requirements submitted by installation users. In contrast, at both Fort Campbell and Fort Hood, the director of information management does attempt to ensure that automation requests submitted by users are based on valid needs. At the two major commands visited, the review and validation processes for automation initiatives were also ineffective. At TRADOC,installation- submitted initiatives are reviewed to determine whether the initiatives are compatible with the existing technical configuration. TRADOCofficials depend on the installation director of information management to deter- mine if initiatives are based on valid requirements, yet there is no con- trol mechanism in place to ensure that the director fulfills this function. FORSCOM likewise has no process guiding the review, validation, or moni- toring of installation procurements, even though during fiscal year 1989, FORSCOM and its installations had over $45 million in automation procurements individually valued at over $25,000. The responsibility for such oversight was delegated to the installation-level directors of information management in 1987. Despite the fact that FORSCOM'S automation procurements are supposed to be routed through its director of information management for review and approval, this was not always done, according to our review of a sample of individual fiscal year 1988 and 1989 procurements. Page 17 GAO/IMTEX-90-68 Army Information Resources Management , Chapter 2 Army Information Resources Management Program Not Fully Implemented ODISC4Does Not Validate The chief of the ODISC4office responsible for controlling Information Initiatives Submitted by Management Plan initiatives submitted by major commands said the review process is not totally effective. The IRM program requires that Major Commands Army headquarters review automation initiatives to ensure that they do not duplicate another initiative or an ongoing effort, and are consistent with overall Army IRM program goals. We found, however, that ODISC4’Sprocess could not ensure that initia- tives submitted by major commands and installations were based on requirements analyses or were traceable back to missions or functions. Additionally, 0~1x4 could not ensure that automation initiatives would ultimately conform to the Army information architecture. Finally, initia- tives were not tied to the budget process. Therefore, once approved, they could be used to justify procurements for an indefinite period of time. Major Automation Projects In the absence of an Army-wide information architecture and an effec- May Not Support Program tive information management planning process, the Army has no assur- ante that its computers, communications networks, or data base Objectives management systems will fulfill its IRM goal for an open system architec- ture supportable by several different vendors’ equipment and software. Moreover, our work suggests that several major ongoing Army initia- tives may have to be redone to conform to the overall architecture once developed. For example: l Earlier this year we reported that the Army was uncertain about the computers on which its standard information systems would operate.” With this uncertainty, continued development of major systems could have led to substantial conversion costs or limited competitive procure- ments. On the basis of our report, the Congress withheld funding for several Army standard systems until the service developed a strategy showing how these systems would move from the present to the future operating environment. During the course of our work we noted that while several of the systems under development were redirected to operate on nonproprietary platforms, others were too far along to be redirected. l At TRADOCwe found that a proprietary operating environment (hard- ware, operating systems, and communications network protocols) has been mandated for all of its installations. “AIW Budget: Potential Reductions to Army Automation Initiatives (GAO/IMTECB09,Nov.20, 1989). Page 18 GAO/IMTEGSO-68 Army Information Resources Management chapter 2 Army Iuf’ormatlon Resources Mauagement Program Not Fully Implemented . The Army is in the process of issuing a servicewide contract for a data base management system that will only operate in a specific operating environment. Page 19 GAO/IMTEG90-68 Army Information Resources Management Chapter 3 Corrective Actions Will Require Time and Oversight The Army has recently undertaken a number of efforts to correct identi- fied deficiencies and improve its management of information resources. We are concerned, however, that given the magnitude of the efforts, it may take longer than the Army realizes or has reported to Congress to effectively implement revised policies and procedures. We are also con- cerned that a desire to show progress may result in premature or over- stated claims that identified problems are corrected. In a February 13, 1990, letter, the Army Vice Chief of Staff reiterated Army Actions to support for the IRM program and advised the major commands of efforts Correct Control they must undertake to strengthen oversight, eliminate duplication, and Deficiencies establish strong internal controls. Actions that the Army has under- taken to improve IRM include establishing a Corrective Action Plan to organize, track, and resolve all deficiencies identified in past audit reports; revising Army Major Automated Information System Review Committee guidelines to increase information systems oversight; rechartering the Architecture Control Committee to improve informa- tion management; revising the Information Management Plan process and developing gui- dance to improve Army effectiveness in identifying and validating new information requirements; developing Information Mission Area Modernization Plans to prioritize systems initiatives in the currently constrained budget environment; sending assistance teams to major commands to help them comply with IRM POliCy; establishing a Management and Oversight Improvement Program to inte- grate and eliminate duplication of initiatives to resolve IRM deficiencies; establishing the Army Data Management and Standards Program, to provide a single approach to data-element standardization throughout the Army; and . developing the Army Strategy for Sustaining Base Automation, which describes the direction that Army IRM will follow through the 1990s. A discussion of these actions is included in appendix I. We were unable to evaluate these actions or their impact because they were in their ini- tial stages when we completed our audit work. However, we did make the following observations. Page 20 GAO/IMTEGSO-68 Army Information Resources Management Chapter 3 Corrective Actions Will Require Time and Oversight The initiatives that the Army has recently undertaken build on the Army Officials May efforts begun in 1984 to implement the IRM program. At that time, the Have Underestimated A rmy began to realign resources, revise policy, develop an information the Time Required to architecture, and institute control mechanisms to support the informa- tion management reorganization. Now, not only is the Army still Implement Current working to fully implement those efforts, it is also working to correct Initiatives problems with the portions of the program that have been implemented. And at the same time, the Army must maintain its existing operations while it is continuing with new systems development. Army officials estimate that action to correct deficiencies will be com- pleted by the end of this year. For example: l All Corrective Action Plan issues are scheduled to be resolved by December 1990. . Final publication of Army guidance on the revised Information Manage- ment Plan process is expected in July 1990. l An interim Army Information Mission Area Modernization Plan has been developed until major commands and Army staff agencies have time to develop and submit their own individual modernization plans this December in preparation for the next budget cycle. . The Army Strategy for Sustaining Base Automation calls for complete information management policy by December 31, 1990. Despite the Army’s estimate, past experience indicates that this activity may well take longer than the Army has reported to Congress to com- plete. For example, when the Army IRM program was initiated in May 1984, the service projected that the information management infrastruc- ture would be completed by October 1985. Some 4 l/2 years later, the program is nowhere near full implementation. According to the 0~1~~4 policy division chief, some of the realignments necessary to institute the program were never completed, and policy development and revision is still underway. The Information Management Plan process was partially implemented, but it never became a fully effective mechanism for identi- fying and validating information requirements. While development of the Army-wide information architecture is ongoing, officials with whom we spoke estimated that it may require 15 to 20 years to become effective. Page 2 1 GAO/IMTEG90-68 Army Information Resources Management Chapter 3 Corrective Actions Will Require Time and Oversight Our review of the Army’s initiatives indicates that claims of completed Corrective Actions actions need to be assessed with caution to ensure that they are justi- May Be Overstated in fied. While the Corrective Action Plan is a step in the right direction, no Terms of Anticipated one at Army headquarters is centrally reviewing its tasks and mile- stones for issue correction to ensure their accuracy, completeness, or Early feasibility. As a result, Army units have submitted questionable solu- Accomplishments tions for Corrective Action Plan issue resolution. For example, the Army reported that the issue concerning development of the Army-wide infor- mation architecture is resolved because the policy for doing so has been prepared. It seems obvious to us that the indicated action is only the initial step in resolving the problem; the Army information architectures still need to be developed and integrated. In another instance, the Army asserted that it has planned its future automation environment to guide all Army information systems devel- opment. Army officials told us, however, that the planned automation environment is not based on an in-depth analysis of Army information requirements, as required by Defense and Army policy. As such, these actions by no means constitute final or adequate problem resolution. The Army has also revised its policy to require that major commands conduct oversight reviews of information systems. However, according to an Army official, no one from headquarters will participate in these major command reviews because they will be too numerous. In our opinion, such reviews will require headquarters participation to ensure achievement of overall Army goals, particularly since the Army has not developed its Army-wide information architecture. Additionally, the combined monetary investment at this level is substantial, and thus war- rants headquarters oversight. Finally, while Army regulation 25-9 gives ODISC4the responsibility to enforce the Army Data Management and Standards Program, Army offi- cials said that ODISC~does not have the funds with which to do so. These officials stated that, in the past, the lack of resources has been a major contributor to ineffective attempts to standardize data in the Army. They said that, as a result, there is currently no timetable or assurance of having data standardized. Page 22 GAO/IMTECSO-58 Army Information Resources Management Chapter 4 Conclusionsand Recommendations The Army’s IRM program is ambitious; on paper, it appears sound. Meant Conclusions to provide a defined management and planning structure to help achieve Army-wide information management goals, it can only, however, be effective if it is implemented. Key provisions of the program still remain to be implemented. The program’s basic building block is the information architecture. A tool with which to judge information requirements on the basis of mis- sion needs, its development has been hampered at all levels within the Army. The lack of a headquarters architecture, no specific lower-ech- elon implementation guidance, the lack of local commander commitment to developing architectures, and an emphasis on developing new sys- tems over a standard architecture have relegated the accomplishment of this basic tool to less-than-top priority. Further, because of a lack of controls, the information management planning process for ensuring that initiatives are based on valid require- ments is ineffective. As a result, the Army cannot assure that the sys- tems it is acquiring will conform to an overall Army information architecture, are based on valid requirements, are not duplicative, and comply with pertinent automated data processing policies and regulations. Yet the Army’s information technology budget continues to grow; in 6 years it has almost doubled. It appears likely that, if strongly managed and fully implemented, Army actions now underway to correct IRM deficiencies could solve many of the current problems. We are concerned, however, that given the magni- tude of the efforts, established time frames for fully achieving these goals may not be realistic, Further, an understandable desire to demon- strate progress may result in premature or overstated claims that identi- fied problems are fully corrected when such is not the case. In order to strengthen its information resource management, we recom- Recommendations mend that the Secretary of Defense direct the Secretary of the Army to take the following actions: l Establish specific milestones for the development of a fully integrated, requirements-based information architecture and the implementation of an effective planning and control structure. Page 23 GAO/IMTEC90-68 Army Information Resources Management Chapter 4 Conclueiolup and Recommendatlona l Limit new information management initiatives to those mandated by Congress or necessary to fulfill legal requirements until such time as a fully integrated, requirements-based information architecture is devel- oped and an effective control structure is implemented. . Institute strong central direction and control over actions currently underway to implement and correct problems with the Army IRM Pro- gram, and establish and report to the Congress realistic time frames for their completion. Page 24 GAO/IMTEG90H)-58Army Information Resources Management Page 26 GAO/MTEG9O-58 Army Information Resources Management (I Appendix I . Army Efforts to Correct Information Resources ManagementDeficiencies The Director, ODISC~, established the Corrective Action Plan in Sep- The Corrective Action tember 1989 to systematically organize, track, and resolve information Plan management deficiencies identified in various audit reports in the past few years. The Director appointed a task force within the Plans Division of ODISC4to have overall responsibility for the Corrective Action Plan project. The task force reviewed the source documents and tasked 191 of the total 228 Corrective Action Plan issues to various Army organiza- tions for resolution. The task force prioritized the issues, with all sched- uled for completion by the end of December 1990. Overall progress of issue resolution is managed through periodic in-process reviews for the Director and Vice-Director. The Army recently revised its Major Automated Information System Revision of Army Review Committee guidelines to strengthen the Army control process Major Automated and increase oversight of information systems. The Committee reviews Information System major or special-interest automation systems to ensure that they will provide cost-effective solutions to mission needs, comply with appli- Review Committee cable standards and policy, and conform to information architectures. Guidelines Increases Milestone approval resulting from Committee reviews provides a requi- site endorsement for initiatives that compete for funding. Information Systems Oversight Army Regulation 25-3, Army Life Cycle Management of Information Systems, published in November 1989, outlines policies and responsibili- ties for Army development, review, and approval of information sys- tems. The regulation establishes the Army Committee threshold at $10 million in program costs, prohibits Army units from fragmenting requirements into separate projects to avoid oversight and approval, requires that projects with program costs below $10 million and above $2.5 million be subjected to reviews at the major command level, and requires that information systems with program costs under $2.5 million be reviewed, approved, and managed at the major command level unless the major command delegates authority to a lower-echelon activity. In addition to Army Regulation 25-3, revisions are being made to several Department of Defense and Army regulations and pamphlets to docu- ment the changes to the Committee process and life cycle management. Army officials expect that all such guidance will be completed by the end of 1990. Page 26 GAO/IMTECSO-58 Army Information Resources Management , . Appendix I Army Efforts to Correct Information Resources Management Deficiencies In January 1990 the Army revised the Architecture Control Committee Architecture Control charter and expanded its responsibilities and membership to provide Committee stronger information management, guidance, and control. The Com- Rechartered to mittee resolves architecture issues and is responsible for reviewing, evaluating, and making recommendations to the Director, ODISC4, con- Improve Information cerning information architectures, Information Management Plan initia- Management and tives, modernization plans, and policy guidance. The Director has Control replaced the Vice-Director as chairman to increase the authority of the committee. In addition, the Army has expanded committee membership to include representatives of all major commands. The Army recently revised the Information Management Plan (now Revision of the called the Requirements Statement) process to improve Army effective- Information ness in identifying and validating new information requirements. ODISC4 Management Plan is developing Army Regulation 25-2, the Information Mission Area Plan- ning Process, to guide Army organizations on the revised process, This Process new “how to” guidance will require that information initiatives be vali- dated against functional proponent architectures and an organization’s information model, provide specific criteria and instructions for require- ments validation, and outline a plan for coding and tracking expendi- tures on information initiatives, This guidance is scheduled for final publication in July 1990. Another corrective action concerning the planning process requires that informa- tion initiatives more than 3-years old be revalidated. ODISCX now requires major commands and Army staff agencies to Information Mission develop modernization plans that prioritize initiatives for moving to the Area Modernization objective configuration in a fiscally constrained environment. ODISC4 will Plans integrate the individual plans to comprise the Army-wide Information Mission Area Modernization Plan. This plan will do what was not done in the past: tie Information Management Plan initiatives to the budget process and limit systems to the minimum necessary to achieve mission- essential capabilities. Managers will use the plan to program funds in the budget process, Page 27 GAO/IMTEGSO-St3 Army Information Resources Management . Appendix I Army Efforts to Correct Information Resources Management Deficiencies The Director, ODISC4,created the Information Mission Area Assistance Information Mission Team to visit major commands and help them comply with higher level Area Assistance Team d’irec t’Ives and guidance within the Information Mission Area frame- work. Depending upon the needs of the activity visited, the team is com- prised of technical, management, and functional experts to advise local officials on various areas of information management. According to ODISC4officials, team visits began in March 1990. The Director established the Automated Information System Manage- Management and ment and Oversight Improvement Plan in January 1990 to identify, inte- Oversight grate, and eliminate duplication of initiatives to resolve Army IRM Improvement Program deficiencies. The plan is also to help ensure that management direction is being followed on a sustained basis. The Director will conduct quar- terly reviews to determine which completed initiatives require follow-up management, provide resources to manage and track initiatives for com- pliance, and identify and assign new initiatives to be managed in accor- dance with the plan. The Army established policy on its Data Management and Standards Army Data Program in September 1989. The specific objectives of the program are Management and to Standards Program . manage data effectively throughout their life cycle; . establish data architectures that support the Army’s information requirements; l promote data independent of applications development; l maintain and control data in data bases so they are accessible to many applications; . provide a single approach to data-element standardization throughout the Army; and l gain acceptance of Army standard data elements by such agencies as the Department of Defense, the Joint Chiefs of Staff, and the North Atlantic Treaty Organization. Army Regulation 25-9 designates the Director as the senior policy offi- cial for data management, with responsibility for setting policy and enforcing the development and use of standard elements within the Army. The regulation specifies that heads of agencies and commanders incorporate data management in their Information Management Plans and initiatives. The regulation also calls for a data encyclopedia of stan- dard data elements and their attributes. Page 28 GAO/IMTEGSO-68 Army Information Resources Management Appendix I Army Efforts to Correct Information Resources Management Deficiencies The Army Strategy for Sustaining Base Automation describes the direc- Army Strategy for tion that the Army will follow through the 1990s to provide information Sustaining Base services to maintain force readiness at minimum cost. The strategy is Automation “composed of linked and mutually supporting management, technical, standards, and security strategies that describe the collective efforts necessary to modernize existing sustaining base automation systems in a constrained fiscal environment.” Many of these efforts have already been discussed above. Others include moving to an open systems archi- tecture, and executing the contract to replace the Army Standard Infor- mation Management System with the Sustaining Base Information Service in 1992. The strategy is intended to compare the current sustaining base automa- tion environment with the future environment. It lays out an objective configuration for building the sustaining base architecture, incorpo- rating the Information Mission Area principles. It also outlines an imple- mentation/management strategy for achieving these sustaining base principles. Page 29 GAO/IMTEC90-68 Army Information Resources Management Appendix II . Major Contributors to This Report Thomas J. Howard, Assistant Director Information Wiley E. Poindexter, Jr., Assignment Manager Management and Sondra F. McCauley, Evaluator Technology Division, Washington, DC. Phillip E. Rutar, Evaluator-in-Charge Cincinnati Regional Robert L. Williams, Jr., Evaluator Office Connie W. Sawyer, Jr., Regional Assignment Manager Norfolk Regional Office Carl L. Higginbotham, Regional Assignment Manager Atlanta Regional Eva Z. Margolies, Evaluator Office . (LIO41)6) Page 30 GAO/IMTEC90-68 Army Information Resources Management ‘I’ht~rt~ is25”0 tliscotir~t~ on orders it for siugltb ;itltlwss. 100 or more wpiw Iwtilctt lo a ---
Information Resources: Army Should Limit New Initiatives Until Management Program Is Implemented
Published by the Government Accountability Office on 1990-06-29.
Below is a raw (and likely hideous) rendition of the original report. (PDF)