Information Technology: Departments Need to Improve Chief Information Officers' Review and Approval of IT Budgets

In December 2014, Congress enacted FITARA, which was intended to improve covered agencies' acquisitions of IT. FITARA also provided an opportunity to strengthen the authority of CIOs to provide needed direction and oversight of agencies' IT budgets.

GAO was asked to review whether CIOs' IT budgeting practices are consistent with FITARA and OMB's implementing guidance. This report addresses the extent to which selected federal agencies (1) established policies and procedures that address IT budgeting requirements, (2) could demonstrate that they had developed fiscal year 2017 IT budgets for sampled investments consistent with FITARA and OMB guidance, and (3) implemented processes to ensure that annual IT budgets are informed by reliable cost information.

GAO selected four departments to review. These departments had the two highest and the two lowest average initial selfassessments scores of compliance with OMB's FITARA guidance, as well as a fiscal year 2017 IT budget of at least $1 billion. Within each of the departments, GAO also selected the component agencies with the largest fiscal year 2017 IT budget. For each selected department and component agency, GAO reviewed relevant IT budget policies and procedures, analyzed a sample of major and non-major investment proposals against key OMB requirements, and determined whether selected departments captured government labor costs, among other things.

The departments GAO reviewed—the Departments of Energy (DOE), Health and Human Services (HHS), Justice (DOJ), and the Treasury (Treasury)—took steps to establish policies and procedures that align with eight selected Office of Management and Budget (OMB) requirements intended to implement information technology (IT) acquisition reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act, or FITARA) and to provide the chief information officer (CIO) visibility into and oversight over the IT budget. For example, of the eight OMB requirements, all four departments had established policies and procedures related to the level of detail with which IT resources are to be described in order to inform the CIO during the planning and budgeting processes. Agencies varied, however, as to how fully they had established policies and procedures related to some other OMB requirements, and none of the four departments had yet established procedures for ensuring that the CIO had reviewed whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (See table.)

Where the departments had not fully established policies and procedures, it was due, in part, to having not addressed in their FITARA implementation and delegation plans how they intended to implement the OMB requirements. Until departments develop comprehensive policies and procedures that address IT budgeting requirements established by OMB, they risk inconsistently applying requirements that are intended to facilitate the CIO's oversight and approval of the IT budget.

Departments varied in the extent to which they could demonstrate implementation of key IT budgeting requirements when developing fiscal year 2017 funding requests for sampled investments. Specifically, while DOJ demonstrated that it had fully implemented the selected requirements for the majority of the investments GAO sampled, HHS and Treasury partially demonstrated implementation for a majority of the sampled investments, and DOE could not demonstrate implementation for the majority of the sampled investments. For example, DOE, HHS, and Treasury were not able to fully show that their CIOs had reviewed whether estimates of IT resources included in the budget request were appropriate for two of their respective departments' largest fiscal year 2017 IT investments. Departments often could not demonstrate that they had implemented selected IT budgeting requirements at the investment level because they had not established comprehensive policies and procedures that required them to do so. As a result, departments could not show that CIOs were sufficiently involved in planning fiscal year 2017 IT expenditures at the individual investment level.

All four selected departments lacked quality assurance processes for ensuring their IT budgets were informed by reliable cost information. Specifically, the selected departments did not have IT capital planning processes for (1) ensuring government labor costs have been accurately reported, (2) aligning contract costs with IT investments, and (3) utilizing budget object class data to capture all IT programs. This resulted in billions of dollars in requested IT expenditures without departments having comprehensive information to support those requests, and nearly $4.6 billion in IT contract spending that was not explicitly aligned with investments in selected departments' IT portfolios. This was due to a lack of processes for periodically reviewing data quality and estimation methods for government labor estimates, as well as a lack of mechanisms to cross-walk IT spending data in their procurement and accounting systems with investment data in their IT portfolio management systems. In August 2017, OMB developed a new approach of using a standard set of categories to group IT spending that, if properly implemented, has the potential to provide departments and CIOs enhanced visibility into IT costs across the portfolio. Nevertheless, until departments establish processes for assessing or otherwise ensuring the quality of relevant IT cost data used to inform their IT budgets, department CIOs will have less assurance that their budget includes appropriate and comprehensive estimates of IT resources.

GAO is making 43 recommendations to the eight selected departments and component agencies to address gaps in their IT budgeting policies and procedures, demonstrate implementation of OMB requirements, and establish procedures to ensure IT budgets are informed by reliable cost information. HHS, the Centers for Medicare and Medicaid Services, DOJ, the Federal Bureau of Investigation, and the Internal Revenue Service agreed with our recommendations. DOE partially agreed with one recommendation and agreed with the other recommendations made to it, as well as with the recommendations made to its component agency—the National Nuclear Security Administration. Treasury neither agreed nor disagreed with the recommendations.

Information systems are critical to the health, economy, and security of  the nation. Toward this end, the President’s fiscal year 2018 budget  estimated that, for information technology (IT), the federal government  had invested approximately $94 billion in fiscal year 2017 and expected to  invest approximately $96 billion in fiscal year 2018—the largest amount  ever. However, as we have previously reported, prior IT expenditures  have too often produced failed projects—that is, projects with multimillion  dollar cost overruns and schedule delays measured in years, and with  questionable mission-related achievements.

Moreover, the President’s Management Agenda has pointed out that  federal executives have been challenged by the lack of visibility into, and  accuracy of IT spending data. In this regard, the agenda noted that 84  percent of the federal IT budget was assigned to the spending category of  “other,” and was not tied to a specific category of IT spending. The  Administration stated that this lack of granularity makes it difficult to  baseline federal IT investments and show the public whether the  government is spending taxpayer dollars effectively in order to drive the  large-scale change needed to improve business transformation and  citizen services.

Recognizing the severity of issues related to the government-wide  management of IT, in December 2014, Congress enacted IT acquisition  reform legislation (commonly referred to as the Federal Information  Technology Acquisition Reform Act, or FITARA) as part of the Carl Levin  and Howard P. ‘Buck’ McKeon National Defense Authorization Act for  Fiscal Year 2015. FITARA was intended to improve covered agencies’  acquisitions of IT and enable Congress to monitor their progress, as well as hold those agencies accountable for reducing duplication and  achieving cost savings. In addition, with the enactment of FITARA, the  federal government is to strengthen the authority of chief information  officers (CIO) to provide needed direction and oversight of covered  agencies’ IT budgets. Among other things, FITARA requires the CIOs of  certain major civilian agencies to have a significant role in the decision  processes for all annual and multi-year planning and to approve the IT  budget requests of the agencies.

In June 2015, the Office of Management and Budget (OMB) released  FITARA guidance (referred to as the “common baseline”). The common  baseline describes how covered agencies are to implement the  requirements of the law through the use of management controls,  including controls related to the development of IT budgets.

With these requirements in mind, you asked us to determine whether  CIOs’ IT budgeting practices are consistent with FITARA and  implementing guidance. This report examines the extent to which  selected federal agencies (1) established policies and procedures that  address the IT budgeting requirements of FITARA and related OMB IT  budget guidance, (2) could demonstrate that they had developed fiscal  year 2017 IT budgets for sampled investments consistent with FITARA  and OMB guidance, and (3) implemented processes to ensure that  annual IT budgets are informed by reliable cost information.

To address our objectives, we selected four departments to review. First,  we identified a subset of the 24 agencies covered by the Chief Financial  Officers Act that had a fiscal year 2017 IT budget request of at least $1  billion. From this subset, we then identified the four agencies having the  two highest and the two lowest average initial FITARA self-assessment  scores (which reflected the extent to which the agencies had reported  implementing the specific requirements called for in the act’s provisions).  In the event that one or more agencies had the same average  self-assessment scores, we selected the agency with the largest fiscal  year 2017 IT budget. Based on these criteria, we selected four  departments for our review: (1) the Department of Energy (DOE), (2) the  Department of Health and Human Services (HHS), (3) the Department of  Justice (DOJ), and (4) the Department of the Treasury (Treasury).

In addition, for each of these four departments, we selected the  component agency that had the largest fiscal year 2017 IT budget  request. The component agencies within the four selected departments  were: (1) the National Nuclear Security Administration (NNSA) within  DOE, (2) the Centers for Medicare and Medicaid Services (CMS) within  HHS, (3) the Federal Bureau of Investigation (FBI) within DOJ, and  (4) the Internal Revenue Service (IRS) within Treasury.

For the first objective, we compared the selected departments’ IT  budgeting and capital planning policies and procedures to those  requirements in OMB’s FITARA guidance that related to developing IT  budgets. In selecting the requirements, we reviewed 10 areas within  OMB’s common baseline that related to budget formulation and  execution, and selected 8 requirements—such as including the CIO in the  planning and budgeting stages for programs that are fully or partially  supported with IT resources—that, in our professional judgment, would  significantly impact the development and approval of departments’ annual  IT budgets.

We also assessed selected component agencies’ IT budgeting and  capital planning policies and procedures in cases where the department  had delegated the responsibility for performing the requirement to its  components. Of the four departments we reviewed, three departments— DOE, HHS, and Treasury—had delegated the responsibility to component  agencies for performing certain IT budgeting and capital planning  requirements.

With regard to the second objective, we determined whether the  departments had implemented key IT budgeting requirements for a  non-generalizable sample of investments in their fiscal year 2017 budget  formulation. In doing so, we chose 16 investments—the largest major and  non-major investments at the department level and the largest major and  non-major investments at the component level—based on the selected  departments’ fiscal year 2017 IT budget requests.

We then reviewed investment-related IT budget formulation artifacts— such as briefings, reports, meeting minutes, memorandums, and other  relevant documentation—for the sampled major and non-major  investments at each of the departments and component agencies included in our review. We compared this documentation to the actions  agencies should have taken to implement five of the eight selected  requirements from the first objective. We focused on these five  requirements because, based on our professional judgment, the actions  taken to implement these requirements could be observed for individual  investments, such as whether the CIO was included in the planning and  budgeting stages for investments with IT resources.

To address the third objective, we assessed the departments’ efforts to  develop their fiscal year 2017 budget with reliable cost information by  comparing the selected departments’ IT capital planning and budgeting  processes against three best practices (from among others) that we and  the International Organization for Standardization have identified:  capturing government labor costs, aligning contract costs with  investments, and utilizing budget object class data. We selected these  three practices because of their potential to inform the development of a  complete and accurate IT budget for a federal department.

We then reviewed, for each selected department, government labor  estimates and contract-related information in the 2017 budget submission  reported on the Federal IT Dashboard, contract obligation data reported  within the Federal Procurement Data System-Next Generation,  documentation identifying the department’s budget object classes, and  each selected department’s IT capital planning policies and procedures.

We analyzed each department’s IT investment proposals and capital  planning procedures to determine whether the department was capturing  government labor costs for each investment, aligning contract costs with  investments, and utilizing budget object class data to inform its IT budget  formulation.

We supplemented our analyses with interviews of relevant officials in the  selected departments’ offices of the CIO and Chief Financial Officer, as  well as program offices. These interviews included discussions of our  observations of any shortfalls in their processes. A full description of our  objectives, scope, and methodology can be found in appendix I.

We conducted this performance audit from January 2017 to November  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

In addition to improving the government-wide acquisition of IT, FITARA  was intended to assist Congress in holding covered agencies  accountable for their progress towards reducing duplication and achieving  cost savings. The act also enhanced the CIO’s authority in covered  agencies for the formulation and approval of their agency’s IT budgets.  In this regard, the act requires CIOs to have a significant role in the  decision processes for all annual and multi-year planning, and to approve  the IT budget requests of the agency.

In June 2015, OMB released guidance that describes how agencies are  to implement the requirements of FITARA. The guidance is intended to,  among other things: assist agencies in aligning their IT resources with statutory  requirements; establish government-wide IT management controls that will meet the  law’s requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements;  strengthen the relationship between agency CIOs and component  CIOs; and  strengthen the CIO’s accountability for IT costs, schedules,  performance, and security.

The guidance identifies a number of actions that agencies are to take to  establish a basic set of roles and responsibilities (the common baseline)  for CIOs and other senior agency officials. One such action is that  agencies are to conduct a self-assessment to determine whether their  current policies and procedures meet or do not meet the common  baseline requirements. If the agencies do not meet the requirements, they  are to submit an implementation plan describing the changes they intend  to make to their policies and procedures in order to ensure that the  common baseline requirements are met. Further, the guidance notes that  senior agency officials—including Chief Financial Officers and Chief  Acquisition Officers—are to work in partnership to facilitate successful  implementation of the common baseline and to ensure the CIO is a  strategic partner in agency strategies, budgets, and operations.

In its guidance, OMB states that agency CIOs are allowed to delegate  certain responsibilities from the common baseline to other agency  officials, such as component agency CIOs. For example, CIOs can  delegate to these officials, inclusion in the planning, programming, and  budgeting stages for programs with IT resources. However, according to  the guidance, agency CIOs cannot delegate their responsibility for  reviewing and approving the major IT investments portion of the budget  request. The guidance further states that, for delegated responsibilities,  agency CIOs are to establish plans that demonstrate how they will retain  accountability. These delegation plans should include procedures for  ensuring that the delegated official will execute the responsibility with the  appropriate level of rigor.

In addition to the FITARA implementation guidance, OMB Circular A-130  establishes general requirements for the planning; budgeting;  governance; acquisition; and management of federal information,  personnel, equipment, funds, IT resources, and supporting infrastructure  and services. The circular identifies responsibilities for planning,  programming, and budgeting that reinforce requirements in OMB’s  FITARA implementation guidance.

Moreover, in May 2018 the President issued an executive order that  reinforces requirements in OMB’s FITARA implementation guidance.  The order noted that its purpose was to further enhance the effectiveness  of CIOs by, among other things, requiring agency heads to ensure that  the CIO has a significant role in all IT-related annual and multi-year  planning, programming, budgeting, and execution decisions. In addition,  the executive order noted that agency heads are to direct the CIO to be a  voting member of and to chair agency governance boards, including  investment review boards, that have purview over IT or that set  agency-wide IT standards.

We have previously testified that, while agencies have made progress in  implementing FITARA, its further implementation is critical to improving IT  management. We have also noted that, continued congressional  oversight of agencies’ implementation of this law is essential to help  ensure that these efforts succeed.

In addition, in an August 2018 report, we noted that 23 federal agencies  had reported wide variations in the authority over component-level IT  spending. For example, 8 agencies reported that the CIO had 100  percent authority over the agencies’ IT spending (including for  components), while 10 agencies reported that these officials had authority  for less than 50 percent of such spending. These widely varying levels of  authority over agency-wide IT spending existed, in part, because OMB’s  guidance did not completely define the authority that CIOs should have  over this spending. Accordingly, we recommended that OMB define the authority that the CIOs are to have when agencies report on their  authority over IT spending. OMB subsequently agreed with our  recommendation.

Departments Took Steps to Establish Policies and Procedures for IT Budgeting, but Lacked Plans to Fully Implement FITARA Requirements

As previously mentioned, OMB’s guidance on implementing FITARA  requires departments to develop policies and procedures to address a  number of requirements identified in the basic set of roles and  responsibilities (the common baseline) for CIOs. These include the eight  selected common baseline requirements related to the CIO’s  responsibility for IT budgeting. As identified in table 1, these requirements  can be categorized into three areas: (1) CIO visibility into IT resources,  (2) CIO input into IT resource plans, and (3) CIO review and approval of  IT budgets.

OMB required federal agencies and departments to establish FITARA  implementation plans that articulated policies and procedures for  addressing each of the common baseline requirements and that  described changes the departments intended to make to address any  gaps in their policies and procedures. Further, for delegated  responsibilities, OMB required agency CIOs to establish delegation plans  that demonstrate how they intend to retain accountability for the  requirement and ensure that the delegated official will execute the  responsibility with the appropriate level of rigor.

Toward this end, the selected departments had taken steps to establish  policies and procedures that addressed the common baseline  requirements established by OMB; however, most of the departments, or  their component agencies, lacked comprehensive policies and  procedures that fully addressed all of the requirements. Specifically, of  the eight common baseline requirements that we reviewed, all four  departments and their respective component agencies had fully  documented one requirement in their policies and procedures, and either  had partially documented or had not documented the other seven  requirements. While shortfalls existed for each department, DOJ had the  most comprehensive IT budgeting policies and procedures, followed by  Treasury, HHS, and DOE, respectively.

In addition, department CIOs at Treasury, HHS, and DOE had delegated  many of the responsibilities for addressing the IT budgeting requirements  to component CIOs—thus, these component agencies were to  supplement their departments’ policies and procedures with their own IT  budgeting policies and procedures for the responsibilities they were  delegated.

Among the three respective component agencies to which Treasury,  HHS, and DOE had delegated IT budgeting responsibilities, the extent to  which the components had documented requirements in their policies and  procedures varied. For example, IRS had documented policies and  procedures for all four of its delegated requirements. In addition, CMS  had documented policies and procedures that satisfied two, partially  satisfied two, and did not satisfy one of the five requirements delegated to  that component. For its part, NNSA had not documented any of its five  delegated requirements in the component’s policies and procedures.

Figure 1 illustrates the extent to which all four departments’ policies and  procedures had addressed the selected OMB common baseline  requirements, and is followed by a discussion of each category of  requirement. In addition, the figure highlights areas where component  agencies addressed their delegated responsibilities or did not address  their delegated responsibilities. Appendices II through V (for DOE, HHS,  DOJ, and Treasury, respectively) provide additional details about our  assessment of the extent to which the departments’ policies and  procedures had addressed the selected OMB common baseline  requirements, as well as the extent to which component agencies fulfilled  their delegated responsibilities.

Establish the Level of Detail with Which IT Resources Are to Be Described in Order to Inform the CIO during the Planning and Budgeting Processes

All four departments had policies and procedures that addressed the level  of detail with which IT resources are to be described in order to inform the  CIO during the planning and budgeting processes. For example, three of  the four departments (DOE, HHS, and Treasury) had policies that  required the IT budget to include a description of IT resource categories  that are required by OMB’s IT capital planning guidance, such as  government labor and certain infrastructure resources. DOJ’s policy  required the IT budget to include a description of 49 different IT resource  categories. As a result, the departments have increased the likelihood  that IT resources will be consistently described with the appropriate level  of detail for the CIO.

Establish Agency-Wide Policy for the Level of Detail with Which Planned Expenditures for All Transactions That Include IT Resources Are to Be Reported to the CIO

Each of the four departments had documented within their IT budgeting  procedures the level of detail that was required for reporting planned IT  expenditures to the CIO. However, the procedures did not explicitly  require that every transaction that related to IT resources be included in  the planned expenditure reporting to the CIO. Without explicitly requiring  that all transactions that have IT resources be included in the reporting of  planned expenditures, there is increased risk that the CIO cannot ensure  that all budget requests contain complete and accurate resource  estimates, in a consistent manner, to inform the department’s annual IT  budget.

Include the CIO in the Planning and Budgeting Stages for Programs That Are Fully or Partially Supported with IT Resources

The departments varied in the extent to which their policies and  procedures included a requirement for the department-level CIO to be  included in programs supported with IT resources. For example, DOE and  DOJ took steps to ensure that their CIOs are included in the planning and  budgeting of programs with IT resources by requiring that each IT  acquisition request include information about the investment in the CIO’s  IT portfolio that is to support the acquisition. Adding this investment  information to each acquisition request is intended to allow the CIO to  ensure that the requests are factored into resource planning for the IT  budget.

However, DOE’s, HHS’s, and Treasury’s policies and procedures did not  always require that the CIO be included in the planning and budgeting  stages for every program with IT resources. For example, DOE’s policies  called for the CIO to be included in the budget development process by  requiring the program offices to submit their IT budget to the CIO for  review and approval annually. On the other hand, this policy did not apply  to NNSA’s IT programs because the responsibility to meet this  requirement was delegated to that component.

NNSA drafted procedures to carry out the delegated responsibility, but  the procedures did not call for the DOE CIO—in addition to the  component-level CIO—to have input into the IT budget, as required by  the Secretary of Energy’s October 2016 FITARA implementation  memorandum. According to officials in NNSA’s Office of the CIO, the  component expects to finalize the procedures by the end of August 2018;  however, the officials did not say whether the finalized procedures would  include a requirement for NNSA to obtain input from the DOE CIO on its  IT budget. By not requiring that the department-level CIO be included in  the planning and budgeting stages for programs that are fully or partially  supported with IT resources, DOE, HHS, and Treasury are at increased  risk that the CIO is not providing input into key IT resource planning  decisions.

Include the CIO as a Member of Governance Boards That Inform Decisions Regarding All IT Resources, Including Component-Level Governance Boards

The charters for all four department-level investment review boards that  inform decisions regarding IT resources indicated that their respective  CIOs were included as members. In addition, the charters for  component-level investment review boards that inform decisions  regarding IT resources at CMS and IRS included their respective  component-level CIOs. However, a similar review board at FBI did not  include the component-level CIO as a member and NNSA had not yet  finalized its charter. Further, none of the charters for the selected  components’ investment review boards indicated that the  department-level CIOs were members.

Among the three CIOs at DOE, HHS, and Treasury that had delegated  the responsibility of component-level board membership to component  CIOs, the department-level CIOs at these agencies had not established  procedures for ensuring that the components had implemented this  responsibility, as required by OMB. As previously mentioned, while  department CIOs were allowed to delegate this responsibility, OMB  requires department CIOs to establish delegation plans that describe  each requirement being delegated, demonstrate how the department  CIOs will retain accountability for the requirement, and ensure that the  delegated official executed the responsibility with the appropriate level of  rigor. By not requiring that the department-level CIO be included in key  governance board decisions regarding IT investments or establishing  delegation plans that outline such activities for component CIOs, the  selected departments are at increased risk that the CIO is not providing  input into key IT resource planning decisions.

Document the Processes by Which Program Leadership Works with the CIO to Plan an Overall Portfolio of IT Resources

Departments varied in the extent to which they had documented the  process by which program leadership is to work with the CIO to plan an  overall portfolio of IT resources. For example, DOJ and Treasury  documented a detailed process with roles and responsibilities for how  program leadership is to work with their CIOs to plan resources for the  overall portfolio through their IT governance process.

However, DOE and HHS had partially documented the process they were  to follow to meet this requirement. Specifically, these departments  documented that they were to utilize department-level governance boards  to plan IT resources with program leadership for investments subject to  the governance board reviews. However, they did not always document  how CIOs were to work with program leadership in planning IT resources  for other investments that were not subject to department-level  governance board reviews, such as existing HHS investments that are  greater than or equal to $20 million annually and DOE investments  initiated by NNSA. As a result of shortfalls in documenting policies and  procedures that require the CIO to work with program leadership to plan  the IT portfolio, DOE and HHS are at an increased risk that the CIO’s role  in the formulation of IT budgets is limited.

CIO Review and Approval of the IT Budget Request

Ensure the CIO Has Reviewed and Approved the Major IT Investments Portion of the Budget Request

The four selected departments varied in the extent to which they had  documented in their policies and procedures how their CIOs are to review  and approve the major IT investments portion of the budget request. For  example, DOJ had a documented process for how the CIO is to review  and approve all major IT investments through the department’s annual  budget planning and IT portfolio review processes.

In contrast, the other three departments partially addressed the  requirement by documenting the requirement to review and approve  certain major investments, but not all major investments. To illustrate,  DOE documented policies and procedures that required the CIO to review  major IT investments, but the policies and procedures did not apply to  major IT investments within NNSA and the national laboratories, including  those related to high-performance computing.

Further, NNSA had draft policies and procedures requiring its  component-level CIO to review major IT investments. However, these  policies and procedures had not yet been finalized and approved, and  they did not include a requirement for the DOE CIO’s review of these  investments. Moreover, the department had not developed policies and  procedures stipulating this requirement for the national laboratories. While  officials in the department’s Office of the CIO stated that they plan to  revise policies and procedures for the national laboratories to include the  CIO in their annual planning processes, the officials did not identify a time  frame for completing those revisions.

As another example, HHS had documented a process that required the  department-level CIO to review and approve new major IT investments  greater than or equal to $20 million. In addition, the process required  that the review and approval of new and existing major investments  between $10 million and $20 million annually be delegated to the  department’s component CIOs. Accordingly, CMS met this requirement at  the component level by documenting IT investment review board policies  and procedures that require the component CIO to review and approve major, high-risk, and mission critical IT investments with estimated costs  of less than $20 million. However, HHS did not fully address the  department-level requirement in that its process did not document how  the department-level CIO would review and approve existing (as opposed  to new) major investments greater than or equal to $20 million annually.  As a result of not fully documenting the process for how the departments  are to meet this requirement, DOE, HHS, and Treasury are at increased  risk that major investments will be submitted for the budget without being  reviewed and approved by the CIO.

Ensure the CIO Has Reviewed IT Resources That Are to Support Major Program Objectives and Significant Increases and Decreases in IT Resources

The departments we reviewed varied in the extent to which they had  documented in their policies and procedures how they are to ensure that  the CIO has reviewed IT resources that are to support major program  objectives and significant increases and decreases in resources. For  example, DOJ and Treasury had documented in their policies and  procedures their CIOs’ role in reviewing IT resources that support major  program objectives and significant increases and decreases in their  resources.

However, the other two departments—HHS and DOE—had not  documented this role for their CIOs. Specifically, HHS policies and  procedures did not include a requirement for the CIO to review significant  increases and decreases in IT resources. In addition, the HHS CIO  delegated to component-level CIOs the responsibility to review IT  resources that support major program objectives for investments of less  than $20 million annually. However, HHS had not established procedures  for ensuring its components carried out the responsibility, and the  component agency we selected—CMS—did not include this requirement  in its procedures.

Similarly, DOE had not documented procedures for the department-level  CIO’s role in reviewing IT resources that support major program  objectives and significant increases and decreases in IT resources. For  NNSA programs, DOE delegated the responsibility to the NNSA CIO.  However, NNSA had not documented the NNSA CIO’s role in reviewing  planned IT support for major program objectives, as well as significant  increases and decreases in IT resources. Until DOE and HHS develop  policies and procedures that include how the CIO is to review whether  each investment’s IT resources support major program objectives and  have increased or decreased significantly, they will have less assurance  that the IT budget request consistently supports the departments’ goals  and objectives and that the CIOs have approved significant changes in  the budget.

Ensure the CIO Has Reviewed Whether the IT Portfolio Includes Appropriate Estimates of All IT Resources Included in the Budget Request

None of the four departments had documented in their policies and  procedures how their CIOs are to ensure, as part of the IT budget review  and approval process, that the IT portfolio includes appropriate estimates  of all resources. Specifically, DOE, HHS, Treasury, and DOJ had not  documented in their policies and procedures the necessary steps that  their CIOs would need to take in order to ensure that the portfolios  included the appropriate estimates of all IT resources in the budget  requests.

In addition, Treasury delegated this responsibility to its component CIOs  for component-level investments, and IRS had documented procedures  for validating the estimates of all IT resources for the IRS budget request.  However, Treasury did not document the necessary steps to ensure that  its delegated authorities were being carried out, as required by OMB.

Without documented policies and procedures for the steps the CIO is to  take to review whether the IT portfolio includes appropriate estimates of  all IT resources included in the budget request or delegation plans that  outline such activities for component CIOs, the selected departments may  be limited in their ability to assure that their CIOs are effectively  positioned to consistently and adequately review and approve the IT  budget request.

Gaps in Departments’ FITARA Implementation and Delegation Plans

The shortcomings in the four departments’ policies and procedures  related to CIO visibility into IT resources, CIO input into IT resource  planning, and CIO review and approval of the IT budget request were  due, in part, to having not addressed in their FITARA implementation and  delegation plans how they intended to implement the OMB common  baseline requirements.

For example, none of the four departments’ FITARA implementation  plans addressed how they intended to implement the requirement that all  transactions related to IT resources be included in planned expenditure  reporting to the CIO. These departments’ implementation plans also did  not address the requirement that the CIO review whether the IT portfolio  includes appropriate estimates of all IT resources identified in the budget  request. Officials in DOE’s Office of the CIO stated that the department is  in the process of determining ways to add specific review criteria to its  capital planning policies and procedures to identify how the department is  to review the appropriateness of IT resources in the portfolio. Had such  procedures been documented and identified in the department’s FITARA  implementation plan, it would have been better positioned to demonstrate  how this common baseline requirement is being addressed.

In addition, the HHS and Treasury FITARA delegation plans did not  address how their CIOs would ensure components carried out their  responsibilities for reviewing and approving the IT budget request.  Officials in HHS’s Office of the CIO stated that delegation memorandums  issued to their components included procedures for ensuring components  carried out their responsibilities. However, the delegation plans they  provided to us did not include such procedures. Officials in Treasury’s  Office of the CIO stated that they did not believe that it was their  responsibility to have procedures for verifying that components are  carrying out their delegated responsibilities because they viewed it as an  audit function. However, having such procedures is called for by OMB’s  FITARA implementation guidance.

Without FITARA implementation plans that address the shortfalls in  policies and procedures for ensuring the implementation of OMB’s  common baseline requirements, departments have limited assurance that  their CIOs will implement the requirements as intended by OMB and  FITARA. In addition, without identifying the steps within the FITARA  delegation plans that departments intend to take to ensure the  responsibilities delegated to components are appropriately carried out,  the departments may have limited assurance that these actions have  been taken.

Selected Departments Demonstrated Mixed Implementation of IT Budgeting Requirements in Developing Fiscal Year 2017 Budgets for a Sample of Investments

While it is important for federal agencies to establish policies and  procedures that describe how they are to carry out IT budgeting  requirements identified in FITARA and OMB guidance, it is equally  important for them to implement the requirements when planning and  budgeting for individual IT investments and to retain supporting  documentation that would demonstrate that they have done so. Among  the eight selected OMB common baseline requirements related to IT  budgeting, five of the requirements are applicable at the individual  investment level. Table 2 shows how these five common baseline  requirements would be implemented at the individual investment level, as  well as the related categories.

The selected departments and their respective component agencies  varied in the extent to which they could demonstrate that they had  implemented the five common baseline requirements when developing  their fiscal year 2017 funding requests for 16 sampled investments.

Figure 2 and the subsequent discussion summarize the extent to which  the departments and their component agencies could demonstrate that  they had implemented the five requirements in developing fiscal year  2017 budgets for the sample of investments that we reviewed. As  described earlier, we reviewed the largest major and non-major  investment for each of the four departments and four component  agencies. In addition, appendices II through V provide further details  about our assessments of the extent to which the departments and  component agencies demonstrated that they had implemented the five  requirements.

IT Resources for Each Investment Are Described in Order to Inform the CIO during the Planning and Budgeting Processes

For the investments that we reviewed, the departments and their  components varied in the extent to which they could demonstrate that  they had described their investments’ IT resources. For example, DOJ  and Treasury described specific IT resources, such as costs for  personnel and software, in spreadsheets or databases for processing  annual requests for resources for each proposed IT investment.

Conversely, HHS and DOE did not fully describe in supporting  documentation their respective IT resources for their investments  included in our review. For example, HHS could not demonstrate that it  had described the department-level non-major investment’s IT resources.  In addition, although HHS described non-labor resources that were  allocated for a portion of the sampled department-level major investment,  the department did not describe labor resources for the investment. HHS  also could not account for the investment’s entire funding request— leaving nearly $17 million in resources that were not described. Officials  in HHS’s Office of the CIO were unable to explain why supporting  documentation for the investment only accounted for a portion of the  investment’s total funding request, and not the entire request.

HHS and DOE officials provided various reasons as to why their  departments did not describe in supporting documentation all of the IT  resources associated with the investments we sampled. For example,  HHS could not demonstrate that it had described IT resources for the  non-major investment that we reviewed because officials in the Office of  the CIO did not have the supporting documentation associated with its  funding request. In addition, according to officials in HHS’s Office of the  CIO, the department’s omission of required labor resources from program  office artifacts supporting the funding request for the department-level  major investment was an oversight. According to the officials, during the  budget formulation cycle, the department did not consistently maintain  documentation for its investments that would describe the IT resources  and lacked a mature governance process for reviewing the IT resources  associated with the investment.

Moreover, officials in DOE’s Office of the CIO stated that the  department’s budgeting procedures did not call for clearly identifying  specific IT resources. However, at a minimum, DOE’s budgeting  procedures required that the budget estimate for investments include  planned government labor expenditures.

Until HHS and DOE describe IT resources within their investments, the  CIO may have limited visibility into what the resources are that are being  requested in the annual IT budget.

The CIO Is Included in the Planning and Budgeting Stages for Investments with IT Resources

The extent to which each of the four departments’ could demonstrate that  their CIOs were included in the planning and budgeting stages for the  sampled investments with IT resources varied. Specifically, of the four  investments we reviewed for each agency, DOJ and its component  included the CIO in the planning and budgeting stages via an annual IT  portfolio review that included the four sampled investments.

On the other hand, HHS, Treasury, and DOE—along with their  components—could not always demonstrate that the department-level CIO was included for their investments. For example, within HHS, its  component agency—CMS—partially implemented the requirement for  both of the sampled investments. Specifically, CMS documented the  CIO’s review and approval of each investment’s detailed IT resource  estimates during governance board reviews. However, HHS’s supporting  documentation did not demonstrate that the department CIO was involved  in the planning process for these investments even though its capital  planning and investment control policy required this official to review,  validate, and approve these IT investments through the department-level  review board.

Further, Treasury could not demonstrate that the department’s CIO was  included in the planning and budgeting stages for the two  department-level investments that we reviewed. According to officials in  Treasury’s Office of the CIO, the relevant documentation was not retained  for the selected department-level investments because procedures were  not in place to document reviews by the CIO and certain artifacts that  may have documented such reviews were no longer available in part due  to employee turnover within the program offices responsible for the  investments. Until DOE, HHS, and Treasury include the CIO in the  planning and budgeting stages for investments with IT resources, they  may be at risk of duplicating resources or funding investments without the  CIO’s knowledge or approval.

Program Leadership Works with the CIO to Plan the Investment’s IT Resources

The selected departments varied in their ability to demonstrate that their  CIOs worked with program leadership across the investments we  sampled for the fiscal year 2017 funding request—both within and across  the departments. For example, DOJ demonstrated that the CIO worked  with program leaders in planning IT resources for both the major and  non-major investment at the department level by jointly developing a plan  for how business units were to utilize funds for IT services. At the  component-level, FBI demonstrated that IT officials assisted program  leadership in the planning of the major investment, but could not  demonstrate that the CIO worked with program leadership on both the  major and non-major investment.

In addition, HHS fully demonstrated that the CIO worked with program  leaders in planning IT resources for its major investment. For example,  the CIO reviewed detailed IT resource narratives and line item estimates  for the investment at a department-level governance board meeting with  program leadership. However, HHS could not demonstrate that the CIO  worked with program leadership to plan the non-major investment. At the  component-level, CMS partially demonstrated that the CIO took such  actions to plan the component-level investments. Specifically, the CIO at  CMS worked with program officials to review and approve detailed IT  resource requests for the investments. However, HHS could not  demonstrate that its CIO was also involved in planning IT resources with  program leadership for the same investments, as required by the  department’s policy. Officials in the Office of the CMS CIO stated that  they believed that the CMS CIO was an authorized delegate for this  responsibility. However, the officials could not provide documentation of  the delegation as required by OMB.

Further, Treasury could not demonstrate that the CIO had worked with  program leadership in planning IT resources for the department-level  investments. According to officials in the Office of the CIO, they could not  demonstrate the actions the CIO took to work with program leadership  because documentation that would show the interaction was not retained.  The officials stated that documentation was not retained due to turnover  within the program offices responsible for the investments. At the  component-level, IRS partially demonstrated that the CIO took action to  work with program leadership for a portion of the component-level  investments’ budget through IT budget reviews. However, IRS could not  demonstrate coordination with program leadership for the full amount of  the investments’ budget because the agency did not maintain a document  trail for lower-level budgeting activities that included all relevant resource  planning for the investments.

Lastly, DOE could not fully demonstrate that the CIO had worked with  program leadership in planning IT resources across all four investments  at the department and component. DOE could not demonstrate this, in  part, because the Office of the CIO’s internal process, during the  formulation of the fiscal year 2017 budget, did not require input from all  relevant stakeholders, including senior leadership, directors, and program  managers. Officials in DOE’s Office of the CIO acknowledged the gap in  its process and stated that the department and its component agency— NNSA—are working to establish processes that include senior  management and program officials in the planning process. As of May  2018, DOE did not have a time frame for establishing these processes.

The lack of consistent partnership of program leaders and the CIO to plan  an investment’s IT resources at the department and component levels  limits the ability of the CIO to have a significant role in the formulation of  the department’s IT budget.

The CIO Reviews Whether the Investment’s IT Resources Support Major Program Objectives and Have Increased or Decreased Significantly

The selected departments varied in the extent to which they could  demonstrate that the CIO had appropriately reviewed all the investments  we sampled. For example, DOJ demonstrated that the CIO reviewed  whether the IT resources for the department- and component-level  investments supported major program objectives and whether there were  increases and decreases in IT resources for the investments.

In addition, HHS partially addressed the requirement for its  component-level investments. Specifically, while the component-level CIO  at CMS reviewed changes in the investments’ resources, supporting  documentation did not show that alignment with major program objectives  was reviewed.

Further, Treasury and DOE could not demonstrate that their CIOs  reviewed whether the investment’s IT resources support major program  objectives and any significant increases or decreases in resources for  their department-level investments. According to officials in the offices of  the CIO at Treasury and DOE, relevant documentation that would have  demonstrated review activities had not been maintained for the  investments. Until DOE, HHS, and Treasury can consistently demonstrate  that the CIO has reviewed whether each investment’s IT resources  support major program objectives and have increased or decreased  significantly, the departments will have less assurance that the IT budget  request supports their goals and objectives and that significant changes  in the budget are appropriate.

The CIO Reviews Whether the Investment’s Estimates of IT Resources in the Portfolio and Budget Request Are Appropriate

The selected departments varied in the extent to which they could  demonstrate that the CIO took steps to review whether the investment’s  estimates of IT resources in the portfolio and budget request were  appropriate.

For example, the CIO for DOE’s component agency—NNSA— demonstrated the review and approval of the non-major investment’s  estimates of IT resources. However, NNSA could not demonstrate that  the CIO reviewed the estimates for the major investment because it did  not retain documentation that would provide details on the investment’s  budget formulation and approval.

In addition, HHS’s component agency—CMS—partially demonstrated  implementation of the requirement on the major investment. Specifically,  the CIO for CMS reviewed and approved supporting documentation for  the investment’s detailed resource estimates totaling more than $500  million in developing the fiscal year 2017 budget request. However, the  fiscal year 2017 budget request for this investment was $399 million, and  according to officials in the CMS Office of the CIO, the CMS CIO did not  review and approve the lowered estimate—ensuring the IT portfolio  reflected an appropriate estimate.

According to CMS officials in the Office of the CIO, the lowered estimate  was the result of the user fees portion of the investment being removed  from the request before it was submitted to OMB because it was not  funded by annual appropriations. However, OMB’s fiscal year 2017 IT  capital planning guidance required departments to report all budgetary  sources of funding for each investment, including amounts available for  obligation through collection of fees, as well as annual appropriations.

Further, Treasury could not demonstrate that the CIO had reviewed the  resource estimates for the department-level investments. At the  component level, IRS demonstrated that officials in the Office of the CIO  reviewed supporting documentation for detailed cost estimates for the  component-level investments. However, these cost estimates only  accounted for a portion, and not the full amount, of the investment.

Finally, DOJ could not demonstrate that the component agency CIO  ensured that the IT portfolio included appropriate estimates of all IT  resources for the non-major investment at the component level. While  officials in the FBI’s Office of the CIO stated that the component’s CIO  was involved in reviewing detailed resource estimates for the investment  prior to its submission to the department-level CIO, they could not provide  supporting documentation because the FBI had not established  procedures that explicitly required documenting the performance of this  activity. Until the CIOs at DOE, HHS, Treasury, and DOJ consistently  review IT resource estimates for each investment, departments will have  less assurance that the estimates in the budget request are appropriate.

Departments Lacked Processes for Ensuring That Their IT Budgets Are Informed by Reliable Costs; the Administration Has Introduced an Initiative to Improve Cost Visibility

GAO and international standards recommend certain quality assurance  practices that can assist departments in developing an IT budget that is  informed by reliable cost information. These practices include, among  others: (1) ensuring government labor costs have been accurately  reported for all investments, (2) aligning contract costs with the  investments, and (3) utilizing budget object class data to capture all IT  programs. Further, having documented IT capital planning processes to  implement these practices is important because OMB requires  department CIOs to fully account for and report on planned expenditures  in their annual IT budget requests.

All of the four selected departments—DOE, HHS, DOJ, and Treasury— lacked quality assurance processes to ensure government labor costs  have been accurately reported, align contract costs with IT investments,  and utilize budget data to capture all IT programs. However, OMB’s fiscal  year 2019 IT capital planning guidance introduced several major changes  to the budgeting process which, if effectively implemented, should provide  departments and CIOs with enhanced visibility into IT costs across the  portfolio and additional assurance that the budget is being informed by all  relevant IT costs.

The Administration’s Efforts to Revise IT Budget Reporting Could Provide Department CIOs Additional Visibility into IT Spending

OMB’s fiscal year 2019 IT capital planning guidance, released in August  2017, introduced several major changes to the federal IT budgeting  process, including the practice of using a set of low-level cost categories  to group spending. Subsequently, the President’s Management Agenda,  released in March 2018, identified “improving outcomes through federal  IT spending transparency” as one of the Administration’s 14 cross-agency  priority goals.

According to the President’s Management Agenda, the Administration  intends to accomplish the cross-agency priority goal related to improving  federal IT spending transparency by, among other things, increasing the  granularity in IT budget reporting by utilizing a set of cost categories from  OMB’s capital planning guidance. Figure 3 identifies the standard cost  categories that OMB plans to implement in IT budget reporting.

In its fiscal year 2019 IT capital planning guidance, OMB has recognized  potential value in utilizing budget object classes, or similar financial data,  to provide CIOs and Chief Financial Officers additional visibility into costs  that inform the budget. As noted in the guidance, OMB expects that this  new approach for utilizing financial data to inform the IT investment  portfolio will enable the reconciliation of this portfolio with the  department’s budget submitted by the Chief Financial Officer. Further,  this effort is to help CIOs work more closely and in partnership with the  Chief Financial Officers by using budget object classes and sub-object  classes as a way to reconcile different presentations of estimated costs.  In addition, OMB’s guidance stated that departments should begin to  identify where they lack capabilities or resources to deliver financial data  for the new low-level IT cost categories (shown in figure 3), consider what  changes are necessary to achieve the new reporting requirements, and  take steps to align reporting with the categories.

Moreover, the President’s Management Agenda stated that the changes  to how IT spending is to be categorized were made, in part, because  federal executives have long known that they could better manage the  more than $90 billion in federal government IT spending with increased  visibility and more accurate data. The President’s Management Agenda  action plan identified several milestones and due dates for accomplishing  the goal of improving federal IT spending transparency, such as  determining data sources necessary for departments to report within the  low-level cost categories and establishing the common tools and services  for the required reporting by June 2019. Moreover, the action plan stated  that federal departments are expected to report all of the spending within  their IT portfolio against the cost categories by September 2019. Given  that improving federal IT spending transparency has been identified as  one of the President’s top 14 management priorities and is critical to  enabling department CIOs in carrying out their IT budgeting authorities  from FITARA, it is important that OMB and departments take action now  in order to meet the 2019 reporting requirements.

The Administration’s approach for obtaining additional granularity on  department IT investment spending, when implemented, should provide  departments and CIOs enhanced visibility into IT costs across the  portfolio. If implemented effectively, this approach could also provide  departments additional assurance that their budgets are being informed  by relevant IT costs.

Recognizing the importance of CIOs’ ability to be responsible for IT  budgeting, OMB’s common baseline includes eight requirements that  departments’ policies and procedures should address to implement  FITARA. While the four selected departments in our review either fully or  partially addressed the majority of the requirements, none fully addressed  all of them. The lack of policies and procedures was due, in part, to the  fact that departments had not adequately addressed all of the required  common baseline requirements in their FITARA implementation and  delegation plans, as directed by OMB. Until the departments establish  policies and procedures that address all requirements, they risk  inconsistently applying requirements that are key to providing their CIOs  visibility into resources, input to resource plans, and meaningful review  and approval of IT budgets.

In addition, the lack of policies and procedures has hampered the  departments’ ability to demonstrate their implementation of the common  baseline requirements for their investments. While DOJ fully  demonstrated implementation for the selected requirements for the  majority of the investments we sampled, HHS and Treasury partially  demonstrated implementation for a majority of their investments, and  DOE had not demonstrated implementation for the majority of its  investments. As a result, departments were not always able to show that  these CIOs had adequate input to resource plans and review of their IT  budgets. Without retaining supporting documentation to show how  common baseline requirements have been addressed on individual  investments, the departments will be challenged in consistently  demonstrating that CIOs are sufficiently involved in planning and  budgeting annual IT expenditures.

Finally, the four selected departments lacked quality assurance  processes for ensuring their IT budgets are informed by reliable cost  information. This resulted in billions of dollars that were requested without  departments having comprehensive information to support those  requests. Among other things, this was due to a lack of processes for  periodically reviewing data quality and estimation methods for  government labor estimates, as well as a lack of processes to cross-walk  IT spending data in their procurement and accounting systems with  investment data in their IT portfolio management systems.

The Administration’s new approach of using a standard set of low-level  cost categories to group IT spending could help departments address  their lack of processes if properly implemented. It is important that OMB  and departments meet the 2019 milestone dates associated with this  approach so that department CIOs have additional transparency into IT  spending and can make informed budget decisions. Nonetheless,  departments will continue to have limited insight into IT budgeting until  they capture all relevant IT costs in their budgets.

We are making a total of 43 recommendations, including 9 to DOE, 6 to  NNSA, 10 to HHS, 4 to CMS, 4 to DOJ, 1 to FBI, 8 to Treasury, and 1 to  IRS.

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  establish department-wide policy for the level of detail of planned  expenditure reporting to the CIO for all transactions that include IT  resources. (Recommendation 1)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  include the CIO in the planning and budgeting stages for all programs that  are fully or partially supported with IT resources. (Recommendation 2)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  include the CIO as a member of governance boards that inform decisions  regarding all IT resources, including component-level boards.  (Recommendation 3)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  document the processes by which program leadership works with the CIO  to plan an overall portfolio of IT resources. (Recommendation 4)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  document the process for the CIO’s review and approval of the major IT  investments portion of the budget request. (Recommendation 5)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  document the CIO’s role in reviewing IT resources that are to support  major program objectives and significant increases and decreases in IT  resources. (Recommendation 6)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, address gaps in the department’s FITARA  plans by developing and implementing policies and procedures that  document the steps the CIO is to take to ensure whether the IT portfolio  includes appropriate estimates of all IT resources included in the budget  request. (Recommendation 7)

The Secretary of Energy should direct the Office of the CIO and other  offices, as appropriate, to take steps to ensure that the actions taken to  comply with OMB’s common baseline for implementing FITARA on  individual investments are adequately documented. (Recommendation 8)

The Secretary of Energy should ensure that the Office of the CIO and  other offices, as appropriate, establish quality assurance processes— such as data quality checks, reviews of estimation methods, linkages  between the IT portfolio and procurement system data, and linkages  between the IT portfolio and financial system data—for ensuring the  annual IT budget is informed by complete and reliable information on  anticipated government labor, contract, and other relevant IT  expenditures. (Recommendation 9)

The Administrator of NNSA should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that establish agency-wide policy for the level of detail with  which planned expenditures for all transactions that include IT resources  are to be reported to the CIO. (Recommendation 10)

The Administrator of NNSA should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that include the CIO in the planning and budgeting stages for  all programs that are fully or partially supported with IT resources.  (Recommendation 11)

The Administrator of NNSA should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that include the CIO as a member of governance boards that  inform decisions regarding all IT resources. (Recommendation 12)

The Administrator of NNSA should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that document the process for the CIO’s review and approval  of the major IT investments portion of the budget request.  (Recommendation 13)

The Administrator of NNSA should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that document the CIO’s role in reviewing IT resources that  are to support major program objectives and significant increases and  decreases in IT resources. (Recommendation 14)

The Administrator of NNSA should direct the Office of the CIO and other  offices, as appropriate, to take steps to ensure that the actions taken to  comply with OMB’s common baseline for implementing FITARA on  individual investments are adequately documented. (Recommendation  15)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that establish department-wide policy for the level of detail of  planned expenditure reporting to the CIO for all transactions that include  IT resources. (Recommendation 16)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that include the CIO in the planning and budgeting stages for  all programs that are fully or partially supported with IT resources.  (Recommendation 17)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that include the CIO as a member of governance boards that  inform decisions regarding all IT resources, including component-level  boards. (Recommendation 18)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that document the processes by which program leadership  works with the CIO to plan an overall portfolio of IT resources.  (Recommendation 19)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that document the process for the CIO’s review and approval  of the major IT investments portion of the budget request.  (Recommendation 20)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that document the CIO’s role in reviewing IT resources that  are to support major program objectives and significant increases and  decreases in IT resources. (Recommendation 21)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, address gaps in the  department’s FITARA plans by developing and implementing policies and  procedures that document the steps the CIO is to take to ensure whether  the IT portfolio includes appropriate estimates of all IT resources included  in the budget request. (Recommendation 22)

The Secretary of Health and Human Services should direct the  department CIO to establish, for any OMB common baseline  requirements that are related to IT budgeting that have been delegated, a  plan that specifies the requirement being delegated, demonstrates how  the CIO intends to retain accountability for the requirement, and ensures  through quality assurance processes that the delegated official will  execute such responsibilities with the appropriate level of rigor.  (Recommendation 23)

The Secretary of Health and Human Services should direct the Office of  the CIO and other offices, as appropriate, to take steps to ensure that the  actions taken to comply with OMB’s common baseline for implementing  FITARA on individual investments are adequately documented.  (Recommendation 24)

The Secretary of Health and Human Services should ensure that the  Office of the CIO and other offices, as appropriate, establish quality  assurance processes—such as data quality checks, reviews of estimation  methods, linkages between the IT portfolio and procurement system data,  and linkages between the IT portfolio and financial system data—for  ensuring the annual IT budget is informed by complete and reliable  information on anticipated government labor, contract, and other relevant  IT expenditures. (Recommendation 25)

The Administrator of CMS should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that include the CIO in the planning and budgeting stages for  all programs that are fully or partially supported with IT resources.  (Recommendation 26)

The Administrator of CMS should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that document the processes by which program leadership  works with the CIO to plan an overall portfolio of IT resources.  (Recommendation 27)

The Administrator of CMS should ensure that the Office of the CIO and  other offices, as appropriate, develop and implement policies and  procedures that document the CIO’s role in reviewing IT resources that  are to support major program objectives and significant increases and  decreases in IT resources. (Recommendation 28)

The Administrator of CMS should direct the Office of the CIO and other  offices, as appropriate, to take steps to ensure that the actions taken to  comply with OMB’s common baseline for implementing FITARA on  individual investments are adequately documented. (Recommendation  29)

The Attorney General should ensure that the Office of the CIO and other  offices, as appropriate, address gaps in the department’s FITARA plans  by developing and implementing policies and procedures that establish  department-wide policy for the level of detail of planned expenditure  reporting to the CIO for all transactions that include IT resources.  (Recommendation 30)

The Attorney General should ensure that the Office of the CIO and other  offices, as appropriate, address gaps in the department’s FITARA plans  by developing and implementing policies and procedures that include the  CIO as a member of governance boards that inform decisions regarding  all IT resources, including component-level boards. (Recommendation  31)

The Attorney General should ensure that the Office of the CIO and other  offices, as appropriate, address gaps in the department’s FITARA plans  by developing and implementing policies and procedures that document  the steps the CIO is to take to ensure whether the IT portfolio includes  appropriate estimates of all IT resources included in the budget request.  (Recommendation 32)

The Attorney General should ensure that the Office of the CIO and other  offices, as appropriate, establish quality assurance processes—such as  data quality checks, reviews of estimation methods, linkages between the  IT portfolio and procurement system data, and linkages between the IT  portfolio and financial system data—for ensuring the annual IT budget is  informed by complete and reliable information on anticipated government  labor, contract, and other relevant IT expenditures. (Recommendation 33)

The FBI Director should direct the Office of the CIO and other offices, as  appropriate, to take steps to ensure that the actions taken to comply with  OMB’s common baseline for implementing FITARA on individual  investments are adequately documented. (Recommendation 34)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, address gaps in the department’s  FITARA plans by developing and implementing policies and procedures  that establish department-wide policy for the level of detail of planned  expenditure reporting to the CIO for all transactions that include IT  resources. (Recommendation 35)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, address gaps in the department’s  FITARA plans by developing and implementing policies and procedures  that include the CIO in the planning and budgeting stages for all programs  that are fully or partially supported with IT resources. (Recommendation  36)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, address gaps in the department’s  FITARA plans by developing and implementing policies and procedures  that include the CIO as a member of governance boards that inform  decisions regarding all IT resources, including component-level boards.  (Recommendation 37)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, address gaps in the department’s  FITARA plans by developing and implementing policies and procedures  that document the process for the CIO’s review and approval of the major  IT investments portion of the budget request. (Recommendation 38)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, address gaps in the department’s  FITARA plans by developing and implementing policies and procedures  that document the steps the CIO is to take to ensure whether the IT  portfolio includes appropriate estimates of all IT resources included in the  budget request. (Recommendation 39)

The Secretary of the Treasury should direct the department CIO to  establish, for any OMB common baseline requirements that are related to  IT budgeting that have been delegated, a plan that specifies the  requirement being delegated, demonstrates how the CIO intends to retain  accountability for the requirement, and ensures through quality assurance  processes that the delegated official will execute such responsibilities with  the appropriate level of rigor. (Recommendation 40)

The Secretary of the Treasury should direct the Office of the CIO and  other offices, as appropriate, to take steps to ensure that the actions  taken to comply with OMB’s common baseline for implementing FITARA  on individual investments are adequately documented. (Recommendation  41)

The Secretary of the Treasury should ensure that the Office of the CIO  and other offices, as appropriate, establish quality assurance  processes—such as data quality checks, reviews of estimation methods,  linkages between the IT portfolio and procurement system data, and  linkages between the IT portfolio and financial system data—for ensuring  the annual IT budget is informed by complete and reliable information on  anticipated government labor, contract, and other relevant IT  expenditures. (Recommendation 42)

The IRS Commissioner should direct the Office of the CIO and other  offices, as appropriate, to take steps to ensure that the actions taken to  comply with OMB’s common baseline for implementing FITARA on  individual investments are adequately documented. (Recommendation  43)

We provided a draft of this report to the four departments and four  component agencies included in our review, as well as to OMB. In  response, we received comments from two departments and three  component agencies (HHS, CMS, DOJ, FBI, and IRS) which agreed with  our recommendations. One department (DOE) partially agreed with one  recommendation and agreed with the other recommendations made to it,  as well as with the recommendations made to its component agency  (NNSA). In addition, one department (Treasury) neither agreed nor  disagreed with the recommendations. Further, OMB provided technical  comments, which we incorporated in the report, as appropriate.

The following departments and component agencies agreed with all of the  recommendations that we directed to them:

HHS provided written comments, reprinted in appendix VI, stating that  it concurred with the 10 recommendations made to the department,  and with the 4 recommendations made to CMS. Of the  recommendations made to the department, HHS stated that the  processes it currently has in place address the various gaps in the  department’s FITARA plans, documentation, and quality assurance  processes. However, HHS did not provide additional evidence to  demonstrate that the weaknesses we identified have been mitigated.  Thus, we maintain that the department needs to take further actions to  address our recommendations. Until it takes the appropriate actions to  address gaps in its FITARA plans, document the actions taken to  comply with OMB’s guidance, and implement key quality assurance  processes, the department will be at increased risk that its CIO is not  effectively engaged in IT budgeting decisions.

With regard to its component agency, HHS stated that CMS would  take action to implement the recommendations made to it by updating  the relevant policies and procedures to more explicitly identify the role  of the CIO in developing the IT budget.

In comments provided via email on September 27, 2018, an audit  liaison in the Internal Review and Evaluation Office of the Justice  Management Division stated that DOJ concurred with the four  recommendations made to the department, and with the one  recommendation made to FBI.

IRS provided written comments, reprinted in appendix VII, stating that  it concurred with our recommendation, has taken steps to begin  implementing our recommendation, and is committed to making  further progress toward fully implementing all OMB requirements  when planning and budgeting for its individual investments.

DOE provided written comments, reprinted in appendix VIII, in which it  concurred with eight of the nine recommendations made to the  department and partially concurred with one recommendation. The  department also concurred with all six recommendations made to NNSA.

Of the nine recommendations made to DOE, the department stated that it  already had processes in place, or had taken action to address six of the  recommendations, including the recommendation with which it partially  concurred. However, the department did not provide sufficient evidence to  demonstrate that the weaknesses we identified had been mitigated. Thus,  we maintain that the recommendations warrant further actions. Until DOE  takes the appropriate actions to address gaps in its FITARA plans,  document the actions taken to comply with OMB’s guidance, and  implement key quality assurance processes, the department will be at  increased risk that the CIO is not effectively engaged in IT budgeting  decisions.

In addition, DOE stated that NNSA’s Office of the CIO plans to develop  policies and procedures—in collaboration with the component agency’s  Office of Acquisition and Project Management and the agency’s Office of  Management and Budget—that should address the findings and six  recommendations made to NNSA. The department anticipates that the  policies and procedures will be finalized by March 31, 2019.

Lastly, Treasury responded via email on September 28, 2018, but did not  state whether it agreed or disagreed with our eight recommendations.  Specifically, an audit liaison in Treasury’s Office of the CIO stated that the  department believes it is implementing most of the OMB common  baseline requirements in practice, but agreed that gaps exist in its policies  and documentation. The official added that the department had started  work on strengthening existing policies and procedures or developing  new ones to close the gaps uncovered by our review.

We are sending copies of this report to the appropriate congressional  requesters; OMB; the Secretaries of the Departments of Energy, Health  and Human Services, and the Treasury; the Attorney General; the  Administrator of NNSA, the Administrator of CMS, the FBI Director, and  the IRS Commissioner. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-4456 or at harriscc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IX.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which selected federal  agencies (1) established policies and procedures in place that address  the information technology (IT) budgeting requirements of the Federal  Information Technology Acquisition Reform Act (FITARA) and related  Office of Management and Budget (OMB) IT budget guidance, (2) could  demonstrate that they had developed fiscal year 2017 IT budgets for  sampled investments consistent with FITARA and OMB guidance, and  (3) implemented processes to ensure that annual IT budgets are informed  by reliable cost information.

To address our objectives, we first identified the subset of the 24  agencies covered by the Chief Financial Officers Act that had a fiscal year  2017 IT budget request of at least $1 billion. From this subset, we then  identified the four agencies having the two highest and the two lowest  average initial FITARA self-assessment scores, which included an  assessment of OMB’s common baseline for IT management (common  baseline). In the event that one or more agencies had the same average  self-assessment scores, we selected the agency with the largest fiscal  year 2017 IT budget. Based on these criteria, we selected four  departments for our review: (1) the Department of Energy (DOE), (2) the  Department of Health and Human Services (HHS), (3) the Department of  Justice (DOJ), and (4) the Department of the Treasury (Treasury).

In addition, for each of these four departments, we selected their  component agencies that had the largest fiscal year 2017 IT budget  request. The components within the four selected departments were:  (1) the National Nuclear Security Administration (NNSA) within DOE,  (2) the Centers for Medicare and Medicaid Services (CMS) within HHS,  (3) the Federal Bureau of Investigation (FBI) within DOJ, and (4) the  Internal Revenue Service (IRS) within Treasury.

For the first objective, we compared the selected departments’ policies  and procedures to requirements selected from OMB’s FITARA guidance  (referred to as the common baseline) that related to developing  departments’ IT budgets. In selecting the requirements, we reviewed 10  areas related to budget formulation and execution within OMB’s common  baseline, and used professional judgment to select 8 requirements that  we believed would significantly impact the development and approval of  departments’ annual IT budgets. In doing so, we excluded one  requirement that affected the development of annual IT budgets to a  lesser extent and combined one requirement that was similar to another.  Specifically, we excluded the requirement from the area related to the  chief information officer’s (CIO) role in program management because the  CIO’s review of program management artifacts could not be directly  related to the IT budget review and approval process.

In addition, two common baseline areas had a similar requirement that  the CIO be involved in the internal planning of IT resources prior to the  budget submission. We combined these into one requirement for our  review. We consulted with OMB officials in the Office of the Federal CIO  on the requirements that we selected and how we planned to evaluate  them and the officials agreed with our approach.

The eight OMB common baseline requirements within budget formulation  and execution that we identified and selected are: establish the level of detail with which IT resources are to be  described in order to inform the CIO during the planning and  budgeting processes; establish agency-wide policy for the level of detail with which planned  expenditures for all transactions that include IT resources are to be  reported to the CIO;  include the CIO in the planning and budgeting stages for programs  that are fully or partially supported with IT resources;  include the CIO as a member of governance boards that inform  decisions regarding all IT resources, including component-level  governance boards; document the processes by which program leadership works with the  CIO to plan an overall portfolio of IT resources; ensure the CIO has reviewed and approved the major IT investments  portion of the budget request; ensure the CIO has reviewed IT resources that are to support major  program objectives and significant increases and decreases in IT  resources; and ensure the CIO has reviewed whether the IT portfolio includes  appropriate estimates of all IT resources included in the budget  request.

After determining the eight requirements that we would review, we  categorized them into three areas: CIO visibility into IT resources, CIO  input to IT resource plans, and CIO review and approval of IT budgets.

We then reviewed the current policies and procedures that each  department had documented for its IT budgeting process to determine  whether the department documented a process for how they would  address each of the eight common baseline requirements we selected for  review. In addition to policies and procedures, we also reviewed each  department’s FITARA implementation plan, which included a description  of the steps the department must take to ensure that all FITARA and  OMB requirements would be implemented; and the delegation  memorandums from department CIOs, in which formal assignments of  responsibilities to other department officials are documented, where  applicable.

In cases where the department CIO fully or partially delegated  responsibilities to component officials, we requested relevant  documentation from the agency component with the largest fiscal year  2017 IT budget request. In such cases, we based our determination of  departments’ implementation of the requirement on (1) the extent to  which the component agency had documented policies and procedures  that carried out the delegated requirement and (2) the extent to which the  department CIO had procedures for ensuring the delegation was being  carried out by the components.

With regard to our second objective, we determined whether the selected  departments had implemented key IT budgeting requirements for a  non-generalizable sample of investments in their fiscal year 2017 budget  formulation. In doing so, we chose 16 investments—the largest major and  non-major investments at the department level and the largest major and  non-major investments at the component level—based on the selected  departments’ fiscal year 2017 IT budget request. Although the  information obtained is not generalizable to all of the departments’  investments, the sample provided a range of examples and conditions  under which the departments were implementing requirements found in  OMB’s common baseline.

We then identified a subset of requirements from the eight department  requirements for developing IT budgets found in OMB’s common baseline  for which implementation could be observed at the investment level. In  doing so, we used professional judgment to select the subset of  requirements where actions taken to implement these requirements could  be observed for individual investments. Specifically, we did not select the  requirement to establish agency-wide policy for the level of detail with  which planned expenditures for all transactions that include IT resources  are to be reported to the CIO, because the requirement primarily applied  to enterprise-wide policymaking and reporting. Also, we did not select the  requirement to include the CIO as a member of governance boards that  inform decisions regarding all IT resources for review on individual  investments because certain investments may not have been subject to  governance board reviews during fiscal year 2017. In addition, we did not  select the requirement to ensure the CIO has reviewed and approved the  major IT investments portion of the budget request for review on  individual investments because half of the investments we selected were  not classified as major investments.

The five requirements for which we selected and reviewed  implementation at the investment level were:  IT resources for each investment are described in order to inform the  CIO during the planning and budgeting processes;  the CIO is included in the planning and budgeting stages for  investments with IT resources; program leadership works with the CIO to plan the investment’s IT  the CIO reviews whether the investment’s IT resources support major  program objectives and have increased or decreased significantly;  and  the CIO reviews whether the investment’s estimates of IT resources in  the portfolio and budget request are appropriate.

For each investment, if available, we obtained artifacts for the fiscal year  2017 budget submission—such as briefings, reports, meeting minutes,  memorandums, and other relevant documentation showing the CIO’s  involvement in relevant reviews or decisions. We compared this  documentation to relevant OMB requirements for developing the IT  budget at the individual investment level.

To address our third objective, we assessed the selected departments’  efforts to develop their fiscal year 2017 budget with reliable cost  information by comparing the department’s IT capital planning and  budgeting processes against best practices identified by us and the  International Organization for Standardization—such as capturing  government labor costs, aligning contract costs with investments, and  utilizing budget object class data. We selected these three practices  (from among others) because of their potential to inform the development  of a complete and accurate IT budget for a federal department.

Capturing government labor costs. We reviewed each selected  departments’ IT capital planning policies and procedures and  government labor estimates within the 2017 IT budget submission  reported on the Federal IT Dashboard. For each selected department,  we identified the processes by which forecasted government labor  costs are to be captured within investment proposals submitted with  the annual IT budget. We then analyzed each department’s 2017 IT  investment proposals to determine whether the department was  capturing government labor for each investment. In doing so, we  analyzed each selected department’s IT portfolio submitted with its  fiscal year 2017 budget to determine whether the identified  investments had included planned government labor costs, as  required by OMB.

Aligning contract costs with investments. We reviewed each  selected departments’ IT capital planning policies and procedures,  contract-related information within the 2017 IT budget submission  reported on the Federal IT Dashboard, and contract obligation data  reported within the Federal Procurement Data System-Next  Generation. From these document reviews, we identified the  processes by which contract-related costs are to be captured within  investment proposals submitted with the annual IT budget. We then  determined whether departments were able to align current contracts  with 2017 IT investment proposals. In doing so, we identified fiscal  year 2016 contracts that departments reported in the Federal  Procurement Data System-Next Generation that had an IT-related  product or service code and an expected completion date that  extended into fiscal year 2017 or beyond. We then attempted to  match, using the unique procurement identification number for each  contract, a corresponding IT investment for those contracts in  departments’ fiscal year 2017 IT budget data. For contracts that we  could not find a match, or alignment, with investments in departments’  fiscal year 2017 IT budget data, we identified dollars obligated on  those contracts from October 2016 through September 2017.

Utilizing budget object class data. We reviewed each selected  departments’ IT capital planning policies and procedures, budget  object classes that are to help track IT financial transactions, and  OMB’s fiscal year 2019 IT capital planning guidance that calls for  greater use of IT financial data. We then assessed whether  departments’ IT capital planning processes utilized budget object  class information to ensure that relevant IT costs are being captured  as investments for the annual IT budget.

We assessed the reliability of reported government labor costs by  identifying instances in which investments had not included planned  government labor costs and by corroborating those instances with  officials in the departments’ offices of the CIO. We determined that the  data were sufficiently reliable for our purposes. Where we identified data  quality issues in capturing government labor costs for department  investments, we included those in the findings of this report. We also  assessed the reliability of Federal Procurement Data System-Next  Generation data by performing electronic testing of selected data  elements and reviewing existing information about the system and the  data it produces. Specifically, we reviewed the data dictionary, data  validation rules, and the fiscal year 2016 Federal Government  Procurement Data Quality Summary for agency data in the Federal  Procurement Data System-Next Generation. We determined that the data  were sufficiently reliable for our purposes.

We supplemented our review with interviews with officials in the  departments’ offices of the CIO, Chief Financial Officer, and program  offices to include discussions of our observations of any shortfalls in their  processes.

We conducted this performance audit from January 2017 to November  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Department of Energy Detailed Analysis

DOE established department-wide IT capital planning and budgeting  procedures that document the level of detail with which IT resources  are to be described during the planning and budgeting process. The  documented level of detail included OMB’s required reporting on  government labor and certain resources for infrastructure  investments.

This requirement was assigned at the department level.

DOE documented IT capital planning procedures for the level of detail  of planned expenditure reporting. However, the procedures did not  explicitly require that all transactions with an IT component be  included in the expenditure reporting.

DOE’s FITARA implementation plan stated that the NNSA CIO was to  work with the chief financial officer and chief acquisition officer to  update NNSA’s policies to ensure they documented the level of detail  for planned expenditure reporting for all IT transactions. However,  NNSA had not established such policies and procedures.

DOE documented IT capital planning and annual budgeting  procedures that included the CIO in the planning and budgeting  stages for some, but not all programs identified as having IT  resources. Specifically, at the time of our review, the department had  not yet documented procedures for ensuring the CIO was included in  budget decisions for all programs with IT resources, including those  within NNSA and national laboratories.

According to DOE’s FITARA implementation plan and a  memorandum from the Secretary providing further instructions on  FITARA, NNSA was to provide an opportunity for the department CIO  to provide input in its planning and budgeting stages for programs  with IT resources and to document related review processes.  However, at the time of our review, NNSA had not yet established the  procedures that were to detail how this process was to be carried out.

DOE developed charters that included the CIO as a member of  department-level IT governance boards, but had not included the CIO  as a member of component-level IT investment review boards.

According to DOE’s FITARA implementation plan, NNSA was to allow  the DOE CIO to provide input into NNSA acquisition decisions  through its IT investment review board. However, at the time of our  review, NNSA had not yet finalized its investment review board  charter and related procedures to include the DOE CIO.

DOE documented IT governance board procedures by which the CIO  is to work with program leadership in planning IT resources for some,  but not all of the programs subject to department-level governance  board reviews. Specifically, at the time of our review, the department  had not yet documented procedures by which the CIO was to work  with program leadership in planning IT resources within NNSA and  national laboratories, including high-performance computing efforts.

DOE documented IT capital planning and governance board  procedures for its CIO to review and approve some, but not all of its  major IT investments. Specifically, at the time of our review, the  department had not yet documented procedures for the CIO to review  major investments within NNSA and national laboratories, including  high-performance computing efforts.

According to DOE’s FITARA implementation plan, the NNSA CIO  was to review and approve NNSA major IT investments and provide  the DOE CIO an opportunity to review and provide input prior to the  final decision. However, at the time of our review, procedures to do  so had not yet been established.

At the time of our review, DOE had not yet documented procedures  for reviewing IT resources that are to support major program  objectives and significant increases and decreases in IT resources for  other department and component agency budget requests. DOE  delegated the responsibility to meet this requirement to NNSA for  their programs.

According to DOE’s FITARA implementation plan, the NNSA CIO  was to review and approve NNSA major IT investments and provide  the DOE CIO an opportunity to review and provide input prior to the  final decision. However, at the time of our review, procedures to do  so had not yet been established. In addition, NNSA had not  documented procedures by which the NNSA CIO was to review IT  resources that are to support major program objectives as well as  significant increases and decreases in IT resources.

DOE had not documented procedures for this requirement.

This requirement was assigned at the department level.  ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common  ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the  ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB  common baseline requirement.  N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

GAO’s assessment  NNSA could not demonstrate that the CIO reviewed the investment’s  alignment with major program objectives or changes in resources.

The CIO reviewed IT resources that are to support major program  objectives through business case materials that described the goals  that the investment supported. In addition, the CIO reviewed decreases  in the annual resource requirements by reviewing acquisition planning  artifacts that included the investment’s cost estimate details.

DOE could not demonstrate that the CIO reviewed the appropriateness  of IT resource estimates underlying the investment’s budget request.

NNSA could not demonstrate that the CIO reviewed the  appropriateness of IT resource estimates underlying the investment’s  budget request.

The NNSA CIO took steps to ensure the appropriateness of IT resource  estimates included in the investment’s budget request by reviewing  acquisition planning artifacts that included details on the fiscal year  2017 cost estimates.  ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment.  ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the  ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

This requirement was assigned at the department level.

HHS documented IT capital planning procedures for the level of detail of  planned expenditure reporting. However, the procedures had not explicitly  required that all transactions with an IT component are included in the  expenditure reporting.

HHS documented IT capital planning procedures for including the CIO in  the planning and budgeting stages for new programs with IT resources that  are greater than or equal to $20 million annually. However, at the time of  our review, the department had not documented procedures for ensuring  the CIO was included in the budget decisions for existing programs with IT  resources that are greater than or equal to $20 million annually or for other  programs that may have IT resources, such as those that are not primarily  IT-oriented. The HHS CIO delegated the responsibility for carrying out this  requirement to component CIOs for investments less than $20 million  annually. However, HHS had not established procedures for ensuring its  components were carrying out this responsibility.

CMS documented annual IT budget instructions and governance board  procedures for the component CIO’s involvement in the planning and  budgeting stages for major investments less than $20 million annually.  However, CMS had not documented procedures for how the CIO was to be  involved in budgeting decisions for non-major investments.

HHS developed charters that included the CIO on department-level  governance boards that inform decisions regarding IT resources, such as  the HHS Domain IT Steering Committee and the Chief Technology Officer  Council. However, the HHS CIO was not a member of the Service and  Supply Fund board—which reviews and approves operations and common  service spending across the department—and other component-level IT  investment review boards at CMS. The HHS CIO delegated the  responsibility for carrying out this requirement to CMS’s CIO for  investments less than $20 million annually. However, HHS had not  established procedures for ensuring components were carrying out this  responsibility.

Selected OMB common baseline requirements

CMS included its CIO as a member of the IT investment review board to  oversee investments that are less than $20 million annually, consistent with  the delegation from the HHS CIO.

HHS documented IT capital planning and governance board procedures by  which the CIO is to work with program leadership to plan IT resources for  new investments greater than or equal to $20 million annually. However,  the department had not established procedures by which the CIO is to work  with program leadership in planning resources for existing investments  greater than or equal to $20 million annually. HHS’s CIO delegated the  responsibility of reviewing and approving IT investments to components for  investments less than $20 million annually. However, HHS had not  established procedures for ensuring its components were carrying out this  responsibility.

CMS documented the procedures by which program leadership was to  work with the CMS CIO to plan IT resources for selected major and non- major investments through its IT investment review board. However, CMS  had not established procedures for how the CIO was to work directly with  program leadership on non-major IT investments that are not subject to the  IT investment review board.

HHS documented IT capital planning and governance board procedures by  which the CIO is to review and approve new major IT investments greater  than or equal to $20 million annually. However, the department had not  established procedures by which the CIO was to review and approve other  major IT investments, including major investments greater than or equal to  $20 million annually that are not new investments. The HHS CIO delegated  the responsibility of the requirement to review and approve major  investments between $10 million and $20 million annually to its component  CIOs. However, at the time of our review, HHS had not established  procedures for ensuring its components carried out the responsibility.

CMS documented procedures for its CIO to review and approve major IT  investments that are between $10 million and $20 million annually through  its IT capital planning and governance board procedures, consistent with its  delegation from the HHS CIO.

HHS had not documented procedures for the CIO’s review of significant  increases and decreases in IT resources. In addition, the HHS CIO  delegated the responsibility for the requirement to review IT resources that  are to support major program objectives to component-level CIOs for  investments less than $20 million annually. However, HHS had not  established procedures for ensuring its components carried out the  responsibility.

CMS had not documented procedures for how the component was to  review IT resources that are to support major program objectives,  consistent with its delegated responsibility by the HHS CIO.

HHS has not documented procedures for this requirement.

This requirement was assigned at the department level.  ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common  ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the  ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB  N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

The HHS CIO was included in the planning and budgeting stages of the  sampled investment by reviewing the IT resources through budget  analysis meetings with the program office and department-level  governance board. However, the review board only discussed nearly  $15.8 million of the $33 million in total IT resources for the investment that  was reported to OMB, and HHS officials could not demonstrate that the  CIO was involved in the planning and budgeting stages for the remaining  portion of the budget request.

HHS could not demonstrate that the CIO was involved in the planning and  budgeting stages for the sampled investment’s IT resources.

The CMS CIO was included in the planning and budgeting stages for the  sampled investment by reviewing and approving the investment’s budget  request. However, HHS could not demonstrate that the department-level  CIO was involved in the budgeting process for the investment’s IT  resources through governance board reviews, as required by HHS policy.  In addition, HHS could not demonstrate that the responsibility for this  requirement had been delegated to the CMS CIO for the fiscal year 2017  budget request.

The CMS CIO was included in the planning and budgeting stages for the  sampled investment by reviewing the investment’s budget. However, HHS  could not demonstrate that the department-level CIO was involved in the  budgeting process for the investment’s IT resources through governance  board reviews, as required by HHS policy. In addition, HHS could not  demonstrate that the responsibility for this requirement had been  delegated to the CMS CIO for the fiscal year 2017 budget request.

HHS demonstrated that the CIO worked with program leadership to plan  the investment’s IT resources through a department-level governance  board meeting with program leadership, a briefing with the program office,  and direction to investment managers to plan for a different funding  scenario when determining the investment’s IT resource estimate.

HHS could not demonstrate that the CIO worked with program leadership  to plan the sampled investment’s IT resources.

The CMS CIO worked with program leadership to plan the investment’s IT  resources by chairing the CMS IT investment review board that approved  the investment’s funding proposal. However, HHS could not demonstrate  that the department-level CIO was involved in the planning process for the  investment’s IT resources as required by HHS policy. In addition, HHS  could not demonstrate that the responsibility for this requirement had  been delegated to the CMS CIO for the fiscal year 2017 budget request.

The CMS CIO worked with program leadership to plan the investment’s IT  resources by chairing the CMS IT investment review board that reviewed  the investment’s funding proposal. However, HHS could not demonstrate  that the department-level CIO was involved in the planning process for the  investment’s IT resources as required by HHS policy. In addition, HHS  could not demonstrate that the responsibility for this requirement had  been delegated to the CMS CIO for the fiscal year 2017 budget request.

Selected OMB common baseline requirements CIO review and approval of IT budgets

The HHS CIO reviewed the investment’s alignment with major program  objectives during an annual operational analysis review in December  2015. However, HHS did not demonstrate that the CIO reviewed the  increase in IT resources for the investment totaling $33 million, more than  double its initial estimate of nearly $15.8 million.

HHS could not demonstrate that the CIO reviewed the investment’s  alignment with major program objectives or changes in resources.

The CMS CIO reviewed changes in resources identified within individual  activity funding requests related to the investment. However, CMS could  not demonstrate that the CIO reviewed the investment’s alignment with  major program objectives. In addition, HHS could not demonstrate that the  department-level CIO was involved in reviewing changes in IT resources  for the investment. Moreover, HHS could not demonstrate that the  responsibility for reviewing changes in IT resources had been delegated  to the CMS CIO for the fiscal year 2017 budget request.

The HHS CIO took steps to determine the appropriateness of nearly $15.8  million of the IT resource estimates for this investment by reviewing a line  item budget estimate prepared for a department-level governance board.  However, HHS could not demonstrate that the CIO took steps to  determine the appropriateness of the IT resources for the remaining  portion of the investment’s total 2017 budget request of $33 million as  reported to OMB.

HHS could not demonstrate that the CIO or a designee reviewed the  appropriateness of the IT resource estimates underlying the investment’s  2017 budget request.

The CMS CIO took steps to determine the appropriateness of the  investment’s IT resources totaling approximately $500 million by reviewing  the detailed budget request at an IT investment review board meeting.  However, according to the Federal IT Dashboard, the fiscal year 2017  budget request for this investment totaled $399 million, and CMS could  not demonstrate that the CIO took steps to determine the appropriateness  of the revised budget total. In addition, HHS could not demonstrate that  the department-level CIO reviewed the appropriateness of the  investment’s IT resources. Moreover, HHS could not demonstrate that the  responsibility for this requirement had been delegated to the CMS CIO for  the fiscal year 2017 budget request.

The CMS CIO took steps to determine the appropriateness of the  investment’s IT budget request by reviewing the IT resource request  through the investment review board. However, HHS could not  demonstrate that the department-level CIO reviewed the appropriateness  of the investment’s IT resources. In addition, HHS could not demonstrate  that the responsibility for this requirement had been delegated to the CMS  CIO for the fiscal year 2017 budget request.  ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment.  ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the  ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

DOJ established department-wide IT capital planning and  budgeting procedures that document the level of detail with which  IT resources are to be described during the planning and  budgeting process. The documented level of detail went beyond  OMB’s minimum required reporting to include 49 IT resources  across four business areas.

This requirement was assigned at the department level.

DOJ documented IT capital planning procedures for the level of  detail of planned expenditure reporting. However, the procedures  did not explicitly require that all transactions with an IT component  are included in the expenditure reporting.

DOJ documented procedures for including the CIO in the planning  and budgeting stages for programs with IT resources.

DOJ documented governance board charters that included the  CIO as a member of department-level IT governance boards.  However, the CIO was not included a member of key  component-level IT investment review boards, including those at  FBI.

DOJ documented procedures in its IT Governance Guide by  which the CIO is to work with program and component leadership  in planning the overall portfolio of IT resources.

This requirement was assigned at the department-level.

DOJ documented procedures in its IT Governance Guide and  Department Investment Review Council for the CIO to review and  approve major IT investments.

DOJ documented procedures in its IT Governance Guide and IT  capital planning guidance for the CIO to review IT resources that  are to support major program objectives and significant increases  and decreases in resources.

DOJ did not document procedures for this requirement.

This requirement was assigned at the department level.  ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common  ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the  ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB  N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

FBI included the DOJ CIO in the planning and budgeting stages for the  sampled investment through a review of the funding request during an  annual IT portfolio review in October 2015.

DOJ’s CIO collaborated with program leaders in planning IT resources for  the investment through development of the annual operating plan for  DOJ’s working capital fund and through meetings with component  business leadership and meetings with component CIOs.

DOJ’s CIO collaborated with program leaders in planning IT resources for  the investment through development of the annual operating plan for  DOJ’s working capital fund.

While FBI program leadership collaborated with IT representatives from  the Criminal Justice and Information Services Division in planning IT  resources, FBI could not demonstrate that the CIO was involved in the  planning or that the responsibility had been delegated to the division.

FBI could not demonstrate that the CIO worked with program leadership  to plan the sampled investment’s IT resources.

DOJ’s CIO reviewed IT resources that are to support major program  objectives and changes in IT resources through development of the  annual operating plan for DOJ’s working capital fund and in an annual IT  portfolio review in October 2015.

FBI obtained a review from the DOJ CIO regarding IT resources that are  to support major program objectives and significant changes in IT  resources through an annual IT portfolio review in October 2015.

DOJ’s CIO took steps to ensure the investment included appropriate  estimates of IT resources in its budget request by reviewing spreadsheets  with additional and more detailed cost information during an annual IT  portfolio review in October 2015.

While IT representatives within the Criminal Justice and Information  Services Division were involved in validating underlying IT resource  estimates, FBI could not demonstrate that the CIO was involved in the  planning or that the responsibility had been delegated to the division.

FBI could not demonstrate that the CIO or designee reviewed the  appropriateness of IT resource estimates underlying the investment’s  budget request.  ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment.  ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the  ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

This requirement was assigned at the department level.

Treasury documented IT capital planning procedures for reporting  investments’ planned IT expenditures. However, the procedures did not  explicitly require that all transactions with an IT component are included in  the expenditure reporting.

While the department documented procedures for including the CIO in the  planning and budgeting stages for department-level programs that are  identified as having IT resources, it did not document procedures for  ensuring the CIO is included in all department-level programs that may  have IT resources, including those that are not primarily IT-oriented. In  addition, Treasury’s CIO delegated this requirement to component CIOs  for component-level investments. However, the agency had not  established procedures for verifying that components were carrying out  this delegated responsibility.

IRS documented annual IT budgeting procedures for including the IRS  CIO in the component’s planning and budgeting stages for all programs  that have IT resources.

Treasury developed department-level IT governance board charters that  included the CIO as a member. In addition, the Treasury CIO delegated  the responsibility for this requirement to component CIOs for component- level IT governance boards. However, the department had not established  procedures for verifying that components were carrying out this delegated  responsibility.

IRS included its CIO as a member of its IT investment review board  through its documented IT budgeting procedures.

Treasury has documented procedures in its IT capital planning guidance  by which the CIO works with program and component leadership in  planning IT resources.

While Treasury documented procedures in its IT capital planning guidance  for the CIO to review major IT investments with each component, the  department had not documented procedures for how the CIO was to  approve those investments. In addition, the Treasury CIO delegated to  component CIOs the responsibility to develop proposed IT planning and  budgeting artifacts while the Treasury CIO would retain the authority to  approve them. However, the department had not established procedures  for verifying that components were carrying out this delegated  responsibility.

IRS documented annual IT budgeting procedures that described how the  component CIO was to review and approve major IT investments.

Treasury established procedures through its Quarterly Performance  Reviews and its IT capital planning guidance to review IT resources that  are to support major program objectives and significant changes in IT  resources. For example, during the annual Spring portfolio review with  each component, the CIO was to discuss strategic IT changes for the  component and any significant resource changes that have occurred on  individual investments.

Treasury had not documented procedures for ensuring the  appropriateness of IT resource estimates for department-level  investments. In addition, Treasury delegated the responsibility for this  requirement to component CIOs for component-level investments.  However, the department had not established procedures for verifying that  components were carrying out this delegated responsibility.

IRS documented annual IT budgeting procedures for ensuring the  appropriateness of IT resources within the component-level IT portfolio.  The procedures included validating annual IT demand requests that form  the basis of the budget request.  ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common  ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the  ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB  N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

IRS demonstrated that managers from the Office of the CIO  worked with program leadership from IRS business units in  developing a portion of the sampled investment’s budget of $286  million through IT budget reviews conducted by an integrated  review team in July 2015. However, the component agency could  not demonstrate that Office of the CIO officials worked with  program leadership to develop the budget for the full investment  totaling $468 million.

IRS demonstrated that managers from the Office of the CIO  worked with program leadership from IRS business units in  developing a portion of the sampled investment’s budget of $40  million through IT budget reviews conducted by an integrated  review team in July 2015. However, the component agency could  not demonstrate that Office of the CIO officials worked with  program leadership to develop the budget for the full investment  totaling $343 million.

Treasury could not demonstrate that the CIO reviewed the  investment’s alignment with major program objectives or changes  in resources.

IRS demonstrated that managers from the Office of the CIO  reviewed alignment with major program objectives and changes in  underlying resources for a portion of the sampled investment’s  budget of $286 million through IT budget reviews conducted by an  integrated review team in July 2015. However, the component  agency could not demonstrate that Office of the CIO officials  reviewed alignment with major program objectives and changes in  resources for the full investment totaling $468 million.

IRS demonstrated that managers from the Office of the CIO  reviewed alignment with major program objectives and changes in  underlying resources for a portion of the sampled investment’s  budget of $40 million through IT budget reviews conducted by an  integrated review team in July 2015. However, the component  agency could not demonstrate that Office of the CIO officials  reviewed alignment with major program objectives and changes in  resources for the full investment totaling $343 million.

Treasury could not demonstrate that the CIO or designee reviewed  the appropriateness of IT resource estimates underlying the  investment’s budget request.

Selected OMB common baseline requirement

IRS demonstrated that managers from the Office of the CIO  reviewed detailed cost estimates for a portion of the sampled  investment’s budget of $286 million through IT budget reviews  conducted by an integrated review team in July 2015. However,  the component agency could not demonstrate that Office of the  CIO officials reviewed detailed cost estimates for the full  investment totaling $468 million.

IRS demonstrated that managers from the Office of the CIO  reviewed detailed cost estimates for a portion of the sampled  investment’s budget of $40 million through IT budget reviews  conducted by an integrated review team in July 2015. However,  the component agency could not demonstrate that Office of the  CIO officials reviewed detailed cost estimates for the full  investment totaling $343 million.   ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment.  ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the  ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

Appendix VII: Comments from the Internal Revenue Service

Appendix VIII: Comments from the Department of Energy

Appendix IX: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Dave Powner (Director), Nicole  Jarvis (Assistant Director), Joshua Leiling (Analyst-in-Charge), Chris  Businsky, Kara Epperson, Rebecca Eyler, Suellen Foth, Torrey Hardee,  Tarunkant Mithani, Monica Perez-Nelson, and Andrew Stavisky made key  contributions to this report.