Information Technology: Agencies Need to Involve Chief Information Officers in Reviewing Billions of Dollars in Acquisitions

The federal government invested more than $90 billion on IT in fiscal year 2016. However, prior IT expenditures have produced failed projects. Recognizing the severity of issues, in December 2014 Congress enacted IT acquisition reform legislation (referred to as the Federal Information Technology Acquisition Reform Act, or FITARA). Among other things, OMB's FITARA implementation guidance requires covered agencies' chief acquisition officers to identify IT contracts for the CIOs to review and approve.

GAO's objectives were to determine the extent to which (1) federal agencies identify IT contracts and how much is invested in them, and (2) federal agency CIOs are reviewing and approving IT acquisitions. To do so, GAO reviewed data on IT contracts from fiscal year 2016 at 22 agencies and compared agency actions to law and OMB guidance.

Most of the 22 selected agencies did not identify all of their information technology (IT) contracts. The selected agencies identified 78,249 IT-related contracts, to which they obligated $14.7 billion in fiscal year 2016. However, GAO identified 31,493 additional contracts with $4.5 billion obligated, raising the total amount obligated to IT contracts in fiscal year 2016 to at least $19.2 billion (see figure).The percentage of additional IT contract obligations GAO identified varied among the selected agencies. For example, the Department of State did not identify 1 percent of its IT contract obligations. Conversely, 8 agencies did not identify over 40 percent of their IT-related contract obligations.

Many of the selected agencies that did not identify these IT acquisitions did not follow Office of Management and Budget's (OMB) guidance. Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for Chief Information Officer (CIO) review, as required by OMB. In addition, 7 agencies did not establish guidance to aid officials in recognizing IT. Until agencies involve the acquisitions office in their IT identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions. Without proper identification of IT acquisitions, agencies and CIOs cannot effectively provide oversight of these acquisitions.

In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB's requirement that the CIO review and approve IT acquisition plans or strategies. Further, only 11 of 96 randomly selected IT contracts at 10 agencies that GAO evaluated were CIO-reviewed and approved as required by OMB's guidance. The 85 IT contracts not reviewed had a total possible value of approximately $23.8 billion. Until agencies ensure that CIOs review and approve IT acquisitions, CIOs will continue to have limited visibility and input into their agencies' planned IT expenditures and will not be able to use the increased authority that FITARA's contract approval provision is intended to provide. Further, agencies will likely miss an opportunity to strengthen CIOs' authority and the oversight of IT acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived.

GAO is making 39 recommendations, including that agencies ensure that acquisition offices are involved in identifying IT and issue related guidance; and to ensure IT acquisitions are reviewed according to OMB guidance. OMB and 20 agencies generally agreed with or did not comment on the recommendations. One agency agreed with one recommendation, but disagreed with another. GAO believes this recommendation is warranted. One agency disagreed with two recommendations. GAO subsequently removed one of these, but believes the other recommendation is warranted, as discussed in the report.

Information systems are critical to the health, economy, and security of  the nation. To support these systems, the federal government invested  more than $90 billion in information technology (IT) in fiscal year 2016.  However, prior IT expenditures have too often produced failed projects— that is, projects with multimillion dollar cost overruns and schedule delays  measured in years, and with questionable mission-related achievements.

Recognizing the severity of issues related to the government-wide  management of IT, in December 2014, Congress enacted IT acquisition  reform legislation (commonly referred to as the Federal Information  Technology Acquisition Reform Act, or FITARA) as part of the Carl Levin  and Howard P. ‘Buck’ McKeon National Defense Authorization Act for  Fiscal Year 2015. FITARA holds promise for improving agencies’  acquisitions of IT and enabling Congress to monitor agencies’ progress,  as well as for holding agencies accountable for reducing duplication and  achieving cost savings. In addition, with the enactment of FITARA, the  federal government has an opportunity to strengthen the authority of chief  information officers (CIO) to provide needed direction and oversight of  agencies’ IT acquisitions, among other areas.

We recently testified that, while agencies have made progress in  implementing the law, its further implementation is critical to improving IT  management. We have also noted that continued congressional  oversight of agencies’ implementation of FITARA is essential to help  ensure that these efforts succeed.

Among other things, FITARA requires CIOs of major civilian agencies to  review and approve IT contracts. With this in mind, you asked us to  review whether CIOs are approving IT contracts as required by this law.  Our objectives were to determine the extent to which (1) federal agencies  identify IT contracts and how much is invested in them, and (2) federal  agency CIOs are reviewing and approving IT acquisitions.

Our review included the Office of Management and Budget (OMB) and 22  of the 24 agencies covered by the Chief Financial Officers Act. We did  not include the Department of Defense because it is excluded from the  provision in FITARA requiring CIO approval of IT contracts. We also did  not include the Department of Homeland Security because we recently  issued a report on the department’s implementation of FITARA.

To determine the extent to which federal agencies identify IT contracts  and how much is invested in them, we requested that each of the 22  agencies provide us a list of their IT contract obligations for fiscal year  2016. Separately, we identified IT-related contracts from each of these  agencies using fiscal year 2016 data reported on USAspending.gov. We then compared these resulting lists of IT-related contracts to the agency- provided lists of contracts to determine which contracts the agencies had  not identified. We also reviewed other agency documentation, such as IT  acquisition policies and processes, as well as acquisition plans and  strategies. In addition, we interviewed the agencies’ acquisition officials  and officials from the Office of the CIO to determine their processes for  identifying IT contracts.

To determine the extent to which federal agency CIOs are reviewing and  approving IT acquisitions, we randomly selected 10 contracts at 10  agencies (100 total contracts) to review in depth. For each of the 100  selected contracts, we asked the associated agency to confirm that the  contract was IT-related and requested evidence of the CIO’s or CIO  designee’s review and approval. We compared the resulting  documentation to FITARA and OMB guidance to determine whether the  IT acquisitions had been appropriately reviewed and approved.

We also reviewed agency documentation on IT acquisition processes and  procedures and compared it to the requirements in FITARA and OMB  guidance. Further, we interviewed the agencies’ officials, including  officials in the Office of the CIO, to clarify their respective processes and  policies.

We found the data from USAspending.gov and contract data provided by  the agencies to be sufficiently reliable for the purposes of our reporting  objectives and used the data as evidence to support our findings,  conclusions, and recommendations. For the USAspending.gov data, we  reviewed publicly available documentation related to the database, such  as the USAspending.gov data dictionary. For both the USAspending.gov  and agency-provided contract data, we tested the datasets to look for  duplicate records and missing data in key fields. We also interviewed  agency officials to corroborate the data. A full description of our  objectives, scope, and methodology can be found in appendix I.

We conducted this performance audit from July 2016 to January 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

While IT investments have the potential to improve lives and  organizations, federally funded IT projects can—and, too often, have— become risky, costly, and unproductive mistakes. We have previously  reported that the federal government has spent billions of dollars on failed  or troubled IT investments, such as  the Office of Personnel Management’s (OPM) Retirement Systems  Modernization program, which was canceled in February 2011, after  spending approximately $231 million on the agency’s third attempt to  automate the processing of federal employee retirement claims;  the United States Coast Guard’s effort, initiated in 2010, to replace its  aging electronic health records system, but which was discontinued in  October 2015 after spending nearly $67 million. As a result, the Coast  Guard currently has a manual, paper-based health records  management process;  the tri-agency National Polar-orbiting Operational Environmental  Satellite System, which was halted in February 2010 by the White  House’s Office of Science and Technology Policy after the program  spent 16 years and almost $5 billion;  the Department of Veterans Affairs’ (VA) Scheduling Replacement  Project, which was terminated in September 2009 after spending an  estimated $127 million over 9 years;  the Farm Service Agency’s Modernize and Innovate the Delivery of  Agricultural Systems program, which was halted in July 2014 after  spending $423 million to modernize IT systems over 10 years; and  the Department of Health and Human Services’ (HHS) Healthcare.gov  website and its supporting systems, which were to facilitate the  establishment of a health insurance marketplace by January 2014, but  which encountered significant cost increases, schedule slips, and  delayed functionality.

These failed or troubled projects often suffered from a lack of disciplined  and effective management, such as project planning, requirements  definition, and program oversight and governance. In many instances,  agencies had not consistently applied best practices that are critical to  successfully acquiring IT investments.

To help address these ongoing challenges, in February 2015, we added  improving the management of IT acquisitions and operations to our list of  high-risk areas for the federal government. This area highlighted several  critical IT initiatives in need of additional congressional oversight,  including (1) reviews of troubled projects; (2) efforts to increase the use of  incremental development; (3) efforts to provide transparency relative to  the cost, schedule, and risk levels for major IT investments; (4) reviews  of agencies’ operational investments; (5) data center consolidation; and  (6) efforts to streamline agencies’ portfolios of IT investments. We noted  that implementation of these initiatives had been inconsistent and more  work remained to demonstrate progress in achieving IT acquisitions and  operations outcomes.

In our February 2015 high-risk report, we also identified actions that OMB  and federal agencies needed to take to make progress in this area. These  included implementing FITARA and at least 80 percent of our  recommendations related to the management of IT acquisitions and  operations within 4 years. Specifically, between fiscal years 2010 and  2015, we made 803 recommendations to OMB and federal agencies to  address shortcomings in IT acquisitions and operations, including many  to improve the implementation of the previously mentioned six critical IT  initiatives and other government-wide, cross-cutting efforts.

In February 2017, we issued an update to our high-risk series and  reported that, while progress had been made in improving the  management of IT acquisitions and operations, significant work still  remained to be completed. For example, as of May 2017, OMB and  federal agencies had fully implemented 380 (or about 47 percent) of the  803 recommendations. Nevertheless, in fiscal year 2016, we made 202  new recommendations, thus further reinforcing the need for OMB and  agencies to address the shortcomings in IT acquisitions and operations.  Also, beyond addressing our prior recommendations, our 2017 high-risk  update noted the importance of OMB and federal agencies continuing to  expeditiously implement the requirements of FITARA.

Agencies Are to Follow Federal Requirements for Acquisitions

The Federal Acquisition Regulation (FAR) is the primary regulation for  use by federal executive agencies in their acquisition of supplies and  services with appropriated funds. The FAR requires agencies to perform  planning for all acquisitions. Acquisition planning begins when an agency  need is identified and includes developing requirements and creating  written acquisition plans. A detailed acquisition plan must address all of  the technical, business, management, and other significant  considerations that will control the acquisition. It should include, among  other things, a statement of need, cost, a plan of action, and milestones.  The FAR is less specific on the requirements for an acquisition strategy,  but it states that acquisition planning should include developing the  overall strategy for managing the acquisition.

Once a contract is awarded, the awarding agency must enter certain  information into the Federal Procurement Data System-Next Generation,  the federal government’s database that captures information on contract  awards and obligations and is the primary database that serves as the  source of other contracting data systems, such as USAspending.gov.  The system captures information on contract awards and obligations,  including, the vendor, and amount obligated. Further, agencies must  select a product and service code that represents the predominant  product or service being purchased. Product and service codes are used  to describe and identify products, services, and research and  development spending within the system.

In an effort to eliminate redundancies and increase efficiencies in federal  acquisition, in September 2015, the Category Management Leadership  Council and OMB developed a government-wide category structure to  support category management implementation across the federal  government. The Council and OMB reviewed the product and service  codes and grouped them into 19 individual spend categories, including IT.  See appendix II for a list of the 79 IT-related product and service codes.

Federal Law Establishes Agency IT Management Responsibilities

Over the last three decades, Congress has enacted several laws to help  federal agencies improve the management of IT investments. For  example, the Clinger-Cohen Act of 1996 requires agency heads to  appoint CIOs and specifies many of their responsibilities with regard to IT  management. Among other things, CIOs are responsible for  implementing and enforcing applicable government-wide and agency IT  management principles, standards, and guidelines; assuming  responsibility and accountability for IT investments; and monitoring the  performance of IT programs and advising the agency head whether to  continue, modify, or terminate such programs. The Clinger-Cohen Act,  as amended, also defines IT as: any equipment or interconnected system  or subsystem of equipment, used in the automatic acquisition, storage,  analysis, evaluation, manipulation, management, movement, control,  display, switching, interchange, transmission, or reception of data or  information by the agency or a contractor under a contract with the  agency.

As previously mentioned, recognizing the severity of issues related to the  government-wide management of IT, Congress enacted FITARA in December 2014. The law includes provisions related to seven areas at  covered agencies:

Agency CIO authority enhancements. CIOs at agencies are  required to (1) approve the IT budget requests of their respective  agencies, (2) certify that OMB’s incremental development guidance is  being adequately implemented for IT investments, (3) approve the  appointment of other agency employees with the title of CIO, and (4)  review and approve contracts for IT. With regard to the review of IT  contracts, FITARA requires that agency CIOs review and approve IT  contracts prior to award, unless that contract is associated with a non- major investment. When the contract is associated with a non-major  investment, the CIO are allowed to delegate the review and approval  duties to an official that reports directly to the CIO. Alternatively, the  law states that an agency may use its governance processes to  approve any IT contract, as long as the agency CIO is a full  participant in the governance processes.

Federal data center consolidation initiative. Agencies are required  to provide OMB with a data center inventory, a strategy for  consolidating and optimizing the data centers (to include planned cost  savings), and quarterly updates on progress made. The law also  requires OMB to develop a goal for how much is to be saved through  this initiative, and provide annual reports on cost savings achieved.

Enhanced transparency and improved risk management. OMB  and agencies are to make detailed information on federal IT  investments publicly available, and agency CIOs are to categorize  their investments by level of risk. In addition, in the case of major IT  investments rated as high risk for 4 consecutive quarters, the law  requires that the agency CIO and the investment’s program manager  conduct a review aimed at identifying and addressing the causes of  the risk.

Portfolio review. Agencies are to annually review IT investment  portfolios in order to, among other things, increase efficiency and  effectiveness and identify potential waste and duplication. In  establishing the process associated with such portfolio reviews, the  law requires OMB to develop standardized performance metrics, to  include cost savings, and to submit quarterly reports to Congress on  cost savings.

Expansion of training and use of IT acquisition cadres. Agencies  are to update their acquisition human capital plans to address  supporting the timely and effective acquisition of IT. In doing so, the  law calls for agencies to consider, among other things, establishing IT  acquisition cadres or developing agreements with other agencies that  have such cadres.

Government-wide software purchasing program. The General  Services Administration (GSA) is to develop a strategic sourcing  initiative to enhance government-wide acquisition and management of  software. In doing so, the law requires that, to the maximum extent  practicable, GSA should allow for the purchase of a software license  agreement that is available for use by all executive branch agencies  as a single user.

Maximizing the benefit of the federal strategic sourcing initiative.  FITARA requires that OMB issue regulations for federal agencies that  do not use the federal strategic sourcing initiative to purchase  services and supplies that are offered by this initiative. The  regulations are to include a requirement for agencies to analyze the  comparative value between what is to be purchased and what the  strategic sourcing initiative offers.

OMB Established Guidance for Agencies to Implement FITARA

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. The guidance emphasizes the need for CIOs to  have full accountability for IT acquisition and management decisions, and  gives agencies considerable flexibility in making those decisions. Among  other things, the guidance is intended to: assist agencies in aligning their IT resources with agency missions,  goals, and requirements; establish government-wide IT management controls that will meet the  law’s requirements, while providing agencies with flexibility to adapt to  agency processes and mission requirements;  clarify the CIO’s role and strengthen the relationship between  department CIOs and bureau or component CIOs; and  strengthen CIO accountability for IT cost, schedule, performance, and  security.

With regard to CIOs’ review and approval of IT contracts, OMB’s  guidance expands upon FITARA in a number of ways. Specifically,  according to the guidance:

CIOs may review and approve IT acquisition strategies and plans,  rather than individual IT contracts;

CIOs can designate other agency officials to act as their  representatives, but the CIOs must retain accountability;

Chief Acquisition Officers (CAO) are responsible for ensuring that all  IT contract actions are consistent with CIO-approved acquisition  strategies and plans; and

CAOs are to indicate to the CIOs when planned acquisition strategies  and acquisition plans include IT.

Agencies Identified $14.7 Billion in IT Obligations, but Did Not Identify an Additional $4.5 Billion

OMB’s FITARA implementation guidance requires agencies’ CAOs to  indicate to CIOs when planned acquisition strategies and acquisition  plans include IT. Given the Category Management Leadership Council  and OMB’s categorization of IT product and service codes, CAOs should  be identifying the obligations that have IT-related codes.

The 22 selected agencies identified 78,249 IT-related contracts, to which  they obligated approximately $14.7 billion in fiscal year 2016. Of that  amount, approximately $14 billion was categorized as IT-related,  consistent with the Category Management Leadership Council and  OMB’s product and service codes, and approximately $626 million was  categorized under other, non-IT codes.

The $626 million in obligations with non-IT codes could contain  embedded IT or be associated with IT programs. For example, the  agencies reported IT-related acquisitions categorized under such non-IT  codes as IT/telecommunications training, data analysis, and research and  development. Three agencies accounted for most of these non-IT  obligations: the Department of Veterans Affairs (VA) accounted for $220  million, the Environmental Protection Agency (EPA) accounted for $156  million, and the Department of Labor (Labor) accounted for $105 million.

However, in addition to the obligations that agencies reported to us, we  identified 31,493 additional contracts at 21 agencies with IT-related  product and service codes. The associated agencies obligated  approximately $4.5 billion to these contracts, raising the total amount  obligated to IT contracts in fiscal year 2016 to at least approximately  $19.2 billion. Figure 1 reflects the obligations agencies reported to us  relative to the obligations we identified.

The percentage of additional IT contract obligations that we identified  varied among the selected agencies. For instance, the Department of  State (State) did not identify 1 percent of its IT contract obligations.  Conversely, eight agencies—the Departments of the Interior (Interior),  Transportation (Transportation), and the Treasury (Treasury), as well as  the National Science Foundation (NSF), the U.S. Agency for International  Development (USAID), HHS, GSA, and OPM did not identify over 40 percent of their IT contract obligations. Figure 2 reflects the contract  obligations that the selected agencies reported to us (both with IT-related  codes and those with non-IT codes) relative to the obligations we  identified. For additional information about the IT obligations identified by  these agencies, see appendix III.

Agencies offered various reasons for why they had not identified the  approximately $4.5 billion in IT obligations. For example, officials from  OPM and NSF stated that their agencies only identified new IT contracts  and did not include contract modifications in their identified IT obligations,  making their submissions much smaller. NSF also noted that it only  identified IT contracts over $150,000. In addition, GSA and Transportation  officials stated that at least one of the Category Management Leadership  Council’s IT product and service codes should not be considered IT. For  instance, an official in GSA’s Vendor Management Office stated that  contracts using a product and service code for miscellaneous  maintenance, repair, and rebuilding should not be categorized as IT.  Likewise, Transportation officials provided examples of contracts that the  agency did not consider being IT-related, even though they were  categorized under IT product and service codes for program review or  development services. In addition, Transportation and USAID officials  stated that they did not use the complete list of IT product and service  codes in their identification efforts. A Treasury official in the Office of the  CIO stated that the department focused on codes that were the most  important.

We agree that the Council’s IT product and service codes could include  contracts that are not IT. Further, as previously discussed, IT is included  in product and service codes that the Council did not identify as IT.  Nonetheless, the Council has provided a valuable service in developing  specific categories from which agencies can select in identifying IT. To  the extent that agencies have concerns about specific categories, they  could raise them to the Council.

In addition, the majority of the selected agencies that did not identify the  $4.5 billion in IT obligations also did not follow OMB’s guidance to have  the CAO identify all IT acquisitions for CIO review and approval. As those  tasked with monitoring their respective agencies’ acquisition activities, the  offices of the CAOs are in a unique position to identify prospective IT  acquisitions to the CIOs. Of the 21 selected agencies that did not identify  the approximately $4.5 billion in IT obligations, 8 involved the acquisition  offices in the identification of their IT acquisitions. For example, OPM’s  process followed OMB’s guidance by directly involving its senior  procurement executive in the identification of the acquisitions.

Conversely, the other 14 agencies did not follow OMB’s guidance to have  a process in which the acquisition offices identified, or helped to identify,  IT acquisitions for CIO review. Among these agencies, for example, EPA  officials indicated that program office officials are responsible for  identifying IT requirements and obtaining the appropriate approvals.  EPA’s process does not require acquisition office participation. Instead,  the program office officials work with IT officials to determine if the  contract is IT-related and subject to the IT acquisition approval policy.

In addition, 7 agencies reported that they rely on the requesting program  offices to self-identify whether their acquisitions are IT-related. Table 1  summarizes the officials responsible for the identification of IT  acquisitions at the selected agencies.

We have previously reported on the importance of developing and issuing  policies or supporting guidance in order to successfully implement  processes and achieve related objectives. In recognition of the  importance of establishing guidance to assist agency officials in  identifying IT, 14 of the 22 selected agencies issued such guidance.

However, 7 agencies did not. Specifically, the Departments of Agriculture  (USDA), Energy (Energy), Justice (Justice), Labor, and Transportation;  the National Aeronautics and Space Administration (NASA); and the  Social Security Administration (SSA) did not establish guidance regarding  the identification of IT-related acquisitions. For instance, officials in  Justice’s Office of the CIO stated that the agency does not follow a  prescribed process to determine which acquisitions are IT-related and  does not use guidance or checklists to aid with the identification. One  other agency, Interior, had established draft guidance to assist officials  when identifying IT; however, the agency did not identify a schedule for  finalizing the draft guidance.

Until agencies involve the acquisition office in their IT identification  processes, and establish and effectively implement supporting guidance,  they will likely not be able to ensure that all IT acquisitions are identified.

As a result, agencies risk not having appropriate oversight of IT worth  billions of dollars.

Most Agency CIOs Are Not Reviewing and Approving IT Acquisitions in Accordance with OMB’s Requirements

FITARA and OMB’s associated implementation guidance require major  civilian agency CIOs to review and approve acquisitions of IT either  directly, or through the agency’s governance processes. In particular,  OMB’s guidance states that agencies shall not approve any acquisition  plan or strategy that includes IT without the agency CIO’s review and  approval.

OMB’s guidance also allows the CIO to delegate these responsibilities to  other agency officials to act as the CIO’s representative; however, staff  in OMB’s Office of the Federal CIO noted that these assignments need to  be approved by OMB. Alternatively, FITARA and OMB’s guidance allow  agencies to use IT governance processes to conduct these reviews and  approvals as long as the CIO is a full participant in the process.

Most of the processes at the 22 selected agencies do not fully satisfy  OMB’s requirements that the CIO review and approve IT acquisition plans  or strategies (or that the CIO participate in a governance process that  reviews and approves IT acquisition plans and strategies). Specifically,  8 agencies’ processes fully satisfy OMB’s requirements, while 14 of the  agencies’ processes do not fully satisfy the requirements. Of these, 8  agencies partially satisfy the requirements and 6 do not satisfy the  requirements. For example,

NSF fully satisfies OMB’s requirement by requiring that the CIO  review and approve each IT acquisition plan. Similarly, SBA requires  the CIO to review and approve each IT acquisition plan over the  FAR’s simplified acquisition threshold.

HUD partially satisfies OMB’s requirements in that its process only  requires the office of the CIO to review a subset of IT acquisitions  (those over $500,000). In addition, the HUD CIO has delegated the  approval authority to the Deputy CIO and others within the Office of  the CIO, but this delegation has not been approved by OMB.

VA does not yet have a process in place that satisfies OMB’s  requirements, but officials in VA’s Office of Information and  Technology stated that they are currently developing processes and  procedures necessary to implement FITARA accountability and  responsibilities for IT acquisitions. While the agency did not submit a  documented time frame for its plans, VA officials stated that they  would like to implement the new process by the second quarter of  fiscal year 2018.

Table 2 summarizes the extent to which the selected agencies’ processes  satisfy OMB’s requirements for the CIO to review and approve IT  acquisition plans. Appendix IV provides additional details about the  agencies’ processes that are used to review and approve IT acquisitions.

Of 96 randomly selected IT contracts at 10 agencies, only 11 acquisitions  associated with these contracts had been reviewed and approved as  required by OMB. The acquisitions associated with 85 contracts, with a  total possible value of approximately $23.8 billion, did not receive the  appropriate level of review. Further, despite having CIO review and  approval processes in place that fully or partially satisfied OMB’s  requirements, four agencies (the Department of Commerce (Commerce),  HHS, Justice, and SSA) did not consistently ensure that the CIO or a  designee reviewed and approved the acquisition plan or strategy.

Table 3 summarizes the number and total possible value of IT contracts  that we reviewed for consistency with OMB’s requirements. Appendix V  provides more details on the selected IT acquisitions and the CIO  approval of them.

Four key factors contributed to the acquisitions associated with the 85  contracts not being reviewed and approved by the CIOs in accordance  with OMB’s requirements:

Non-compliant processes. As previously mentioned, agencies’  processes at 7 of the 10 agencies did not fully satisfy OMB’s  requirements that the CIO review and approve IT acquisition plans  and strategies. Four agencies reported that they were following their  own agency processes which we determined do not fully align with  requirements. For example, NASA officials responsible for information  regarding one of the selected contracts stated that the CIO only  provides technical guidance and concurrence on the acquisition plan  and does not approve the acquisition plan. This is not consistent with  OMB’s requirement that the CIO or designee review and approve IT  acquisition plans.

In addition, for 16 contracts, the respective agencies stated that there  were no acquisition plans associated with the particular acquisitions.  For example, a director in USDA’s Forest Service’s acquisition office  issued waivers for 2 acquisitions, making them exempt from needing  acquisition plans. Thus, the CIO did not review and approve  acquisition plans for those contracts. As noted earlier, OMB’s  guidance states that if there is not an acquisition plan or strategy, the  contract action itself should be reviewed and approved. However, in  all 16 cases, the associated agencies’ CIOs did not undertake such  reviews.

Improper delegation. We identified 16 instances where agencies  allowed CIOs to delegate their review to levels lower than agency  policy or OMB allows. For example, Treasury’s CIO delegated  contract approval to the component CIOs—one of whom further  delegated this approval based on monetary thresholds to a variety of  other officials. According to the component’s policy, one of the  selected acquisitions, worth over $22 million, should have been  approved by the component’s Deputy CIOs, Associate CIOs, or  Deputy Associate CIOs. However, this particular acquisition was  approved by an IT Project Manager. Further, two agencies allowed  their CIOs to delegate IT acquisition approvals to other officials,  without having these assignments approved by OMB. For example,  three of NASA’s selected acquisitions were reviewed and approved by  the component CIOs; however, NASA had not had these assignments  approved by OMB.

Approval of other documentation. In 26 instances, CIOs or  designees reviewed and approved acquisition documentation other  than the required acquisition plan or strategy. For example, CIOs or  designees reviewed and approved documents such as a requisition, a  procurement request, or a business case analysis. While the CIOs or  designees reviewed and approved some form of acquisition  documentation prior to the award of these acquisitions, these forms of  documentation did not have all the elements typically associated with  an acquisition plan. As a result, the CIO (or designee) may not have  been adequately equipped to make an informed decision about the  acquisition.

Undocumented approvals. We identified 2 instances where the  agency reported that the CIO or designee approved the IT acquisition,  but did not document the approval. For example, regarding one  contract, Commerce officials stated that one of the agency’s selected  acquisitions was reviewed and approved by its component CIO for the  Bureau of Economic Analysis. However, the agency could not provide  evidence to show the CIO’s approval beyond an e-mail after the  contract was signed stating that the CIO was aware of and had  approved that particular acquisition.

Until agencies fully satisfy FITARA and OMB’s requirements by ensuring  that CIOs, or their appropriate designees, review and approve IT  acquisitions, CIOs risk continuing to have limited visibility and input into  their agencies’ planned IT expenditures and not being able to use the  increased authority that FITARA’s contract approval provision is intended  to provide. In addition, agencies are missing an opportunity to strengthen  CIOs’ authority and to provide needed direction and oversight of their IT  acquisitions. As a result, agencies may award IT contracts that are  duplicative, wasteful, or poorly conceived.

Given the history of failures and amount of money at stake, it is  imperative that agencies properly oversee IT acquisitions. While the 22  selected agencies reported $14.7 billion in IT obligations, 21 agencies did  not identify $4.5 billion as IT. Further, because the selected agencies did  not always identify their IT acquisitions, it is likely that agencies have  additional unidentified IT spending. Among other reasons, this shortfall  existed because many agencies did not ensure that their acquisition  offices were involved in the identification process, or provide clear  guidance for ensuring that IT was properly identified. Without proper  identification of IT acquisitions, agencies and CIOs cannot effectively  provide oversight of them.

In addition, many of the selected agencies covered by FITARA did not  ensure the appropriate CIO review and approval of IT acquisitions that  were identified. The CIOs’ review and approval presents an opportunity  for CIOs to increase visibility into agency IT and recognize opportunities  for improvement. However, the review and approval processes at 14 of  the selected agencies were not in full compliance with OMB  requirements, and only 11 of 96 randomly selected IT acquisitions were  appropriately reviewed and approved by the CIO. As a result, agencies  awarded IT contracts with a total possible value of $23.8 billion without  the required CIO review and approval. Consequently, CIOs had limited  visibility and insight into their agencies’ IT, thereby increasing the risk of  entering into contracts that were duplicative, wasteful, or poorly  conceived.

We are making a total of 39 recommendations to federal agencies.

We are making the following 3 recommendations to USDA:

The Secretary of Agriculture should ensure that the office of the CAO  is involved in the process to identify IT acquisitions.  (Recommendation 1)

The Secretary of Agriculture should direct the CAO and CIO to issue  specific guidance to ensure IT-related acquisitions are properly  identified. (Recommendation 2)

The Secretary of Agriculture should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 3)

We are making the following 2 recommendations to Commerce:

The Secretary of Commerce should ensure that the office of the CAO  is involved in the process to identify IT acquisitions.  (Recommendation 4)

The Secretary of Commerce should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 5)

We are making the following 2 recommendations to Education:

The Secretary of Education should ensure that the office of the CAO  is involved in the process to identify IT acquisitions.  (Recommendation 6)

The Secretary of Education should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 7)

We are making the following 2 recommendations to Energy:

The Secretary of Energy should direct the CAO and CIO to issue  specific guidance to ensure IT-related acquisitions are properly  identified. (Recommendation 8)

The Secretary of Energy should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 9)

We are making the following recommendation to HHS:

The Secretary of HHS should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 10)

We are making the following 2 recommendations to the Department of  Housing and Urban Development:

The Secretary of Housing and Urban Development should ensure that  the office of the CAO is involved in the process to identify IT  acquisitions. (Recommendation 11)

The Secretary of Housing and Urban Development should ensure that  IT acquisition plans or strategies are reviewed and approved  according to OMB’s guidance. (Recommendation 12)

We are making the following 3 recommendations to Interior:

The Secretary of the Interior should ensure that the office of the CAO  is involved in the process to identify IT acquisitions.  (Recommendation 13)

The Secretary of Interior should direct the CAO and CIO to finalize  and issue guidance on identifying IT acquisitions in order to ensure  the CIO review and approval of those acquisitions. (Recommendation  14)

The Secretary of the Interior should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 15)

We are making the following 2 recommendations to Justice:

The Attorney General should direct the senior procurement executive  and CIO to issue specific guidance to ensure IT-related acquisitions  are properly identified. (Recommendation 16)

The Attorney General should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 17)

We are making the following 3 recommendations to Labor:

The Secretary of Labor should ensure that the office of the CAO is  involved in the process to identify IT acquisitions. (Recommendation  18)

The Secretary of Labor should direct the CAO and CIO to issue  specific guidance to ensure IT-related acquisitions are properly  identified. (Recommendation 19)

The Secretary of Labor should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 20)

We are making the following 2 recommendations to State:

The Secretary of State should ensure that the office of the CAO is  involved in the process to identify IT acquisitions. (Recommendation  21)

The Secretary of State should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 22)

We are making the following recommendation to Treasury:

The Secretary of the Treasury should ensure that IT acquisition plans  or strategies are reviewed and approved according to OMB’s  guidance. (Recommendation 23)

We are making the following 3 recommendations to Transportation:

The Secretary of Transportation should ensure that the office of the  CAO is involved in the process to identify IT acquisitions.  (Recommendation 24)

The Secretary of Transportation should direct the CAO and CIO to  issue specific guidance to ensure IT-related acquisitions are properly  identified. (Recommendation 25)

The Secretary of Transportation should ensure that IT acquisition  plans or strategies are reviewed and approved according to OMB’s  guidance. (Recommendation 26)

We are making the following 2 recommendations to VA:

The Secretary of VA should ensure that the office of the CAO is  involved in the process to identify IT acquisitions. (Recommendation  27)

The Secretary of VA should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 28)

We are making the following recommendation to EPA:

The Administrator of EPA should ensure that the office of the CAO is  involved in the process to identify IT acquisitions. (Recommendation  29)

We are making the following 3 recommendations to NASA:

The Administrator of NASA should ensure that the office of the CAO is  involved in the process to identify IT acquisitions. (Recommendation  30)

The Administrator of NASA should direct the CAO and CIO to issue  specific guidance to ensure IT-related acquisitions are properly  identified. (Recommendation 31)

The Administrator of NASA should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 32)

We are making the following recommendation to NRC:

The Chairman of NRC should ensure that the office of the senior  procurement executive is involved in the process to identify IT  acquisitions. (Recommendation 33)

We are making the following recommendation to OPM:

The Director of OPM should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 34)

We are making the following recommendation to SBA:

The Administrator of SBA should ensure that the office of the senior  procurement executive is involved in the process to identify IT  acquisitions. (Recommendation 35)

We are making the following 3 recommendations to SSA:

The Commissioner of SSA should ensure that the office of the senior  procurement executive is involved in the process to identify IT  acquisitions. (Recommendation 36)

The Commissioner of SSA should direct the senior procurement  executive and CIO to issue specific guidance to ensure IT-related  acquisitions are properly identified. (Recommendation 37)

The Commissioner of SSA should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 38)

We are making the following recommendation to USAID:

The Administrator of USAID should ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  (Recommendation 39)

We provided a draft of this report to OMB and the other 22 agencies  included in our review. Among the comments received, 16 agencies  (Energy, GSA, HHS, HUD, Interior, Justice, Labor, NASA, OPM, SBA,  SSA, State, Transportation, USAID, USDA, and VA) agreed with our  recommendations; 2 agencies (EPA and OMB) did not agree or disagree  with our recommendations; 1 agency (Education) partially agreed with our  recommendations; 1 agency (NRC) disagreed with our recommendations;  and 2 agencies (Treasury and NSF) had no comments on the  recommendations. One other agency (Commerce) did not provide  comments on the report.

The agencies’ comments that we received, and our evaluations of them,  are summarized as follows:  In comments provided via e-mail on December 8, 2017, an OMB GAO  liaison did not agree or disagree with our findings. The official stated  that improved coordination and collaboration between CIOs, CAOs,  and senior procurement executives is critical, but represents a  significant cultural shift for most agencies. The official added that  OMB’s Office of Federal Procurement Policy and Office of the Federal  CIO are working closely with agency CAOs and CIOs through the CIO  Council and CAO Council to discuss practices that agencies have  found helpful in achieving this cultural change.

In comments provided via e-mail on November 18, 2017, a Senior  Advisor from USDA’s Office of the CIO stated that the department  concurred with the findings in our report and had no additional  comments.

In written comments, Education concurred with one of our  recommendations, which called for the department to ensure that the  office of the CAO is involved in the process to identify IT acquisitions.  However, Education did not concur with a second recommendation to  ensure that IT acquisition plans or strategies are reviewed and  approved according to OMB’s guidance. The department stated that  the CIO reviews and approves IT acquisition strategies and plans as  part of his review and approval of IT investments. Specifically, the  department stated that its Departmental Directive OCIO: 3-108,  “Information Technology Investment Management” establishes a  process for Office of the CIO review of IT acquisitions. Further, the  department stated that its Statement of Work Review Process adds  increased rigor to the CIO’s review and approval by requiring all  acquisitions with IT elements to be submitted for Office of the CIO  review. Finally, the department stated that the Federal Student Aid  Investment Review Board charter documents the agency CIO as a  voting member. The department added the CIO is required to vote on  Federal Student Aid IT investments greater than $10 million. For  Federal Student Aid investments less than $10 million, the CIO is  provided the same level of insight as any other Investment Review  Board member, but has delegated the required vote to the Federal  Student Aid CIO.

The IT Investment Management Directive, together with the  department’s associated Lifecycle Management Framework  (referenced in the directive), indicates that the office of the CIO is to  review IT acquisition plans. However, the department’s Statement of  Work Review Process does not require the review and approval of  acquisition plans. Instead, the process states that the office of the CIO  may review IT acquisition plans or strategies as one of several  possible documents, including statements of work or cost estimates.

We also reviewed the Federal Student Aid Investment Review Board  charter and updated our report to reflect the department CIO’s  involvement on the Federal Student Aid’s Investment Review Board.  Based on this collective information, we updated our assessment of  Education’s IT acquisition policy to reflect that the department had  partially met OMB’s requirements. Nevertheless, the CIO’s review of  the department’s acquisition plans and strategies should be required,  rather than optional. Thus, we believe that our recommendation to  ensure that IT acquisition plans or strategies are reviewed and  approved according to OMB’s guidance is still warranted. Education’s  comments are reprinted in appendix VI.

In written comments, Energy concurred with our two  recommendations directed to the department and stated that it has  activities underway to revise the department’s acquisition policy.

Energy added that it planned to address the recommendations by  December 31, 2017. Energy’s comments are reprinted in appendix  VII.

In comments provided via e-mail on December 7, 2017, a  Management Analyst in HHS’s Office of the CIO stated that the  department agreed with the recommendation and had no comments  on the report.

In written comments, HUD stated that it concurred with our two  recommendations to the department. HUD’s comments are reprinted  in appendix VIII.

In written comments, Interior stated that it concurred with our three  recommendations to the department. Interior’s comments are  reprinted in appendix IX.

In comments provided via e-mail on November 27, 2017, a Program  Analyst from Justice’s Internal Review and Evaluation Office stated  that the department concurred with our two recommendations. The  department also provided technical comments, which we have  incorporated in the report, as appropriate.

In written comments, Labor concurred with our three  recommendations that we directed to the department. These  recommendations called for the department to (1) ensure that the  office of the CAO is involved in the process to identify IT acquisitions,  (2) issue specific guidance to ensure IT-related acquisitions are  properly identified, and (3) ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance.  Labor detailed actions recently taken to implement each of the  recommendations and submitted documentation to support its  assertions. For example, the department submitted its Acquisition  Plan Preparation Guide and related acquisition plan templates to  show that it had issued guidance on identifying IT and required the  CIO review and approval of IT acquisition plans. Implementation of  these steps should help ensure appropriate oversight of IT  acquisitions. Labor’s comments are reprinted in appendix X.

In written comments, State agreed with both of our recommendations.  In particular, regarding our recommendation to ensure that the office  of the CAO is involved in the process to identify IT acquisitions, the  department stated that senior State officials, including the CAO and  CIO, will develop a plan to ensure that the CAO monitors acquisition  activities and ensures acquisition decisions are consistent with all  applicable laws, such as FITARA.

Further, regarding the recommendation to ensure that the  department’s IT acquisition plans or strategies are reviewed and  approved according to OMB’s guidance, State referenced its capital  planning and investment control guide that describes how a group  under the direction of the CIO reviews acquisition strategies during  the IT portfolio selection process. However, while the guide states that  the CIO is to approve the finalized IT portfolio, the guide does not  state that the CIO is to review the individual acquisition strategy  documents. As a result, our recommendation is still warranted. State’s  comments are reprinted in appendix XI.

In comments provided via e-mail on December 7, 2017, an Audit  Liaison from Treasury’s Office of the CIO stated that the department  had no comments on the report. The department did not say whether  it agreed or disagreed with the recommendation, but noted that it had  planned corrective actions to work with Treasury stakeholders, to  include the Chief Procurement Executive, Bureau CIOs, and  Acquisition officials; and OMB officials to develop acquisition plans  and strategies according to OMB’s FITARA guidance for IT  acquisition.

In comments provided via e-mail on November 27, 2017, the Director  of Audit Relations and Program Improvement within the Department  of Transportation stated that the department concurred with the  findings and recommendations.

In written comments, VA concurred with our two recommendations to  the department and stated that it is taking steps to address the  recommendations. Specifically, regarding the recommendation to  ensure that the office of the CAO is involved in the process to identify  IT acquisitions, the department stated that it had addressed this  concern by implementing an updated version of the Acquisition and  Management of VA IT Resources directive in November 2017. In its  discussion of this directive, the department stated that the CIO, in  conjunction with the CAO, collaborates on all IT actions to ensure  FITARA compliance.

While the directive clarifies the scope of VA’s IT resources subject to  the oversight authority of the CIO, the directive does not indicate that  the office of the CAO is also involved in this process. It will be  important for VA to consider this recommendation as it continues to  implement FITARA requirements.

Further, regarding the recommendation to ensure that IT acquisition  plans or strategies are reviewed and approved according to OMB’s  guidance, the department stated that its Office of Strategic Sourcing is  currently developing processes and procedures necessary to  implement FITARA accountability and responsibilities for IT  acquisitions. The department also stated that the new acquisition  review process is scheduled to be implemented in the second quarter  of fiscal year 2018. VA’s comments are reprinted in appendix XII.

In written comments, EPA stated it did not take exception to the  report’s findings, conclusions, and recommendations. Regarding the  recommendation to ensure that the office of the CAO is involved in the  process to identify IT acquisitions, the agency stated that the policy  which implements interim guidance from the CIO to comply with  FITARA requirements is being updated. The agency added that future  policy revisions are to include the requirement that the CAO or a  designee will address this recommendation. EPA’s comments are  reprinted in appendix XIII.

In comments provided via e-mail on November 17, 2017, a program  analyst in GSA’s GAO/Office of Inspector General Audit Management  Division stated that the agency concurred with the report and had no  additional comments.

In written comments, NASA concurred with the three  recommendations to the agency and stated that it believes it has  already addressed them. Specifically, regarding the recommendation  to ensure that the Office of the CAO is involved in the process to  identify IT acquisitions, NASA asserted that its CAO is already  adequately involved. However, NASA did not provide evidence that it  fulfills this requirement. For instance, none of the processes  mentioned in NASA’s comments support the assertion that the  acquisition office is involved in the identification of individual  acquisitions as IT. Further, the discussion of a form used to identify IT  acquisitions (NASA Form 1707) confirmed our original conclusion that  the officials identifying IT acquisitions are not in the acquisition office.

In addition, NASA concurred with our recommendation to issue  specific guidance to ensure IT-related acquisitions are properly  identified, and stated that the agency currently has several policies  that provide such guidance. However, the policies named by the  agency (NASA Policy Directive 1000.5B, NASA Interim Directive  1000.110, NASA FAR Supplement 1804.7301, and NASA FAR  Supplement 1807.71) do not contain guidance on how the identifying  officials should determine whether an acquisition is IT-related. For  example, our review of NASA Form 1707 (required by NASA FAR  Supplement 1804.7301) showed that, while this form has instructions  on how to fill out its IT section, it does not contain guidance on how to  properly identify an acquisition as IT-related. In addition, NASA did not  provide an official policy on the role of the Center Functional Review  Team in the identification process.

Further, NASA concurred with our recommendation to ensure that its  IT acquisition plans or strategies are reviewed and approved  according to OMB guidance and stated that, on September 27, 2017,  the CIO had issued a memo delegating the authority to review and  approve all IT acquisitions to the Center CIOs. However, as previously  mentioned, these delegations of authority need to be approved by  OMB, and NASA’s delegation of IT acquisition authority had not been  approved by OMB, as required. In addition, NASA has not  demonstrated that the CIO’s review and approval is occurring, as  none of the 9 acquisitions we randomly selected were reviewed and  approved by the CIO. NASA also stated that the CIO and Assistant  Administrator for Procurement review acquisition plans as part of their  participation in Acquisition Strategy Meetings. However, as we  mention in the report, not all IT contracts have acquisition strategy  meetings. NASA’s comments are reprinted in appendix XIV.

In written comments, NRC did not concur with our recommendations  and stated that our draft report did not accurately reflect the agency’s  process for reviewing and approving IT acquisitions. With regard to  our recommendation to ensure that the office of the senior  procurement officer is involved in the process to identify IT  acquisitions, the agency provided technical comments which stated  that acquisition office officials review acquisitions to ensure that IT is  properly identified. However, the agency did not provide supporting  documentary evidence to support this assertion. Lacking evidence  from the agency that would enable us to verify the implementation of  the process described in its comments, we maintain that our  recommendation is warranted.

In addition, our draft of this report included a recommendation for  NRC to ensure that IT acquisition plans or strategies are reviewed  and approved according to OMB’s guidance. NRC disagreed with this  recommendation and stated in its technical comments that the agency  does not require the development of acquisition plans for acquisitions  under $1 million. Thus, the NRC CIO does not review acquisition  plans under that threshold. The agency also stated that it has a  process for approving contract actions under the $1 million threshold.

According to OMB guidance, in the absence of acquisition plans or  strategies, CIOs may approve the corresponding contract actions.

Since NRC has a process for approving contract actions under the $1  million threshold, we revised the report to reflect that NRC has  processes in place for the review and approval of acquisition plans in  a manner consistent with OMB guidance and removed the associated  recommendation. NRC’s comments are reprinted in appendix XV and  its technical comments have been incorporated in the report, as  appropriate.

In comments provided via e-mail on November 21, 2017, an NSF  liaison stated that the agency had no comments.

In written comments, OPM concurred with our recommendation and  stated that the agency will review and update its policies and  processes as needed, so that they are aligned with OMB’s guidance.  OPM’s comments are reprinted in appendix XVI.

In written comments, SBA agreed with our recommendation to ensure  that the office of the CAO is involved in the process to identify IT  acquisitions. SBA noted that it is not required to have a CAO, but  agreed with having its acquisition workforce involved in IT  acquisitions. Based on the agency’s comments, we modified the  associated recommendation to refer to the agency’s senior  procurement executive rather than the CAO. SBA stated that it has  already begun to implement the recommendation for fiscal year 2018.  SBA’s comments are reprinted in appendix XVII.

In written comments, SSA agreed with the three recommendations  that we had directed to the agency, stated that it had taken steps to  address the recommendations, and submitted supporting  documentation. In particular, SSA agreed with the recommendation to  ensure that the office of the CAO is involved in the process to identify  IT acquisitions and, in response, provided documentation that is to  detail the involvement of its Chief Financial Officer (who is the  agency’s senior procurement executive) in identifying and approving  IT acquisitions. Implementation of these steps should help ensure  appropriate oversight of IT acquisitions.

Regarding our recommendation to issue specific guidance to ensure  IT-related acquisitions are properly identified, SSA agreed with the  recommendation and stated that, according to its IT Acquisition  Approval Policy, the Chief Financial Officer notifies the CIO of IT  acquisitions by submitting acquisition plans to the CIO for approval.  However, while SSA’s policy does support this method of CIO  notification, it does not provide guidance to assist in identifying IT.

Further, SSA agreed with our recommendation to ensure that IT  acquisition plans or strategies are reviewed and approved according  to OMB’s guidance and provided its September 2017 policy for  acquisition plan approval. After reviewing this policy and SSA’s 2017  capital planning and investment control process, we updated our  report to show that SSA’s processes satisfy OMB’s requirements.  While SSA has made progress in implementing OMB’s FITARA  requirements, the agency needs to demonstrate that the CIO’s review  and approval are occurring, as 3 of the 10 acquisitions we randomly  selected were not reviewed and approved as required by OMB’s  guidance. It will be important for SSA to consider this  recommendation as it continues to implement FITARA requirements.   SSA’s comments are reprinted in appendix XVIII. The agency also  provided technical comments, which we have incorporated in the  report as appropriate.

In written comments, USAID agreed with our recommendation and  stated that the CIO and CAO are working together to (1) ensure all IT- related acquisition plans and strategies are reviewed and approved by  the CIO and (2) further communicate this requirement to the  acquisition planning stakeholders. USAID’s comments are reprinted in  appendix XIX. The agency also provided technical comments, which  we have incorporated in the report as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretaries of the Departments of Agriculture,  Commerce, Education, Energy, Health and Human Services, Housing  and Urban Development, Labor, State, the Interior, the Treasury,  Transportation, and Veterans Affairs; the U.S. Attorney General of the  Department of Justice; the Administrators of the Environmental Protection  Agency, General Services Administration, National Aeronautics and  Space Administration, Small Business Administration, and the U.S.  Agency for International Development; the Commissioner of the Social  Security Administration; the Directors of the National Science Foundation  and the Office of Personnel Management; and the Chairman of the  Nuclear Regulatory Commission. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9286 or at pownerd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix XX.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) federal agencies  identify information technology (IT) contracts and how much is invested in  them, and (2) federal agency Chief Information Officers (CIO) are  reviewing and approving IT acquisitions.

For both objectives, our review included the Office of Management and  Budget (OMB) and 22 agencies of the 24 agencies covered by the Chief  Financial Officer Act. We did not include the Department of Defense  because it is excluded from the relevant provision in the Federal  Information Technology Acquisition Reform Act (FITARA) requiring CIO  approval of IT contracts. Further, we did not include the Department of  Homeland Security because we recently issued a report that reviewed the  department’s implementation of FITARA, including the CIO’s approval of  IT contracts. For specific information on the CIOs’ review of individual IT  contracts, we focused on 10 agencies covered by FITARA that obligated  the most money to IT contracts in fiscal year 2016 (except the  Departments of Defense and Homeland Security).

To determine the extent to which federal agencies identify IT contracts  and how much is invested in them, we requested that each of the 22  selected agencies submit a list of their IT contract obligations for fiscal  year 2016. We also requested the associated contract identification  number, obligation amount, and product and service code.

In order to determine if the agencies gave us a full accounting of their IT  obligations, we used the Category Management Leadership Council’s  categorizations of federal government spending by product and service  codes. In particular, we used the Council’s list of 79 IT-related codes,  which is listed in appendix II, to identify fiscal year 2016 IT-related  contract obligations on USAspending.gov. For each funding agency, we  downloaded all contracts associated with the IT-related codes, such as  purchase orders, blanket purchase agreements, and government-wide  acquisition contracts. By comparing the resulting list of IT-related  contracts on USAspending.gov data to those provided by the agencies,  we were able to determine which IT-related contract obligations the  agencies had not identified. In doing so, we gave the agency credit for  identifying the entire IT contract if an agency identified any portion of the  contract (e.g., a contract modification). Consequently, the total of  obligations that agencies did not identify is likely higher than the totals we  were able to report.

To assess the reliability of the USAspending.gov data, we reviewed  publicly available documentation related to the database, such as the  USAspending.gov data dictionary. We also reviewed the results of our  previous reports on USAspending.gov that had identified deficiencies in  the accuracy and reliability of the reported data. For both the  USAspending.gov and agency-supplied contract data, we tested the  datasets to look for duplicate records and missing data in key fields. We  also interviewed agency officials to corroborate the data. We found the  contract data from USAspending.gov, while sometimes incomplete, were  sufficient for our purpose of identifying IT contracts and demonstrating the  amount of obligations toward IT contracts. In addition, we found the  contract data provided by the agencies to be sufficiently reliable for the  purposes of our reporting objectives. We used these data as evidence to  support our findings, conclusions, and recommendations.

We also compared the product and service codes in the lists of IT  contracts provided by the agencies to the list of IT product and service  codes developed by the Category Management Leadership Council.  From this comparison, we determined which agency-submitted  obligations were associated with IT-related product and service codes  and which obligations were associated with non-IT codes.

To determine the cause for any discrepancies between the agency- provided list of obligations and those found on USAspending.gov, we  asked each agency to describe and provide evidence of the Chief  Acquisition Officer’s (CAO) involvement in the process for identifying IT  acquisitions for CIO review. We also collected both testimonial evidence  and documentation that described the identification process for potential  IT acquisitions. We analyzed these data from each agency to determine the involvement of the CAO and officials within the CAO’s acquisition  office. We also determined the involvement of officials positioned outside  of the acquisition office, such as officials from the office requesting the IT  acquisition or from the Office of the CIO. As a result, we were able to  establish which officials were responsible for identifying acquisitions for IT  review at each agency. We also reviewed the submitted evidence to  determine whether the agencies provided guidance that clearly described  or defined IT to the identifying officials.

To determine the extent to which federal agency CIOs are reviewing and  approving IT acquisitions, we first compiled a composite list of IT-related  contracts from fiscal year 2016 for each of the 10 selected agencies by  combining:  contracts associated with IT-related product and service codes from  USAspending.gov,  contracts associated with IT vendors from USAspending.gov,  contracts linked with major IT investments as listed on OMB’s IT  Dashboard, and  contracts provided by agencies in response to our earlier request for a  list of IT contracts.

We then randomly selected 10 IT contracts from each of the 10 agencies  on which to perform additional analysis (100 total contracts). For each of  the 100 selected contracts, we asked the associated agency to confirm  that the contract was, in fact, IT-related and requested evidence of CIO or  CIO designee review and approval of the contract’s associated  acquisition. We compared the resulting documentation to FITARA and  OMB guidance to determine the extent to which the IT acquisitions had  been reviewed and approved. In order to receive full credit, agencies had  to provide evidence that the CIO had reviewed and approved the  acquisition plans or strategies for those IT acquisitions associated with  major IT investments. For IT acquisitions associated with non-major IT  investments, agencies had to provide evidence that the CIO, or a  designee that reports directly to the CIO, reviewed and approved the  acquisition plan or strategy. If agencies could not associate the IT  acquisition with a particular IT investment, we looked for evidence that the  CIO reviewed and approved the acquisition plan or strategy, since  FITARA does not state that the review and approval of these IT  acquisitions can be delegated.

To determine whether agencies had processes in place to ensure the  review and approval of IT acquisitions, we reviewed agency  documentation on IT acquisition processes and procedures and  compared it to the requirements in FITARA and OMB guidance. We  also interviewed agency officials to clarify their respective processes and  policies. In order to receive full credit, agencies had to provide evidence  that they had a process in place that required the agency CIO to review  and approve IT acquisition plans or strategies with the exception of those  associated with non-major IT investments. Agencies received partial or no  credit if their processes had one or more of the following shortfalls: approval was not documented, delegated IT acquisition review and approval without OMB approval of did not provide the CIOs or their delegates oversight of all IT  involved the review of other documentation instead of the required  acquisition plans or strategies, or did not provide department CIO oversight over IT acquisitions at the  component level.

We conducted this performance audit from July 2016 to January 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: IT-Related Product and Service Codes

In September 2015, the Category Management Leadership Council and  the Office of Management and Budget (OMB) identified a total of 79  information technology (IT)-related product and service codes, of which  43 are for IT services and 36 are for IT products. Table 4 provides details  on the IT-related services and product codes.

Appendix III: Estimated Total Fiscal Year 2016 IT Obligations by Agency

The 22 selected agencies identified approximately $14.7 billion in  obligations for information technology (IT)-related contracts in fiscal year  2016. Of that amount, approximately $14 billion was categorized as IT- related per the Category Management Leadership Council’s product and  service codes, and approximately $626 million was categorized under  other, non-IT codes. In addition to the obligations that agencies reported  to us, we identified an additional $4.5 billion in obligations for contracts  with IT-related product and service codes, raising the total amount  obligated to IT contracts in fiscal year 2016 to at least approximately  $19.2 billion. Table 5 provides details on each selected agency’s  obligations for IT-related contracts in fiscal year 2016.

Appendix IV: Agency Acquisition Processes Used to Review and Approve IT Acquisitions

The Federal Information Technology Acquisition Reform Act (FITARA)  and the Office of Management and Budget’s (OMB) associated  implementation guidance require major civilian agency chief information  officers (CIO) to review and approve acquisitions of information  technology (IT) either directly, or as full participants in the agency’s  governance processes. In particular, OMB’s guidance states that  agencies shall not approve an acquisition plan or strategy that includes IT  without the agency CIO’s review and approval. OMB’s guidance also  allows the CIO to delegate these responsibilities to other agency officials  to act as the CIO’s representative; however, staff in OMB’s Office of the  Federal CIO noted that these assignments need to be approved by  OMB. Alternatively, FITARA and OMB’s guidance allows agencies to use  IT governance processes to conduct these reviews and approvals, as  long as the CIO is a full participant in the process. Table 6 provides  details on the selected agencies’ acquisition processes and the degree to  which the processes comply with OMB’s requirements.

Appendix V: Details on Selected IT Acquisitions

Of 96 randomly selected information technology (IT) contracts at 10  agencies, 9 acquisitions associated with these contracts had been  reviewed and approved as required by the Office of Management and  Budget (OMB). The acquisitions associated with the remaining 87  contracts did not receive the appropriate levels of Chief Information  Officer (CIO) review and approval in accordance with OMB  requirements. Table 7 provides details on the selected IT acquisitions  and the CIO review and approval of them.

Appendix VI: Comments from the Department of Education

Appendix VII: Comments from the Department of Energy

Appendix VIII: Comments from the Department of Housing and Urban Development

Appendix IX: Comments from the Department of the Interior

Appendix X: Comments from the Department of Labor

Appendix XI: Comment from the Department of State

Appendix XII: Comments from the Department of Veterans Affairs

Appendix XIII: Comments from the Environmental Protection Agency

Appendix XIV: Comments from the National Aeronautics and Space Administration

Appendix XV: Comments from the Nuclear Regulatory Commission

Appendix XVI: Comments from the Office of Personnel Management

Appendix XVII: Comments from the Small Business Administration

Appendix XVIII: Comments from the Social Security Administration

Appendix XIX: Comments from the U.S. Agency for International Development

Appendix XX: GAO Contact and Staff Acknowledgments

David A. Powner, (202) 512-9286 or pownerd@gao.gov.

In addition to the contact named above, Kevin Walsh (Assistant Director),  Jessica Waselkow (Analyst in Charge), Chris Businsky, Rebecca Eyler,  Angel Ip, Tarunkant Mithani, David Plocher, Meredith Raymond, and  Adam Vodraska made key contributions to this report.