This is the accessible text file for GAO report number GAO-03-186T entitled 'Homeland Security: OMB's Temporary Cessation of Information Technology Funding for New Investments' which was released on October 01, 2002. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products’ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. Testimony: Before the Subcommittee on Technology and Procurement Policy, Committee on Government Reform, House of Representatives: United States General Accounting Office: GAO: For Release on Delivery Expected at 10 a.m. EDT Tuesday October 1, 2002: Homeland Security: OMB’s Temporary Cessation of Information Technology Funding for New Investments: Statement of Joel C. Willemssen Managing Director, Information Technology Issues: GAO-03-186T: Mr. Chairman and Members of the Subcommittee: Thank you for inviting us to participate in today’s hearing on the temporary cessation of funding for new information technology (IT) infrastructure and business system investments related to the proposed Department of Homeland Security. This action was taken by the Office of Management and Budget (OMB) in an attempt to identify redundant investments or achieve more efficiencies in these investments by organizations expected to be part of the proposed department. Since the events of September 11, the President and the Congress have responded with important actions to protect the nation--creating the Office of Homeland Security, establishing a new agency to improve transportation security, and working in collaboration with federal, state, and local governments and private sector entities to prevent future terrorist acts. In addition, as you know Mr. Chairman, on June 18, the President transmitted draft legislation to the Congress for the creation of a new Department of Homeland Security whose mission would be preventing terrorist attacks within the United States, reducing America’s vulnerability to terrorism, and minimizing the damage and recovering from attacks that do occur.[Footnote 1] After some brief background describing the Administration’s Department of Homeland Security proposal, I will discuss, at your request, * information management and technology challenges facing the proposed department and: * OMB’s policy that selected agencies temporarily cease funding of new IT infrastructure and business system investments. Results in Brief: Integrating the diverse communication and information systems of the myriad of organizations that would be part of the proposed Department of Homeland Security would be an enormous undertaking. Among the near- term challenges that would have to be addressed to successfully tackle this task is developing an enterprise architecture. Managed properly, enterprise architectures can clarify and help optimize the interdependencies and interrelationships among related enterprise operations and the underlying IT infrastructure and applications that support them. Another near-term challenge is establishing and enforcing a disciplined IT investment management process. Well managed IT investments that are carefully selected and focused on meeting mission needs can propel an organization forward, dramatically improving performance while reducing costs. To help tackle these challenges, in July OMB issued two memoranda to selected agencies telling them to “cease temporarily” and report on new IT infrastructure and business system investments above $500,000, which are to be reviewed by IT investment review groups.[Footnote 2] Several agencies reported new IT infrastructure and business system investments to OMB, which are currently being evaluated by OMB and the investment review groups. In addition, as of September 26, three agencies had submitted emergency requests for expedited review, which were subsequently approved. However, because the non-emergency agency submissions are still being evaluated, at this time it is too early to assess the effect of OMB’s action. Background: Under the President’s proposal,[Footnote 3] 22 existing major components and about 170,000 people would be integrated into the new department in order to strengthen the country’s defenses against terrorism. Table 1 lists the major components the Administration proposes to move to the new department. Table 1: Major Components the Administration Proposes to Move to the Department of Homeland Security (by parent department/agency)A: Parent department/agency: Department of Agriculture; Components(s) proposed to be moved: Animal and Plant Health Inspection Service; Plum Island Animal Disease Center. Parent department/agency: Department of Commerce; Components(s) proposed to be moved: Critical Infrastructure Assurance Office; National Institute of Standards and Technology’s; Computer Security Division. Parent department/agency: Department of Defense; Components(s) proposed to be moved: National Communications System. Parent department/agency: Department of Energy; Components(s) proposed to be moved: Lawrence Livermore National Laboratory; National Infrastructure Simulation and Analysis; Center; Nuclear Incident Response. Parent department/agency: Federal Emergency; Management Agency; Components(s) proposed to be moved: All. Parent department/agency: General Services Administration; Components(s) proposed to be moved: Federal Computer Incident Response Center; Federal Protective Service. Parent department/agency: Department of Health and; Human Services; Components(s) proposed to be moved: Civilian Biodefense Research Program; Chemical, Biological, Radiological and Nuclear; Response Assets. Parent department/agency: Department of Justice; Components(s) proposed to be moved: Immigration and Naturalization Service; National Domestic Preparedness Office; National Infrastructure Protection Center; Office of Domestic Preparedness. Parent department/agency: Department of Transportation; Components(s) proposed to be moved: Transportation Security Administration; Coast Guard. Parent department/agency: Department of Treasury; Components(s) proposed to be moved: Secret Service; Customs Service. [A] Other organizations also proposed to be part of a new Department of Homeland Security are the Domestic Emergency Support Team, which is an interagency group currently mobilized by the Attorney General in response to major incidents, and a newly created National Bio-Weapons Defense Analysis Center. Source: The President’s proposal entitled The Department of Homeland Security, President George W. Bush, June 2002. The National Institute of Standards and Technology’s Computer Security Division was not included in the President’s original proposal but was incorporated in the President’s draft legislation to the Congress. [End of table] As we previously testified, the creation of the Department of Homeland Security will be one of the largest reorganizations ever undertaken.[Footnote 4] Performing a successful transition of this scale will take considerable time and money and, as a result, thorough planning will be critical to the successful creation of the proposed department. We have previously recommended that careful attention to fundamental public sector management practices and principles, such as strong financial, technology, and human capital management, are critical to the successful implementation of government reorganizations. [Footnote 5] Proposed Department Faces Significant IT Management Challenges: As we have previously testified,[Footnote 6] information management and technology are among the critical success factors that the proposed new department should emphasize in its initial implementation phase.[Footnote 7] As all of the programs and agencies are brought together in the proposed department, it will be an enormous undertaking to integrate their diverse communication and information systems. Some of the challenges that the proposed department will have to face and overcome include: * establishing an effective IT management organization, * implementing appropriate security controls, * instituting mature systems acquisition, development, and operational practices, * addressing human capital issues, * constructing and enforcing an enterprise architecture, and: * establishing and enforcing a disciplined IT investment management process. Let me now turn to the latter two challenges in more detail, given their near-term importance and relationship to OMB’s recent actions regarding the proposed department. Enterprise Architectures: A Hallmark of Successful Organizations: Our experience with federal agencies has shown that attempts to modernize IT environments without blueprints--models simplifying the complexities of how agencies operate today, how they want to operate in the future, and how they will get there--often result in unconstrained investment and systems that are duplicative and ineffective.[Footnote 8] Enterprise architectures offer such blueprints. Managed properly, architectures can clarify and help optimize the interdependencies and interrelationships among related enterprise operations and the underlying IT infrastructure and applications that support them. The development, implementation, and maintenance of architectures are recognized hallmarks of successful public and private organizations. Further, OMB Circular A-130, which implements the Clinger-Cohen Act of 1996,[Footnote 9] requires executive branch agencies to use them. In our February report on the use of enterprise architectures in the federal government, we provided an initial version of an enterprise architecture maturity framework to serve as a standard for measuring the status and progress of agencies’ architecture efforts.[Footnote 10] Figure 1 provides a simplified depiction of this framework. Figure 1: GAO’s Five Stages of Enterprise Architecture Maturity (version 1.0): [See PDF for image] Source: GAO. [End of figure] Our February report found that agencies’ use of enterprise architectures was a work in progress, with much to be accomplished. This is demonstrated by table 2, which lists the maturity stage (1 representing the lowest maturity and 5 representing the highest) of the parent organization and, if available, the entity within this organization that is proposed to be moved to a new Department of Homeland Security. Table 2: Maturity Stage of Parent Organizations and, Where Available, the Entity Proposed to be Moved to a New Department of Homeland Security: Department/agency: Department of Agriculture; * Animal and Plant Health Inspection Service; Enterprise architecture maturity stage: 1; 1. Department/agency: Department of Commerce; Enterprise architecture maturity stage: 3. Department/agency: Department of Defense; Enterprise architecture maturity stage: 3. Department/agency: Department of Energy; Enterprise architecture maturity stage: 2. Department/agency: Federal Emergency Management Agency; Enterprise architecture maturity stage: 2. Department/agency: General Services Administration; Enterprise architecture maturity stage: 2. Department/agency: Department of Health and Human Services; Enterprise architecture maturity stage: 1. Department/agency: Department of Justice; * Immigration and Naturalization Service; Enterprise architecture maturity stage: 3; 1. Department/agency: Department of Transportation; * Coast Guard; Enterprise architecture maturity stage: 2; 2. Department/agency: Department of the Treasury; * Secret Service; * Customs Service; Enterprise architecture maturity stage: 1; 2; 5. Note: Only those component entities for which we have enterprise architecture data are listed. Source: GAO. [End of table] To its credit, OMB recognizes the importance of an enterprise architecture and has reported that it is in the process of defining a framework for creating a national enterprise architecture for homeland security. IT Investment Management: A Process to Improve Performance and Reduce Costs: Investments in IT can have a dramatic impact on an organization’s performance. Well managed IT investments that are carefully selected and focused on meeting mission needs can propel an organization forward, dramatically improving performance while reducing costs. Likewise, poor investments, those that are inadequately justified or whose costs, risks, and benefits are poorly managed, can hinder and even restrict an organization’s performance. Recognizing this, in 1996 the Congress passed the Clinger-Cohen Act, which requires agencies to implement IT investment and capital planning processes. In support of the Clinger-Cohen Act, in May 2000, we issued the Information Technology Investment Management (ITIM) maturity framework,[Footnote 11] which identifies critical processes for successful IT investment management and organizes these processes into an assessment framework comprising five stages of maturity. Each stage builds upon the lower stages and enhances the organization’s ability to manage its IT investments. Figure 2 shows the five ITIM stages and provides a brief description of each stage. Figure 2: The five stages of Maturity Within ITIM: [See PDF for image] Source: GAO. [End of figure] Using this model, our evaluations of selected agencies, including the Coast Guard and the Immigration and Naturalization Service, found that while some processes have been put in place to help them effectively manage their planned and ongoing IT investments, more work remains.[Footnote 12] For the proposed new department, OMB has reported that it is defining a framework for an IT capital planning process, which is an important step in developing strong IT management at the outset. The ITIM framework can provide a useful roadmap for new organizations--like the proposed Department of Homeland Security--for implementing a fundamentally sound IT capital planning and investment management process, because it identifies the key practices for creating and maintaining such a process. Agencies Told to Temporarily Cease Funding for New IT Infrastructure and Business System Investments, but It Is Too Early to Assess Effect: In July, OMB issued two memoranda[Footnote 13] to selected agencies telling them to (1) cease temporarily new IT infrastructure and business system (i.e., financial management, procurement, and human resources systems) investments above $500,000 pending a review of the investment plans of all proposed Department of Homeland Security component agencies, (2) identify and submit to OMB information on any current or planned spending on these types of initiatives, and (3) participate in applicable IT investment review groups[Footnote 14] co- chaired by OMB and the Office of Homeland Security. According to OMB, its goal in issuing these memoranda is to seek opportunities for improved effectiveness and economy (including millions in anticipated savings). In addition, according to officials from OMB’s Office of Information and Regulatory Affairs, another purpose was to obtain an inventory of current and planned IT infrastructure and business system investments for organizations that would be moved to the proposed Department of Homeland Security. This information is expected to help in the Administration’s transition planning for the proposed department. Table 3 summarizes the funding for new IT infrastructure and business system investments for fiscal years 2002 and 2003 that the affected agencies submitted to OMB in response to the July memoranda. Table 3 may not include all investments being reviewed by OMB and the investment review groups. In particular, we did not include operations and maintenance funding because OMB reported that its July memoranda did not affect “steady state” spending needed to continue operations. Table 3: Agencies’ Reported Funding for New IT Infrastructure and Business System Investments for fiscal years 2002 and 2003 (in thousands)A: Department/agency: Department of Agriculture; * Animal and Plant Health Inspection Service; IT Infrastructure: Fiscal year 2002: 3,100; IT Infrastructure: Fiscal year 2003: 3,200; Business Systems: Fiscal year 2002: Not applicable[B]; Business Systems: Fiscal year 2003: Not applicable. Department/agency: Department of Commerce; IT Infrastructure: Fiscal year 2002: Not applicable; IT Infrastructure: Fiscal year 2003: Not applicable; Business Systems: Fiscal year 2002: Not applicable; Business Systems: Fiscal year 2003: Not applicable. Department/agency: Department of Defense; IT Infrastructure: Fiscal year 2002: Not applicable; IT Infrastructure: Fiscal year 2003: Not applicable; Business Systems: Fiscal year 2002: No submission requested by OMB[C]; Business Systems: Fiscal year 2003: No submission requested by OMB. Department/agency: Federal Emergency Management Agency; IT Infrastructure: Fiscal year 2002: 7,500; IT Infrastructure: Fiscal year 2003: 4,000; Business Systems: Fiscal year 2002: 1,700; Business Systems: Fiscal year 2003: 700. Department/agency: Department of Justice; * Immigration and Naturalization Service[D]; IT Infrastructure: Fiscal year 2002: 40,155; IT Infrastructure: Fiscal year 2003: 83,900; Business Systems: Fiscal year 2002: 0; Business Systems: Fiscal year 2003: 0. Department/agency: Department of Transportation; * Transportation Security Administration; * Coast Guard; IT Infrastructure: Fiscal year 2002: 40,300; No written response submitted to OMB[E]; IT Infrastructure: Fiscal year 2003: 0; No written response submitted to OMB; Business Systems: Fiscal year 2002: Not applicable; ; No written response submitted to OMB; Business Systems: Fiscal year 2003: Not applicable; No written response submitted to OMB. Department/agency: Department of the Treasury; * Secret Service[F]; * Customs Service[G]; IT Infrastructure: Fiscal year 2002: 0; 200; IT Infrastructure: Fiscal year 2003: 0; 4,000; Business Systems: Fiscal year 2002: 0; 3,790; Business Systems: Fiscal year 2003: 0; 4,210. [A] OMB sent the July memoranda to those agencies that had the larger organizations that would be part of the proposed Department of Homeland Security and did not send them to the Departments of Energy and Health and Human Services and the General Services Administration, which also have components that would be moved under to the proposed department. [B] Not applicable means that the agency reported that it did not have any system investments meeting OMB’s criteria. [C] OMB did not request that the Department of Defense provide information on business system investments. [D] The Immigration and Naturalization Service also reported an additional $2.85 million and $3.05 million in fiscal years 2002 and 2003, respectively for internet and intranet projects, but did not specify whether these funds were new funds or for operations and maintenance. [E] The Coast Guard stated that it did not provide OMB with a list of system investments, noting that it addressed most of its investment issues with the investment review groups. [F] The Secret Service reported no new funding for current and planned IT infrastructure and business system investments. However, its submission indicated that it intended to conduct various planned upgrades, such as an upgrade to its Enterprise Financial Management System, and the implementation of a search engine using operations and maintenance funding. [G] In addition to the new funding for IT infrastructure and business system investments included in the table, the Customs Service’s submission stated that it had “planned upgrades for standard growth” for several initiatives in which it planned to use operations and maintenance funding. Source: Applicable agencies. We did not validate this information. The July memoranda also stated that, if an agency had a critical need or emergency, it could submit information for an expedited review. As of September 26, agencies had requested three emergency requests for expedited review. Specifically, according to OMB, the following emergency requests have been approved, (1) a Coast Guard request to proceed with a licensing agreement with Microsoft, (2) a Transportation Security Administration request to proceed with a task order for a managed services contract, and (3) a Secret Service request to go forward with a search engine that would conduct database searches across the agency. [End of table] Mr. Chairman, you asked us to identify the process being used in reviewing the projects submitted under OMB’s memoranda, the criteria being used in determining which projects would go forward, and the length of time that the memoranda are expected to be in effect. First, OMB has not yet finalized its process for reviewing the IT infrastructure and business system investments reported by the agencies. However, officials from OMB’s Office of Information and Regulatory Affairs told us that OMB expects to use the same basic process that it used in addressing the emergency requests. Namely, (1) agencies will submit information on their new IT infrastructure or business system investments to OMB, (2) OMB and the applicable IT investment review group will review the agency submission, and (3) the applicable review group will make a recommendation. Once a recommendation is made, according to these officials, the normal budget execution process will be implemented, which may require additional action by OMB or the applicable agency head. Second, regarding the criteria for evaluating current and planned IT investments of affected agencies, officials from OMB’s Office of Information and Regulatory Affairs stated that they will use the principles contained in section 300 of OMB Circular A-11 and section 8(b) of OMB Circular A-130. These circulars instruct agencies to develop, implement, and use capital programming processes that, for example: (1) evaluate and select capital assets investments that will support core mission functions and demonstrate projected returns on investments that are clearly equal to or better than alternative uses of public resources, (2) ensure that improvements to existing information systems and planned information systems do not unnecessarily duplicate IT capabilities within the same agency, and (3) institute performance measures and management processes that monitor and compare actual performance to planned results. Finally, OMB Office of Information and Regulatory Affairs officials did not know how long the memoranda would remain in effect, stating that they will remain in effect until their goals are met. Specifically, these officials stated that whether and how long the investment review groups established by the memoranda continue to operate will in large part depend on if or when legislation establishing the Department of Homeland Security is enacted. Impact of OMB’s Action Too Early to Assess: Mr. Chairman, you also asked us to address the impact of the OMB memoranda on the affected agencies. Although OMB directed selected agencies to temporarily cease these investments, it does not necessarily mean that work is to be stopped on all IT infrastructure and business system projects at the applicable agencies. First, the memoranda only pertain to funding for new development efforts and not to existing systems in a “steady state” using operations and maintenance funding. Second, the cessation does not apply if funds pertaining to a development or acquisition contract have already been obligated. Third, as I previously noted, agencies can request an expedited review to obtain the approval to proceed if they have an emergency or critical need. The following are examples of how OMB’s direction to cease temporarily would apply in certain circumstances. * If an agency had an existing procurement system in a “steady state” in which no major modifications or modernization efforts were planned, there would be no effect on the funding of this system. * If an agency had an ongoing contract with available obligations for the development of a financial management system, there would be no effect on this contract, but new obligations for development or modernization efforts would be required to be approved by the Business Systems IT Review Group. * If an agency wanted to award a contract for a new or modernized IT infrastructure item, such as a local-area-network, over $500,000, it would be required to obtain approval from the Homeland Security IT Investment Review Group before proceeding. At this time it is not possible to assess the full effect of the July memoranda on the selected agencies. Except for emergency requests, according to officials from OMB’s Office of Information and Regulatory Affairs, the investment review groups have not taken any action on the agencies’ submissions in response to the July memoranda because neither they nor OMB have completed their reviews of these documents. In addition, OMB officials stated that OMB is not tracking whether, or to what extent, agencies have halted spending or altered system plans as a result of the July memoranda. Although it may be too early to evaluate the results of the July memoranda at this time, OMB has stated that the investment review groups would track any savings resulting from its actions, which should provide some information to help assess the outcome of the temporary cessation in the future. At least one agency has put planned initiatives on hold pending the establishment of the Department of Homeland Security. Specifically, in its submission to OMB in response to the July memoranda, the Federal Emergency Management Agency reported that it had put all initiatives related to two projects, including its Personnel Resources Information Systems Mart, on hold pending the creation of the Department of Homeland Security. Mr. Chairman, this concludes my statement. I would be pleased to answer any questions that you or other members of the subcommittee may have at this time. Contact: If you should have any questions about this testimony, please contact me at (202) 512-6240 or via e-mail at willemssenj@gao.gov. FOOTNOTES [1] The House of Representatives has passed (H.R. 5005), and the Senate is considering (S. 2452) legislation to create a Department of Homeland Security. Although the bills are different, they share the goal of establishing a statutory Department of Homeland Security. [2] Two review groups were established, the (1) Homeland Security IT Investment Review Group, which is to review IT infrastructure investments and (2) Business Systems IT Review Group, which is to review business system investments. [3] The President’s proposal entitled The Department of Homeland Security, President George W. Bush, June 2002. [4] U.S. General Accounting Office, Homeland Security: Critical Design and Implementation Issues, GAO-02-957T (Washington, D.C.: July 17, 2002). [5] U.S. General Accounting Office, Government Reorganization: Issues and Principles, GAO/T-GGD/AIMD-95-166 (Washington, D.C.: May 17, 1995). [6] U.S. General Accounting Office, Proposal for Cabinet Agency Has Merit, But Implementation Will be Pivotal to Success, GAO-02-886T (Washington, D.C.: June 25, 2002). [7] Other critical success factors include strategic planning, organization alignment, communication, building partnerships, performance management, human capital strategy, knowledge management, financial management, acquisition management, and risk management. [8] For example, U.S. General Accounting Office, Air Traffic Control: Complete and Enforced Architecture Needed for FAA Systems Modernization, GAO/AIMD-97-30 (Washington, D.C.: Feb. 3, 1997) and Tax System Modernization: Blueprint Is a Good Start but Not Yet Sufficiently Complete to Build or Acquire Systems, GAO/AIMD/GGD-98-54 (Washington, D.C.: Feb. 24, 1998). [9] Clinger-Cohen Act of 1996, P.L. 104-106, section 5125, 110 Stat. 684 (1996). [10] U.S. General Accounting Office, Information Technology: Enterprise Architecture Use across the Federal Government Can Be Improved, GAO-02-6 (Washington, D.C.: Feb. 19, 2002). [11] U.S. General Accounting Office, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, Exposure Draft, GAO/AIMD-10-1.23 (Washington, D.C.: May 2000). [12] For example, see U.S. General Accounting Office, Information Technology: INS Needs to Strengthen Its Investment Management Capability, GAO-01-146, Dec. 29, 2000) and Information Technology Management: Coast Guard Practices Can Be Improved, GAO-01-190 (Washington, D.C.: Dec. 12, 2000). [13] Office of Management and Budget, Reducing Redundant IT Infrastructure Related to Homeland Security, M-02-12 (July 19, 2002) and Review and Consolidation of Business Management Systems for the Proposed Department of Homeland Security, M-02-13 (July 30, 2002). [14] Two review groups were established, the (1) Homeland Security IT Investment Review Group, which is to review IT infrastructure investments, such as local area networks and desktop services and (2) Business Systems IT Review Group, which is to review business system investments, including those related to financial management, human resources, and procurement systems.