Summary
The National Aeronautics and Space Administration's (NASA) nonintegrated financial management systems have weakened its ability to oversee its contractors, and its contract management has been on GAO's high-risk list since 1990. In April 2000, NASA began its Integrated Financial Management Program (IFMP), its third attempt in recent years at modernizing financial management processes and systems. GAO was asked to review whether NASA was following key best practices in acquiring IFMP components and implementing one of the first components--the core financial module.
The core financial module, if implemented as planned, may provide some improvement to NASA's accounting system environment. However, NASA is not following key best practices for acquiring and implementing IFMP. In acquiring IFMP components, NASA is facing risks in understanding dependencies among commercial components. NASA has not analyzed the interdependencies among selected and proposed IFMP components, and it does not have a methodology for doing so. For programs like IFMP, which involve building a system from commercial components, it is essential to understand the characteristics and credentials of each component to select ones that are compatible and can be integrated without having to build and maintain expensive interfaces. By acquiring IFMP components without first understanding system component relationships, NASA has increased its risks of implementing a system that will not optimize mission performance and will cost more and take longer to implement than necessary. In implementing the core financial module, NASA is facing risks in two additional areas. User needs: NASA did not consider the information needs of key system users and deferred addressing the requirements of program managers, cost estimators, and the Congress. Although this module should eliminate NASA's separate, incompatible accounting systems, little has been done to reengineer acquisition management processes. Program managers and cost estimators indicated that they will continue to rely on other means to capture the data needed to manage programs such as the International Space Station. Requirements management: NASA is relying on a requirements management process that does not require documentation of detailed system requirements prior to system implementation and testing. Over 80 percent of the requirements GAO reviewed lacked specificity, and several could not be traced among various documents. These defects also significantly impaired the testing phase of the system implementation effort. Further, NASA has not implemented metrics to help gauge the effectiveness of its requirements management process. NASA's approach will likely result in increasing amounts of time spent on costly rework and reduced progress. Unless these issues are successfully addressed, NASA is at increased risk of having IFMP become its third unsuccessful attempt to transform its financial management and business operations.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
No director on record
No team on record
No phone on record
Recommendations for Executive Action
Recommendation: Given that NASA has already largely deployed and placed into production the IFMP commercial components acquired to date, the NASA Administrator should direct the Program Executive Officer for IFMP to focus near-term attention on stabilizing the operational effectiveness of these deployed commercial components.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for identifying known and potential risks.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for assessing the severity of the risks on the basis of probability and impact.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for developing risk mitigation strategies.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for assigning accountability and responsibility for implementing these strategies.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for tracking progress in implementing these strategies.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
Recommendation: Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for reporting progress regularly and frequently to relevant congressional committees.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: NASA has not developed a corrective action plan to identify known and potential risks. According to IFMP officials, they have an overall risk mitigation strategy related to IFMP that they use for this purpose and do not think it necessary to revise their strategy based on GAO's recommendations. Although NASA has begun to implement GAO's recommendations to improve its requirements management and cost-estimating processes, which, if implemented properly, could help to mitigate the risk associated with relying on already-deployed IFMP components, GAO continues to believe that a comprehensive corrective action plan would aid NASA in its effort to stabilize the system and improve the functionality of IFMP.
Recommendation: Additionally, this plan should provide for developing and properly documenting requirements that are consistent, verifiable, and traceable, and that contain the necessary specificity to minimize requirement-related defects.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Based on our recent audit work, NASA has now developed, documented, and implemented a requirements management process that complies with applicable standards and NASA internal requirements. NASA provided documentation that they are following these processes for the Contract Management Module Project. As a result, NASA should have more detailed, traceable requirements for this project, which should significantly decrease the amount of rework needed and help the project meet its objectives.
Recommendation: Additionally, this plan should provide for conducting thorough regression testing before placing modified components into production.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Based on our recent audit work, NASA has now implemented both disciplined requirements management processes and effective testing procedures. NASA officials are applying these new procedures to the IEMP Contract Management Module project and have indicated that they intend to follow these procedures for upcoming projects as well. As a result of these improved processes, NASA should be able to ensure significantly fewer defects and obtain reasonable assurance that an application is working as expected when new IEMP modules are put into operation.
Recommendation: Additionally, this plan should provide for implementing a metrics program that will identify and address the root causes of system defects.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: Based on our recent audit work, NASA has implemented validation processes that capture necessary metrics and allow officials to evaluate the effectiveness of processes. NASA officials have applied these new processes to the Contract Management Module project and indicated that they will be used for other IEMP projects as well. As a result, NASA should be able to more readily identify and address the root causes of system defects, which in turn should help the agency meet its cost, schedule, and performance goals for IEMP.
Recommendation: Additionally, this plan should provide for reengineering acquisition management processes, particularly with respect to the consistency and detail of budget and actual cost and schedule data provided by contractors.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: According to NASA, to fully meet this recommendation it will need to complete its new program/project management policy and guideline development, update its technical and financial data structures, implement an integrated budget, cost, schedule, and reporting capability, and implement an integrated asset management and supply chain management system.
Recommendation: Additionally, this plan should provide for engaging stakeholders--including program managers, cost estimators, and the Congress--in developing a complete and correct set of user requirements.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: NASA has implemented this recommendation. The IFM program has enhanced the method and approach used to engage all levels of stakeholders and developed new program management requirements.
Recommendation: To mitigate future risks, the Administrator should require the Program Executive Officer for IFMP, before the acquisition of any additional IFMP components, to establish and implement a methodology for commercial system component dependency analysis and decision making.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: The agency has established a methodology for analyzing and understanding the interdependencies of commercial components prior to acquiring Integrated Enterprise Management Program (IEMP) components. The methodology describes steps for risk management and requirements development and management, and references supporting tools, techniques, methods, and practices for integrating multiple commercial component products to fulfill a set of user requirements. Further, NASA issued an IEMP Quality Assurance Plan on August 7, 2006, that provides for the iterative prototyping and development approach, which is an important aspect of effective analysis of commercial component dependency analysis. According to an agency official, this approach was used for the SAP Version Upgrade IEMP component and is to be used on future IEMP projects. The agency also provided a Software Component Dependency Analysis Process document that describes, at a high-level, the technical procedures associated with software component integration efforts. By taking these actions, the agency has met the intent of the recommendation.
Recommendation: To mitigate future risks, the Administrator should require the Program Executive Officer for IFMP, before the acquisition of any additional IFMP components, to evaluate the suitability of already acquired, but not yet implemented, IFMP component products within the context of a component dependency analysis methodology.
Agency Affected: National Aeronautics and Space Administration
Status: Implemented
Comments: According to NASA, the eTravel project, an IEMP component, has been reviewed against NASA's methodology for analyzing and understanding the interdependencies of commercial components and its Software Component Dependency Analysis Process document. The review verifies that the component dependency analysis processes are being used as a part of this effort. NASA's IEMP documentation also describes how this process was used for the NASA Account Management System prototype and the Identify Management System prototype. By taking these actions, the agency has met the intent of the recommendation.
