Search Options
Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us

SECY-98-032

February 27, 1998

PURPOSE:

The purpose of this paper is to inform the Commission of our plans to implement a revised Capital Planning and Investment Control (CPIC) process. The proposed new CPIC process is attached.

BACKGROUND:

The Clinger-Cohen Act (formerly the Information Technology Management Reform Act or ITMRA) of 1996 required each Federal agency head to design and implement a CPIC process for evaluating information technology (IT) projects.

A proposed prototype process for the fiscal year (FY) 1999 budget cycle was detailed in a memorandum dated November 21, 1996, from the Executive Director for Operations to Chairman Jackson. The prototype was approved in a memorandum dated January 8, 1997, from Chairman Jackson to the Acting Chief Information Officer.

DISCUSSION:

During the FY 1999 budget cycle, three major proposed IT projects (the Reactor Program System - RPS, PC Replacement, and the Agencywide Document Access and Management System - ADAMS) were reviewed using the prototype CPIC process. Subsequently, the Office of the Chief Information Officer (OCIO) staff solicited comments from participants in that process. And, in July 1997, OCIO staff attended a Best Practices Workshop in which 23 agencies shared their CPIC experiences.

Lessons Learned From NRC and Other Agencies' Experiences

From NRC experience, we learned the following:

• Preparation of the CPIC analyses and reports was resource intensive and time consuming. Therefore, resources devoted to CPIC analysis should be scaled to the size and complexity of the proposed IT investment.
• The CPIC review period was lengthy, partially because each successive reviewing body asked for new alternatives to be evaluated.
• The roles and focus of reviewing bodies need to be better defined (e.g., both the IT Council and the Budget Review Group reviewed technical alternatives and budget issues).
• In addition to forcing more discipline into the review of proposed projects, the process helped identify the true scope of proposed projects, required identification and comparison of alternatives, clarified interrelationships between IT systems, provided detailed information that allowed more accurate cost estimates, and assessed return on investment, project management, and technology risk.
• It is impractical to backfit, generate, or re-create CPIC analyses for IT investments that were begun before the NRC adopted a CPIC process. (Therefore, formal CPIC analyses will be required only for proposed new IT investments with defined functional requirements, i.e., the selection phase in Office of Management and Budget and General Accounting Office [OMB/GAO] guidance.)
• Proposed IT investments in the concept phase need "seed money" to define the scope and requirements of the project in order to prepare a CPIC analysis and to make a refined business case.
• Unless a proposed project has obtained a budget "placeholder" (e.g., STARFIRE, the new financial management system) or unless approved budget is reallocated, new projects receiving approval would normally wait up to 2 years for funds to begin design and development because of the budget cycle.

From the Best Practices Workshop, we learned the following:

• The maturity of NRC's CPIC process appears to be comparable to that at other agencies.
• Nearly every agency and organization reported success in implementing portions of the CPIC "Selection" or project concept phase.
• Fewer agencies have made significant progress in the other two CPIC phases, that is, the "Control" or project phase and the "Evaluation" or operations phase.
• Four of the seven major Government agencies making formal presentations stated that IT investment evaluations and comparisons were made at the program office level in their respective agencies, that is, IT investments in one business area were not ranked against those in another area to generate an agency-level prioritized list of IT investments.
• Among the barriers to the successful implementation of a CPIC process, three were particularly noteworthy:

• Adopting overly complicated processes and reporting procedures
• Tendency to adopt a one-size-fits-all process (lack of flexibility)
• Failure to take decisive action on projects exceeding planned budget

Principles Underlying the Proposed New CPIC Process

The proposed new CPIC process is based on the following principles:

• Business/program requirements will drive IT investment decisions.
• Business/program area leaders (i.e., project sponsors) will establish the priorities for the use of IT resources in their business areas.
• Prior to entering into the CPIC process, proposed projects will be screened to ensure that the sponsor has considered ways to optimize efficiency and effectiveness of agency operations (i.e., process optimization).
• Management review of a sponsor's proposed IT investment will focus on the business case (need), effective integration with other IT projects that support the same or related business processes throughout the NRC, and potential overlaps or interfaces with other users' requirements.
• OCIO review of a proposed IT investment will primarily focus on conformance with data and systems architectures, standards, costing, timing, systems integration, technology selection, redundancy, infrastructure, and project management. OCIO review will also ensure that business process optimization and overlapping requirements are addressed by the sponsor before approval of the IT project.
• The CPIC process will promote more discipline and accountability in the IT investment process without imposing an undue burden on the NRC program staff.
• Each project will have a Project Management Plan, which is an agreement between the CIO and the project's business sponsor on the scope, staffing, schedule (with milestones and deliverables), the budget, the use of standards, the acquisition vehicle, and the performance goals of the project.
• The business project sponsor will be empowered to manage the project within its Project Management Plan.

Summary of Changes in the Proposed CPIC Process Based on Lessons Learned and Underlying Principles

The proposed new process continues to satisfy the law, addresses OMB guidance, and improves on the prototype process by

• Integrating the CPIC process with the NRC's planning framework by receiving information from and providing it to that framework at appropriate junctures.
• Streamlining the process and the documentation required.
• Replacing the IT Council with an Information Technology Business Council (ITBC) having authority to make binding decisions on proposed IT investments to
• Eliminate overlap of multiple review bodies, and
• Place review authority with individuals knowledgeable about NRC's business needs, and IT systems and architecture
• Using the project or control phase cost rather than life cycle cost as the criteria for determining the amount of documentation and the level of review
• Project phase is where cost overruns, due to changes in requirements and schedule slippages (factors which can be managed), typically occur, and
• Life cycle cost estimates are difficult to estimate at the project screening phase (however life cycle costs will be estimated in the CPIC analysis of alternatives)
• Using an estimated project cost of $500K as a threshold
• CIO initial review and abbreviated CPIC analysis if less than $500K
• ITBC initial review and indepth CPIC analysis if $500K or greater
• Defining the following three steps for the selection phase of the process if estimated project phase cost is $500K or greater. (See Figure 1 for project cost less than $500K)

• Placing accountability with the business project manager during the control or project phase. (An IT investment proposal becomes a project when its functional requirements are identified and it has been approved to proceed, is funded with a project team in place and a project workplan defined. It remains a project until all work is completed and the system is operational.)
• Requiring that if at any point in its development, in the view of the business or technical project managers, the project cost is going to exceed 5 percent (as opposed to OMB's reporting requirement for a variance of 10 percent) of the cost estimated at project initiation, the project enters the variance category.
• Requiring that lower cost projects be stopped pending consideration of the need for an indepth CPIC analysis if the variance would put them over the $500K threshold.
• Requiring that business sponsors of projects in the variance category ask the EC (or CIO if project is less than $500K) for approval to continue and additional funds from the Chief Financial Officer (CFO), before the anticipated cost overrun occurs.
• Establishing an IT application systems investment fund to provide interim funding for high priority projects with an approved business case (requirements analysis, CPIC alternatives analysis, and project management plan). The fund will provide startup funding for an approved project to begin development during the period when sponsor-provided seed money is exhausted and money is not yet available through the budget process. The CIO in consultation with the CFO will make a recommendation for the amount of the fund. The recommendation will be based on proposed projects identified in the IT planning call and historical experience at the agency and will be reviewed during the normal budget process. We anticipate that the size of the fund would be on the order of $2-3M. Monies from the fund will not be released for use until a project is approved via the CPIC process.

Coordination

The Chief Financial Officer has reviewed this Commission Paper for resource implications and has no objections. This paper has been coordinated with the Executive Director for Operations who has no objections. The Office of the General Counsel (OGC) has reviewed this paper and has no legal objections (see Enclosure 3, which reflects OGC guidance).

Next Steps

We plan to proceed to modify the CPIC guidance and to implement the new process within 10 working days of the date of this paper. We plan to have the NRC CPIC process peer review by the CIO Council's Capital Planning subcommittee as part of its planned assessment of agency implementation of capital planning guidance. The CPIC procedures will be refined to reflect feedback from this peer review, if appropriate.

ENCLOSURE 1

The Proposed NRC Capital Planning and Investment Control Process (CPIC)

This document describes the Capital Planning and Investment Control (CPIC) process for a proposed new project. Figure 1 is a graphical representation of the process.

PROCESS TRIGGERING ACTION - IT PROJECT PROPOSAL SCREENING FORM SUBMISSION

• A sponsoring organization identifies a business need for a proposed information technology (IT) investment and completes and submits to the Office of the Chief Information Officer (OCIO) an IT Project Proposal Screening Form (see Enclosure 2).

Initial Screening by OCIO

• The OCIO uses the Screening Form to make a preliminary determination as to whether the sponsor has compared NRC business practices and operations with "best practices" in other agencies and considered ways to change agency operations to improve efficiency and effectiveness. If these background activities have not been accomplished, the OCIO returns the proposal to the sponsor.
• The OCIO uses the Screening Form to determine whether the proposal is reviewed by the Information Technology Business Council (ITBC) or the OCIO and whether a more in-depth or an abbreviated CPIC analysis is required. This determination is based on a preliminary cost estimate of the proposed investment's project phase. (An IT investment proposal becomes a project [i.e., enters the project phase] when its functional requirements are identified, it has been approved to proceed, is funded, with a project team in place and a project workplan defined. It remains a project until all work has been completed and the system is operational.)

NEXT STEPS IF PROJECT COST GREATER THAN $500,000

Concept/Selection Phase

Step 1 - Review of Screening Form

• The ITBC reviews the Screening Form to verify that the sponsor has compared the NRC business process with best practices and considered process reengineering. If so, the ITBC continues the review of the form to evaluate the business case for the concept. The ITBC reviews the proposed investment from an overall agency perspective, including agency operations and process optimization, the business need, and overlap, duplication, and integration with other existing or planned application systems supporting related business processes throughout the agency. (The ITBC review is basically at a conceptual level.)
• If the ITBC determines the proposed investment has value for the NRC, the sponsor allocates money from its budget (seed money) to scope the project and begin the CPIC process. The CPIC process includes defining requirements; identifying alternatives; identifying appropriate commercial off-the-shelf application software (if available); estimating the life cycle costs (based on 5 years of operations), benefits, and risks of the project under all alternatives; and developing (in conjunction with the OCIO) a Project Management Plan. (The Project Management Plan includes staffing, the schedule (with milestones and deliverables), the budget, the use of standards, the acquisition vehicle, and the performance goals of the project.)

Step 2 - CPIC Analysis

• The final CPIC analysis is reviewed by the ITBC and the OCIO. OCIO review of a proposed IT investment will primarily focus on conformance with data and systems architectures, standards, costing, timing, systems integration, technology selection, redundancy, infrastructure, and project management. OCIO review will also ensure that business process optimization and overlapping requirements are addressed by the sponsor.
• If the ITBC supports the CPIC analysis and alternative recommended, and the CIO agrees that the alternative is consistent with data and systems architectures, standards, etc., the project (via the CPIC analysis) is presented by the business sponsor to the Executive Council (EC) to request the go ahead to "begin" the project phase.

Step 3 - EC Approval

• If approved by the EC, a project is given the go-ahead and funding is requested through the normal budget process
• Appropriate output measures and targets for the project are identified

Project/Control Phase

• Once an IT investment receives funding, the CIO determines whether to recommend to the Chairman and the Commission that it be reported to the Office of Management and Budget (OMB) as a major system in the annual NRC Performance Plan. Criteria for determining whether the IT investment should be reported include the magnitude of the project phase cost, the estimated life cycle cost, risks, whether the resulting system would be critical to the NRC mission, and whether the resulting system would have a significant role in the administration of agency programs, finances, property, or other resources.
• Once a project is underway, the business project manager will report progress on project performance goals (cost, schedule, and capability to meet specified requirements) in the appropriate program operating plan and provide periodic reviews to the EC. (This effort is supported by the Office of the CIO.)
• If at any point in its development, in the view of the business and the technical project managers, the project development cost is going to exceed 5 percent of the cost estimated at project initiation, the project enters the variance category. Sponsors of projects in that category must explain the issues involved causing the expected overrun to the EC, request approval from the EC to continue, and request additional funds from the Chief Financial Officer, before the cost overrun occurs.

Operational/Evaluation Phase

• Once an IT investment leaves the project phase and becomes operational, the CPIC project sponsor will begin to measure program improvements.
• Within six months after the system becomes operational, the sponsor will compare original project goals (costs, schedule, and capability to meet specified requirements), projected program benefits, and risks against the actual project experience and prepare a summary of lessons learned. Lessons learned will be used to improve the CPIC process and as guidance for managers of future projects.

PROJECT COST LESS THAN $500,000

Proposed IT investments with estimated project costs of less than $500,000 would need the CIO's approval. The CIO has the discretion to ask the ITBC to review these proposed IT investments. As shown in Figure 1, such projects would require less documentation and fewer reviews. Sponsors of projects in the variance category must ask the CIO for approval to continue (pending additional funds being made available by the sponsoring office), before the cost overrun occurs. These projects will be stopped pending the consideration of the need for an in-depth CPIC analysis if the variance would put them over the $500K threshold.

Role and Responsibilities of the Chairman and the Commission in the CPIC Process

The Chairman, in accordance with the Clinger-Cohen Act, reports yearly to OMB any significant variance from project cost, performance, or schedule goals established for major IT investments. (OMB's Circular A -11 defines significant variance as 10 percent or more deviation from the baseline project phase costs initially reported.)

The Commission would review and approve the major projects reportable to OMB as part of its review of the annual NRC Performance Plan.

FIGURE 1

Proposed IT Project Review Framework

Triggering Action - Sponsor prepares and submits IT Project Proposal Screening Form to OCIO for initial screening. Review path then determined by the estimated project cost.

ENCLOSURE 3

Specific Procedures Addressing Clinger-Cohen Act Section on "Content of Process"

This enclosure addresses elements of the Clinger-Cohen Act identified by the Office of the General Council as not being explicitly covered in the Commission Paper or Enclosure 1. Note that the references are to the Steps identified in Enclosure 1, "The Proposed NRC Capital Planning and Investment Control Process."

Procedures to be included in the document providing detailed guidance for implementing the Capital Planning and Investment Control process are as follows:

• The CPIC process for a proposed investment as identified in Step 1 - Project Screening, shall include a determination by the project sponsor as to whether the investment would result in shared benefits or costs for other Federal agencies or State or local governments.
• The CPIC process for a proposed investment shall identify quantifiable measurements including costs, staff resources, and risks. When feasible and meaningful, the CPIC process shall identify quantifiable measurements of benefits. The CPIC process shall also identify qualitative benefits.
• The CPIC process for a proposed investment shall identify minimum evaluative criteria for consideration, including projected net, risk-adjusted return on investment, to the extent to which it is deemed practical, feasible, and could be meaningfully applied.

Procedure to be included in a Charter for the Information Technology Business Council:

• In Step 2 - CPIC Analysis, the Information Technology Business Council (ITBC) shall apply any criteria developed during Step 1 of the initial phase of the CPIC process, including the quantifiable and qualitative measures, when considering whether to recommend the undertaking of a particular information technology investment. To the extent to which it is deemed practical, feasible and they can be meaningfully applied, the ITBC shall consider these same criteria when comparing alternative information technology investments in a specific business or program area.
  (Note that prioritization of information technology investments will occur during the budget formulation process when all proposed expenditures are evaluated in terms of their contribution to meeting NRC's mission subject to the availability of funds).

ENCLOSURE 2
(February 9, 1998)

IT PROJECT PROPOSAL SCREENING FORM

MISSION NEED:

What are the business needs, both internal and external, that are driving this project? How do they relate to the Commission's mission, strategic plan and performance plan? What specific goals and measures will this project support? List the primary benefits of the project. How is it expected to improve mission/program/operational performance?

PROJECT OBJECTIVES:

What are the principal objectives of the project?

PROCESS BENCHMARKING AND REDESIGN:

Describe background and project preparatory activities conducted to date. Which of the following have been accomplished: (a) Benchmarking - comparison of NRC business practice and operations with "best practices" in other organizations? (b) Process optimization - consideration of ways to change agency operations to improve efficiency and effectiveness?

INTEGRATION WITH BUSINESS AREA PLANS:

What business areas, functions, and processes does the proposed project support? (Please identify on page 3.) What is the relationship of the project to current plans for the business area as a whole, i.e., what is the relationship of the proposed project to other existing or planned applications systems? What existing systems, if any, will the new system replace? What are the plans for integration and data sharing with other systems? What involvement is needed by other offices, including both offices that will create data for the system as well as offices that will use the system to conduct their business?

USERS:

If the project would create an application system, which offices would use the system? Would the regions use the system? How many of the agency's staff would have access to the system? Would the public have access to the system?

INFRASTRUCTURE IMPACT:

What IT infrastructure needs (PC capabilities, telecommunications, etc.) are associated with this project and when are these capabilities needed? Highlight any needs for infrastructure upgrades (e.g., telecommunications upgrades, software not currently on the LAN) that exceed currently planned and scheduled infrastructure capabilities.

STAFFING:

If a proposed IT project is approved and funded, is the office prepared to manage it on a full-time basis? What office plans have been made for providing a project manager and necessary staffing for detailed requirements analysis, prototyping, testing, etc.? What staff support is needed from OCIO and when?

ACQUISITION PLANS:

What IT equipment, software, and development service purchases are anticipated and what general acquisition approach is planned? Have you explored whether a commercially-available "off-the-shelf" application might satisfy your requirements or do you intend to develop a customized application? If acquisition vehicles other than those available through OCIO are anticipated, the office should highlight these.

SECURITY REQUIREMENTS:

Would the project create an application system that processes classified or sensitive data? (See definition in the glossary of Management Directive, Volume 12, Security)

PRELIMINARY ESTIMATED COST FOR PROJECT PHASE:

What is the estimated cost category of the Project Phase of the proposed IT investment? (An IT investment proposal becomes a project when its functional requirements are identified, has been approved to proceed, is funded, has a project team in place, and has a project workplan defined. It remains a project until it becomes an installed operational system). Cost categories are (1) Less than $500K, (2) $500K to $1M, (3) Over $1M but less than $3M, and (4) $3M or more.

ESTIMATED SEED MONEY:

Assuming the proposed project is approved to proceed, what is the estimated amount of seed money that will be required to prepare the business case for the project? Primary elements of the business case are (a) identify and define requirements, (b) identify potential solution together with several alternatives (including the status quo), (c) estimate the life cycle costs, benefits, and risks of each alternative, and (d) prepare, together with the OCIO, a detailed Project Management Plan with staffing, budget, schedule, milestones, and performance goals. Note that projects with estimated development costs of less than $500K will require an abbreviated business case, appropriately scaled to the size of the project.

DEFINITIONS:

APPLICATION SYSTEM: Computer hardware, software and procedures designed to capture, store, manipulate, retrieve and report data/information. (excludes scientific codes and single-user personal productivity applications).

NEW APPLICATION SYSTEM: Automation of a manual process or changes to an existing application significant enough to require a complete system rewrite.

MAJOR MODIFICATION TO AN APPLICATION SYSTEM: Changes to an existing application system, hardware or software, that go far beyond slight adjustments to the functionality. Adjustments including significant equipment and/or hardware changes or many data elements, reports, queries and process changes would be considered major. Adding, deleting or changing a few data elements or a few reports/queries would be considered a minor enhancement or maintenance.

INFRASTRUCTURE: Includes hardware, software, services, equipment, and components necessary to support local and enterprise-wide information technology requirements. This includes desktop systems, customer service, network components and services, telecommunications components and services, operational support, and maintenance.

PLEASE CIRCLE THE BUSINESS FUNCTION(S) THE PROPOSED PROJECT SUPPORTS