While IT investments have the potential to improve lives and organizations, federally funded IT projects can—and, too often, have— become risky, costly, and unproductive mistakes. We have previously reported that the federal government has spent billions of dollars on failed or troubled IT investments, such as the Office of Personnel Management’s (OPM) Retirement Systems Modernization program, which was canceled in February 2011, after spending approximately $231 million on the agency’s third attempt to automate the processing of federal employee retirement claims; the United States Coast Guard’s effort, initiated in 2010, to replace its aging electronic health records system, but which was discontinued in October 2015 after spending nearly $67 million. As a result, the Coast Guard currently has a manual, paper-based health records management process; the tri-agency National Polar-orbiting Operational Environmental Satellite System, which was halted in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion; the Department of Veterans Affairs’ (VA) Scheduling Replacement Project, which was terminated in September 2009 after spending an estimated $127 million over 9 years; the Farm Service Agency’s Modernize and Innovate the Delivery of Agricultural Systems program, which was halted in July 2014 after spending $423 million to modernize IT systems over 10 years; and the Department of Health and Human Services’ (HHS) Healthcare.gov website and its supporting systems, which were to facilitate the establishment of a health insurance marketplace by January 2014, but which encountered significant cost increases, schedule slips, and delayed functionality. These failed or troubled projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT investments. To help address these ongoing challenges, in February 2015, we added improving the management of IT acquisitions and operations to our list of high-risk areas for the federal government. This area highlighted several critical IT initiatives in need of additional congressional oversight, including (1) reviews of troubled projects; (2) efforts to increase the use of incremental development; (3) efforts to provide transparency relative to the cost, schedule, and risk levels for major IT investments; (4) reviews of agencies’ operational investments; (5) data center consolidation; and (6) efforts to streamline agencies’ portfolios of IT investments. We noted that implementation of these initiatives had been inconsistent and more work remained to demonstrate progress in achieving IT acquisitions and operations outcomes. In our February 2015 high-risk report, we also identified actions that OMB and federal agencies needed to take to make progress in this area. These included implementing FITARA and at least 80 percent of our recommendations related to the management of IT acquisitions and operations within 4 years. Specifically, between fiscal years 2010 and 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations, including many to improve the implementation of the previously mentioned six critical IT initiatives and other government-wide, cross-cutting efforts. In February 2017, we issued an update to our high-risk series and reported that, while progress had been made in improving the management of IT acquisitions and operations, significant work still remained to be completed. For example, as of May 2017, OMB and federal agencies had fully implemented 380 (or about 47 percent) of the 803 recommendations. Nevertheless, in fiscal year 2016, we made 202 new recommendations, thus further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations. Also, beyond addressing our prior recommendations, our 2017 high-risk update noted the importance of OMB and federal agencies continuing to expeditiously implement the requirements of FITARA. The Federal Acquisition Regulation (FAR) is the primary regulation for use by federal executive agencies in their acquisition of supplies and services with appropriated funds. The FAR requires agencies to perform planning for all acquisitions. Acquisition planning begins when an agency need is identified and includes developing requirements and creating written acquisition plans. A detailed acquisition plan must address all of the technical, business, management, and other significant considerations that will control the acquisition. It should include, among other things, a statement of need, cost, a plan of action, and milestones. The FAR is less specific on the requirements for an acquisition strategy, but it states that acquisition planning should include developing the overall strategy for managing the acquisition. Once a contract is awarded, the awarding agency must enter certain information into the Federal Procurement Data System-Next Generation, the federal government’s database that captures information on contract awards and obligations and is the primary database that serves as the source of other contracting data systems, such as USAspending.gov. The system captures information on contract awards and obligations, including, the vendor, and amount obligated. Further, agencies must select a product and service code that represents the predominant product or service being purchased. Product and service codes are used to describe and identify products, services, and research and development spending within the system. In an effort to eliminate redundancies and increase efficiencies in federal acquisition, in September 2015, the Category Management Leadership Council and OMB developed a government-wide category structure to support category management implementation across the federal government. The Council and OMB reviewed the product and service codes and grouped them into 19 individual spend categories, including IT. See appendix II for a list of the 79 IT-related product and service codes. Over the last three decades, Congress has enacted several laws to help federal agencies improve the management of IT investments. For example, the Clinger-Cohen Act of 1996 requires agency heads to appoint CIOs and specifies many of their responsibilities with regard to IT management. Among other things, CIOs are responsible for implementing and enforcing applicable government-wide and agency IT management principles, standards, and guidelines; assuming responsibility and accountability for IT investments; and monitoring the performance of IT programs and advising the agency head whether to continue, modify, or terminate such programs. The Clinger-Cohen Act, as amended, also defines IT as: any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency or a contractor under a contract with the agency. As previously mentioned, recognizing the severity of issues related to the government-wide management of IT, Congress enacted FITARA in December 2014. The law includes provisions related to seven areas at covered agencies: Agency CIO authority enhancements. CIOs at agencies are required to (1) approve the IT budget requests of their respective agencies, (2) certify that OMB’s incremental development guidance is being adequately implemented for IT investments, (3) approve the appointment of other agency employees with the title of CIO, and (4) review and approve contracts for IT. With regard to the review of IT contracts, FITARA requires that agency CIOs review and approve IT contracts prior to award, unless that contract is associated with a non- major investment. When the contract is associated with a non-major investment, the CIO are allowed to delegate the review and approval duties to an official that reports directly to the CIO. Alternatively, the law states that an agency may use its governance processes to approve any IT contract, as long as the agency CIO is a full participant in the governance processes. Federal data center consolidation initiative. Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved. Enhanced transparency and improved risk management. OMB and agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their investments by level of risk. In addition, in the case of major IT investments rated as high risk for 4 consecutive quarters, the law requires that the agency CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk. Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication. In establishing the process associated with such portfolio reviews, the law requires OMB to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings. Expansion of training and use of IT acquisition cadres. Agencies are to update their acquisition human capital plans to address supporting the timely and effective acquisition of IT. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres or developing agreements with other agencies that have such cadres. Government-wide software purchasing program. The General Services Administration (GSA) is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, GSA should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. Maximizing the benefit of the federal strategic sourcing initiative. FITARA requires that OMB issue regulations for federal agencies that do not use the federal strategic sourcing initiative to purchase services and supplies that are offered by this initiative. The regulations are to include a requirement for agencies to analyze the comparative value between what is to be purchased and what the strategic sourcing initiative offers. In June 2015, OMB released guidance describing how agencies are to implement FITARA. The guidance emphasizes the need for CIOs to have full accountability for IT acquisition and management decisions, and gives agencies considerable flexibility in making those decisions. Among other things, the guidance is intended to: assist agencies in aligning their IT resources with agency missions, goals, and requirements; establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to agency processes and mission requirements; clarify the CIO’s role and strengthen the relationship between department CIOs and bureau or component CIOs; and strengthen CIO accountability for IT cost, schedule, performance, and security. With regard to CIOs’ review and approval of IT contracts, OMB’s guidance expands upon FITARA in a number of ways. Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans, rather than individual IT contracts; CIOs can designate other agency officials to act as their representatives, but the CIOs must retain accountability; Chief Acquisition Officers (CAO) are responsible for ensuring that all IT contract actions are consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies and acquisition plans include IT. OMB’s FITARA implementation guidance requires agencies’ CAOs to indicate to CIOs when planned acquisition strategies and acquisition plans include IT. Given the Category Management Leadership Council and OMB’s categorization of IT product and service codes, CAOs should be identifying the obligations that have IT-related codes. The 22 selected agencies identified 78,249 IT-related contracts, to which they obligated approximately $14.7 billion in fiscal year 2016. Of that amount, approximately $14 billion was categorized as IT-related, consistent with the Category Management Leadership Council and OMB’s product and service codes, and approximately $626 million was categorized under other, non-IT codes. The $626 million in obligations with non-IT codes could contain embedded IT or be associated with IT programs. For example, the agencies reported IT-related acquisitions categorized under such non-IT codes as IT/telecommunications training, data analysis, and research and development. Three agencies accounted for most of these non-IT obligations: the Department of Veterans Affairs (VA) accounted for $220 million, the Environmental Protection Agency (EPA) accounted for $156 million, and the Department of Labor (Labor) accounted for $105 million. However, in addition to the obligations that agencies reported to us, we identified 31,493 additional contracts at 21 agencies with IT-related product and service codes. The associated agencies obligated approximately $4.5 billion to these contracts, raising the total amount obligated to IT contracts in fiscal year 2016 to at least approximately $19.2 billion. Figure 1 reflects the obligations agencies reported to us relative to the obligations we identified. The percentage of additional IT contract obligations that we identified varied among the selected agencies. For instance, the Department of State (State) did not identify 1 percent of its IT contract obligations. Conversely, eight agencies—the Departments of the Interior (Interior), Transportation (Transportation), and the Treasury (Treasury), as well as the National Science Foundation (NSF), the U.S. Agency for International Development (USAID), HHS, GSA, and OPM did not identify over 40 percent of their IT contract obligations. Figure 2 reflects the contract obligations that the selected agencies reported to us (both with IT-related codes and those with non-IT codes) relative to the obligations we identified. For additional information about the IT obligations identified by these agencies, see appendix III. Agencies offered various reasons for why they had not identified the approximately $4.5 billion in IT obligations. For example, officials from OPM and NSF stated that their agencies only identified new IT contracts and did not include contract modifications in their identified IT obligations, making their submissions much smaller. NSF also noted that it only identified IT contracts over $150,000. In addition, GSA and Transportation officials stated that at least one of the Category Management Leadership Council’s IT product and service codes should not be considered IT. For instance, an official in GSA’s Vendor Management Office stated that contracts using a product and service code for miscellaneous maintenance, repair, and rebuilding should not be categorized as IT. Likewise, Transportation officials provided examples of contracts that the agency did not consider being IT-related, even though they were categorized under IT product and service codes for program review or development services. In addition, Transportation and USAID officials stated that they did not use the complete list of IT product and service codes in their identification efforts. A Treasury official in the Office of the CIO stated that the department focused on codes that were the most important. We agree that the Council’s IT product and service codes could include contracts that are not IT. Further, as previously discussed, IT is included in product and service codes that the Council did not identify as IT. Nonetheless, the Council has provided a valuable service in developing specific categories from which agencies can select in identifying IT. To the extent that agencies have concerns about specific categories, they could raise them to the Council. In addition, the majority of the selected agencies that did not identify the $4.5 billion in IT obligations also did not follow OMB’s guidance to have the CAO identify all IT acquisitions for CIO review and approval. As those tasked with monitoring their respective agencies’ acquisition activities, the offices of the CAOs are in a unique position to identify prospective IT acquisitions to the CIOs. Of the 21 selected agencies that did not identify the approximately $4.5 billion in IT obligations, 8 involved the acquisition offices in the identification of their IT acquisitions. For example, OPM’s process followed OMB’s guidance by directly involving its senior procurement executive in the identification of the acquisitions. Conversely, the other 14 agencies did not follow OMB’s guidance to have a process in which the acquisition offices identified, or helped to identify, IT acquisitions for CIO review. Among these agencies, for example, EPA officials indicated that program office officials are responsible for identifying IT requirements and obtaining the appropriate approvals. EPA’s process does not require acquisition office participation. Instead, the program office officials work with IT officials to determine if the contract is IT-related and subject to the IT acquisition approval policy. In addition, 7 agencies reported that they rely on the requesting program offices to self-identify whether their acquisitions are IT-related. Table 1 summarizes the officials responsible for the identification of IT acquisitions at the selected agencies. We have previously reported on the importance of developing and issuing policies or supporting guidance in order to successfully implement processes and achieve related objectives. In recognition of the importance of establishing guidance to assist agency officials in identifying IT, 14 of the 22 selected agencies issued such guidance. However, 7 agencies did not. Specifically, the Departments of Agriculture (USDA), Energy (Energy), Justice (Justice), Labor, and Transportation; the National Aeronautics and Space Administration (NASA); and the Social Security Administration (SSA) did not establish guidance regarding the identification of IT-related acquisitions. For instance, officials in Justice’s Office of the CIO stated that the agency does not follow a prescribed process to determine which acquisitions are IT-related and does not use guidance or checklists to aid with the identification. One other agency, Interior, had established draft guidance to assist officials when identifying IT; however, the agency did not identify a schedule for finalizing the draft guidance. Until agencies involve the acquisition office in their IT identification processes, and establish and effectively implement supporting guidance, they will likely not be able to ensure that all IT acquisitions are identified. As a result, agencies risk not having appropriate oversight of IT worth billions of dollars. FITARA and OMB’s associated implementation guidance require major civilian agency CIOs to review and approve acquisitions of IT either directly, or through the agency’s governance processes. In particular, OMB’s guidance states that agencies shall not approve any acquisition plan or strategy that includes IT without the agency CIO’s review and approval. OMB’s guidance also allows the CIO to delegate these responsibilities to other agency officials to act as the CIO’s representative; however, staff in OMB’s Office of the Federal CIO noted that these assignments need to be approved by OMB. Alternatively, FITARA and OMB’s guidance allow agencies to use IT governance processes to conduct these reviews and approvals as long as the CIO is a full participant in the process. Most of the processes at the 22 selected agencies do not fully satisfy OMB’s requirements that the CIO review and approve IT acquisition plans or strategies (or that the CIO participate in a governance process that reviews and approves IT acquisition plans and strategies). Specifically, 8 agencies’ processes fully satisfy OMB’s requirements, while 14 of the agencies’ processes do not fully satisfy the requirements. Of these, 8 agencies partially satisfy the requirements and 6 do not satisfy the requirements. For example, NSF fully satisfies OMB’s requirement by requiring that the CIO review and approve each IT acquisition plan. Similarly, SBA requires the CIO to review and approve each IT acquisition plan over the FAR’s simplified acquisition threshold. HUD partially satisfies OMB’s requirements in that its process only requires the office of the CIO to review a subset of IT acquisitions (those over $500,000). In addition, the HUD CIO has delegated the approval authority to the Deputy CIO and others within the Office of the CIO, but this delegation has not been approved by OMB. VA does not yet have a process in place that satisfies OMB’s requirements, but officials in VA’s Office of Information and Technology stated that they are currently developing processes and procedures necessary to implement FITARA accountability and responsibilities for IT acquisitions. While the agency did not submit a documented time frame for its plans, VA officials stated that they would like to implement the new process by the second quarter of fiscal year 2018. Table 2 summarizes the extent to which the selected agencies’ processes satisfy OMB’s requirements for the CIO to review and approve IT acquisition plans. Appendix IV provides additional details about the agencies’ processes that are used to review and approve IT acquisitions. Of 96 randomly selected IT contracts at 10 agencies, only 11 acquisitions associated with these contracts had been reviewed and approved as required by OMB. The acquisitions associated with 85 contracts, with a total possible value of approximately $23.8 billion, did not receive the appropriate level of review. Further, despite having CIO review and approval processes in place that fully or partially satisfied OMB’s requirements, four agencies (the Department of Commerce (Commerce), HHS, Justice, and SSA) did not consistently ensure that the CIO or a designee reviewed and approved the acquisition plan or strategy. Table 3 summarizes the number and total possible value of IT contracts that we reviewed for consistency with OMB’s requirements. Appendix V provides more details on the selected IT acquisitions and the CIO approval of them. Four key factors contributed to the acquisitions associated with the 85 contracts not being reviewed and approved by the CIOs in accordance with OMB’s requirements: Non-compliant processes. As previously mentioned, agencies’ processes at 7 of the 10 agencies did not fully satisfy OMB’s requirements that the CIO review and approve IT acquisition plans and strategies. Four agencies reported that they were following their own agency processes which we determined do not fully align with requirements. For example, NASA officials responsible for information regarding one of the selected contracts stated that the CIO only provides technical guidance and concurrence on the acquisition plan and does not approve the acquisition plan. This is not consistent with OMB’s requirement that the CIO or designee review and approve IT acquisition plans. In addition, for 16 contracts, the respective agencies stated that there were no acquisition plans associated with the particular acquisitions. For example, a director in USDA’s Forest Service’s acquisition office issued waivers for 2 acquisitions, making them exempt from needing acquisition plans. Thus, the CIO did not review and approve acquisition plans for those contracts. As noted earlier, OMB’s guidance states that if there is not an acquisition plan or strategy, the contract action itself should be reviewed and approved. However, in all 16 cases, the associated agencies’ CIOs did not undertake such reviews. Improper delegation. We identified 16 instances where agencies allowed CIOs to delegate their review to levels lower than agency policy or OMB allows. For example, Treasury’s CIO delegated contract approval to the component CIOs—one of whom further delegated this approval based on monetary thresholds to a variety of other officials. According to the component’s policy, one of the selected acquisitions, worth over $22 million, should have been approved by the component’s Deputy CIOs, Associate CIOs, or Deputy Associate CIOs. However, this particular acquisition was approved by an IT Project Manager. Further, two agencies allowed their CIOs to delegate IT acquisition approvals to other officials, without having these assignments approved by OMB. For example, three of NASA’s selected acquisitions were reviewed and approved by the component CIOs; however, NASA had not had these assignments approved by OMB. Approval of other documentation. In 26 instances, CIOs or designees reviewed and approved acquisition documentation other than the required acquisition plan or strategy. For example, CIOs or designees reviewed and approved documents such as a requisition, a procurement request, or a business case analysis. While the CIOs or designees reviewed and approved some form of acquisition documentation prior to the award of these acquisitions, these forms of documentation did not have all the elements typically associated with an acquisition plan. As a result, the CIO (or designee) may not have been adequately equipped to make an informed decision about the acquisition. Undocumented approvals. We identified 2 instances where the agency reported that the CIO or designee approved the IT acquisition, but did not document the approval. For example, regarding one contract, Commerce officials stated that one of the agency’s selected acquisitions was reviewed and approved by its component CIO for the Bureau of Economic Analysis. However, the agency could not provide evidence to show the CIO’s approval beyond an e-mail after the contract was signed stating that the CIO was aware of and had approved that particular acquisition. Until agencies fully satisfy FITARA and OMB’s requirements by ensuring that CIOs, or their appropriate designees, review and approve IT acquisitions, CIOs risk continuing to have limited visibility and input into their agencies’ planned IT expenditures and not being able to use the increased authority that FITARA’s contract approval provision is intended to provide. In addition, agencies are missing an opportunity to strengthen CIOs’ authority and to provide needed direction and oversight of their IT acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived. Given the history of failures and amount of money at stake, it is imperative that agencies properly oversee IT acquisitions. While the 22 selected agencies reported $14.7 billion in IT obligations, 21 agencies did not identify $4.5 billion as IT. Further, because the selected agencies did not always identify their IT acquisitions, it is likely that agencies have additional unidentified IT spending. Among other reasons, this shortfall existed because many agencies did not ensure that their acquisition offices were involved in the identification process, or provide clear guidance for ensuring that IT was properly identified. Without proper identification of IT acquisitions, agencies and CIOs cannot effectively provide oversight of them. In addition, many of the selected agencies covered by FITARA did not ensure the appropriate CIO review and approval of IT acquisitions that were identified. The CIOs’ review and approval presents an opportunity for CIOs to increase visibility into agency IT and recognize opportunities for improvement. However, the review and approval processes at 14 of the selected agencies were not in full compliance with OMB requirements, and only 11 of 96 randomly selected IT acquisitions were appropriately reviewed and approved by the CIO. As a result, agencies awarded IT contracts with a total possible value of $23.8 billion without the required CIO review and approval. Consequently, CIOs had limited visibility and insight into their agencies’ IT, thereby increasing the risk of entering into contracts that were duplicative, wasteful, or poorly conceived. We are making a total of 39 recommendations to federal agencies. We are making the following 3 recommendations to USDA: The Secretary of Agriculture should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 1) The Secretary of Agriculture should direct the CAO and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 2) The Secretary of Agriculture should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 3) We are making the following 2 recommendations to Commerce: The Secretary of Commerce should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 4) The Secretary of Commerce should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 5) We are making the following 2 recommendations to Education: The Secretary of Education should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 6) The Secretary of Education should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 7) We are making the following 2 recommendations to Energy: The Secretary of Energy should direct the CAO and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 8) The Secretary of Energy should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 9) We are making the following recommendation to HHS: The Secretary of HHS should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 10) We are making the following 2 recommendations to the Department of Housing and Urban Development: The Secretary of Housing and Urban Development should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 11) The Secretary of Housing and Urban Development should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 12) We are making the following 3 recommendations to Interior: The Secretary of the Interior should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 13) The Secretary of Interior should direct the CAO and CIO to finalize and issue guidance on identifying IT acquisitions in order to ensure the CIO review and approval of those acquisitions. (Recommendation 14) The Secretary of the Interior should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 15) We are making the following 2 recommendations to Justice: The Attorney General should direct the senior procurement executive and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 16) The Attorney General should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 17) We are making the following 3 recommendations to Labor: The Secretary of Labor should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 18) The Secretary of Labor should direct the CAO and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 19) The Secretary of Labor should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 20) We are making the following 2 recommendations to State: The Secretary of State should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 21) The Secretary of State should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 22) We are making the following recommendation to Treasury: The Secretary of the Treasury should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 23) We are making the following 3 recommendations to Transportation: The Secretary of Transportation should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 24) The Secretary of Transportation should direct the CAO and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 25) The Secretary of Transportation should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 26) We are making the following 2 recommendations to VA: The Secretary of VA should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 27) The Secretary of VA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 28) We are making the following recommendation to EPA: The Administrator of EPA should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 29) We are making the following 3 recommendations to NASA: The Administrator of NASA should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 30) The Administrator of NASA should direct the CAO and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 31) The Administrator of NASA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 32) We are making the following recommendation to NRC: The Chairman of NRC should ensure that the office of the senior procurement executive is involved in the process to identify IT acquisitions. (Recommendation 33) We are making the following recommendation to OPM: The Director of OPM should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 34) We are making the following recommendation to SBA: The Administrator of SBA should ensure that the office of the senior procurement executive is involved in the process to identify IT acquisitions. (Recommendation 35) We are making the following 3 recommendations to SSA: The Commissioner of SSA should ensure that the office of the senior procurement executive is involved in the process to identify IT acquisitions. (Recommendation 36) The Commissioner of SSA should direct the senior procurement executive and CIO to issue specific guidance to ensure IT-related acquisitions are properly identified. (Recommendation 37) The Commissioner of SSA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 38) We are making the following recommendation to USAID: The Administrator of USAID should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. (Recommendation 39) We provided a draft of this report to OMB and the other 22 agencies included in our review. Among the comments received, 16 agencies (Energy, GSA, HHS, HUD, Interior, Justice, Labor, NASA, OPM, SBA, SSA, State, Transportation, USAID, USDA, and VA) agreed with our recommendations; 2 agencies (EPA and OMB) did not agree or disagree with our recommendations; 1 agency (Education) partially agreed with our recommendations; 1 agency (NRC) disagreed with our recommendations; and 2 agencies (Treasury and NSF) had no comments on the recommendations. One other agency (Commerce) did not provide comments on the report. The agencies’ comments that we received, and our evaluations of them, are summarized as follows: In comments provided via e-mail on December 8, 2017, an OMB GAO liaison did not agree or disagree with our findings. The official stated that improved coordination and collaboration between CIOs, CAOs, and senior procurement executives is critical, but represents a significant cultural shift for most agencies. The official added that OMB’s Office of Federal Procurement Policy and Office of the Federal CIO are working closely with agency CAOs and CIOs through the CIO Council and CAO Council to discuss practices that agencies have found helpful in achieving this cultural change. In comments provided via e-mail on November 18, 2017, a Senior Advisor from USDA’s Office of the CIO stated that the department concurred with the findings in our report and had no additional comments. In written comments, Education concurred with one of our recommendations, which called for the department to ensure that the office of the CAO is involved in the process to identify IT acquisitions. However, Education did not concur with a second recommendation to ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. The department stated that the CIO reviews and approves IT acquisition strategies and plans as part of his review and approval of IT investments. Specifically, the department stated that its Departmental Directive OCIO: 3-108, “Information Technology Investment Management” establishes a process for Office of the CIO review of IT acquisitions. Further, the department stated that its Statement of Work Review Process adds increased rigor to the CIO’s review and approval by requiring all acquisitions with IT elements to be submitted for Office of the CIO review. Finally, the department stated that the Federal Student Aid Investment Review Board charter documents the agency CIO as a voting member. The department added the CIO is required to vote on Federal Student Aid IT investments greater than $10 million. For Federal Student Aid investments less than $10 million, the CIO is provided the same level of insight as any other Investment Review Board member, but has delegated the required vote to the Federal Student Aid CIO. The IT Investment Management Directive, together with the department’s associated Lifecycle Management Framework (referenced in the directive), indicates that the office of the CIO is to review IT acquisition plans. However, the department’s Statement of Work Review Process does not require the review and approval of acquisition plans. Instead, the process states that the office of the CIO may review IT acquisition plans or strategies as one of several possible documents, including statements of work or cost estimates. We also reviewed the Federal Student Aid Investment Review Board charter and updated our report to reflect the department CIO’s involvement on the Federal Student Aid’s Investment Review Board. Based on this collective information, we updated our assessment of Education’s IT acquisition policy to reflect that the department had partially met OMB’s requirements. Nevertheless, the CIO’s review of the department’s acquisition plans and strategies should be required, rather than optional. Thus, we believe that our recommendation to ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance is still warranted. Education’s comments are reprinted in appendix VI. In written comments, Energy concurred with our two recommendations directed to the department and stated that it has activities underway to revise the department’s acquisition policy. Energy added that it planned to address the recommendations by December 31, 2017. Energy’s comments are reprinted in appendix VII. In comments provided via e-mail on December 7, 2017, a Management Analyst in HHS’s Office of the CIO stated that the department agreed with the recommendation and had no comments on the report. In written comments, HUD stated that it concurred with our two recommendations to the department. HUD’s comments are reprinted in appendix VIII. In written comments, Interior stated that it concurred with our three recommendations to the department. Interior’s comments are reprinted in appendix IX. In comments provided via e-mail on November 27, 2017, a Program Analyst from Justice’s Internal Review and Evaluation Office stated that the department concurred with our two recommendations. The department also provided technical comments, which we have incorporated in the report, as appropriate. In written comments, Labor concurred with our three recommendations that we directed to the department. These recommendations called for the department to (1) ensure that the office of the CAO is involved in the process to identify IT acquisitions, (2) issue specific guidance to ensure IT-related acquisitions are properly identified, and (3) ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. Labor detailed actions recently taken to implement each of the recommendations and submitted documentation to support its assertions. For example, the department submitted its Acquisition Plan Preparation Guide and related acquisition plan templates to show that it had issued guidance on identifying IT and required the CIO review and approval of IT acquisition plans. Implementation of these steps should help ensure appropriate oversight of IT acquisitions. Labor’s comments are reprinted in appendix X. In written comments, State agreed with both of our recommendations. In particular, regarding our recommendation to ensure that the office of the CAO is involved in the process to identify IT acquisitions, the department stated that senior State officials, including the CAO and CIO, will develop a plan to ensure that the CAO monitors acquisition activities and ensures acquisition decisions are consistent with all applicable laws, such as FITARA. Further, regarding the recommendation to ensure that the department’s IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance, State referenced its capital planning and investment control guide that describes how a group under the direction of the CIO reviews acquisition strategies during the IT portfolio selection process. However, while the guide states that the CIO is to approve the finalized IT portfolio, the guide does not state that the CIO is to review the individual acquisition strategy documents. As a result, our recommendation is still warranted. State’s comments are reprinted in appendix XI. In comments provided via e-mail on December 7, 2017, an Audit Liaison from Treasury’s Office of the CIO stated that the department had no comments on the report. The department did not say whether it agreed or disagreed with the recommendation, but noted that it had planned corrective actions to work with Treasury stakeholders, to include the Chief Procurement Executive, Bureau CIOs, and Acquisition officials; and OMB officials to develop acquisition plans and strategies according to OMB’s FITARA guidance for IT acquisition. In comments provided via e-mail on November 27, 2017, the Director of Audit Relations and Program Improvement within the Department of Transportation stated that the department concurred with the findings and recommendations. In written comments, VA concurred with our two recommendations to the department and stated that it is taking steps to address the recommendations. Specifically, regarding the recommendation to ensure that the office of the CAO is involved in the process to identify IT acquisitions, the department stated that it had addressed this concern by implementing an updated version of the Acquisition and Management of VA IT Resources directive in November 2017. In its discussion of this directive, the department stated that the CIO, in conjunction with the CAO, collaborates on all IT actions to ensure FITARA compliance. While the directive clarifies the scope of VA’s IT resources subject to the oversight authority of the CIO, the directive does not indicate that the office of the CAO is also involved in this process. It will be important for VA to consider this recommendation as it continues to implement FITARA requirements. Further, regarding the recommendation to ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance, the department stated that its Office of Strategic Sourcing is currently developing processes and procedures necessary to implement FITARA accountability and responsibilities for IT acquisitions. The department also stated that the new acquisition review process is scheduled to be implemented in the second quarter of fiscal year 2018. VA’s comments are reprinted in appendix XII. In written comments, EPA stated it did not take exception to the report’s findings, conclusions, and recommendations. Regarding the recommendation to ensure that the office of the CAO is involved in the process to identify IT acquisitions, the agency stated that the policy which implements interim guidance from the CIO to comply with FITARA requirements is being updated. The agency added that future policy revisions are to include the requirement that the CAO or a designee will address this recommendation. EPA’s comments are reprinted in appendix XIII. In comments provided via e-mail on November 17, 2017, a program analyst in GSA’s GAO/Office of Inspector General Audit Management Division stated that the agency concurred with the report and had no additional comments. In written comments, NASA concurred with the three recommendations to the agency and stated that it believes it has already addressed them. Specifically, regarding the recommendation to ensure that the Office of the CAO is involved in the process to identify IT acquisitions, NASA asserted that its CAO is already adequately involved. However, NASA did not provide evidence that it fulfills this requirement. For instance, none of the processes mentioned in NASA’s comments support the assertion that the acquisition office is involved in the identification of individual acquisitions as IT. Further, the discussion of a form used to identify IT acquisitions (NASA Form 1707) confirmed our original conclusion that the officials identifying IT acquisitions are not in the acquisition office. In addition, NASA concurred with our recommendation to issue specific guidance to ensure IT-related acquisitions are properly identified, and stated that the agency currently has several policies that provide such guidance. However, the policies named by the agency (NASA Policy Directive 1000.5B, NASA Interim Directive 1000.110, NASA FAR Supplement 1804.7301, and NASA FAR Supplement 1807.71) do not contain guidance on how the identifying officials should determine whether an acquisition is IT-related. For example, our review of NASA Form 1707 (required by NASA FAR Supplement 1804.7301) showed that, while this form has instructions on how to fill out its IT section, it does not contain guidance on how to properly identify an acquisition as IT-related. In addition, NASA did not provide an official policy on the role of the Center Functional Review Team in the identification process. Further, NASA concurred with our recommendation to ensure that its IT acquisition plans or strategies are reviewed and approved according to OMB guidance and stated that, on September 27, 2017, the CIO had issued a memo delegating the authority to review and approve all IT acquisitions to the Center CIOs. However, as previously mentioned, these delegations of authority need to be approved by OMB, and NASA’s delegation of IT acquisition authority had not been approved by OMB, as required. In addition, NASA has not demonstrated that the CIO’s review and approval is occurring, as none of the 9 acquisitions we randomly selected were reviewed and approved by the CIO. NASA also stated that the CIO and Assistant Administrator for Procurement review acquisition plans as part of their participation in Acquisition Strategy Meetings. However, as we mention in the report, not all IT contracts have acquisition strategy meetings. NASA’s comments are reprinted in appendix XIV. In written comments, NRC did not concur with our recommendations and stated that our draft report did not accurately reflect the agency’s process for reviewing and approving IT acquisitions. With regard to our recommendation to ensure that the office of the senior procurement officer is involved in the process to identify IT acquisitions, the agency provided technical comments which stated that acquisition office officials review acquisitions to ensure that IT is properly identified. However, the agency did not provide supporting documentary evidence to support this assertion. Lacking evidence from the agency that would enable us to verify the implementation of the process described in its comments, we maintain that our recommendation is warranted. In addition, our draft of this report included a recommendation for NRC to ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance. NRC disagreed with this recommendation and stated in its technical comments that the agency does not require the development of acquisition plans for acquisitions under $1 million. Thus, the NRC CIO does not review acquisition plans under that threshold. The agency also stated that it has a process for approving contract actions under the $1 million threshold. According to OMB guidance, in the absence of acquisition plans or strategies, CIOs may approve the corresponding contract actions. Since NRC has a process for approving contract actions under the $1 million threshold, we revised the report to reflect that NRC has processes in place for the review and approval of acquisition plans in a manner consistent with OMB guidance and removed the associated recommendation. NRC’s comments are reprinted in appendix XV and its technical comments have been incorporated in the report, as appropriate. In comments provided via e-mail on November 21, 2017, an NSF liaison stated that the agency had no comments. In written comments, OPM concurred with our recommendation and stated that the agency will review and update its policies and processes as needed, so that they are aligned with OMB’s guidance. OPM’s comments are reprinted in appendix XVI. In written comments, SBA agreed with our recommendation to ensure that the office of the CAO is involved in the process to identify IT acquisitions. SBA noted that it is not required to have a CAO, but agreed with having its acquisition workforce involved in IT acquisitions. Based on the agency’s comments, we modified the associated recommendation to refer to the agency’s senior procurement executive rather than the CAO. SBA stated that it has already begun to implement the recommendation for fiscal year 2018. SBA’s comments are reprinted in appendix XVII. In written comments, SSA agreed with the three recommendations that we had directed to the agency, stated that it had taken steps to address the recommendations, and submitted supporting documentation. In particular, SSA agreed with the recommendation to ensure that the office of the CAO is involved in the process to identify IT acquisitions and, in response, provided documentation that is to detail the involvement of its Chief Financial Officer (who is the agency’s senior procurement executive) in identifying and approving IT acquisitions. Implementation of these steps should help ensure appropriate oversight of IT acquisitions. Regarding our recommendation to issue specific guidance to ensure IT-related acquisitions are properly identified, SSA agreed with the recommendation and stated that, according to its IT Acquisition Approval Policy, the Chief Financial Officer notifies the CIO of IT acquisitions by submitting acquisition plans to the CIO for approval. However, while SSA’s policy does support this method of CIO notification, it does not provide guidance to assist in identifying IT. Further, SSA agreed with our recommendation to ensure that IT acquisition plans or strategies are reviewed and approved according to OMB’s guidance and provided its September 2017 policy for acquisition plan approval. After reviewing this policy and SSA’s 2017 capital planning and investment control process, we updated our report to show that SSA’s processes satisfy OMB’s requirements. While SSA has made progress in implementing OMB’s FITARA requirements, the agency needs to demonstrate that the CIO’s review and approval are occurring, as 3 of the 10 acquisitions we randomly selected were not reviewed and approved as required by OMB’s guidance. It will be important for SSA to consider this recommendation as it continues to implement FITARA requirements. SSA’s comments are reprinted in appendix XVIII. The agency also provided technical comments, which we have incorporated in the report as appropriate. In written comments, USAID agreed with our recommendation and stated that the CIO and CAO are working together to (1) ensure all IT- related acquisition plans and strategies are reviewed and approved by the CIO and (2) further communicate this requirement to the acquisition planning stakeholders. USAID’s comments are reprinted in appendix XIX. The agency also provided technical comments, which we have incorporated in the report as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretaries of the Departments of Agriculture, Commerce, Education, Energy, Health and Human Services, Housing and Urban Development, Labor, State, the Interior, the Treasury, Transportation, and Veterans Affairs; the U.S. Attorney General of the Department of Justice; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, Small Business Administration, and the U.S. Agency for International Development; the Commissioner of the Social Security Administration; the Directors of the National Science Foundation and the Office of Personnel Management; and the Chairman of the Nuclear Regulatory Commission. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9286 or at pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix XX. Our objectives were to determine the extent to which (1) federal agencies identify information technology (IT) contracts and how much is invested in them, and (2) federal agency Chief Information Officers (CIO) are reviewing and approving IT acquisitions. For both objectives, our review included the Office of Management and Budget (OMB) and 22 agencies of the 24 agencies covered by the Chief Financial Officer Act. We did not include the Department of Defense because it is excluded from the relevant provision in the Federal Information Technology Acquisition Reform Act (FITARA) requiring CIO approval of IT contracts. Further, we did not include the Department of Homeland Security because we recently issued a report that reviewed the department’s implementation of FITARA, including the CIO’s approval of IT contracts. For specific information on the CIOs’ review of individual IT contracts, we focused on 10 agencies covered by FITARA that obligated the most money to IT contracts in fiscal year 2016 (except the Departments of Defense and Homeland Security). To determine the extent to which federal agencies identify IT contracts and how much is invested in them, we requested that each of the 22 selected agencies submit a list of their IT contract obligations for fiscal year 2016. We also requested the associated contract identification number, obligation amount, and product and service code. In order to determine if the agencies gave us a full accounting of their IT obligations, we used the Category Management Leadership Council’s categorizations of federal government spending by product and service codes. In particular, we used the Council’s list of 79 IT-related codes, which is listed in appendix II, to identify fiscal year 2016 IT-related contract obligations on USAspending.gov. For each funding agency, we downloaded all contracts associated with the IT-related codes, such as purchase orders, blanket purchase agreements, and government-wide acquisition contracts. By comparing the resulting list of IT-related contracts on USAspending.gov data to those provided by the agencies, we were able to determine which IT-related contract obligations the agencies had not identified. In doing so, we gave the agency credit for identifying the entire IT contract if an agency identified any portion of the contract (e.g., a contract modification). Consequently, the total of obligations that agencies did not identify is likely higher than the totals we were able to report. To assess the reliability of the USAspending.gov data, we reviewed publicly available documentation related to the database, such as the USAspending.gov data dictionary. We also reviewed the results of our previous reports on USAspending.gov that had identified deficiencies in the accuracy and reliability of the reported data. For both the USAspending.gov and agency-supplied contract data, we tested the datasets to look for duplicate records and missing data in key fields. We also interviewed agency officials to corroborate the data. We found the contract data from USAspending.gov, while sometimes incomplete, were sufficient for our purpose of identifying IT contracts and demonstrating the amount of obligations toward IT contracts. In addition, we found the contract data provided by the agencies to be sufficiently reliable for the purposes of our reporting objectives. We used these data as evidence to support our findings, conclusions, and recommendations. We also compared the product and service codes in the lists of IT contracts provided by the agencies to the list of IT product and service codes developed by the Category Management Leadership Council. From this comparison, we determined which agency-submitted obligations were associated with IT-related product and service codes and which obligations were associated with non-IT codes. To determine the cause for any discrepancies between the agency- provided list of obligations and those found on USAspending.gov, we asked each agency to describe and provide evidence of the Chief Acquisition Officer’s (CAO) involvement in the process for identifying IT acquisitions for CIO review. We also collected both testimonial evidence and documentation that described the identification process for potential IT acquisitions. We analyzed these data from each agency to determine the involvement of the CAO and officials within the CAO’s acquisition office. We also determined the involvement of officials positioned outside of the acquisition office, such as officials from the office requesting the IT acquisition or from the Office of the CIO. As a result, we were able to establish which officials were responsible for identifying acquisitions for IT review at each agency. We also reviewed the submitted evidence to determine whether the agencies provided guidance that clearly described or defined IT to the identifying officials. To determine the extent to which federal agency CIOs are reviewing and approving IT acquisitions, we first compiled a composite list of IT-related contracts from fiscal year 2016 for each of the 10 selected agencies by combining: contracts associated with IT-related product and service codes from USAspending.gov, contracts associated with IT vendors from USAspending.gov, contracts linked with major IT investments as listed on OMB’s IT Dashboard, and contracts provided by agencies in response to our earlier request for a list of IT contracts. We then randomly selected 10 IT contracts from each of the 10 agencies on which to perform additional analysis (100 total contracts). For each of the 100 selected contracts, we asked the associated agency to confirm that the contract was, in fact, IT-related and requested evidence of CIO or CIO designee review and approval of the contract’s associated acquisition. We compared the resulting documentation to FITARA and OMB guidance to determine the extent to which the IT acquisitions had been reviewed and approved. In order to receive full credit, agencies had to provide evidence that the CIO had reviewed and approved the acquisition plans or strategies for those IT acquisitions associated with major IT investments. For IT acquisitions associated with non-major IT investments, agencies had to provide evidence that the CIO, or a designee that reports directly to the CIO, reviewed and approved the acquisition plan or strategy. If agencies could not associate the IT acquisition with a particular IT investment, we looked for evidence that the CIO reviewed and approved the acquisition plan or strategy, since FITARA does not state that the review and approval of these IT acquisitions can be delegated. To determine whether agencies had processes in place to ensure the review and approval of IT acquisitions, we reviewed agency documentation on IT acquisition processes and procedures and compared it to the requirements in FITARA and OMB guidance. We also interviewed agency officials to clarify their respective processes and policies. In order to receive full credit, agencies had to provide evidence that they had a process in place that required the agency CIO to review and approve IT acquisition plans or strategies with the exception of those associated with non-major IT investments. Agencies received partial or no credit if their processes had one or more of the following shortfalls: approval was not documented, delegated IT acquisition review and approval without OMB approval of did not provide the CIOs or their delegates oversight of all IT involved the review of other documentation instead of the required acquisition plans or strategies, or did not provide department CIO oversight over IT acquisitions at the component level. We conducted this performance audit from July 2016 to January 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In September 2015, the Category Management Leadership Council and the Office of Management and Budget (OMB) identified a total of 79 information technology (IT)-related product and service codes, of which 43 are for IT services and 36 are for IT products. Table 4 provides details on the IT-related services and product codes. The 22 selected agencies identified approximately $14.7 billion in obligations for information technology (IT)-related contracts in fiscal year 2016. Of that amount, approximately $14 billion was categorized as IT- related per the Category Management Leadership Council’s product and service codes, and approximately $626 million was categorized under other, non-IT codes. In addition to the obligations that agencies reported to us, we identified an additional $4.5 billion in obligations for contracts with IT-related product and service codes, raising the total amount obligated to IT contracts in fiscal year 2016 to at least approximately $19.2 billion. Table 5 provides details on each selected agency’s obligations for IT-related contracts in fiscal year 2016. The Federal Information Technology Acquisition Reform Act (FITARA) and the Office of Management and Budget’s (OMB) associated implementation guidance require major civilian agency chief information officers (CIO) to review and approve acquisitions of information technology (IT) either directly, or as full participants in the agency’s governance processes. In particular, OMB’s guidance states that agencies shall not approve an acquisition plan or strategy that includes IT without the agency CIO’s review and approval. OMB’s guidance also allows the CIO to delegate these responsibilities to other agency officials to act as the CIO’s representative; however, staff in OMB’s Office of the Federal CIO noted that these assignments need to be approved by OMB. Alternatively, FITARA and OMB’s guidance allows agencies to use IT governance processes to conduct these reviews and approvals, as long as the CIO is a full participant in the process. Table 6 provides details on the selected agencies’ acquisition processes and the degree to which the processes comply with OMB’s requirements. Of 96 randomly selected information technology (IT) contracts at 10 agencies, 9 acquisitions associated with these contracts had been reviewed and approved as required by the Office of Management and Budget (OMB). The acquisitions associated with the remaining 87 contracts did not receive the appropriate levels of Chief Information Officer (CIO) review and approval in accordance with OMB requirements. Table 7 provides details on the selected IT acquisitions and the CIO review and approval of them. David A. Powner, (202) 512-9286 or pownerd@gao.gov. In addition to the contact named above, Kevin Walsh (Assistant Director), Jessica Waselkow (Analyst in Charge), Chris Businsky, Rebecca Eyler, Angel Ip, Tarunkant Mithani, David Plocher, Meredith Raymond, and Adam Vodraska made key contributions to this report.
The federal government invested more than $90 billion on IT in fiscal year 2016. However, prior IT expenditures have produced failed projects. Recognizing the severity of issues, in December 2014 Congress enacted IT acquisition reform legislation (referred to as the Federal Information Technology Acquisition Reform Act, or FITARA). Among other things, OMB's FITARA implementation guidance requires covered agencies' chief acquisition officers to identify IT contracts for the CIOs to review and approve. GAO's objectives were to determine the extent to which (1) federal agencies identify IT contracts and how much is invested in them, and (2) federal agency CIOs are reviewing and approving IT acquisitions. To do so, GAO reviewed data on IT contracts from fiscal year 2016 at 22 agencies and compared agency actions to law and OMB guidance. Most of the 22 selected agencies did not identify all of their information technology (IT) contracts. The selected agencies identified 78,249 IT-related contracts, to which they obligated $14.7 billion in fiscal year 2016. However, GAO identified 31,493 additional contracts with $4.5 billion obligated, raising the total amount obligated to IT contracts in fiscal year 2016 to at least $19.2 billion (see figure).The percentage of additional IT contract obligations GAO identified varied among the selected agencies. For example, the Department of State did not identify 1 percent of its IT contract obligations. Conversely, 8 agencies did not identify over 40 percent of their IT-related contract obligations. Many of the selected agencies that did not identify these IT acquisitions did not follow Office of Management and Budget's (OMB) guidance. Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for Chief Information Officer (CIO) review, as required by OMB. In addition, 7 agencies did not establish guidance to aid officials in recognizing IT. Until agencies involve the acquisitions office in their IT identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions. Without proper identification of IT acquisitions, agencies and CIOs cannot effectively provide oversight of these acquisitions. In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB's requirement that the CIO review and approve IT acquisition plans or strategies. Further, only 11 of 96 randomly selected IT contracts at 10 agencies that GAO evaluated were CIO-reviewed and approved as required by OMB's guidance. The 85 IT contracts not reviewed had a total possible value of approximately $23.8 billion. Until agencies ensure that CIOs review and approve IT acquisitions, CIOs will continue to have limited visibility and input into their agencies' planned IT expenditures and will not be able to use the increased authority that FITARA's contract approval provision is intended to provide. Further, agencies will likely miss an opportunity to strengthen CIOs' authority and the oversight of IT acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived. GAO is making 39 recommendations, including that agencies ensure that acquisition offices are involved in identifying IT and issue related guidance; and to ensure IT acquisitions are reviewed according to OMB guidance. OMB and 20 agencies generally agreed with or did not comment on the recommendations. One agency agreed with one recommendation, but disagreed with another. GAO believes this recommendation is warranted. One agency disagreed with two recommendations. GAO subsequently removed one of these, but believes the other recommendation is warranted, as discussed in the report.