For example, modernized business systems are  integral to the department’s efforts to address its financial, supply chain,  and information security management high-risk areas. Most  notably, the BEA did not yet include well-defined architectures for DOD’s  components, and DOD’s strategy for “federating” or extending its  architecture to the military departments and defense agencies was still  evolving and had yet to be implemented. DOD Is Continuing to Improve Its Approach to Modernizing Business Systems

DOD continues to take steps to comply with the requirements of the act  and to satisfy relevant systems modernization management guidance. However, additional steps are needed to fully comply with  the act and relevant guidance. According to these officials, DOD leadership is  committed to fully addressing these areas and efforts are planned and  under way to do so. Notwithstanding these additions and deletions, BEA 5.0 still does not  provide business rules for all business processes. For example,  the strategies now provide high-level roles and responsibilities for  federating the architecture and additional definition around the tasks  needed to achieve alignment among DOD and component architectures. However, its latest annual report does not include this  information. To address these limitations, we have made recommendations aimed at  improving the management and content of these architectures. On March 15, 2008, DOD released the  latest version of its ETP, which provides required information on 102  programs (systems and initiatives) that are linked to key transformational  objectives. The latest version contains the results of analyses of gaps between its “As  Is” and “To Be” architectural environments, in which capability and  performance shortfalls are described and investments (such as  transformation initiatives and systems) that are to address these shortfalls  are identified. Until the ETP, or a federated family of such plans,  either directly or by reference includes relevant information on the full  inventory of investments across the department (and does so in a manner  that reflects consideration of the range of variables associated with a well- defined transition plan, such as timing dependencies among investments  and the department’s capability to manage them), it will not have a  sufficient basis for informed investment decision making regarding  disposition of the department’s existing inventory of systems or for  sequencing the introduction of modernized systems. DOD and Military Departments Have Partially Established Key Investment Management Structures, but Have Yet to Fully Define Related Policies and Procedures

The National Defense Authorization Act for Fiscal Year 2005 requires DOD  to establish business system investment review structures, such as the  previously mentioned DBSMC and five IRBs, and processes that are  consistent with the investment management provisions of the Clinger- Cohen Act. We have yet to receive comparable information from the Army. Conclusions

Over the last year, DOD has continued to make important progress in  defining and implementing key institutional modernization management  controls, but much remains to be accomplished. In particular, the  corporate BEA, while continuing to improve, is still missing important  content, and it has yet to be federated through development of aligned  subordinate architectures for each of the department’s component  organizations. In its most recent annual report to  congressional defense committees pursuant to the National Defense  Authorization Act for Fiscal Year 2005, the department missed an  opportunity to do this by not including the results of its IV&V contractor’s  assessments of the completeness, consistency, understandability, and  usability of the federated family of business mission area architectures,  including associated transition plans, as we previously recommended. To determine whether the enterprise transition plan (ETP) addressed the  requirements specified in the act, we reviewed the updated version of the  ETP, which was released on March 15, 2008, relative to the act’s specific  transition plan requirements and related guidance that our last annual  report under the act identified as not being met.
Why GAO Did This Study

In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high risk," and GAO continues to do so today. To assist in addressing this high-risk area, the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 contains provisions that are consistent with prior GAO investment management and enterprise architecture-related recommendations, and requires the department to submit annual reports to its congressional committees on its compliance with these provisions. The act also directs GAO to review each annual report. In response, GAO assessed the actions taken by DOD to comply with requirements of the act. To do so, GAO leveraged its recent reports on various aspects of the department's modernization management controls, and it reviewed, for example, the latest version of its business enterprise architecture and the associated transition plan and architecture federation strategy. GAO also interviewed key officials.

What GAO Found

As part of DOD's continuing efforts to strengthen management of its business systems modernization program, it has taken steps over the last year to build on past efforts and further comply with the National Defense Authorization Act's requirements and related federal guidance. Notwithstanding this progress, aspects of these requirements and relevant guidance have yet to be fully satisfied. In particular, the military departments, under DOD's "federated" and "tiered" approach to establishing institutional modernization management controls, have lagged well behind DOD's corporate efforts, and the corporate efforts are still not yet where they need to be. For example, the latest version of DOD's corporate business enterprise architecture continues to add content needed to improve its completeness, consistency, understandability, and usability. Moreover, its latest architecture federation strategy is more detailed and explicit than the prior version. However, the corporate architecture is still missing important content, such as business rules for, and information flows among, certain business activities. Moreover, the architecture has yet to be federated. Specifically, the military departments, which are the largest members of the federation, do not yet have mature enterprise architecture programs, and the federation strategy aimed at accomplishing this is still evolving. GAO has existing recommendations to address these and other architecture issues. The updated enterprise transition plan, which provides a temporal investment roadmap for transitioning from the current architectural environment to the target environment, continues to identify systems and initiatives that are to fill business capability gaps and address the DOD-wide and component business priorities that are contained in the business enterprise architecture. However, the plan still does not include investments for all components and does not reflect key factors associated with properly sequencing planned investments, such as dependencies among investments and the capability to execute the plan. Furthermore, the military departments, which are the largest members of the business federation, have yet to fully develop their own architecturally-based transition plans. GAO has existing recommendations to address these and other transition plan issues. DOD and the military departments have yet to fully establish key investment review structures and have yet to define related policies and procedures for effectively performing both project-level and portfolio-based investment management. GAO has existing recommendations to address these and other investment issues. Until DOD fully implements GAO's existing recommendations relative to the act and related guidance, its business systems modernization will likely remain a high-risk program.