As we have previously reported, these ongoing and planned IT  programs and projects are part of the FBI’s systems modernization  program. In place of the Virtual Case File project, the FBI launched its  Sentinel program in early 2005 to develop what the bureau describes  as its next-generation electronic information management system. It has centralized IT  responsibility and authority under the CIO, and it is establishing and  beginning to implement management capabilities in the areas of  enterprise architecture, IT investment management, systems  development and acquisition, and IT human capital. Before it can  effectively leverage technology to transform itself, the FBI will have  to build on these capabilities and effectively implement them on its  system investments. In summary, we found that the FBI is now managing its  enterprise architecture program in accordance with many best  practices, but it has yet to adopt others. Examples of best practices  that the bureau has implemented include the following:   ●  the bureau has established a program office that is responsible  for the development of the architecture;   it has issued a written and approved policy governing  architecture development; and   it has ongoing efforts to complete a target architecture. The FBI’s progress over the last 3 years to define and refine an IT  investment approach has been slow. Using cost and other criteria,  these assessments are designed to determine which systems can be  better used, replaced, outsourced, or retired. CIO officials told us that they  recently began implementing parts of the life cycle management  directive across all projects. For other key practices, procedures have been drafted  but require further development. However, the bureau has yet to create an integrated plan of action  that is based on a comprehensive analysis of the human capital roles  and responsibilities needed to support the IT functions established  under the CIO office’s reorganization. According to the CIO, he is in the process of hiring a  contractor with human capital expertise to help identify gaps  between existing skills and abilities and those that will be needed to  successful modernize the bureau’s IT. Success of New IT Investments, Like Sentinel, Will Depend on How Well the FBI Implements its New IT Management Approaches

The success of the FBI in using IT to support its transformation  efforts and in achieving its mission goals and outcomes will depend  on how well it actually implements and institutionalizes the IT  management structures, processes, and controls that have been or  are currently being put in place. Included in these 18 investments is Sentinel, the FBI’s program to  deliver an automated case management and information sharing  capability; this is the successor to the Virtual Case File, the failed  component of the Trilogy program. As an FBI flagship program, Sentinel can serve as a barometer of  how well the FBI defines and implements its new IT management  approaches and capabilities, particularly with regard to a system  that is to rely extensively on commercially available components  (software and hardware). Another very important area particularly relevant to Sentinel is  ensuring that the project’s plans explicitly provide the necessary  time and resources for (1) integrating the commercial components  with the FBI’s existing systems and (2) preparing users for the  impact that the business processes embedded in the COTS products  will have on how the users will be expected to do their jobs,  including potentially new roles and responsibilities. In light of the importance of these and other areas, we have just  initiated a review of Sentinel at the request of the Chairman and  Ranking Member of the House Judiciary Committee; as part of this  review, we plan to address many of these keys to project success. In closing, the FBI has made important progress, particularly in the  last 12 months under the new CIO’s leadership, in establishing  certain IT management and control capabilities that our research  and evaluations show are key to exploiting technology to enable  transformation. Nowhere will this be more crucial than on the Sentinel program. Because of the FBI’s stated approach to building Sentinel, it will be  particularly important for the bureau to ensure that it follows the  kind of acquisition management practices that our work has shown  to be critical for commercial component-based systems to be  successful.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) is in the process of modernizing its information technology (IT) systems. Replacing much of its 1980s-based technology with modern system applications and supporting technical infrastructure, this modernization is intended to enable the FBI to take an integrated, agencywide approach to performing its critical missions, such as federal crime investigation and terrorism prevention. At the request of the Congress, GAO has conducted a series of reviews of the FBI's modernization management. GAO was requested to testify on the bureau's progress to date in several areas of IT management. In addition, GAO discusses the importance of these areas for maximizing the prospects for success of the bureau's ongoing and future IT system investments, including the FBI's flagship Sentinel program; this program replaces the bureau's failed Virtual Case File project and aims to acquire and deploy a modern investigative case management system. In this testimony, GAO relied extensively on its previous work on the FBI's management of its IT processes, human capital, and tools, and it obtained updates on these efforts through reviews of documentation and interviews with responsible FBI officials, including the Chief Information Officer (CIO).

What GAO Found

Over the last 18 months, the FBI has made important progress in establishing IT management controls and capabilities that GAO's research and experience show are key to exploiting technology to enable transformation. These include centralizing IT responsibility and authority under the CIO and establishing and beginning to implement management capabilities in the areas of enterprise architecture, IT investment management, systems development and acquisition life cycle management, and IT human capital. The FBI has developed an initial version of its enterprise architecture and is managing its architecture activities in accordance with many key practices, but it has yet to adopt others (such as ensuring that the program office has staff with appropriate architecture expertise). The FBI is in the process of defining and implementing investment management policies and procedures. For example, it is performing assessments of existing systems to determine if any can be better used, replaced, outsourced, or retired, but these assessments have yet to be completed. The bureau has issued an agencywide standard life cycle management directive, but it has yet to fully implement this directive on all projects. Also, certain key practices, such as acquisition management, require further development. The FBI has taken various steps to bolster its IT workforce, but it has yet to create an integrated plan based on a comprehensive analysis of existing and needed knowledge, skills, and abilities. According to the CIO, he intends to hire a contractor to perform this and develop an implementation plan. The CIO also intends to establish a management structure to carry out the plan. The challenge now for the FBI is to build on these foundational capabilities and implement them effectively on the program and project investments it has under way and planned, none of which is more important than the Sentinel program. The success of this program will depend on how well the FBI defines and implements its new IT management approaches and capabilities, particularly those associated with acquiring a system made up of commercial components, which Sentinel is to be. In this regard, it will be crucial for the FBI, among other things, to understand and control Sentinel requirements in the context of (1) its enterprise architecture, (2) the capabilities and interoperability of commercially available products, and the (3) bureau's human capital and financial resource constraints. It will also be important for the FBI to prepare users for the impact of the new system on how they do their jobs. To the extent that the FBI does not take these steps, it will introduce program risks that could lead to problems similar to those that contributed to the failure of the Virtual Case File project.