To accomplish this, the program office is  responsible for key program management areas, such as architectural  alignment, economic justification, earned value management,  requirements management, and risk management. FOC is now planned for fiscal year 2013, and the estimated life  cycle cost is about $2.4 billion (31 percent increase over the original  estimate). Prior GAO Reviews Have Identified IT Acquisition Management Control Weaknesses on DOD Business System Investments

We have previously reported that DOD has not effectively managed a  number of business system investments. To  varying degrees of effectiveness, Navy ERP has been managed in  accordance with aspects of this framework. Specifically,    compliance with DOD’s federated BEA has not been sufficiently  investment in the program has been economically justified on the basis of  expected life cycle benefits that will likely exceed estimated life cycle  costs, although some estimating limitations nevertheless exist;   earned value management has not been effectively implemented;    an important requirements management activity has been effectively    a risk management process has been defined, but not effectively  implemented for all risks. The reasons that program management and oversight officials cited for  why these key practices have not been sufficiently executed range from  limitations in the applicable DOD guidance and tools to the complexity  and challenges of managing and implementing a program of this size. By  not effectively implementing all the above key IT acquisition management  functions, the program is at increased risk of (1) not being defined in a  way that best meets corporate mission needs and enhances performance  and (2) adding to the more than 2 years in program schedule delays and  about $570 million in program cost increases experienced to date. To its credit, the program office has followed DOD’s BEA compliance  guidance. Therefore, we have no reason to believe that Navy ERP will  not produce a positive return on investment. While important cost estimating practices were not implemented, it is  nevertheless unlikely that these limitations would materially increase the  $2.4 billion cost estimate to a level approaching the program’s $8.6 billion  benefit expectations. To its credit, the program has elected to implement program-level EVM,  which is a best practice that has rarely been implemented in the federal  government. In doing so, however, basic EVM activities have not been  executed. Not performing these important  practices has contributed to the cost overruns and lengthy schedule delays  already experienced on Release 1.0, and they will likely result in more. However, it has not conducted an integrated baseline  review. The effectiveness to which key IT management controls have been  implemented in Navy ERP varies, with one control and several aspects of  others being effectively implemented, and others less so. Recommendations for Executive Action

To strengthen Navy ERP management control and better provide for the  program’s success, we are making the following recommendations:    To improve the reliability of Navy ERP benefit estimates and cost  estimates, we recommend that the Secretary of Defense direct the  Secretary of the Navy, through the appropriate chain of command, to  ensure that future Navy ERP estimates include uncertainty analyses of  estimated benefits, reflect the risks associated with not having cost data  for comparable ERP programs, and are otherwise derived in full  accordance with the other key estimating practices, and economic analysis  practices discussed in this report. To improve Navy ERP’s management of program risks, we recommend  that the Secretary of Defense direct the Secretary of the Navy, through the  appropriate chain of command, to ensure that (1) the plans for mitigating  the risks associated with converting data from legacy systems to Navy  ERP and positioning the commands for adopting the new business  processes embedded in the Navy ERP are re-evaluated in light of the  recent experience with NAVAIR and adjusted accordingly, (2) the status  and results of these and other mitigation plans’ implementation are  periodically reported to program oversight and approval authorities, (3)  these authorities ensure that those entities responsible for implementing  these strategies are held accountable for doing so, and (4) each of the risks  discussed in this report are included in the program’s inventory of active  risks and managed accordingly. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the Department of the Navy is  effectively implementing information technology management controls on  the Navy Enterprise Resource Planning (Navy ERP) program.
Why GAO Did This Study

The Department of Defense (DOD) has long been challenged in implementing key information technology (IT) management controls on its thousands of business system investments. For this and other reasons, GAO has designated DOD's business systems modernization efforts as high-risk. One of the larger business system investments is the Department of the Navy's Enterprise Resource Planning (Navy ERP) program. Initiated in 2003, the program is to standardize the Navy's business processes, such as acquisition and financial management. It is being delivered in increments, the first of which is to cost about $2.4 billion over its useful life and be fully deployed in fiscal year 2013. GAO was asked to determine whether key IT management controls are being implemented on the program. To do this, GAO analyzed, for example, requirements management, economic justification, earned value management, and risk management.

What GAO Found

DOD has implemented key IT management controls on its Navy ERP program to varying degrees of effectiveness. To its credit, the control associated with managing system requirements is being effectively implemented. In addition, important aspects of other controls have at least been partially implemented, including those associated with economically justifying investment in the program and proactively managing program risks. Nevertheless, other aspects of these controls, as well as the bulk of what is needed to effectively implement earned value management, which is a recognized means for measuring program progress, have not been effectively implemented. Among other things, these control weaknesses have contributed to the more than 2-year schedule delay and the almost $600 million cost overruns already experienced on the program since it began, and they will likely contribute to future delays and overruns if they are not corrected. Examples of the weaknesses are: (1) Investment in the program has been economically justified on the basis of expected benefits that far exceed estimated costs ($8.6 billion versus $2.4 billion over a 20-year life cycle). However, important estimating practices, such as using historical cost data from comparable programs and basing the cost estimate on a reliable schedule baseline were not employed. While these weaknesses are important because they limit the reliability of the estimates, GAO's analysis shows that they would not have altered the estimates to the point of not producing a positive return on investment. (2) Earned value management has not been effectively implemented. To its credit, the program office has elected to implement program-level earned value management. In doing so, however, basic prerequisites for effectively managing earned value have not been executed. In particular, the integrated master schedule was not derived in accordance with key estimating practices, and an integrated baseline review has not been performed on any of the first increment's releases. (3) A defined process for proactively avoiding problems, referred to as risk management, has been established, but risk mitigation strategies have not been effectively implemented for all significant risks, such as those associated with data conversion and organizational change management, as well the risks associated with the above-cited weaknesses. The reasons that program management and oversight officials cited for these practices not being executed range from the complexity and challenges of managing and implementing a program of this size to limitations in the program office's scope and authority. Notwithstanding the effectiveness with which important aspects of several controls have been implemented, the above-cited weaknesses put DOD at risk of investing in a system solution that does not optimally support corporate mission needs and mission performance, and meet schedule and cost commitments.