HHS’ Financial System Implementation Effort

In June 2001, the Secretary of HHS directed the department to establish a  unified accounting system that, when fully implemented, would replace  five outdated accounting systems. HHS Has Not Effectively Implemented Key Processes Necessary to Reduce Risks to Acceptable Levels

We found that HHS has not implemented effective disciplined processes in  several key process areas that have been shown to form the foundation for  project success or failure including requirements management, testing,  project management and oversight, and risk management. Requirements were not traceable. This leaves HHS with little time to address any defects  identified during the system testing process and to ensure that the  corrective actions taken to address the defects do not introduce new  defects. However, we have reported—and HHS  has acknowledged—weaknesses in IT investment management, enterprise  architecture, and information security. HHS’ Enterprise IT Management Processes Also Add Risk for UFMS

In addition to weaknesses in disciplined processes in the development of  UFMS, weaknesses in the HHS’ IT management processes also increase the  risks associated with UFMS. HHS is modifying its IT investment  management policies, developing an enterprise architecture, and  responding to security weaknesses with several ongoing activities, but  these changes may not be implemented in time to compensate for the  increased risks. It is  essential that an agency take the necessary steps to ensure that it has the  human capital capacity to design, implement, and operate a financial  management system. HHS has taken first steps to address three of the five key principles  identified in our report on strategic workforce planning. Without  assurances that it is moving ahead with a solid foundation and a fully  developed and strongly administered plan for bringing the entire UFMS  project under the disciplined processes of requirements management,  testing, risk management, and the use of quantitative measures to manage  the project, HHS risks not achieving its goal of a common accounting  system that produces data for management decision making and financial  reporting and risks perpetuating its long-standing accounting system  weaknesses with substantial workarounds to address any needed  capabilities that have not been built into the system. Before proceeding with further implementation of UFMS after deployment  at CDC, we recommend that the Secretary of  Health and Human Services  direct the Assistant Secretary for Budget, Technology, and Finance to  require that the UFMS program staff take the following 14 actions:  Develop and effectively implement a plan on how HHS will implement  the disciplined processes necessary to reduce the risks associated with  this effort to acceptable levels. Develop a concept of operations in accordance with recognized industry  standards such as those promulgated by IEEE. This shortage of staff  resources led to several key deliverables being significantly behind  schedule. HHS will need to ensure effective information security controls  departmentwide for UFMS operations. Through early recognition and resolution of the weaknesses identified,  HHS can optimize its opportunities to reduce the risks that UFMS will not  fully meet one or more of its cost, schedule, and performance objectives. Staff contacts and other key contributors to this  report are listed in appendix V.

Scope and Methodology

Our review of the Department of Health and Human Services’ (HHS)  ongoing effort to develop and implement a unified accounting system  focused on one of the three concurrent but separate projects: the ongoing  implementation of the Unified Financial Management System (UFMS) at  the Centers for Disease Control and Prevention (CDC), the Food and Drug  Administration and HHS’ Program Support Center (PSC). To assess information technology (IT) management practices, we reviewed  prior GAO reports on governmentwide investment management and  enterprise architecture.
Why GAO Did This Study

In June 2001, the Secretary of HHS directed the department to establish a unified accounting system that, when fully implemented, would replace five outdated accounting systems. GAO was asked to review HHS' ongoing effort to develop and implement the Unified Financial Management System (UFMS) and to focus on whether the agency has (1) effectively implemented disciplined processes; (2) implemented effective information technology (IT) investment management, enterprise architecture, and information security management; and (3) taken actions to ensure that the agency has the human capital needed to successfully design, implement, and operate UFMS.

What GAO Found

HHS has not followed key disciplined processes necessary to reduce the risks associated with implementing UFMS to acceptable levels. While development of a core financial system can never be risk free, effective implementation of disciplined processes can reduce those risks to acceptable levels. The problems that have been identified in such key areas as requirements management, including developing a concept of operations, testing, data conversion, systems interfaces, and risk management, compounded by incomplete IT management practices, information security weaknesses, and problematic human capital practices, significantly increase the risks that UFMS will not fully meet one or more of its cost, schedule, and performance objectives. With initial deployment of UFMS at the Centers for Disease Control and Prevention (CDC) scheduled for October 2004, HHS has not developed sufficient quantitative measures for determining the impact of the many process weaknesses identified by GAO and others to evaluate its project efforts. Without well-defined requirements that are traceable from origin to implementation, HHS cannot be assured that the system will provide the functionality needed and that testing will identify significant defects in a timely manner prior to rollout when they are less costly to correct. The agency has not developed the necessary framework for testing requirements, and its schedule leaves little time for correcting process weaknesses and identified defects. HHS has focused on meeting its predetermined milestones in the project schedule to the detriment of disciplined processes. If HHS continues on this path, it risks not achieving its goal of a common accounting system that produces data for management decision making and financial reporting and risks perpetuating its long-standing accounting system weaknesses with substantial workarounds to address needed capabilities that have not been built into the system. Accordingly, GAO believes these issues need to be addressed prior to deployment at CDC. Beyond the risks associated with this specific system development, HHS has departmental weaknesses in IT investment management, enterprise architecture, and information security. Because of the risks related to operating UFMS in an environment with flawed information security controls, HHS needs to take action to ensure that UFMS benefits from strong information security controls. HHS is modifying its IT investment management policies, developing an enterprise architecture, and responding to security weaknesses with several ongoing activities, but substantial progress in these areas is needed to prevent increased risks to cost, schedule, and performance objectives for UFMS. In human capital, many positions were not filled as planned and strategic workforce planning was not timely. HHS has taken the first steps to address these issues; however, ongoing staff shortages have played a role in several key deliverables being significantly behind schedule.