The agency’s IT budget for fiscal year 2008 is approximately $1 billion. The agency expects to spend about 80 percent of its acquisition budget on  infrastructure. SSA’s Current Investment Management Approach

SSA’s investment management process is intended to meet the objectives  of the Clinger-Cohen Act by providing a framework for selecting,  controlling, and evaluating investments that helps to ensure it meets the  strategic and business objectives of the agency. SSA Has Taken Key Steps to Manage Investments, but Gaps Remain in Oversight and in Defining Policies and Procedures

SSA has executed a majority of the key practices—82 percent––needed to  effectively manage its IT projects as investments, but it has not fully  implemented many of the related oversight responsibilities and  procedures that our ITIM framework outlines. Also, the agency has made  progress in establishing the critical processes and key practices for  managing IT investments as a portfolio. It is executing 18 out of 27 key  practices from this stage of the ITIM. However, it has not established  enterprisewide portfolio selection criteria and has executed few key  practices for evaluating the portfolio. Specifically, it is not evaluating IT investments, including performing  postimplementation reviews. However, the agency has not executed nine key practices,  including establishing enterprisewide selection criteria and managing all  of its investments as an enterprisewide portfolio. SSA is executing the seven key practices associated with creating the  portfolio. More Than Half of SSA’s IT Budget Is Not Subject to Its Current Investment Management Process

Even though SSA is executing most Stage 2 and Stage 3 key practices for  the work year budget managed by its investment board, IT products and  services acquired with the acquisition budget ($610 million in acquisitions  in fiscal year 2008—58 percent of the IT budget) are not managed as  investments under SSA’s CPIC process, and are not reviewed by the ITAB. Conclusions

Given the importance of IT to SSA’s mission, it is vital that the agency  manages its investments effectively. To its credit, SSA has established  many of the basic practices needed to build the foundation for managing  its projects as investments and for managing its investments as a portfolio. Recommendations for Executive Action

To strengthen SSA’s investment management capability and address  weaknesses discussed in this report, we recommend that the  Commissioner of Social Security take the following actions:  To fully implement the key practices for building the investment  foundation (Stage 2) for current and project-level future IT investments’  success, direct the Chief Information Officer to    establish comprehensive policies and procedures for defining the  investment governance process that specify (1) investment board  operating procedures, (2) delegations of authority, and (3) criteria for  prioritizing new and ongoing investments;   strengthen and expand the board’s oversight responsibilities for  underperforming projects and evaluations of projects; and   establish a mechanism for tracking corrective actions for underperforming  investments. As we previously noted, by the agency not  applying its investment management process to the acquisition budget, it  limits the ability of SSA’s executive management tasked with overseeing  the agency’s investments to ensure that this portion of the budget is spent  in the most efficient and effective manner. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether Social Security Administration’s  (SSA) investment management approach is consistent with leading  investment management best practices.
Why GAO Did This Study

The Social Security Administration (SSA) spends about $1 billion annually to support its information technology (IT) needs. Given the size and significance of the agency's ongoing and future investments in IT, it is crucial that the agency manages these investments wisely. Accordingly, GAO was requested to determine whether SSA's investment management approach is consistent with leading investment management best practices. To accomplish this, GAO used its IT investment management framework and associated methodology, with a focus on the framework's Stages 2 and 3, which are based on the investment management provisions of the Clinger-Cohen Act of 1996.

What GAO Found

SSA's investment management approach is largely consistent with leading investment management practices. It has established most of the practices needed to manage its projects as investments and is making progress towards managing IT investments as a portfolio; however, it is not applying its investment management process to all of its investments. Specifically: (1) The agency is executing a majority of the key practices needed to build the foundation for managing its IT projects as investments. Of the 5 processes and their 38 associated key practices, SSA is executing 31 practices. However, the agency's investment board, which should provide executive oversight of investments, is not adequately monitoring the performance of IT projects. (2) SSA has made progress in establishing the key practices for managing investments as a portfolio--it is executing 18 out of 27 key practices. The agency has made important progress in defining and creating the investment portfolio, but it has not developed enterprisewide portfolio selection criteria. The agency also has not established procedures for evaluating the portfolio, and its postimplementation reviews do not determine whether projects meet the agency's strategic goals. (3) SSA is not applying its investment management process to a major portion of its IT budget. Specifically, IT products and services acquired with its acquisition budget ($610 million of the $1 billion IT budget for fiscal year 2008) are not managed by the board as investments. SSA's executive-level review board is not responsible for overseeing the acquisition budget. Consequently, executive management has limited insight into investments acquired with these funds, and the agency has limited ability to ensure that the budget is spent in the most efficient and effective manner. Until it establishes oversight of all investments and fully defines policies and procedures for overseeing both individual projects and an agencywide portfolio, SSA risks not being able to select and control these investments consistently and completely, thus increasing the chance that investments will not meet mission needs in the most cost-effective and efficient manner.