Specifically, agencies were required to determine, for each  of their high risk projects, whether the project was meeting one or more of  four performance evaluation criteria: (1) establishing baselines with clear  cost, schedule, and performance goals; (2) maintaining the project’s cost  and schedule variances within 10 percent; (3) assigning a qualified project  manager; and (4) avoiding duplication by leveraging inter-agency and  governmentwide investments. Federal Agencies Identified 226 Projects as High Risk

In response to OMB’s August 2005 memorandum, as of March 2006, the 24  CFO agencies identified 226 IT projects as high risk, totaling about $6.4  billion and representing about 10 percent of the President’s total IT budget  request for fiscal year 2007. About 70 percent of the projects  identified were reported as high risk because their delay or failure would  impact the agency’s essential business functions. The majority of the agencies reported  that their high risk projects did not have performance shortfalls in any of  the four areas identified by OMB. Processes Exist to Identify and Oversee High Risk Projects, but Opportunities Exist to Improve These Processes

Although agencies, with OMB’s assistance, generally identified their high  risk projects by evaluating their IT portfolio against the four criteria  specified by OMB, the criteria were not always consistently applied. In  addition, OMB did not define a process for updating the list. OMB staff perform their oversight of  high risk projects by reviewing the quarterly performance reports, but they  do not have a single aggregate list to analyze projects and for tracking  progress on a governmentwide basis. For projects without shortfalls, officials stated that while the  memorandum does not direct agencies to submit these reports, agencies  communicate the status of these projects to the appropriate officials. High Risk and Management Watch List Projects Identified Using Different Criteria

The high risk projects and Management Watch List projects are identified  using different sets of criteria. Nevertheless, both types of projects  require close attention because of their importance in supporting critical  functions and the likelihood that performance problems associated with  them could potentially result in billions of taxpayers’ dollars being wasted  if they are not detected early. As a result, projects that appear to be high  risk were not always identified as such. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) provide a summary of high risk projects that  identifies by agency the number of high risk projects, their proposed  budget for fiscal year 2007, agency reasons for the high risk designation,  and reported performance shortfalls; (2) determine how high risk projects  were identified and updated and what processes and procedures have  been established to effectively oversee them; and (3) determine the  relationship between the high risk list and OMB’s Management Watch List. Corrective actions  not reported.
Why GAO Did This Study

In August 2005, the Office of Management and Budget (OMB) issued a memorandum directing agencies to identify high risk information technology (IT) projects and provide quarterly reports on those with performance shortfalls--projects that did not meet criteria established by OMB. GAO was asked to (1) provide a summary identifying by agency the number of high risk projects, their proposed budget for fiscal year 2007, agency reasons for the high risk designation, and reported performance shortfalls; (2) determine how high risk projects were identified and updated and what processes and procedures have been established to effectively oversee them; and (3) determine the relationship between the high risk list and OMB's Management Watch List--those projects that OMB determines need improvements associated with key aspects of their budget justifications.

What GAO Found

In response to OMB's August 2005 memorandum, the 24 major agencies identified 226 IT projects as high risk, totaling about $6.4 billion in funding requested for fiscal year 2007. Agencies identified most projects as high risk because their delay or failure would impact the essential business functions of the agency. In addition, agencies reported that about 35 percent of the high risk projects--or 79 investments--had a performance shortfall, meaning the project did not meet one or more of these four criteria: establishing clear baselines, maintaining cost and schedule variances within 10 percent, assigning a qualified project manager, and avoiding duplication with other investments. Although agencies, with OMB's assistance, generally evaluated their IT portfolio against the criteria specified by OMB to identify their high risk projects, the criteria were not always consistently applied. Accordingly, GAO identified several projects that appeared to meet OMB's definition for high risk but were not determined by agencies to be high risk. In addition, OMB does not define a process for updating high risk projects. As a result, agencies had inconsistent updating procedures. Regarding oversight of these projects, agencies either established special procedures or used their existing investment management processes. OMB staff stated that they review the projects' performance and corrective actions planned. However, OMB has not compiled the projects into a single aggregate list, which would serve as a tool to analyze and track the projects on a governmentwide basis. High risk projects and Management Watch List projects are identified using different criteria. The former is meant to track the management and performance of projects, while the latter focuses on an agency's project planning. Both sets of projects require attention because of their importance in supporting critical functions and the likelihood that their performance problems could potentially result in billions of taxpayers' dollars being wasted if the problems are not detected early.