GAO Has Reported on the Need to Improve Oversight of Legacy IT

We have previously reported on legacy IT and the need for the federal  government to improve its oversight of such investments. Three of  the agencies agreed with our recommendations; two partially agreed; and  two agencies had no comments. Specifically, data from the IT Dashboard shows  that, in 2015, 5,233 of the government’s nearly 7,000 IT investments were  spending all of their funds on O&M activities. According to agency data reported to OMB’s IT Dashboard, the 10 IT  investments spending the most on O&M for fiscal year 2015 total $12.5  billion, 20 percent of the total O&M spending, and range from $4.4 billion  on Department of Health and Human Services’ (HHS) Centers for  Medicare and Medicaid Services’ Medicaid Management Information  System to $666.1 million on HHS’s Centers for Medicare and Medicaid  Services IT Infrastructure investment (see table 1). Spending on O&M Has Increased over 7 Years

Over the past 7 fiscal years, O&M spending has increased, while the  amount invested in developing new systems has decreased by about  $7.3 billion since fiscal year 2010. Specifically, in fiscal  year 2010, O&M spending was 68 percent of the federal IT budget, while  in fiscal year 2017, agencies plan to spend 77 percent of their IT funds on  O&M. OMB staff in the Office of E-Government and Information Technology  have recognized the upward trend of IT O&M spending and identified  several contributing factors, including (1) the support of O&M activities  requires maintaining legacy hardware, which costs more over time, and  (2) costs are increased in maintaining applications and systems that use  older programming languages, since programmers knowledgeable in  these older languages are becoming increasingly rare and thus more  expensive. Several O&M investments were rated as moderate to high risk in fiscal  year 2015. While agencies generally conducted the required operational analyses,  they did not consistently perform TechStat reviews on all of the at-risk  investments. Until agencies ensure that their O&M investments are fully  reviewed, the government’s oversight of old and vulnerable investments  will be impaired and the associated spending could be wasteful. IT Investments Are Becoming Obsolete and Agencies Are Not Required to Identify Investments That Need Attention

Legacy IT investments across the federal government are becoming  increasingly obsolete. Specifically, many use outdated languages and old  parts. For instance, Defense is still using 8-inch floppy  disks in a legacy system that coordinates the operational functions of the  United States’ nuclear forces. For example, Treasury reported systems that were  about 56 years old. Agencies reported having plans to modernize or  replace each of these investments and systems. However, the plans for 3 of  those were general or tentative in that the agencies did not provide  specificity on time frames, activities to be performed, or functions to be  replaced or enhanced. Until this policy is finalized and carried  out, the federal government runs the risk of continuing to maintain  investments that have outlived their effectiveness and are consuming  resources that outweigh their benefits. Among other things, we  recommend that the Director of OMB commit to a firm date by which its  draft guidance on legacy systems will be issued, and subsequently direct  agencies to identify legacy systems and/or investments needing to be  modernized or replaced and that the selected agency heads direct their  respective agency CIOs to identify and plan to modernize or replace  legacy systems as needed and consistent with OMB’s draft guidance. Defense and Energy partially agreed  with our recommendation. Defense and Energy’s comments are consistent  with the intent of our recommendation. Further, legacy federal IT investments are  becoming obsolete and several aging investments are using unsupported  components, many of which did not have specific plans for modernization  or replacement.
Why GAO Did This Study

The President's fiscal year 2017 budget request for IT was more than $89 billion, with much of this amount reportedly for operating and maintaining existing (legacy) IT systems. Given the magnitude of these investments, it is important that agencies effectively manage their IT O&M investments.
GAO was asked to summarize its report being released today that (1) assesses federal agencies' IT O&M spending, (2) evaluates the oversight of at-risk legacy investments, and (3) assesses the age and obsolescence of federal IT.
In preparing the report on which this testimony is based, GAO reviewed 26 agencies' IT O&M spending plans for fiscal years 2010 through 2017 and OMB data. GAO further reviewed the 12 agencies that reported the highest planned IT spending for fiscal year 2015 to provide specifics on agency spending and individual investments.

What GAO Found

The federal government spent more than 75 percent of the total amount budgeted for information technology (IT) for fiscal year 2015 on operations and maintenance (O&M) investments. Specifically, 5,233 of the government's approximately 7,000 IT investments are spending all of their funds on O&M activities. Such spending has increased over the past 7 fiscal years, which has resulted in a $7.3 billion decline from fiscal years 2010 to 2017 in development, modernization, and enhancement activities.
Many IT O&M investments in GAO's review were identified as moderate to high risk by agency CIOs and agencies did not consistently perform required analysis of these at-risk investments. Until agencies fully review their at-risk investments, the government's oversight of such investments will be limited and its spending could be wasteful.
Federal legacy IT investments are becoming increasingly obsolete: many use outdated software languages and hardware parts that are unsupported. Agencies reported using several systems that have components that are, in some cases, at least 50 years old. For example, the Department of Defense uses 8-inch floppy disks in a legacy system that coordinates the operational functions of the nation's nuclear forces. In addition, the Department of the Treasury uses assembly language code—a computer language initially used in the 1950s and typically tied to the hardware for which it was developed. OMB recently began an initiative to modernize, retire, and replace the federal government's legacy IT systems. As part of this, OMB drafted guidance requiring agencies to identify, prioritize, and plan to modernize legacy systems. However, until this policy is finalized and fully executed, the government runs the risk of maintaining systems that have outlived their effectiveness. The following table provides examples of legacy systems across the federal government that agencies report are 30 years or older and use obsolete software or hardware, and identifies those that do not have specific plans with time frames to modernize or replace these investments.

What GAO Recommends

In the report being released today, GAO is making multiple recommendations, one of which is for OMB to finalize draft guidance to identify and prioritize legacy IT needing to be modernized or replaced. In the report, GAO is also recommending that selected agencies address obsolete legacy IT O&M investments. Nine agencies agreed with GAO's recommendations, two partially agreed, and two stated they had no comment. The two agencies that partially agreed, the Departments of Defense and Energy, outlined plans that were consistent with the intent of GAO's recommendations.