However, these plans are not integrated and do not consistently  demonstrate the elements of integrated IT project planning. Until the FBI completes these and other efforts to introduce an integrated  approach to IT project planning, there is increased risk that the bureau’s IT  systems will be unnecessarily duplicative, will later require expensive  rework to be integrated, and will thus hamper organizational  transformation efforts. The FBI has  such policies and procedures for managing IT human capital; however, it  does not yet have a documented and consistent approach for acquisition  and investment management. The state of  the FBI’s acquisition and investment management policies and procedures  is due to a number of factors, including diffused and decentralized IT  management authority, past inattention to IT management, and lack of  sustained IT leadership. Until this is completed, the  bureau will be challenged in its ability to effectively manage all of its  systems modernization projects, and thus is at increased risk of acquiring  systems that do not adequately satisfy mission needs on schedule and  within budget, which could hamper the bureau’s systems modernization  and organizational transformation. The bureau’s efforts to define IT investment policies and procedures are  evolving slowly toward alignment with best practices. According to bureau officials, including the current CIO, the slowly  evolving state of investment management is due in part to the fact that the  bureau CIO position, which is responsible for developing the requisite  policies and procedures, has had a high rate of turnover. Recommendations for Executive Action

Until the bureau’s IT management foundation is completed and available to  effectively guide and constrain the hundreds of millions of dollars it is  spending on IT investments, we recommend that the Director direct the  heads of the divisions to limit spending on their respective IT investments  to cost-effective efforts that  take advantage of near-term, relatively small, low-risk opportunities to  leverage technology in satisfying a compelling bureau need;  support operations and maintenance of existing systems critical to the  FBI’s mission; or  support establishment of the FBI’s IT management foundation, including  the development of a modernization blueprint (enterprise architecture),  initiation of integrated project planning, and development of IT  management policies and procedures for systems acquisition and  investment selection and control. To address the first objective—determining whether the FBI had an  integrated plan or set of plans for modernizing its IT systems—we reviewed  program plans, IT capital asset plans and business cases (commonly called  Exhibit 300s), and other supporting documentation from each of the six  divisions, as well as the bureau’s strategic plan, draft IT strategic plan, and  information sharing strategy, and then compared this documentation with  Office of Management and Budget (OMB) planning guidance and our  research and past experience on federal systems modernizations to  determine the extent to which the plans exhibited an integrated approach  to managing IT projects, including addressing project interdependencies. In addition, we interviewed  the CIO and FBI division officials who were responsible for IT systems  acquisition management to (1) verify and clarify our understanding of  division-level policies and procedures in each of the five control areas; (2)  identify planned and ongoing initiatives to, among other things, improve  systems acquisition management across the bureau, including the  definition and implementation of a bureauwide systems life cycle  management process that is to include systems acquisition management  policies and procedures consistent with best practices; (3) determine why  divisions varied in their use of best practices; and (4) determine the effects  of not having these practices in place on ongoing and planned systems  modernization initiatives.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) is investing more than a billion dollars over 3 years to modernize its information technology (IT) systems. The modernization is central to the bureau's ongoing efforts to transform the organization. GAO was asked to determine whether the FBI has (1) an integrated plan for modernizing its IT systems and (2) effective policies and procedures governing management of IT human capital, systems acquisition, and investment selection and control.

What GAO Found

Although improvements are under way and planned, the FBI does not currently have an integrated plan for modernizing its IT systems. Each of the bureau's divisions and other organizational units that manage IT projects performs integrated planning for its respective IT projects. However, the plans do not provide a common, authoritative, and integrated view of how IT investments will help optimize mission performance, and they do not consistently contain the elements expected to be found in effective systems modernization plans. FBI officials attributed the state of modernization planning to, among other things, the bureau's lack of a policy requiring such activities, which is due in part to the fact that the responsibility for managing IT--including modernization planning--has historically been diffused and decentralized. The FBI's CIO recognizes these planning shortfalls and has initiated efforts to address them. Until they are addressed, the bureau risks acquiring systems that require expensive rework to be effectively integrated, thus hampering organizational transformation. The FBI has established policies and procedures governing IT human capital that are consistent with best practices used by leading private and public organizations. However, the bureau's policies and procedures governing systems acquisition, which are developed on a decentralized basis by the divisions and other units that manage IT projects, include some but not all best practices. In addition, the bureau's investment management policies and procedures, which started in 2001, have been evolving and progressing slowly toward alignment with best practices. According to FBI officials, the state of the bureau's acquisition and investment management policies and procedures is due to a number of factors, including diffused and decentralized IT management authority. The CIO recognizes these problems and has efforts planned and under way to strengthen policies and procedures. Until these efforts are completed, the bureau increases the risk that it will experience problems delivering promised IT investments on time and within budget, which, in turn, could adversely affect systems modernization and organizational transformation.