DOD partially agreed with  the recommendations. According to the act, DOD is required to    develop a business enterprise architecture and an enterprise transition  plan for implementing the architecture, identify each business system proposed for funding in DOD’s fiscal year  budget submissions,   delegate the responsibility for business systems to designated approval  authorities within the Office of the Secretary of Defense, require each approval authority to establish investment review structures  and processes, and   effective October 1, 2005, not obligate appropriated funds for a defense  business system modernization with a total cost of more than $1 million  unless the approval authority certifies that the business system  modernization meets several conditions. Recent GAO Reviews of DOD’s Business Systems Modernization

Between 2005 and 2008, we reported that DOD had taken steps to comply  with key requirements of the Fiscal Year 2005 NDAA relative to  architecture development, transition plan development, budgetary  disclosure, and investment review, and to satisfy relevant systems  modernization management guidance; however, each report also  concluded that much remained to be accomplished relative to the act’s  requirements and relevant guidance. DOD  agreed with our recommendations. Collectively,  these steps address several statutory provisions and best practices  concerning the business enterprise architecture, transition plan, budgetary  disclosure, and investment review of systems costing in excess of $1  million. For example, while all three have or are in the process of  establishing an executive committee with responsibility and accountability  for the department’s enterprise architecture, none have fully developed an  enterprise architecture methodology or have a well-defined business  enterprise architecture and transition plan to guide and constrain business  transformation initiatives. However, each has yet to address key elements,  including developing the architecture content, in order to advance to a  level that can be considered fully mature. According to DOD officials, the  lack of progress in addressing key management elements has been due to  the uncertainty and pending decisions surrounding the roles and  responsibilities of key organizations and senior leadership positions. Air  Force officials attributed the state of its enterprise architecture program in  part to the lack of resources. DOD Has Continued to Establish Effective Investment Management Processes, but Has Yet to Fully Define Many Key Processes and Associated Policies and Procedures

Since we reported in 2009, DOD has continued to make progress in  establishing the kind of investment management processes and associated  key practices (i.e., policies and procedures) called for in the act and our  ITIM framework as being integral to effective IT investment management. Specifically, with regard to  the nine Stage 2 practices, DOD enterprise, Air Force, and Navy, as shown  in table 6, have yet to fully define five key practices (or 56 percent of the  practices), and Army has yet to do so for seven (or 78 percent) of the  practices. They also  acknowledged that Army is missing certain documented project-level and  portfolio-level management policies and procedures. More specifically, we previously  reported that DOD had not been performing this step and made  recommendations that they do so. For the investments under review, DOD largely followed its oversight  process but did not perform an important validation activity. Specifically, while DOD  continues to release updates to its corporate enterprise architecture, the  architecture has yet to be federated through development of aligned  subordinate architectures for each of the military departments. In this  regard, each of the military departments has made progress in managing  its respective architecture program, but there are still limitations in the  scope and completeness, as well as the immaturity of the military  department architecture programs, including the completeness of their  own transition plans. Accordingly, it is essential that DOD  resolve these matters expeditiously, as doing so is on the department’s  critical path for fully establishing the full range of institutional  management controls needed to address its business systems  modernization high-risk area. Recommendation for Executive Action

Because we have existing recommendations that address the institutional  management control weaknesses discussed in this report, we are making  no further recommendations in these areas. Appendix I: Objective, Scope, and Methodology

As agreed with congressional defense committees, our objective was to  assess the actions by the Department of Defense (DOD) to comply with  provisions of section 332 of the Ronald W. Reagan National Defense  Authorization Act for Fiscal Year 2005. Our methodology relative to each  of these four provisions is as follows:    To address the architecture and transition plan provision, we focused on  the progress the departments of the Air Force, Army, and Navy have made  in developing their respective parts of the federated DOD business  enterprise architecture.
Why GAO Did This Study

For decades, the Department of Defense (DOD) has been challenged in modernizing its timeworn business systems. Since 1995, GAO has designated DOD's business systems modernization program as high risk. Between 2001 and 2005, GAO reported that the modernization program had spent hundreds of millions of dollars on an enterprise architecture and investment management structures that had limited value. Accordingly, GAO made explicit architecture and investment management-related recommendations. Congress included provisions in the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 that were consistent with GAO's recommendations and required GAO to assess DOD's actions to comply with these provisions. To do so, GAO reviewed documents and interviewed military officials on the progress the military departments have made relative to developing their respective parts of the federated business enterprise architecture and establishing investment management structures and processes.

What GAO Found

DOD continues to take steps to comply with the act's provisions and to satisfy relevant system modernization management guidance. Collectively, these steps address several statutory provisions and best practices concerning the business enterprise architecture, budgetary disclosure, and review of systems costing in excess of $1 million. However, long-standing challenges that GAO previously identified remain to be addressed in order for DOD to be in compliance with guidance and the act. In particular, (1) While DOD continues to release updates to its enterprise architecture, the architecture has yet to be augmented by a coherent family of component architectures. In this regard, each of the military departments has made progress in managing its respective enterprise architecture program since GAO last reported in 2008. However, each has yet to address key elements, including developing the architecture content, to advance to a level that could be considered mature. For example, while each department has established or is in the process of establishing an executive committee with responsibility and accountability for the enterprise architecture, none has fully developed an enterprise architecture methodology or a well-defined business enterprise architecture and transition plan to guide and constrain business transformation initiatives. (2) DOD continues to establish investment management processes, but neither DOD-level organizations nor the military departments have defined the full range of project-level and portfolio-based IT investment management policies and procedures that are necessary to meet the investment selection and control provisions of the Clinger-Cohen Act of 1996. Specifically, with regard to project-level practices, DOD enterprise, Air Force, and Navy have yet to fully define 56 percent of the practices, and Army has yet to do so for 78 percent of the practices. With regard to the portfolio-level practices, DOD enterprise, Air Force, and Navy have yet to fully define 80 percent and Army has yet to do so for any of the practices. In addition, while DOD largely followed its certification and oversight processes, key steps were not performed. For example, as part of the certification process, DOD performed three process assessments specified in DOD guidance, such as assessing investment alignment with the architecture, but did not validate the results of the assessment, thus increasing the risk that certification decisionmaking was based on inaccurate and unreliable information. It is essential that DOD address GAO's existing recommendations aimed at addressing these long-standing challenges, as doing so is critical to the department's ability to establish the full range of institutional management controls needed to address its business systems modernization high-risk program. Department officials attributed the state of progress in part to the uncertainty and pending decisions surrounding the roles and responsibilities of key organizations and senior leadership positions as well as the lack of resources (i.e., people and funding). Because GAO has existing recommendations that address the long-standing challenges discussed in this report, it is making no further recommendations in these areas.

What GAO Recommends

GAO is recommending that DOD complete the implementation of the reorganization of key organizations. DOD agreed with GAO's recommendation.