To carry out its mission, HUD is organized into five main program areas:  Housing, Community Planning and Development, Fair Housing and Equal  Opportunity, Public and Indian Housing, and the Government National  Mortgage Association. Among other things,  these controls include strategic planning and performance measurement,  portfolio-based investment management, human capital management,  enterprise architecture (and supporting segment architecture)  development and use, and establishing responsibility and accountability  for modernization management. EA development and use is aimed at establishing a corporate blueprint for  investing that connects strategic plans with individual programs and  system solutions. Key IT Management and Modernization Controls Have Not Been Fully Established

The department has, to varying degrees, established certain key IT  management and modernization controls needed to help ensure that its  existing IT environment adequately supports mission operations and that  its efforts to modernize this environment are successful. However, these  controls have not been fully implemented either in accordance with a  statutory requirement, federal guidance, or related best practices. Until it does, the  performance of HUD’s existing IT environment, as well as its efforts to  modernize this environment, will be at risk. Moreover, while HUD  assessed and reported on its IT performance in fiscal year 2007, this  assessment showed that it was either behind schedule or not making  progress in 46 percent of the activities it defined as needed to achieve its  IT strategic goals. Without having defined and implemented practices for evaluating the  performance of its IT investment portfolios, HUD will be limited in its  ability to control the risks and achieve the benefits associated with the mix  of legacy system and modernization investments that it selects. The office performed an analysis of the gaps between its IT workforce  requirements and skills (inventory) in fiscal year 2008 using an outdated  inventory of human capital skills, thus rendering the identified gaps  unreliable. The office developed a strategy for closing the gaps, including steps,  activities, and related milestones. HUD Has Yet to Develop Sufficient Architectural Context to Guide and Manage Modernization Projects

A key aspect of HUD’s approach to modernizing its IT environment is to  extend its EA to include what are referred to as segment architectures,  which are to provide the modernization details needed to develop and  implement system solutions for portions, or segments, of a department or  agency. Moreover, the majority of the segment  architectures developed thus far are out of date and do not fully address  key aspects of federal guidance, such as provisions for performance goals  and measurement. Nevertheless, we also reported that HUD had not addressed two important  elements. To date, the department has not established its EPMO and thus has not  assigned responsibility and authority for management of its modernization  efforts. To HUD’s credit, it is aware of the need to improve many of these IT  management controls, but its IT resources have in recent years been  almost exclusively directed to sustaining its existing IT environment, and  it has yet to develop specific plans for strengthening each of these  management controls. 3. 4. GAO Comments

1. 2. 5.
Why GAO Did This Study

Information technology (IT) plays a critical role in the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission, which was recently expanded under the Housing and Economic Recovery Act of 2008. Pursuant to a congressional mandate to study HUD's IT environment, GAO reviewed the adequacy of key IT management and modernization controls within the department, including strategic planning and performance measurement, investment management, human capital management, enterprise architecture development and use, and modernization program office establishment. To do so, GAO compared HUD policies, guidance, plans, reports, and other products and actions to relevant aspects of statutory requirements, federal guidance, and related best practices.

What GAO Found

The department has to varying degrees established key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. Specifically, HUD has (1) developed an IT strategic plan, with strategic goals and related activities and performance targets, but it has not assessed its IT performance since fiscal year 2007, and its assessment at that time showed performance shortfalls. For example, it reported that it was behind schedule or not making progress on about one-half of the activities needed to achieve its IT strategic goals. (2) established policies and procedures for creating portfolios of IT investments, but it lacks related practices to effectively control them. For example, criteria to evaluate the performance of its portfolio do not exist. (3) analyzed gaps in its IT workforce and developed a strategy for addressing them, but the analysis was based on an incomplete and outdated inventory of human capital skill levels, thus rendering its strategy unreliable. (4) established an enterprise architecture program--to connect strategic plans with individual programs and system solutions--that meets key aspects of related best practices, but its efforts to extend its architecture by adding the level of detail needed to implement modernization projects, referred to as segment architectures, are not sufficient. For example, while HUD has identified and prioritized segments to be modernized, it has not adhered to these priorities, and the segments developed do not reflect important elements of federal guidance, and most are out of date. (5) identified the need for a modernization program office with the responsibility for managing its modernization efforts but has not established this office. Department officials acknowledged these shortcomings and stated that efforts to address them have been constrained by such factors as turnover in IT leadership and, until recently, limited modernization resources and initiatives. Until it strengthens these IT management controls, the performance of its existing IT environment and the success of its recent and future efforts to modernize this environment will be at risk.