Our objective was to determine whether the District had implemented disciplined software acquisition processes for acquiring its new financial management system. The District has a policy on solicitation and the FMS project followed this policy. These include (1) having a written organizational policy for establishing and managing requirements allocated to software, (2) documenting plans for the development and management of requirements, (3) having documented processes for requirements development, including elicitation, analysis, and verification, (4) measuring and reporting on the status of requirements development and management activities to management, (5) appraising the impact on software of system-level requirements changes and (6) having a mechanism to ensure that contractor-delivered work products meet specified requirements. For example, the District does not have an organizational policy for establishing and managing software-related requirements, there is no clear assignment of responsibility for requirements development and management and no documented evidence exists to show either resource requirements or resources expended for requirements development activities. FMS Risk Management Processes Are Ineffective

The FMS project had one strength for this KPA. However, the District is not performing any of the other practices to satisfy this KPA. While the District has many strengths in its acquisition processes for FMS, it also has many weaknesses that, overall, make its processes undisciplined and immature. Develop written policy for software acquisition risk management. As discussed in the report, significant improvements would be necessary to achieve the minimally acceptable level of maturity as defined by the Software Engineering Institute’s Software Acquisition Maturity Model to satisfy the intent of all the software acquisition key process areas.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed whether the District of Columbia had implemented disciplined software acquisition processes for its new financial management system (FMS).

What GAO Found

GAO noted that: (1) while the District has many strengths in its acquisition processes for FMS, it also has many weaknesses; (2) when compared to standards established by the Software Engineering Institute, the District's processes for software acquisitions are not mature; (3) of the six key process areas (KPA) evaluated for the repeatable level, the District fully satisfied only one--solicitation; (4) severe weaknesses were found in other critical key processes, including requirements development and management and evaluation; (5) for example, the District does not have a policy for establishing and managing software-related requirements, does not at present have adequate resources for requirements development, and has not formally designated responsibility for requirements development and management; (6) similarly, the District does not have an effective evaluation process, and is currently unable to objectively determine if the acquired systems will satisfy the contract requirement; (7) finally, the District has not satisfied the one KPA evaluated for the defined level of maturity, acquisition risk management; and (8) the FMS project does not have a risk management plan and does not track project risk.