FDA Lacks a Comprehensive List of Its IT Systems

Federal guidance calls for agencies to prepare and maintain a  comprehensive list of their IT systems. Although FDA reported spending approximately $439 million for IT  investments in fiscal year 2011, the agency does not have a  comprehensive list of IT systems identifying and providing key information  about the systems that it currently uses or is developing. IV for  a list of the 44 IT investments.) In addition to the OMB budget documents, the agency’s list of 21 mission- critical systems and modernization initiatives did not fully identify FDA’s IT  systems. Until  the agency has a comprehensive inventory of its IT assets, it will lack the  information needed to ensure that it is identifying the appropriate mix of  investments that best meet its needs and priorities. Nevertheless,  much work remains on FDA’s largest mission-critical system  modernization project, MARCS, and a lack of adequate planning, among  other things, makes it uncertain when or if it will meet its goals of  replacing eight key legacy systems and providing needed functionality. In  addition, FDA has not yet fully implemented key IT management  capabilities to guide and support its modernization effort, such as IT  strategic planning, enterprise architecture development and  implementation, and IT human capital planning. By enhancing existing applications  and developing new systems, it is to provide information to headquarters  and field users to perform inspections, compliance activities, and  laboratory operations. However, despite its importance to FDA’s overall modernization efforts,  much of the planned functionality has not been delivered, and FDA has  yet to retire the legacy systems MARCS was intended to replace. While the Program Manger provided a fiscal year 2011 schedule and  multiple 2012 subproject schedules, these documents lacked key  information that is required in an IMS. Until  FDA establishes these capabilities, successful completion of its  modernization efforts is in jeopardy. Since 2008, the agency has had five CIOs,  potentially hampering its ability to plan and effectively implement a long- range IT strategy. FDA Has Made Mixed Progress in More Effectively Sharing and Integrating Data

Data sharing is critical for FDA to effectively carry out its mission. As  previously noted, the agency needs timely access to data to be able to  support its product review and approval process, its inspection of imports  and manufacturing facilities, and its postmarket surveillance activities. Specifically, the agency has several initiatives under  way to more effectively share its data, including adopting an  enterprisewide standard for formatting data, and several projects aimed at  enhancing its ability to share data, both internally and with external  partners. However, these projects have made mixed progress, and more  significant work remains for FDA to fully implement standardized data  sharing across the agency. FDA Has Not Adequately Assessed Data-Sharing Opportunities within the Center for Food Safety and Applied Nutrition

OMB and the Federal CIO Council guidance state that agencies should  analyze their business and information environments to determine  information-sharing requirements and identify improvement  opportunities.information sharing within the agency and other government agencies. Nonetheless, the center has not comprehensively assessed its  information-sharing needs and capabilities to identify further opportunities  for data sharing and system integration. Conclusions

While FDA has taken several important steps toward modernizing its IT  environment, much remains to be done, and these efforts have not been  guided by key foundational IT management practices, which expose them  to significant risk. Recommendations for Executive Action

To help ensure the success of FDA’s modernization efforts, we are  recommending that the Commissioner of FDA direct the CIO to take the  following four actions:
Take immediate steps to identify all of FDA’s IT systems and develop  an inventory that includes information describing each system, such  as costs, system function or purpose, and status information, and  incorporate use of the system portfolio into the agency’s IT investment  management process. In its comments, the department neither agreed nor disagreed with our  recommendations but stated that FDA has taken actions to address many  of the issues in our report. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) assess the Food and Drug Administration’s  (FDA) current portfolio of information technology (IT) systems, including  the number of systems in use and under development, and their purpose  and costs; (2) assess the status and effectiveness of FDA’s efforts to  modernize the mission-critical systems that support its regulatory  programs; and (3) examine the agency’s progress in effectively  integrating and sharing data among key systems. We supplemented our analysis with interviews of the agency’s CIO, Chief  Technology Officer, Chief Enterprise Architect, Senior Technical Advisor,  and other relevant IT managers regarding management of FDA’s IT  portfolio, the status of and plans to modernize key systems such as  MARCS, shortfalls in mission-related systems, IT strategic and human  capital planning, status of enterprise architecture development, and  efforts to improve interoperability of systems that support FDA’s  regulatory mission.
Why GAO Did This Study

The Food and Drug Administration (FDA), an agency within the Department of Health and Human Services (HHS), relies heavily on information technology (IT) to carry out its mission of ensuring the safety and effectiveness of regulated consumer products. Specifically, IT systems are critical to FDAs product review, adverse event reporting, and compliance activities. Recognizing limitations in its IT capabilities, the agency has undertaken various initiatives to modernize its systems. GAO was asked to (1) assess FDAs current portfolio of IT systems, including the number of systems in use and under development, and their purpose and costs; (2) assess the status and effectiveness of FDA's efforts to modernize the mission-critical systems that support its regulatory programs; and (3) examine the agency's progress in effectively integrating and sharing data among key systems. To do this, GAO reviewed information on key FDA systems and interviewed agency officials to determine the status of systems and the effectiveness of key IT management practices, as well as data sharing among key systems.

What GAO Found

While FDA has taken several important steps toward modernizing its IT environment, much remains to be done. FDA reported spending about $400 million for IT investments in fiscal year 2011; however, the agency currently lacks a comprehensive IT inventory that identifies and provides key information about the systems it uses and is developing. Office of Management and Budget (OMB) and GAO guidance call for federal agencies to maintain such an inventory in order to monitor and manage their IT investments. This inventory should include information on each system, such as costs, functionality or purpose, and status. However, FDA does not have such a comprehensive list of its systems. Instead, the agency points to budget documents required by OMB, which included information on 44 IT investments for fiscal year 2011. The agency also provided a partial list of 21 mission-critical systems and modernization initiatives. Nonetheless, agency officials acknowledged that these documents do not identify all FDAs systems or the complete costs, purpose, or status of each system. Until the agency has a complete and comprehensive inventory, it will lack critical information needed to effectively assess its IT portfolio.
Much work remains on FDAs largest and costliest system modernization effortthe Mission Accomplishments and Regulatory Compliance Services program. This program is estimated to cost about $280 million and is intended to enhance existing applications and develop new systems that provide information for inspections, compliance activities, and laboratory operations. However, much of the planned functionality has not been delivered and its completion is uncertain. Moreover, the program lacks an integrated master schedule identifying all the work activities that need to be performed and their interdependencies. FDAs Chief Information Officer (CIO) stated that the agency is reevaluating the scope of the initiative. As a result, it is uncertain when or if FDA will meet its goals of replacing key legacy systems and providing modernized functionality to support its mission. In addition, FDA has not yet fully implemented key IT management capabilities essential for successful modernization, as previously recommended by GAO. These include developing an actionable IT strategic plan, developing an enterprise architecture to guide its modernization effort, and assessing its IT human capital needs. This is due in part to the fact that FDAs IT management structure has been in flux. Since 2008, the agency has had five CIOs, hampering its ability to plan and effectively implement a long-range IT strategy. While the agency recently hired a CIO, without stable leadership and capabilities, the success of FDAs modernization efforts is in jeopardy.
The agency currently has initiatives under way to improve its data sharing with internal and external partners, including adoption of an enterprisewide standard for formatting data and several projects aimed at enhancing its ability to share data. Effective data sharing is essential to its review and approval process, inspection of imports and manufacturing facilities, and tracking of contaminated products. However, these projects have made mixed progress, and significant work remains for FDA to fully implement standardized data sharing. Further, FDAs Center for Food Safety and Applied Nutrition has not comprehensively assessed information-sharing needs to ensure that its systems and databases are organized for effective information sharing. This is needed to help ensure more efficient access to and sharing of key information supporting its mission.

What GAO Recommends

GAO is recommending that FDA develop a comprehensive inventory of its IT systems, develop an integrated master schedule for a major modernization effort, and assess information needs to identify opportunities for greater sharing. In commenting on a draft of this report, HHS neither agreed nor disagreed with the recommendations but stated that FDA has taken actions to address many of the issues in the report.