Since we reported on the FBI’s lack of an architecture, others have  similarly reported on this gap in the bureau’s ability to effectively  modernize its systems and transform its operations. While the bureau’s EA efforts to date  represent important progress from where it was in 2003, when we last  assessed its efforts, much remains to be accomplished before the FBI will  have an effective EA program. According to these plans,  the architecture is to describe the “as is” and “to be” environments, as well  as a sequencing plan. For example,  the EA program office does not yet have adequate resources. Further, the program office reports that it is in the process of developing its  “as is” architecture. Despite this progress, much  remains to be accomplished before the FBI will have an effective EA  program. Bureau Is Not Effectively Managing Its EA Contractor

Federal acquisition regulations and relevant IT acquisition management  guidance recognize the importance of effectively managing contractor  activities. The FBI’s approach to managing its EA contract does not include most of  the performance-based contracting features described in the FAR. In tracking and overseeing its contractor, the FBI also has not employed  the kind of effective practices specified in relevant acquisition management  guidance. For example, the bureau does not have a written policy to govern  its tracking and oversight activities, has not designated responsibility or  established a group for performing contract tracking and oversight  activities, and has not developed an approved contractor monitoring plan. In particular, these policies and procedures  are to include an FBI-wide standard life-cycle management directive that is  to define procedures for the use of performance-based contracting  methods and the establishment of tracking and oversight structures,  policies, and processes. Conclusions

Having a well-defined and enforced architecture is critical to the FBI’s  ability to effectively and efficiently modernize its mission operations and  supporting IT environment. Moreover, given that the FBI’s  program is heavily relying on contractor support, it is also important for the  bureau to ensure that it employs effective contract management controls  that will enable it to, among other things, define contractor work to be  performed in measurable, results-oriented terms; establish positive and  negative contractor performance incentives; and define and implement  contractor tracking and oversight processes consistent with acquisition  management guidance. GAO contacts and staff who made major  contributions to this report are listed in appendix V.

Objectives, Scope, and Methodology

As specified in the conference report accompanying the Consolidated  Appropriations Act, 2005, our objectives were to determine (1) whether  the Federal Bureau of Investigation (FBI) is managing its enterprise  architecture (EA) program in accordance with established best practices  and (2) what approach the bureau is following to track and oversee its EA  contractor, including the use of effective contractual controls. Detailed Descriptions of Elements in GAO’s EA Management Maturity Framework

Because the task of developing, maintaining, and implementing an EA is an  important, complex, and difficult endeavor, doing so effectively and  efficiently requires that rigorous, disciplined management practices be  adopted. Establish a program office that is responsible for EA development and  maintenance. Use a framework, methodology, and automated tool to develop the  architecture. Develop an architecture program management plan. Consistent with the EA  program plans discussed in Stage 2, an organization should ensure that  the EA products completely and correctly describe both the “as is” and  the “to be” environments of the enterprise and include a sequencing plan  for migrating the organization between the two environments. According to FBI  officials, these versions are not yet complete. The FBI is in the process of completing its EA, and  thus, it is not yet an integral part of the bureau’s IT  investment process.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) is currently modernizing its information technology (IT) systems to support its efforts to adopt a more bureauwide, integrated approach to performing its mission. A key element of such systems modernization programs is the use of an enterprise architecture (EA), which is a blueprint of an agency's current and planned operating and systems environment, as well as an IT investment plan for transitioning between the two. The conference report accompanying FBI's fiscal year 2005 appropriations directed GAO to determine (1) whether the FBI is managing its EA program in accordance with established best practices and (2) what approach the bureau is following to track and oversee its EA contractor, including the use of effective contractual controls.

What GAO Found

The FBI is managing its EA program in accordance with many best practices, but other such practices have yet to be adopted. These best practices, which are described in GAO's EA management maturity framework, are those necessary for an organization to have an effective architecture program. Examples of practices that the bureau has implemented include establishing a program office that is responsible for developing the architecture, having a written and approved policy governing architecture development, and continuing efforts to develop descriptions of the FBI's "as is" and "to be" environments and sequencing plan. The establishment of these and other practices represents important progress from the bureau's status 2 years ago, when GAO reported that the FBI lacked both an EA and the means to develop and enforce one. Notwithstanding this progress, much remains to be accomplished before the FBI will have an effective EA program. For example, the EA program office does not yet have adequate resources, and the architecture products needed to adequately describe either the current or the future architectural environments have not been completed. Until the bureau has a complete and enforceable EA, it remains at risk of developing systems that do not effectively and efficiently support mission operations and performance. The FBI is relying heavily on contractor support to develop its EA; however, it has not employed effective contract management controls in doing so. Specifically, the bureau has not used performance-based contracting, an approach that is required by federal acquisition regulations whenever practicable. Further, the bureau is not employing the kind of effective contractor tracking and oversight practices specified in relevant acquisition management guidance. According to FBI officials, the agency's approach to managing its EA contractor is based on its long-standing approach to managing IT contractors: that is, working with the contractor on iterations of each deliverable until the bureau deems it acceptable. This approach, in GAO's view, is not effective and efficient. According to FBI officials, as soon as the bureau completes an ongoing effort to redefine its policies and procedures for managing IT programs (including, for example, the use of performance-based contracting methods and the tracking and oversight of contractor performance), it will adopt these new policies and procedures. Until effective contractor management policies and procedures are defined and implemented on the EA program, the likelihood of the FBI effectively and efficiently producing a complete and enforceable architecture is diminished.