The GCSS-MC is one such system investment. However, the  program now expects to reach FOC in fiscal year 2010 at a cost of about  $442 million over a 12-year life cycle. Effective implementation of this framework can minimize program risks  and better ensure that system investments are defined in a way to  optimally support mission operations and performance, as well as deliver  promised system capabilities and benefits on time and within budget. Thus  far, GCSS-MC has not been managed in accordance with key aspects of  this framework, which has already contributed to more than 3 years in  program schedule delays and about $193 million in cost increases. These  IT acquisition management control weaknesses include    compliance with DOD’s federated BEA not being sufficiently    expected costs not being reliably estimated;    earned value management not being adequately implemented;    system requirements not always being effectively managed, although  this has recently improved;    key program risks not being effectively managed; and    key system quality measures not being used. The reasons that these key practices have not been sufficiently executed  include limitations in the applicable DOD guidance and tools, and not  collecting relevant data, each of which is described in the applicable  sections of this report. As a result, the Marine Corps does not have a sufficient basis for  deciding whether GCSS-MC, as defined, is the most cost-effective solution  to meeting its mission needs, and it does not have a reliable basis against  which to measure cost performance. The original benefit estimate for the first increment was based on  questionable assumptions and insufficient data from comparable  programs. However, this schedule-focused approach has not been  effectively implemented because it is based on a baseline schedule that  was not derived using key schedule estimating practices. However, it has not effectively  implemented the process for all identified risks. Conclusions

DOD’s success in delivering large-scale business systems, such as GCSS- MC, is in large part determined by the extent to which it employs the kind  of rigorous and disciplined IT management controls that are reflected in  DOD policies and related guidance. The department has not effectively implemented a number of essential IT  management controls on GCSS-MC, which has already contributed to  significant cost overruns and schedule delays, and has increased the  program’s risk going forward of not delivering a cost-effective system  solution and not meeting future cost, schedule, capability, and benefit  commitments. Another related indicator of progress,  trends in system problems and change requests, also cannot be gauged  because the data needed to do so are not being collected. Recommendations for Executive Action

To ensure that each GCSS-MC system increment is economically justified  on the basis of a full and reliable understanding of costs, benefits, and  risks, we recommend that the Secretary of Defense direct the Secretary of  the Navy to ensure that investment in the next acquisition phase of the  program’s first increment is conditional upon fully disclosing to program  oversight and approval entities the steps under way or planned to address  each of the risks discussed in this report, including the risk of not being  architecturally compliant and being duplicative of related programs, not  producing expected mission benefits commensurate with reliably  estimated costs, not effectively implementing EVM, not mitigating known  program risks, and not knowing whether the system is becoming more or  less mature and stable. To enhance GCSS-MC’s use of EVM, we recommend that the Secretary of  Defense direct the Secretary of the Navy, through the appropriate chain of  command, to ensure that the program office (1) monitors the actual start  and completion dates of work activities performed so that the impact of  deviations on downstream scheduled work can be proactively addressed;  (2) allocates resources, such as labor hours and material, to all key  activities on the schedule; (3) integrates key activities and supporting  tasks and subtasks; (4) identifies and allocates the amount of float time  needed for key activities to account for potential problems that might  occur along or near the schedule’s critical path; (5) performs a schedule  risk analysis to determine the level of confidence in meeting the program’s  activities and completion date; (6) allocates schedule reserve for high-risk  activities on the critical path; and (7) discloses the inherent risks and  limitations associated with any future use of the program’s EVM reports  until the schedule has been risk-adjusted. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the Department of the Navy is  effectively implementing information technology management controls on  the Global Combat Support System-Marine Corps (GCSS-MC). To  accomplish this, we focused on the first increment of GCSS-MC relative to  the following management areas: architectural alignment, economic  justification, earned value management, requirements management, risk  management, and system quality measurement.
Why GAO Did This Study

GAO has designated the Department of Defense's (DOD) business systems modernization as a high-risk program because, among other things, it has been challenged in implementing key information technology (IT) management controls on its thousands of business systems. The Global Combat Support System-Marine Corps program is one such system. Initiated in 2003, the program is to modernize the Marine Corps logistics systems. The first increment is to cost about $442 million and be deployed in fiscal year 2010. GAO was asked to determine whether the Department of the Navy is effectively implementing IT management controls on this program. To accomplish this, GAO analyzed the program's implementation of several key IT management disciplines, including economic justification, earned value management, risk management, and system quality measurement.

What GAO Found

DOD has not effectively implemented key IT management controls provided for in DOD and related acquisition guidance on this program. If implemented effectively, these and other IT management disciplines increase the likelihood that a given system investment will produce the right solution to fill a mission need and that this system solution will be acquired and deployed in a manner that maximizes the chances of delivering promised system capabilities and benefits on time and within budget. Neither of these outcomes is being fully realized on this program, as evidenced by the fact that its first increment has already slipped more than 3 years and is expected to cost about $193 million more than envisioned. These slippages and cost overruns can be attributed in part to the management control weaknesses discussed in this report and summarized below. Moreover, additional slippages and overruns are likely if these and other IT management weaknesses are not addressed. Investment in the system has not been economically justified on the basis of reliable estimates of both benefits and costs. Specifically, while projected benefits were risk-adjusted to compensate for limited data and questionable assumptions, the cost side of the benefit/cost equation is not sufficiently reliable because it was not derived in accordance with key cost estimating practices. In particular, it was not based on historical data from similar programs and it did not account for schedule risks, both of which are needed for the estimate to be considered accurate and credible. Earned value management that the program uses to measure progress has not been adequately implemented. Specifically, the schedule baseline against which the program gauges progress is not based on key estimating practices provided for in federal guidance, such as assessing schedule risks and allocating schedule reserves to address these risks. As a result, program progress cannot be adequately measured, and likely program completion dates cannot be projected based on actual work performed. Some significant program risks have not been adequately managed. While a well-defined risk management plan and supporting process have been put in place, the process has not always been followed. Specifically, mitigation steps for significant risks either have not been implemented or proved ineffective, allowing the risks to become actual problems. The data needed to produce key indicators of system quality, such as trends in the volume of significant and unresolved problems and change requests, are not being collected. Without such data, it is unclear whether the system is becoming more or less mature and stable. The reasons for these weaknesses range from limitations of DOD guidance and tools, to not collecting relevant data. Until they are addressed, DOD is at risk of delivering a solution that does not cost-effectively support mission operations and falls short of cost, schedule, and capability expectations.