An Enterprise Architecture Is Essential to Effectively Managing Systems Modernization

The development, maintenance, and implementation of enterprise  architectures (EA) are recognized hallmarks of successful public and  private organizations and as such are an IT management best practice. Managed properly, an enterprise architecture can clarify and help  optimize the interdependencies and relationships among a given entity’s  business operations and the underlying systems and technical  infrastructure that support these operations. While  Stage 1 agencies may have initiated some EA activity, these agencies’  efforts are ad hoc and unstructured, lack institutional leadership and  direction, and do not provide the management foundation necessary for  successful EA development. FBI Does Not Have an EA or the Management Foundation Needed to Effectively Develop, Maintain, and Implement One

The FBI has yet to develop an EA, and it does not have the requisite means  in place to effectively develop, maintain, and implement one. As our prior reviews of federal agencies and research of architecture best  practices show, attempts to modernize systems without an architecture,  which is what the FBI is doing, increases the risk that large sums of money  and much time and effort will be invested in technology solutions that are  duplicative, are not well integrated, are unnecessarily costly to maintain  and interface, and do not effectively optimize mission performance. Develop an architecture program management plan. Make EA an integral component of IT investment decision-making  processes. The FBI is currently at Stage 1 of our maturity framework. However, it has not yet selected a development  methodology or automated tool (a repository for architectural products). The state of the FBI’s EA management maturity is attributable to a lack of  management commitment to having and using an architecture and to giving  it priority. To do less will continue to expose the bureau’s system  modernization efforts, and ultimately the effectiveness and efficiency of its  mission performance, to unnecessary risk. This  includes first laying an effective EA management foundation by  (1) ensuring that all business partners are represented on the architecture  governance board; (2) adopting an architecture development methodology  and automated tool; (3) establishing an EA program office that is  accountable for developing the EA; (4) tasking the program office with  developing a management plan that specifies how and when the EA is to be  developed and issued; (5) ensuring that the management plan provides for  the bureau’s “as-is” and “to-be” environments, as well as a sequencing plan  for transitioning from the “as-is” to the “to-be”; (6) ensuring that the  management plan also describes the enterprise in terms of business, data,  applications, and technology; (7) ensuring that the plan also calls for  describing the security related to the business, data, and technology;  (8) ensuring that the plan establishes metrics for measuring EA progress,  quality, compliance, and return on investment; and (9) allocating the  necessary funding and personnel to EA activities. Scope and Methodology

To evaluate whether Federal Bureau of Investigation (FBI) has a  modernization blueprint, commonly called an enterprise architecture (EA),  to guide and constrain its modernization efforts, we requested that the  bureau provide us with all of its EA products. In addition, we  interviewed FBI’s chief architect and other bureau officials to determine,  among other things, the cause of differences between what is specified in  the framework and the condition at the FBI. The FBI has acknowledged the need for an EA. The FBI plans to use the Federal Enterprise  Architecture Framework.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) is in the process of modernizing its information technology (IT) systems. Replacing much of its 1980s-based technology with modern system applications and a robust technical infrastructure, this modernization is intended to enable the FBI to take an integrated approach--coordinated agencywide--to performing its critical missions, such as federal crime investigation and terrorism prevention. GAO was requested to conduct a series of reviews of the FBI's modernization management. The objective of this first review was to determine whether the FBI has an enterprise architecture to guide and constrain modernization investments.

What GAO Found

About 2 years into its ongoing systems modernization efforts, the FBI does not yet have an enterprise architecture. An enterprise architecture is an organizational blueprint that defines--in logical or business terms and in technology terms--how an organization operates today, intends to operate in the future, and intends to invest in technology to transition to this future state. GAO's research has shown that attempting to modernize an IT environment without a well-defined and enforceable enterprise architecture risks, among other things, building systems that do not effectively and efficiently support mission operations and performance. The FBI acknowledges the need for an enterprise architecture and has committed to developing one by the fall of 2003. However, it currently lacks the means for effectively reaching this end. For example, while the bureau did recently designate a chief architect and select an architecture framework to use, it does not yet have an agency architecture policy, an architecture program management plan, or an architecture development methodology, all of which are necessary components of effective architecture management. Given the state of the FBI's enterprise architecture management efforts, the bureau is at Stage 1 of GAO's enterprise architecture management maturity framework. Organizations at Stage 1 are characterized by architecture efforts that are ad hoc and unstructured, lack institutional leadership and direction, and do not provide the management foundation necessary for successful architecture development and use as a tool for informed IT investment decision making. A key for an organization to advance beyond this stage is to treat architecture development, maintenance, and implementation as an institutional management priority, which the FBI has yet to do. To do less will expose the bureau's ongoing and planned modernization efforts to unnecessary risk.