According to DOD, the four  management systems, collectively, are the means by which the  department—and its components—selects, controls, and evaluates its  business systems investments. According to DOD, in 2005 it also adopted a tiered accountability  approach to business transformation. However, while Air Force has established the basic  management structures needed to effectively manage its IT projects as  investments, it has not fully implemented many of the related policies and  procedures outlined in our ITIM framework. Relative to its business  system investments, Air Force has implemented three of nine practices  that call for project-level structures, policies, and procedures, and has not  defined any of the five practices that call for portfolio-level policies and  procedures. Air Force officials stated that they are aware of the absence of  documented policies and procedures, and they are currently working on  guidance to address these areas. Until Air Force has fully defined policies and procedures for both  individual projects and the portfolio of projects, it risks selecting and  controlling these business system investments in an inconsistent,  incomplete, and ad hoc manner, which in turn could reduce the chances  that these investments will meet mission needs in the most effective  manner. ITIM Stage 2  critical processes include (1) defining investment board operations, (2)  identifying the business needs for each investment, (3) developing a basic  process for selecting new proposals and reselecting ongoing investments,  (4) developing project-level investment control processes, and (5)  collecting information about existing investments to inform investment  management decisions. Air Force officials stated that they are aware of the absence of  documented procedures in certain areas of project-level management, and  plan to issue new policies and procedures addressing these areas by  December 2007. According to Air Force  officials, this guidance is expected to be completed and approved by  December 2007. Analyzing, selecting, and maintaining business system investment  portfolios. Regarding our recommendation that DOD direct Air Force to ensure that  the well-defined and disciplined business system investment management  policies and procedures also include portfolio-level management policies  and procedures, the department stated that DOD Instruction 8115.02  defines the DOD IT portfolio management process, which Air Force is  applying in its decisionmaking. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the investment management  approach of the Department of the Air Force (a major Department of  Defense (DOD) component) is consistent with leading investment  management best practices. Our analysis was based on the best practices  contained in GAO’s Information Technology Investment Management  (ITIM) framework and the framework’s associated evaluation  methodology, and focused on Air Force’s establishment of policies and  procedures for business system investments needed to assist organizations  in complying with the investment management provisions of the Clinger- Cohen Act of 1996 (Stages 2 and 3).
Why GAO Did This Study

In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high-risk" and continues to do so today. In 2004, Congress passed legislation reflecting prior GAO recommendations that DOD adopt a corporate approach to information technology (IT) business systems investment management including tiered accountability for business systems at the department and component levels. To support GAO's legislative mandate to review DOD's efforts, GAO assessed whether the investment management approach of one of DOD's components--the Department of the Air Force (Air Force)--is consistent with leading investment management best practices. In doing so, GAO applied its IT Investment Management (ITIM) framework and associated methodology, focusing on the stages related to the investment management provisions of the Clinger-Cohen Act of 1996.

What GAO Found

The Air Force has established the basic management structures needed to effectively manage its IT projects as investments, but has not fully implemented many of the related policies and procedures outlined in GAO's ITIM framework. Air Force has fully implemented three of the nine key practices that call for project-level management structures, policies, and procedures, and has not implemented any of the five practices that call for portfolio-level policies and procedures. Regarding project-level practices, it has established an IT investment board that is responsible for defining and implementing the department's business systems investment governance process, has developed procedures for identifying and collecting information about its business systems to support investment selection and control, and has assigned responsibility for ensuring that the information collected during project identification meets the needs of the investment management process. However, Air Force has not fully documented business systems investment policies and procedures for directing investment board operations, selecting new investments, reselecting ongoing investments, or integrating the investment funding and investment selection processes. In addition, it has not implemented any of the policies and procedures for developing and maintaining a complete business system investment portfolio. Air Force officials stated that they are aware of the absence of documented policies and procedures in certain areas of project-level and portfolio-level management and that they are currently working on guidance to address these areas. For example, officials stated that they had begun drafting portfolio-level policies and procedures. According to Air Force officials, the policies and procedures are expected to be completed and approved by December 2007. Until Air Force fully defines policies and procedures for both individual projects and portfolios of projects, it risks not being able to select and control these business system investments in a way that is consistent and complete, which in turn increases the chances that these investments will not meet mission needs in the most effective manner.