Key requirements include those set by   the Federal Acquisition Streamlining Act of 1994, which (1) requires  agencies to establish cost, schedule, and measurable performance goals  for all major acquisition programs and (2) establishes that agencies  should achieve on average 90 percent of those goals;  the Government Performance and Results Act of 1993, which  establishes the foundation for budget decision making to achieve  strategic goals in order to meet agency mission objectives; and   the Federal Information Security Management Act of 2002, which  requires agencies to integrate IT security into their strategic and  operational planning processes, such as the capital planning and  enterprise architecture processes at the agency. Section 300 defines the budget exhibit 300, also  called the Capital Asset Plan and Business Case, as a document that  agencies submit to OMB to justify resource requests for major IT  investments. The  types of information included in the exhibit 300 are intended, among other  things, to help OMB and the agencies identify and correct poorly planned  or performing investments (i.e., investments that are behind schedule, over  budget, or not delivering expected results) and real or potential systemic  weaknesses in federal information resource management (such as a  shortage of sufficiently qualified project managers). Three types of problems were evident. First, all exhibit 300s had documentation weaknesses. Second, agencies did not always demonstrate (for example, in the  Security and Privacy and the Project and Funding Plan sections) that  they complied with federal requirements or policies with regard to  management and reporting processes. Agency officials attributed the absence of adequate support for their  exhibit 300s to lack of understanding of the requirements or of how to  respond to them. Agency officials mentioned in particular insufficient  guidance or training, as well as lack of familiarity with particular  requirements, such as the EVM process. If underlying support is inadequate  in key areas, OMB and agency executives are depending on unreliable  information to monitor the management of major IT projects and to make  critical decisions on their funding, thus putting at risk millions of dollars in  investments. The investments did not usually demonstrate  the basis for the performance measure information provided in the  exhibit 300. Only 6 of the 29 investments had documentation to support  how agencies initially measured their baseline levels of performance,  from which they measured progress toward the agency’s strategic goals. However, in  about 72 percent of the exhibit 300s reviewed, either supporting  documentation was missing for this cost information, or information in  the documentation did not agree with that in the exhibit 300. Overall, the lack of documentation supporting the exhibit 300s raises  questions regarding the sufficiency of the business case for the investment  and the quality of the projects’ management. At every agency, cost information reported in the 29 exhibit 300s was  derived from ad hoc processes rather than from cost-accounting systems  with adequate controls to ensure accountability. Although we cannot directly project these examples to the more than one  thousand business cases developed each year across the federal  government, our results suggest that the issues raised need attention. The kinds of weaknesses displayed and the causes behind them are  consistent with the pervasive problems with project and investment  management that we have documented in numerous prior reports. In addition, OMB has relied on  these exhibits to identify and oversee high-risk projects; thus, our finding  that the data being presented to OMB may not be reliable or accurate  further complicates its oversight. Objective, Scope, and Methodology

Our objective was to ascertain the extent to which selected agencies have  underlying support for the information described in their fiscal year 2006  exhibit 300s as submitted to the Office of Management and Budget (OMB)  in September 2004. To address our objective, we reviewed the supporting  documentation for 29 exhibit 300s from agencies and components from the  Departments of Agriculture, Commerce, Energy, Transportation, and the  Treasury.
Why GAO Did This Study

Each year, agencies submit to the Office of Management and Budget (OMB) a Capital Asset Plan and Business Case--the exhibit 300--to justify each request for a major information technology (IT) investment. The exhibit's content should reflect controls that agencies have established to ensure good project management, as well as showing that they have defined cost, schedule, and performance goals. It is thus a tool to help OMB and agencies identify and correct poorly planned or performing investments. In its budget and oversight role, OMB relies on the accuracy and completeness of this information. GAO was asked to determine the extent to which selected agencies have underlying support for the information in their fiscal year 2006 exhibit 300s. From five major departments having over $1 billion in IT expenditures in that year, GAO chose for analysis 29 exhibits for projects that supported a cross section of federal activities.

What GAO Found

Underlying support was often inadequate for information provided in the exhibit 300s reviewed. Three general types of weaknesses were evident. All exhibit 300s had documentation weaknesses. Documentation either did not exist or did not fully agree with specific areas of the exhibit 300. For example, both these problems occurred in relation to calculations of financial benefits for most investments. In addition, for 23 of the 29 investments, information on performance goals and measures was not supported by explanations of how agencies had initially measured their baseline levels of performance (from which they determine progress) or how they determined the actual progress reported in the exhibit 300. Agencies did not always demonstrate that they complied with federal or departmental requirements or policies with regard to management and reporting processes. For example, 21 investments were required to use a specific management system as the basis for the cost, schedule, and performance information in the exhibit 300, but only 6 did so following OMB-required standards. Also, none had cost analyses that fully complied with OMB requirements for cost-benefit and cost-effectiveness analyses. In contrast, most investments did demonstrate compliance with information security planning and training requirements. In sections that required actual cost data, these data were unreliable because they were not derived from cost-accounting systems with adequate controls. In the absence of such systems, agencies generally derived cost information from ad hoc processes. Officials from the five agencies (the Departments of Agriculture, Commerce, Energy, Transportation, and the Treasury) attributed these shortcomings in support to lack of understanding of a requirement or how to respond to it. Agency officials mentioned in particular insufficient guidance or training, as well as lack of familiarity with particular requirements. The weaknesses in the 29 exhibit 300s raise questions regarding the sufficiency of the business cases for these major investments and the quality of the projects' management. Without adequate support in key areas, OMB and agency executives may be depending on unreliable information to make critical decisions on IT projects, thus putting at risk millions of dollars. Further, although the 29 examples cannot be directly projected to the over one thousand business cases developed each year across the federal government, the results suggest that the underlying causes for the weaknesses identified need attention. These weaknesses and their causes are also consistent with problems in project and investment management that are pervasive governmentwide, including at such agencies as the Departments of Defense, Health and Human Services, and Homeland Security, as documented in reports by GAO and others.