Specifically, with regard to IT management, the CIO is responsible for  implementing and enforcing applicable governmentwide and agency  IT management policies, principles, standards, and guidelines;    assuming responsibility and accountability for IT investments;    assuming responsibility for maximizing the value and assessing and  managing the risks of IT acquisitions through a process that, among  other things, is integrated with budget, financial, and program  management decisions, and provides for the selection, management,  and evaluation of IT investments;    establishing goals for improving the efficiency and effectiveness of  agency operations through the effective use of IT;    developing, maintaining, and facilitating the implementation of a  sound, secure, and integrated IT architecture; and    monitoring the performance of IT programs and advising the agency  head whether to continue, modify, or terminate such programs. Current Agency CIOs Do Not Have Responsibility for All Assigned Areas

Similar to 2004, we found that the CIOs are not consistently responsible  for all of the 13 areas assigned by statute or identified as critical to  effective IT management; however, they are more focused on IT  management than on the management of agency information. In this regard, the CIOs reported  being responsible for activities in managing IT that include the following:    managing capital planning and investment management processes to  ensure that they were successfully implemented and integrated with  the agency’s budget, acquisition, and planning processes;    developing, maintaining, and facilitating the implementation of sound  and integrated enterprise architectures;    designating a senior department official who will have responsibility  for departmentwide information security;    developing IT strategic plans to emphasize the role that IT can play in  effectively supporting the department’s operations and goals;    developing, maintaining, and improving systems acquisition    managing e-government requirements and ensuring compliance with    developing strategies for development of a skilled IT workforce  combined with strong succession planning. Specifically, CIOs reported they  devote over two-thirds of their time to the seven IT management areas,  which they generally viewed as more important to accomplishing their  mission. By contrast, the CIOs reported spending less than one-fifth of their tim the six information management areas. These additional  areas of responsibility included addressing infrastructure issues,  participating in agencywide boards, or participating in external  organizations, such as the federal CIO Council. Despite this, the views of agency CIOs and others suggested that a  variety of reporting relationships between an agency head and the CIO  can be effective. Additionally, many of the agency CIOs who did not report  directly to the agency head indicated having influence on IT management  decisions within their agency because they had relationships with other  senior agency officials. Tenure at the CIO position has remained almost the same since we last  reported. Federal Law Provides Adequate Authority, but Limitations Exist in Implementation for IT Management

As previously discussed, a major goal of the Clinger-Cohen Act was to  establish CIOs to advise and assist agency heads in managing IT  investments. In order to carry out these responsibilities, CIOs should be  positioned within their agencies to successfully exercise their authority. IT workforce: CIOs also face limitations in their ability to provide input into  hiring component-level senior IT managers and other IT staff. Without addressing CIOs’ lack of influence  over IT workforce planning, the government will continue to face  challenges in this area, risking further inefficiencies. More recently, OMB has taken  additional steps to increase the effectiveness of agency CIOs by clarifying  their roles and authorities under the current law. Federal agencies have begun to contribute by submitting examples  depicting best practices relating to a range of topics including vendor  communication and contract management; the consolidation of multiple  systems into an enterprise solution through the use of cloud services; and  program manager development. Recommendations for Executive Action

To ensure that CIOs are better able to carry out their statutory role as key  leaders in managing IT, we recommend the Director of OMB take the  following three actions:  Issue guidance to agencies requiring that CIOs’ authorities and  responsibilities, as defined by law and by OMB, are fully implemented,  taking into account the issues raised in this report. However, as discussed earlier,  most of the agencies in our study reported that they had not established  processes for documenting internal lessons learned. However,  the CIO also stated that, while our report did not identify legislative  changes needed to enhance current CIOs’ authority and generally felt  that existing law provides sufficient authority, the department believes  there are legislative opportunities to clarify and strengthen CIO  authorities that should be pursued, such as overlap in responsibilities  between the CIO and other officials. Appendix I: Objectives, Scope, and Methodology

Our objectives wer of federal agency Chief Information Officers (CIO) in managing  information and technology; (2) determine what poten tial modifications to  the Clinger-Cohen Act and related laws could be made to enhance CIOs’  authority and effectiveness; and (3) identify key lessons learned by  federal agency CIOs in managing information and technology. Additionally, we  assessed the CIOs’ reported time spent in the 13 IT and information  management areas of responsibility and the importance of each area to  them, as well as their views on changes needed to improve their authorit y  and effectiveness.
Why GAO Did This Study

The federal government invests billions in information technology (IT) each year to help agencies accomplish their missions. Federal law, particularly the Clinger-Cohen Act of 1996, has defined the role of Chief Information Officer (CIO) as the focal point for IT management within agencies. Given the longstanding challenges the government faces in managing IT and the continued importance of the CIO, GAO was asked to (1) determine the current roles and responsibilities of CIOs, (2) determine what potential modifications to the Clinger-Cohen Act and related laws could be made to enhance CIOs' authority and effectiveness, and (3) identify key lessons learned by CIOs in managing IT. To do this, GAO administered a questionnaire to 30 CIOs, compared responses to legislative requirements and the results of a 2004 GAO study, interviewed current CIOs, convened a panel of former agency CIOs, and spoke with the Office of Management and Budget's (OMB) Federal CIO.

What GAO Found

CIOs do not consistently have responsibility for 13 major areas of IT and information management as defined by law or deemed as critical to effective IT management, but they have continued to focus more attention on IT management-related areas. Specifically, most CIOs are responsible for seven key IT management areas: capital planning and investment management; enterprise architecture; information security; IT strategic planning, "e-government" initiatives; systems acquisition, development, and integration; and IT workforce planning. By contrast, CIOs are less frequently responsible for information management duties such as records management and privacy requirements, which they commonly share with other offices or organizations within the agency. In this regard, CIOs report spending over two-thirds of their time on IT management responsibilities, and less than one-third of their time on information management responsibilities. CIOs also report devoting time to other responsibilities such as addressing infrastructure issues and identifying emerging technologies. Further, many CIOs serve in positions in addition to their role as CIO, such as human capital officer. In addition, tenure at the CIO position has remained at about 2 years. Finally, just over half of the CIOs reported directly to the head of their respective agencies, which is required by law. The CIOs and others have stressed that a variety of reporting relationships in an agency can be effective, but that CIOs need to have access to the agency head and form productive working relationships with senior executives across the agency in order to carry out their mission. Federal law provides CIOs with adequate authority to manage IT for their agencies; however, some limitations exist that impede their ability to exercise this authority. Current and former CIOs, as well as the Federal CIO, did not identify legislative changes needed to enhance CIOs' authority and generally felt that existing law provides sufficient authority. Nevertheless, CIOs do face limitations in exercising their influence in certain IT management areas. Specifically, CIOs do not always have sufficient control over IT investments, and they often have limited influence over the IT workforce, such as in hiring and firing decisions and the performance of component-level CIOs. More consistent implementation of CIOs' authority could enhance their effectiveness in these areas. OMB has taken steps to increase CIOs' effectiveness, but it has not established measures of accountability to ensure that responsibilities are fully implemented. CIOs identified a number of best practices and lessons learned for more effectively managing IT at agencies, and the Federal CIO Council has established a website to share this information among agencies. Agencies have begun to share information in the areas of vendor communication and contract management; the consolidation of multiple systems into an enterprise solution through the use of cloud services; and program manager development. However, CIOs have not implemented structured agency processes for sharing lessons learned. Doing so could help CIOs share ideas across their agencies and with their successors for improving work processes and increasing cost effectiveness.

What GAO Recommends

GAO is recommending that OMB update its guidance to establish measures of accountability for ensuring that CIOs' responsibilities are fully implemented and require agencies to establish internal processes for documenting lessons learned. In commenting on a draft of this report, OMB officials generally agreed with GAO's findings and stated that OMB had taken actions that they believed addressed the recommendations.