The DCMO is also responsible for developing  and maintaining the department’s enterprise architecture for its business  mission area. DOD Lacks Governance Mechanisms for Institutionalizing Modernization Management Controls

DOD continues to take steps to comply with the provisions of the Ronald  W. Reagan NDAA for Fiscal Year 2005, as amended, and to satisfy  relevant system modernization management guidance. However, despite  undertaking activities to address NDAA requirements and its future vision;  the department has yet to demonstrate significant results. has not included all business system investments in its fiscal year  2013 budget submission, due in part to an unreliable inventory of all  defense business systems. In addition, while DOD implemented a business  process reengineering (BPR) review process, the department is not  measuring and reporting its results. Specifically, the  office of the DCMO, which took over these responsibilities from  another office that was disestablished in 2011, reported that it had  filled only 82 of its planned 139 positions, with 57 positions vacant. Until the long-standing institutional modernization  management controls provided for under the act, addressed in our  recommendations, and otherwise called for in best practices are fully  implemented, it is likely that the department’s business systems  modernization will continue to be a high-risk program. Fiscal Year 2013 Budget Submission Did Not Include Key Information on All Business Systems

Another requirement of the NDAA for Fiscal Year 2005, as amended, is  that DOD’s annual IT budget submission must include key information on  each business system for which funding is being requested, such as the  system’s precertification authority and designated senior official, the  appropriation type and amount of funds associated with modernization  and current services (i.e., operation and maintenance), and the  associated Defense Business Systems Management Committee approval  decisions. Therefore, SNAP-IT did not reflect about 500 business systems that were identified in DITPR. DOD Has Not Yet Redefined Its Investment Management Process

DOD has made limited progress in defining and implementing investment  management policies and procedures as required by the act and  addressed in our ITIM framework since our last review in 2011. However, it has not implemented any additional practices since that  time. While the department has reported its intent to implement this new  organizational structure and guidance to address statutory requirements  and redefine the process by which the department selects, evaluates, and  controls business systems investments, this structure and guidance have  yet to be established. Consistent with its guidance, DOD has begun to implement its BPR  review process in an effort to meet the act’s requirements. DOD’s Annual Report Continues to Describe Certification Actions for Its Business System Investments

Among other things, the act requires DOD to include, in its annual report  to congressional defense committees, a description of specific actions the  department has taken on each business system submitted for  certification. DOD’s annual report identifies that the Defense Business Systems  Management Committee approved 198 actions to certify, decertify, or  recertify defense business system modernizations. These 198 IRB  certification actions represented a total of about $2.2 billion in  modernization spending. While DOD has continued to report its certification actions, these actions  have been based on limited information, such as unvalidated architecture  compliance assertions, as discussed in the previous section. The department is taking  steps to establish such a business architecture and modernize its  business systems and processes, but long-standing challenges remain. While the  department has agreed with these recommendations, its progress in  addressing the act’s requirements, its vision for a federated architecture,  and our related recommendations is limited, in part, by continued  uncertainty surrounding the roles and responsibilities of key organizations  and senior leadership positions. In addition, to ensure that DOD continues to implement the full range of  institutional management controls needed to address its business  systems modernization high-risk area, we recommend that the Secretary  of Defense ensure that the Deputy Secretary of Defense, as the  department’s Chief Management Officer, establish a policy that clarifies  the roles, responsibilities, and relationships among the Chief  Management Officer, Deputy Chief Management Officer, DOD and  military department Chief Information Officers, Principal Staff Assistants,  military department Chief Management Officers, and the heads of the  military departments and defense agencies, associated with the  development of a federated BEA. Including information about the  department’s progress in staffing the office that was recently established  to be responsible for business systems modernization would not only  facilitate congressional oversight, but also promote departmental  accountability. § 2222 and  related federal guidance.
Why GAO Did This Study

For decades, DOD has been challenged in modernizing its business systems. Since 1995, GAO has designated DODs business systems modernization program as high risk, and it continues to do so today. To assist in addressing DODs business system modernization challenges, the National Defense Authorization Act for Fiscal Year 2005 requires the department to take certain actions prior to obligating funds for covered systems. It also requires DOD to annually report to the congressional defense committees on these actions and for GAO to review each annual report. In response, GAO performed its annual review of DODs actions to comply with the act and related federal guidance. To do so, GAO reviewed, for example, the latest version of DODs business enterprise architecture, fiscal year 2013 budget submission, investment management policies and procedures, and certification actions for its business system investments.

What GAO Found

The Department of Defense (DOD) continues to take steps to comply with the provisions of the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005, as amended, and to satisfy relevant system modernization management guidance. While the department has initiated numerous activities aimed at addressing the act, it has been limited in its ability to demonstrate results. Specifically, the department
released its most recent business enterprise architecture version, which continues to address the acts requirements and is consistent with the departments future vision for developing its architecture. However, the architecture has not yet resulted in a streamlined and modernized business systems environment, in part, because DOD has not fully defined the roles, responsibilities, and relationships associated with developing and implementing the architecture.
included a range of information for 1,657 business system investments in its fiscal year 2013 budget submission; however, it does not reflect about 500 business systems, due in part to the lack of a reliable, comprehensive inventory of all defense business systems.
has not implemented key practices from GAOs Information Technology Investment Management framework since GAOs last review in 2011. In addition, while DOD has reported its intent to implement a new organizational structure and guidance to address statutory requirements, this structure and guidance have yet to be established. Further, DOD has begun to implement a business process reengineering review process but has not yet measured and reported results.
continues to describe certification actions in its annual report for its business system investments as required by the actDOD approved 198 actions to certify, decertify, or recertify defense business system modernizations, which represented a total of $2.2 billion in modernization spending. However, the basis for these actions and subsequent approvals is supported with limited information, such as unvalidated architectural compliance assertions.
lacks the full complement of staff it identified as needed to perform business systems modernization responsibilities. Specifically, the office of the Deputy Chief Management Officer, which took over these responsibilities from another office in September 2011, reported that 41 percent of its positions were unfilled.
DODs progress in modernizing its business systems is limited, in part, by continued uncertainty surrounding the departments governance mechanisms, such as roles and responsibilities of key organizations and senior leadership positions. Until DOD fully implements governance mechanisms to address these long-standing institutional modernization management controls provided for under the act, addressed in GAO recommendations, and otherwise embodied in relevant guidance; its business systems modernization will likely remain a high-risk program.

What GAO Recommends

GAO recommends that the Secretary of Defense take steps to strengthen the departments mechanisms for governing its business systems modernization activities. DOD concurred with two of GAOs recommendations and partially concurred with one, but did not concur with the recommendation that it report progress on staffing the office responsible for business systems modernization to the congressional defense committees. GAO maintains that including staffing progress information in DODs annual report will facilitate congressional oversight and promote departmental accountability.