Customs expects its reliance on information systems to increase as a result of its burgeoning workload. Customs plans to develop and deploy ACE in multiple phases. For five of its six business areas (outbound, passenger, finance, human resources, and investigations), Custom’s architecture does not (1) describe all the agency’s business functions, (2) outline the information needed to perform the functions, and (3) completely identify the users and locations of the functions. Further, while the architecture and related documentation describe business functions and users and locations for one business area (trade compliance), they do not identify the information needs and flows for all the functions. Because these characteristics are not based on a complete understanding of its enterprisewide functional and information needs, Customs does not have adequate assurance that its information systems will optimally support its ability to (1) fully collect and accurately account for billions of dollars in annual federal revenue and (2) allow for the expeditious movement of legal goods and passengers across our nation’s borders while preventing and detecting the movement of illegal goods and passengers. Information: A description of what information is needed to support business operations. Treasury officials responsible for developing and implementing TISAF stated that development of the architecture begins with defining and describing the agency’s major business functions. Incomplete Enterprise Architecture Increases the Risk of Building Systems That Do Not Effectively Support Business Needs

Customs does not have a complete systems architecture to effectively and efficiently guide and constrain the millions of dollars it invests each year in developing, acquiring, and maintaining the information systems that support its six business areas. For the sixth business area (trade compliance), Customs has defined all the business functions and users and work locations and some, but not all, of the information and data needs and flows. Customs also plans to reevaluate its enterprise infrastructure. According to Customs officials, architectural compliance will be assessed and enforced as Customs implements its recently defined investment management process. Conclusions

Customs’ incomplete enterprise information systems architecture and limitations in its plans for enforcing compliance with an architecture once one is completed impair the agency’s ability to effectively and efficiently develop or acquire operational systems, such as ACE, and to maintain existing systems. Recommendations

To ensure that the Customs Service develops and effectively enforces a complete enterprise information systems architecture, we recommend that the Commissioner of Customs direct the Customs CIO, in consultation with the Treasury CIO, to follow through on plans to complete the enterprise information systems architecture. Customs has not followed this approach and, therefore, does not have adequate assurance that its infrastructure (i.e., technical architecture) will meet its business requirements.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Customs Service's enterprise information systems architecture, focusing on determining whether: (1) the architecture is complete; and (2) Customs has processes and procedures to enforce compliance with the architecture.

What GAO Found

GAO noted that: (1) Customs does not yet have a complete enterprise information systems architecture to guide and constrain the millions of dollars it spends annually to develop and acquire new information systems and evolve existing ones; (2) for five of its six business areas Custom's architecture does not: (a) describe all the agency's business functions; (b) define the information needed to perform the functions; and (c) completely identify the users and locations of the functions; (3) while the architecture and related documentation describe business functions, and users and work locations for the sixth business area, they do not identify all the information needs and flows for all the trade functions; (4) also, Customs has named certain technical standards, products, and services that it will use in building systems to support all its business areas; (5) however, Customs has not chosen these based on a complete description of its business needs; (6) the limitations in Customs' architecture are rooted in its decision to focus on defining the technical characteristics of its systems environment; (7) Customs' view does not include the logical characteristics of its enterprise system environment, which would enable it to define and implement systems that optimally support the agency's mission needs; (8) Customs plans to develop the architecture in accordance with Department of the Treasury architectural guidance; (9) specifically, Customs plans to define its functional, information, and work needs and their interrelationships across its six business areas and, in light of these needs and interrelationships, reevaluate the technical characteristics it has selected for its systems environment; (10) until Customs defines the logical characteristics of its business environment and uses them to establish technical standards and approaches, it does not have adequate assurance that the systems it plans to build and operationally deploy will effectively support the agency's business needs; (11) Customs also has not developed and implemented effective procedures to enforce its architecture once it is completed; (12) Customs officials stated that a newly established investment management process will be used to enforce architectural compliance; (13) this process, however, does not require that system investments be architecturally compliant or that architectural deviations be justified and documented; and (14) as a result, Customs risks incurring the same problems as other federal agencies that have not effectively defined and enforced an architecture.