	Background

FMCSA was established within DOT in January 2000 and was tasked  with promoting safe commercial motor vehicle operations and preventing  large truck and bus crashes, injuries, and fatalities. FMCSA’s estimated budget for fiscal year 2017 is approximately $794.2  million. Overview of FMCSA’s IT Environment

FMCSA’s Chief Information Officer (CIO) oversees the development,  implementation, and maintenance of the IT systems and infrastructure  that serve as the key enabler in executing FMCSA’s mission. Such planning includes defining the scope of the  modernization effort, an implementation strategy, and a schedule, as well  as establishing results-oriented goals and measures. However, FMCSA lacks complete plans to guide its systems  modernization efforts. While the agency has an IT strategic plan that describes  the technical strategy, vision, mission, and direction for managing its IT  modernization programs, and defines the strategic goals and objectives to  support its mission, the plan lacks timelines to guide its goals and  strategies related to integrated project planning and execution, IT  security, and innovative IT business solutions, among others. The official further acknowledged that updating the current  strategic plan has not been a priority. According to the framework,  Stage 2 includes the following three processes:  Instituting the investment board: As part of this process, an agency  is to establish an investment review board comprised of senior  executives, including the agency’s head or a designee, the CIO or  other senior executive representing the CIO’s interests, and heads of  business units that are responsible for defining and implementing the  department’s IT investment governance process. Nevertheless, FMCSA has not yet clearly defined roles and  responsibilities of all working groups and individuals involved in the  agency’s IT governance process. With regard to selecting and reselecting IT investments, FMCSA’s  January 2017 governance order requires participation and collaboration  of the IT system owner, business owner, IT planning staff, and  governance boards during the select phases for all investments. According to the Acting CIO, FMCSA is currently drafting procedures for  selecting new investments and reselecting investments that are already  operational and intends to finalize the procedures by the end of May  2017. With regard to IT investment oversight, the agency’s order established  policies and procedures to ensure that governance bodies review  investments and track corrective actions to closure. However, the policies  and procedures for reviewing and tracking actions have not yet been fully  implemented by the three governance bodies. The Acting CIO did not attend  any of the four meetings. These weaknesses were due, in part, to the agency not adhering to its IT  orders and governance board charters, which establish FMCSA’s  governance structure, as described above. As a result, the agency lacks  adequate visibility into and oversight of IT investment decisions and  activities, and cannot ensure that its investments are meeting cost and  schedule expectations and that appropriate actions are taken if these  expectations are not being met. Specifically, none of the program offices conducted the required  operational analyses for the four systems. The program offices stated  that, in lieu of conducting these analyses, they assessed the key factors  of costs, schedules, investment performance, and customer and business  needs as part of the capital planning and investment control process. Aspen: The Aspen program office had partially implemented one of  the required operational analysis factors and had not implemented the  three other factors. Until FMCSA fully reviews its O&M investments as part of its  annual operational analyses, the agency will lack assurance that these  systems meet mission needs, and the associated spending could be  wasteful. Conclusions

While FMCSA has recognized the need to develop an effective  modernization plan and has awarded a contract to do so, it has not  completed an IT strategic plan needed for modernizing its existing legacy  systems. Appendix I: Objectives, Scope, and Methodology

The Fixing America’s Surface Transportation Act included a provision for  us to conduct a comprehensive analysis of the information technology (IT)  and data collection management systems of the Federal Motor Carrier  Safety Administration (FMCSA) by June 4, 2017. Our objectives were to  (1) assess the extent to which the agency has plans to modernize its  existing systems, (2) assess the extent to which FMCSA has  implemented an IT governance structure, and (3) determine the extent to  which FMCSA has ensured selected IT systems are effective. FMCSA had only identified one  major IT investment in fiscal year 2016. We then assessed the agency’s efforts to determine the effectiveness of  these systems in meeting the needs of the agency by reviewing  documentation from the four selected systems and compared it to key  factors identified in OMB’s guidance on conducting annual operational  analysis, which are a key method for examining the performance of  investments with O&M funding.
Why GAO Did This Study

FMCSA, established within the Department of Transportation in January 2000, is charged with reducing crashes involving commercial motor carriers (i.e., large trucks and buses) and saving lives. IT systems and infrastructure serve as a key enabler for FMCSA to achieve its mission. The agency reported spending about $46 million for its IT investments in fiscal year 2016.
In December 2015, the Fixing America's Surface Transportation Act was enacted and required GAO to review the agency's IT, data collection, and management systems. GAO's objectives were to (1) assess the extent to which the agency has plans to modernize its existing systems, (2) assess the extent to which FMCSA has implemented an IT governance structure, and (3) determine the extent to which FMCSA has ensured selected IT systems are effective. To do so, GAO analyzed FMCSA's strategic plan and modernization plans; compared governance documentation to best practices; selected four investments based on operations and maintenance spending for fiscal year 2016, among other factors, and compared assessments for the investments against OMB criteria; and interviewed officials.

What GAO Found

The Federal Motor Carrier Safety Administration (FMCSA) initiated a modernization effort in 2011 and developed an information technology (IT) strategic plan that describes the technical strategy, vision, mission, direction, and goals and objectives to support the agency's mission; however, the plan lacks timelines to guide FMCSA's goals and strategies. In addition, the agency has not completed a modernization plan for its existing IT systems that includes scope, an implementation strategy, schedule, results-oriented goals, and measures, although it has recently awarded a contract to develop such a plan. The Acting Chief Information Officer (CIO) said that updating FMCSA's IT strategic plan had not been a priority for the agency. However, without a complete IT strategic plan, FMCSA will be less likely to move toward its ultimate goal of modernizing its aging legacy systems.
FMCSA has begun to address leading practices of IT governance, but its investment governance framework does not adequately establish an investment board, select and reselect investments, and provide investment oversight. Specifically, regarding the practice of establishing an IT investment review board, FMCSA has not yet clearly defined roles and responsibilities for key working groups and individuals, including the Office of the CIO. Regarding selecting and reselecting IT investments, FMCSA requires participation and collaboration during the select phases for all IT investments; however, it lacks procedures for selecting new investments and reselecting investments that are already operational for continued funding. According to the Acting CIO, the agency is currently drafting these procedures and intends to finalize them by the end of May 2017. Regarding the practice of IT investment oversight, the agency has policies and procedures to ensure that corrective actions and related efforts are executed and tracked, but they have not yet been fully implemented by the three boards. These weaknesses are due to the agency not adhering to its IT orders that establish its governance structure. As a result, FMCSA lacks adequate visibility into and oversight of IT investment decisions and activities, which could ultimately hinder its modernization efforts.
FMCSA had not fully ensured that the four systems GAO selected to review are effectively meeting the needs of the agency because none of the program offices completed operational analyses as required by the Office of Management and Budget (OMB). However, as part of its capital planning and investment control process, FMCSA assessed the four key factors of an operational analysis—costs, schedules, investment performance, and customer and business needs. One of the selected programs had partially implemented all four of these factors; two programs had partially implemented one factor, and one program had not addressed any of these factors. This was due to FMCSA not having guidance for conducting operational analyses for investments in operations and maintenance. Until FMCSA fully reviews its operational investments, the agency will lack assurance that these systems meet mission needs.

What GAO Recommends

GAO is making five recommendations to FMCSA to improve its IT strategic planning, oversight, and operational analyses. The Department of Transportation concurred with all of the recommendations.