To accomplish its mission, HHS is comprised of 12 component agencies  and several staff offices that cover a wide range of activities—including  conducting and sponsoring medical and social science research, guarding  against the outbreak of infectious diseases, assuring the safety of food and  drugs, and providing health care services and insurance. According to the President’s most recent  budget, HHS expects to spend about $5 billion in IT in fiscal year 2006,  making the department’s IT investment budget the third largest in the  federal government. Until HHS implements and oversees  a stable investment management process throughout the department, it  will lack essential management controls over all of its IT investments, and  it will be unable to ensure that it is appropriately selecting, managing, and  evaluating the mix of investments that will maximize returns to the  organization, taking into account the appropriate level of risk. Because of the management attention that has been given to IT investment  management, the department has put in place over half of the key practices  needed to establish the investment foundation. Defining business needs for each IT project helps to ensure that projects  and systems support an organization’s business needs and meet users’  needs. For  example, HHS has not addressed any of the key practices related to  evaluating the portfolio or conducting PIRs. Despite these important steps in defining portfolio selection criteria,  weaknesses remain. Until the department develops a mechanism for ensuring that  component agencies define and implement investment management  processes that align with those of the department, it is running the risk that  effective processes are being institutionalized at both the department and  the component agency level. HHS Does Not Have a Plan to Coordinate and Guide Improvement Efforts

HHS has initiated several efforts to improve its investment management  process. Critical to HHS’s success, going forward will be the development of an  implementation plan that (1) is based on an assessment of strengths and  weaknesses; (2) specifies measurable goals, objectives, and milestones; (3)  specifies needed resources; (4) assigns clear responsibility and  accountability for accomplishing tasks; and (5) is approved by senior  management. Without such a  plan and procedures for implementing it, it is unlikely that the department  will effectively establish mature investment management capability. As a  result, HHS will continue to be challenged in its ability to make informed  and prudent investment decisions in managing its annual multibillion-dollar  IT budget. Recommendations for Executive Action

To strengthen HHS’s investment management capability and address the  weaknesses discussed in this report, we recommend that the Secretary of  the Department of Health and Human Services direct the Chief Information  Officer to develop and implement a plan for improving the department’s IT  investment management processes. Establish a process for the investment board to regularly review and  track the performance of a defined set of component agency IT systems  against expectations, and take corrective actions when these  expectations are not being met; and establish a mechanism for  maintaining visibility into other investments. Finally, to improve the department oversight of its component agency  investment management process, we are recommending that the HHS  Secretary direct the HHS CIO to establish a mechanism for ensuring  component agencies define and implement investment management  processes that are aligned with those of the department. Objectives, Scope, and Methodology

The objectives of our review were to (1) assess the Department of Health  and Human Services’s capabilities for managing its IT investments and (2)  determine any plans HHS might have for improving those capabilities. To address our first objective, we reviewed the results of the department’s  self-assessment of Stages 2 and 3 practices using our ITIM framework and  validated and updated the results of the self-assessment through document  reviews and interviews with officials.
Why GAO Did This Study

The Department of Health and Human Services (HHS) is one of the largest federal agencies, the nation's largest health insurer, and the largest grant- making agency in the federal government. The department manages over 300 programs that serve to improve the health and well-being of the American public and is comprised of several component agencies covering a wide range of activities including conducting and sponsoring medical and social science research, guarding against the outbreak of infectious diseases, assuring the safety of food and drugs, and providing health care services and insurance. It also manages and funds a variety of information technology (IT) initiatives ranging from those facilitating the payment of claims for Medicare and Medicaid services to those supporting health surveillance and communications. In fiscal year 2006, the department plans to spend over $5 billion on information technology--the third largest IT expenditure in the federal budget. As we agreed with Congress, our objectives were to (1) assess the department's capabilities for managing its IT investments and (2)determine any plans the department might have for improving those capabilities. To address these objectives, we analyzed documents and interviewed agency officials to (1)validate and update HHS's self-assessments of key practices in the framework and (2)evaluate HHS's plans for improving its capabilities.

What GAO Found

Because of the management attention that has been given to IT investment management, HHS has established over half of the foundational practices needed to manage its IT investments individually and about 30 percent of the key practices needed to effectively manage its portfolio of investments. For example, HHS has implemented many of the practices required to ensure that (1) projects support business needs and meet users' requirements, (2) a well-defined and disciplined process is used to select IT investments, (3) investment information is captured in a repository for decision makers, and (4) IT portfolio selection criteria are developed and maintained. However, critical weaknesses remain in several areas. Specifically, HHS lacks: (1) business representation on its senior IT investment review board of component agencies to carry out its full scope of responsibilities, (2) an established process for the IT investment board to regularly review a defined set of the component agencies' IT investments and maintain visibility of other investments, (3) criteria for assessing portfolio performance or regularly reviewing the performance of the organization's investment portfolio, and (4) processes for conducting post-implementation reviews (PIR) of its IT investments. The department also does not have a structured mechanism in place for ensuring that component agencies define and implement investment management processes that are aligned with those of the department. Until the department fully establishes all foundational and portfolio-level practices and establishes a mechanism to ensure that component agencies define and implement processes that are aligned with those of the department, executives cannot be assured that they are appropriately selecting, managing, and evaluating the mix of investments that will maximize returns to the organization, taking into account the appropriate level of risk. HHS has initiated steps to improve its investment management process; however, these steps do not fully address the weaknesses we identify in this report, nor are they coordinated along with other needed improvement efforts into a plan that (1) is based on an assessment of strengths and weaknesses; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior management. Without such a plan and procedures for implementing it, the department risks being unable to effectively establish mature investment management capabilities. As a result, executives may not be able to make informed and prudent investment decisions in managing the department's annual multibillion-dollar IT budget.