VA reported spending approximately $3.9 billion to improve and maintain  its IT resources in fiscal year 2015. For fiscal year 2016, the department received appropriations of  approximately $4.1 billion for IT. VA Has Faced Long- Standing Challenges in IT Management

Even as the department has engaged in various attempts to improve its  IT management capabilities, we have issued numerous reports that  highlighted challenges facing its efforts. VA  concurred with our recommendation, but had not completed actions to  address it. VA Manages and Performs Key IT- Related Functions through a Largely Centralized Organization, Which Is Taking Steps to Address Challenges

Since 2007, VA has been operating a centralized IT organization in which  most key functions intended for effective management of IT are  performed by the department’s Office of Information & Technology (OI&T)  and led by the department-level CIO. IT activities have occurred outside the control of OI&T. The CIO’s transformation  strategy calls for OI&T to focus on stabilizing and streamlining core  processes and platforms, mitigating weaknesses highlighted in  information security and GAO assessments, and improving outcomes by  institutionalizing a new set of IT management capabilities. VA Generally Implemented IT Human Capital Management Best Practices but Has Not Projected Leadership Retirements or Fully Identified Skill Gaps

Key to an agency’s success in effectively managing its IT systems is  sustaining a workforce with the necessary knowledge, skills, and abilities  to execute a range of management functions that support the agency’s  mission and goals. OI&T took steps toward implementing effective IT human capital practices  by documenting an IT human capital strategic plan and initiating an  update based on changed priorities, regularly analyzing workforce data,  identifying skill gaps for the current fiscal year, and implementing an IT  training program. Without tracking and forecasting  leadership retirements, OI&T faces a risk of being unprepared to identify  and effectively respond to vacancies in key leadership positions, which in  turn can contribute to ineffective IT management. It has also been  challenged in effectively collaborating with the department’s various  business units and in efficiently and cost-effectively delivering new IT  capabilities. VA’s documented processes for managing IT system  development and acquisition generally reflected best practices in the key  areas we reviewed. However, there were gaps in most of these areas. Ensuring that these processes address all key practices will assist the  department in effectively managing its IT system development and  acquisitions. Recommendations for Executive Action

To assist VA in sustaining an IT workforce with the necessary knowledge,  skills, and abilities to execute its mission and goals, we recommend that  the Secretary of Veterans Affairs direct the Chief Information Officer to  track and review OI&T historical workforce data and projections  related to leadership retirements, and  identify IT skills needed beyond the current fiscal year to assist in  identifying future skills gaps. To assist VA in establishing comprehensive and documented processes  that reflect system development and acquisition best practices, we  recommend that the Secretary of Veterans Affairs direct the Chief  Information Officer to revise OI&T’s documented processes related to project planning, to include (1) estimating the level of effort that will  need to be expended for work products and tasks, and (2) making  adjustments to the project plan to reconcile differences between  estimated and available resources;  requirements management, to include identifying changes to be made  to plans and work products as a result of requirements baseline  changes;  risk management, to include (1) determining costs and benefits of  implementing the risk mitigation plan for each risk and (2) collecting  performance measures on risk handling activities; project monitoring and control, to include the 10 best practices that  were missing from the guidance; process and product quality assurance, to include (1) documenting a  description of the quality assurance reporting chain and defining how  objectivity will be ensured, and (2) periodically reviewing open  noncompliance issues and trends with management that is  designated to receive and act on them; and project scheduling, to include the 9 best practices that were missing  from the guidance and revise the documented processes where the  guidance was contrary to best practices. GAO staff who made major contributions to this report are listed in  appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of this study were to determine (1) how the Department of  Veterans Affairs (VA) is organized to manage and perform key  information technology (IT)-related functions and the extent to which it  has centralized the management of IT resources, (2) the extent to which  VA has implemented effective IT human capital management, and (3) the  extent to which VA has established key processes to effectively manage  major system development and acquisition efforts.
Why GAO Did This Study

VA relies extensively on IT to deliver services to millions of our nation's veterans. VA reported spending approximately $3.9 billion in 2015 and received appropriations of approximately $4.1 billion in 2016 to improve and maintain its IT resources. Even as the department has engaged in various attempts to improve its IT management capabilities, GAO has issued numerous reports that highlighted challenges in its efforts.
This study was to determine (1) how VA is organized to manage and perform key IT-related functions and the extent to which it has centralized the management of IT resources, (2) the extent to which VA has implemented effective IT human capital management, and (3) the extent to which VA has established key processes to effectively manage major system development and acquisition efforts. To conduct its study, GAO reviewed VA policies, procedures, and other documentation and compared the department's processes to best practices for human capital management and IT systems development and acquisition. GAO also interviewed VA officials.

What GAO Found

The Department of Veterans Affairs (VA) performs key information technology (IT)-related functions, such as leadership, strategic planning, systems development and acquisition, and systems operations and maintenance, largely through its centralized Office of Information & Technology (OI&T), led by the Chief Information Officer (CIO). VA's two IT governance boards are intended to play a role in other key functions, such as investment management. Nevertheless, the department faced challenges in effectively managing IT, including (1) preventing IT activities from occurring outside the control of OI&T, (2) maintaining collaboration between OI&T and business units, and (3) delivering efficient and cost-effective IT capabilities. In response to these and other challenges, the CIO initiated an effort in January 2016 to transform OI&T into a more veteran-focused organization that emphasized transparency, accountability, innovation, and teamwork. The transformation strategy calls for OI&T to stabilize and streamline core processes and platforms, mitigate weaknesses from information security and GAO assessments, and improve outcomes by institutionalizing a new set of IT management capabilities. The CIO intends to complete the transformation by the first quarter of 2017.
Key to an agency's success in effectively managing its IT systems is sustaining a workforce with the necessary knowledge, skills, and abilities to execute a range of management functions that support its mission and goals. VA took steps to implement effective IT human capital practices by documenting an IT human capital strategic plan and initiating an update based on changed priorities, analyzing workforce data, identifying skill gaps for the current year, and implementing an IT training program. However, OI&T had not consistently implemented all of these practices. Specifically, the office had not (1) tracked and reviewed historical and projected leadership retirements and (2) identified skills and competencies needed beyond the current year. Without annually tracking and reviewing data related to leadership retirements or identifying skills needed in future years, OI&T faces a risk of being unprepared to effectively respond to vacancies in key positions and not having the capabilities to deliver IT support that can contribute to improved services for veterans.
Key to successful development and acquisition of IT services is establishing documented processes that reflect best practices. Although there were gaps in some areas, VA's processes generally included best practices for project validation, project planning, requirements management, risk management, project monitoring and control, and process and product quality assurance. In addition, processes for developing and maintaining a project schedule had not fully addressed the majority of the associated best practices. Ensuring that these processes address all key practices will assist the department in effectively managing its IT system development and acquisitions.

What GAO Recommends

GAO is recommending that VA take two actions to assist the department in sustaining a workforce with the necessary knowledge, skills, and abilities to execute its mission and goals, as well as six actions to assist the department in developing comprehensive processes that reflect systems development best practices. VA generally agreed with GAO's conclusions and concurred with GAO's eight recommendations.