These offices, along  with the Chief Scientist, report to the FDA Commissioner and carry out  their missions through seven centers and through FDA’s Office of  Regulatory Affairs. Our Prior Work Has Included Recommendations to Address FDA’s Challenges with IT Strategic Planning and Management

In previously reporting on FDA’s IT challenges, we highlighted  deficiencies in a number of the agency’s management processes and  system modernization efforts. FDA Has Developed a New IT Strategic Plan, but It Lacks Key Elements

To be effective as a guide for managing IT investments and better  address agency-wide business challenges, best practices show that an IT  strategic plan should define the agency’s vision and provide a road map  to help align information resources with business strategies and  investment decisions. Accordingly, best practices call for a  comprehensive and effective plan to (1) be aligned with the agency’s  overall strategy; (2) identify the mission of the agency, results-oriented  goals, and performance measures that permit the agency to determine  whether implementation of the plan is succeeding; (3) include strategies  the governing IT organization will use to achieve desired results; and (4)  provide descriptions of interdependencies within and across projects so  that they can be understood and managed. The CIO has stated that the intent of the plan,  entitled Information Technology Strategic Plan, Version 1.0 and dated  September 2015, is to allow OIMT to address business challenges facing  the agency. The plan describes the current state and customer perception  of the IT environment, along with OIMT’s mission, vision, and objectives  of three strategic themes—quality service, security, and efficiency. Nevertheless, in its current state, the document that FDA has developed  does not include the key elements of a comprehensive IT strategic plan. In discussing our concerns, the CIO stated that the intent of the first  version of the September 2015 IT strategic plan was to identify  improvements, based on an assessment of FDA’s IT environment, that  needed to be made to existing IT processes, technologies, roles,  functions, and capabilities within OIMT. However,  according to OIM officials and the CIO, they have not yet established or  documented schedules or milestones for managing and completing the  development and implementation of the next version of the IT strategic  plan. However, it has taken some actions, but has  not yet fully implemented two recommendations regarding the  development and use of schedules for managing and monitoring the  progress of IT initiatives. In addition, FDA incorporated use of the system inventory into the  agency’s IT investment management process. Until it incorporates these elements into and fully  implements the plan, the agency will continue to lack critical information  needed to align IT initiatives with business strategies and investment  decisions, and to determine whether outcomes of the IT initiatives are  succeeding in supporting the agency-wide mission, goals, and objectives. In addition, FDA has implemented most of our prior recommendations for  improving IT management practices. Taking further actions to fully  implement the remaining recommendations will improve the agency’s  ability to successfully monitor the progress of one of FDA’s most critical  and costly IT modernization projects throughout its remaining life cycle. Recommendations for Executive Action

To help ensure that FDA’s IT strategic planning activities are successful  in supporting the agency’s mission, goals, and objectives, we recommend  that the Commissioner of FDA require the CIO to take the following two  actions: establish schedules and milestones for completing a version of an IT  strategic plan that incorporates elements to align the plan’s strategies  with agency-wide priorities; includes results-oriented goals and  performance measures that support the agency’s mission, along with  targets for measuring the extent to which outcomes of IT initiatives  support FDA’s ability to achieve agency-wide goals and objectives;  identifies key IT initiatives that support the agency’s goals; and  describes interdependencies among the initiatives; and  implement the plan to ensure that expected outcomes of the agency’s  key IT initiatives are achieved. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the status of the Food  and Drug Administration’s (FDA) efforts to develop and implement an  information technology (IT) strategic plan that includes results-oriented  goals, activities, milestones, and performance measures; and (2) assess  the extent to which FDA has addressed our prior IT-related  recommendations. For the first objective, our scope was focused on FDA’s efforts to develop  an IT strategic plan to be used to manage and guide key initiatives,  including modernization projects, in support of agency-wide goals and  objectives. Specifically, to determine actions taken by FDA to implement the five  recommendations related to IT planning that we made in our 2009 report,  we collected and examined agency documentation related to its IT  strategic planning, enterprise architecture development, and human  capital planning.
Why GAO Did This Study

IT systems are critical to FDA's ability to achieve its mission. GAO previously reported on limitations in a number of FDA's key IT areas, including data availability and quality, information infrastructure, the ability to use technology to improve regulatory effectiveness, and investment management. GAO recommended FDA take actions to address these limitations, including the development of a comprehensive IT strategic plan to provide direction for modernizing the agency's IT environment.
The Food and Drug Administration Safety and Innovation Act of 2012 included a provision for GAO to report on FDA's progress regarding an IT strategic plan and implementation of GAO's prior recommendations. This report provides an assessment of the (1) status of FDA's efforts to develop and implement an IT strategic plan that includes results-oriented goals, activities, milestones, and performance measures; and (2) extent to which FDA has addressed GAO's prior IT-related recommendations.
To do so, GAO assessed the agency's 2015 IT strategic plan against best practices for IT management. GAO also reviewed supporting documents regarding FDA's actions on prior recommendations.

What GAO Found

As of September 2015, the Food and Drug Administration (FDA), an agency within the Department of Health and Human Services (HHS), had developed and released a new information technology (IT) strategic plan, entitled Information Technology Strategic Plan, Version 1.0 . The plan, according to the agency's Chief Information Officer (CIO), was developed to help FDA's Office of Information Management and Technology (OIMT) address business challenges facing the agency through the implementation of IT. The plan describes the current state of the agency's IT environment, along with OIMT's mission, vision, and the objectives of three strategic themes—quality service, security, and efficiency. The plan also defines performance measures and initiatives intended to support the office's strategic themes.
Nevertheless, the plan lacks key elements that GAO previously recommended be included in a comprehensive strategy to align with the agency-wide mission and goals, and allow the plan to be used for managing IT investments to more effectively address business challenges. For example, FDA's IT strategic plan does not align with strategic priorities and goals that the agency defined for 2014 through 2018. Further, it does not identify results-oriented goals and performance measures and milestones, or targets for measuring the extent to which outcomes of IT initiatives support FDA's ability to achieve agency-wide goals and objectives; strategies that the governing IT organization will use to support agency-wide goals and objectives; and key IT initiatives and interdependencies to be managed. The agency's CIO stated that this version of the strategic plan was developed to address challenges related to processes, technologies, roles, functions, and capabilities for improving the operations of OIMT, which has the responsibility for managing IT. However, FDA has not yet defined schedules or milestones for managing and completing the development and implementation of future versions of the plan that would reflect actions intended to address the agency-wide mission and goals. Until FDA incorporates these key elements of comprehensive IT strategic planning into its plan and fully implements the plan, it will lack critical information needed to align information resources with business strategies and investment decisions, and be hindered in determining whether outcomes of its IT initiatives are succeeding in supporting agency-wide goals.
FDA has made progress in implementing GAO's prior IT-related recommendations. Although it has not yet developed a comprehensive IT strategic plan, the agency has improved enterprise architecture development and IT human capital planning by implementing four of nine prior recommendations. FDA implemented two recommendations to develop an IT systems inventory that can be used to help manage IT investments and to improve information-sharing capabilities of one of its centers, and took steps toward implementing the remaining two recommendations related to improvements in scheduling and monitoring progress of a key IT modernization initiative. However, the agency did not complete all actions needed to implement these two recommendations. Specifically, it did not develop project schedules or conduct IT project monitoring in accordance with best practices. FDA's continued efforts to implement the remaining recommendations are critical to assuring that the agency's ability to manage IT investments and resources will meet its overall mission and goals.

What GAO Recommends

GAO recommends that FDA define schedules and milestones for incorporating into its IT strategic plan elements that align with the agency's mission and business strategies, and fully implement the plan. HHS agreed with the recommendations.