Appendix  III provides additional details on the agency’s mission-critical systems and  infrastructure. He added that in the future, FDA plans to focus on more long- term modernization projects for supporting the agency’s regulatory  responsibilities. Effective IT Management Is Key to Successful Modernization

Key to an agency’s success in modernizing its IT systems, as our research  and experience at federal agencies has shown, is institutionalizing a set of  interrelated IT management capabilities, among which are    strategic planning to describe an organization’s goals, strategies it will use  to achieve desired results, and performance measures;   developing and using an agencywide enterprise architecture, or  modernization blueprint, to guide and constrain IT investments;   establishing and following a portfolio-based approach to investment  implementing information security management that ensures the integrity  and availability of information; and   building and sustaining an IT workforce with the necessary knowledge,  skills, and abilities to execute this range of management functions. FDA Is Pursuing Systems Modernization, but It Has Not Developed an IT Strategic Plan to Guide Its Initiatives

FDA is pursuing numerous initiatives to modernize its IT systems and  infrastructure, including at least 16 enterprisewide initiatives. In summary, an IT strategic plan would provide a comprehensive picture  of what the organization seeks to accomplish, identify the strategi use to achieve desired results, provide results-oriented goals andperformance measures that permit it to determine whether it is  succeeding, and describe interdependencies  that these can be understood and managed. FDA’s Projects and Plans Are Intended to Address Most Previously Identified Limitations

As reflected by its projects and high-level plans, FDA intends to address  most of the limitations in its IT systems and infrastructure that had been  previously identified by the agency’s Science Board, its contractors, and  us. Further, although these projects, activities, and high-level plans are  intended to address most of the limitations, successfully overcoming the  limitations depends in part on the agency’s developing and implementing  appropriately detailed plans. FDA Has Made Mixed Progress in Key IT Management Practices

An agency’s chance of success in modernizing its IT systems is improved if  it institutes critical IT management capabilities, including strategic  planning (discussed in the previous section), investment management,  information security, enterprise architecture, and human capital. Although FDA is making progress in these areas, it has considerable work  to do. Finally, it is not effectively managing its IT human capital. Until it begins managing IT human capital  strategically, FDA cannot be assured that it will have the workforce it  needs to carry out its modernization projects. However, FDA does not have such a plan guiding its modernization efforts. That is, it has begun implementing an enterprisewide  approach to IT management, and it has put into place a foundation for  investment management. Recommendations for Executive Action

To help ensure the success of FDA’s modernization efforts, we  recommend that the Commissioner of FDA require the CIO to take  expeditious actions to    set milestones and a completion date for developing a comprehensive IT  strategic plan, including results-oriented goals, strategies, milestones,  performance measures, and an analysis of interdependencies among  projects and activities, and use this plan to guide and coordinate its  modernization projects and activities;    develop a documented enterprise architecture program management plan  that includes a detailed work breakdown of the tasks, activities, and time  frames associated with developing the architecture, as well as the funding  and staff resources needed;   complete the criteria for setting priorities for the segment architecture and    accelerate development of the segment and enterprise architecture,  including “as is,” “to be,” and transition plans, and in the meantime  develop plans to manage the increased risk to modernization projects of  proceeding without an architecture to guide and constrain their  development; and   develop a skills inventory, needs assessment, and gap analysis, and  develop initiatives to address skills gaps as part of a strategic approach to  IT human capital planning. GAO staff who made major  contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) evaluate the Food and Drug Administration’s  (FDA) overall plans for modernizing its systems, including the extent to  which the plans address identified limitations or inadequacies in the  agency’s information technology (IT) capabilities, and (2) assess to what  extent the agency has put in place key IT management policies and  processes to guide the implementation of its modernization projects. We analyzed the agency’s two  main high-level planning documents that address IT, the agency’s Strategic  Action Plan and the Prescription Drug User Fee Act (PDUFA) IV IT Plan,  to determine whether they included elements of an IT strategic plan.
Why GAO Did This Study

The Food and Drug Administration (FDA) relies heavily on information technology (IT) to carry out its responsibility for ensuring the safety and effectiveness of certain consumer products. Recognizing limitations in its IT capabilities that had been previously identified in studies by FDA and others, the agency has begun various initiatives to modernize its IT systems. GAO was asked to (1) evaluate the agency's overall plans for modernizing its IT systems, including the extent to which the plans address identified limitations or inadequacies in the agency's capabilities, and (2) assess to what extent the agency has put in place key IT management policies and processes to guide the implementation of its modernization projects. GAO analyzed FDA's plans to determine whether they followed best practices and addressed capability limitations, reviewed key management policies and processes, and interviewed agency officials.

What GAO Found

In response to federal law and guidance and urgent mission needs, FDA is pursuing numerous modernization projects (including 16 enterprisewide initiatives), many of which are in early stages. However, FDA does not have a comprehensive IT strategic plan to coordinate and manage these initiatives and projects. Such a plan would describe what the agency seeks to accomplish, identify the strategies it will use to achieve desired results, and provide results-oriented goals and performance measures that permit it to determine whether it is succeeding. FDA has developed two high-level planning documents that include some of these elements, but not all: (1) The agency's Strategic Action Plan provides high-level goals and objectives related to modernization of infrastructure and systems, but it does not provide details on IT initiatives, such as milestones and performance measures. (2) An IT plan for FDA's user fee program for drugs and biological products focuses on selected projects in greater detail, but these projects are only a subset of the agency's modernization initiatives. As reflected by its projects and high-level plans, FDA intends to address most of the limitations in its IT systems and infrastructure that had been previously identified. However, successfully overcoming these limitations depends in part on the agency's developing and implementing appropriately detailed plans. A comprehensive IT strategic plan, including results-oriented goals and performance measures, is vital for guiding and coordinating the agency's numerous ongoing modernization projects and activities. Until it develops such a plan, the risk is increased that the agency's IT modernization may not adequately meet the agency's urgent mission needs. FDA has made mixed progress in establishing important IT management capabilities that are essential in helping ensure a successful modernization. These capabilities include investment management, information security, enterprise architecture development, and human capital management. For example, as part of a move to an enterprisewide approach to IT management, FDA has put policies in place for investment management and project management, and it is making progress in addressing information security. However, significant work remains with regard to enterprise architecture (that is, establishing modernization blueprints describing the organization's operation in terms of business and technology), particularly its "to be" architecture--a blueprint of where it wants to go in the future. Further, the agency is not strategically managing IT human capital--it has not determined its IT skills needs or analyzed gaps between skills on hand and future needs. In both these areas (enterprise architecture and human capital management), the agency's vision for the future, as captured in an IT strategic plan, would be an important asset. Without an effective enterprise architecture and strategic human capital management, FDA has less assurance that it will be able to modernize effectively and will have the appropriate IT staff to effectively implement and support its modernization efforts.