DOD Has Established the Structures Needed to Effectively Manage Business System Investments, but Has Not Fully Defined Many of the Related Policies and Procedures

According to our ITIM framework, organizations should establish the  management structures needed to manage their investments and build an  investment foundation by having defined policies and procedures for  selecting and controlling individual projects (Stage 2 capabilities), and  organizations also should manage projects as a portfolio of investments  according to defined policies and procedures, treating them as an  integrated package of competing investment options and pursuing those  that best meet the strategic goals, objectives, and mission of the agency  (Stage 3 capabilities). The department has defined four of nine practices that call for project- level policies and procedures (see table 4) and one of the five practices  that call for portfolio-level policies and procedures (see table 6). With respect to project-level investment management practices, DOD  officials stated that these are performed at the component level, and that  departmental policies and procedures established for overseeing  components’ execution of these practices are sufficient. With respect to  portfolio-level practices, however, these officials stated that they intend to  improve departmental policies and procedures for business system  investments by, for example, establishing a single governance structure,  but plans or time frames for doing so have not been established. Until DOD fully  defines departmentwide policies and procedures for both individual  projects and the portfolios of projects, it risks selecting and controlling  these business system investments in an inconsistent, incomplete, and ad  hoc manner, which in turn reduces the chances that these investments will  meet mission needs in the most cost-effective manner. In addition, DOD’s business transformation and IRB  guidance define a process for ensuring that programs support the  department’s ongoing and future business needs. Specifically, DOD has issued departmentwide  guidance that assigns responsibilities to the USD(AT&L) for managing  and establishing business system investment portfolios, including  leveraging or establishing a governance forum to oversee these business  system investment portfolio activities. DOD partially agreed with our recommendation to define and implement  policies and procedures for creating and modifying portfolio selection  criteria for business system investments. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the Department of Defense’s  (DOD) corporate investment management approach comports with  relevant federal guidance. Our analysis was based on the best practices  contained in GAO’s Information Technology Investment Management  (ITIM) framework, and the framework’s associated evaluation  methodology, and focused on DOD’s establishment of departmental-level  policies and procedures for business system investments needed to assist  organizations in complying with the investment management provisions of  the Clinger-Cohen Act of 1996 (Stages 2 and 3).
Why GAO Did This Study

In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high-risk," and continues to do so today. In 2004, Congress passed legislation reflecting prior GAO recommendations for DOD to adopt a corporate approach to information technology (IT) business system investment management. To support GAO's legislative mandate to review DOD's efforts, GAO assessed whether the department's corporate investment management approach comports with relevant federal guidance. In doing so, GAO applied its IT Investment Management framework and associated methodology, focusing on the framework's stages related to the investment management provisions of the Clinger-Cohen Act of 1996.

What GAO Found

DOD has established the management structures needed to effectively manage its business system investments, but it has not fully defined many of the related policies and procedures that GAO's IT Investment Management framework defines. Specifically, the department has defined four of nine practices that call for project-level policies and procedures, and one of the five practices that call for portfolio-level policies and procedures. For example, DOD has established an enterprisewide IT investment board responsible for defining and implementing its business system investment governance process, documented policies and procedures for ensuring that systems support ongoing and future business needs, developed procedures for identifying and collecting information about these systems to support investment selection and control, and assigned responsibility to an individual or a group for managing the development and modification of the business system portfolio selection criteria. However, DOD has not fully documented business system investment policies and procedures for directing investment board operations, selecting new investments, reselecting ongoing investments, integrating the investment funding and the investment selection processes, and developing and maintaining a complete business system investment portfolio(s). Regarding project-level investment management practices, DOD officials said that these are performed at the component level, and that departmental policies and procedures established for overseeing components' execution of these practices are sufficient. For portfolio-level practices, however, these officials stated that they intend to improve departmental policies and procedures for business system investments by, for example, establishing a single governance structure, but plans or time frames for doing so have not been established. Until DOD fully defines departmentwide policies and procedures for both individual projects and portfolios of projects, it risks selecting and controlling these business system investments in an inconsistent, incomplete, and ad hoc manner, which in turn reduces the chances that these investments will meet mission needs in the most cost-effective manner.