DOD had not developed a well-defined architecture. For  example, the latest versions of the architecture did not include products  describing the “As Is” business and technology environments. DOD did not have an effective departmentwide management structure  for controlling its business investments. DOD has partially satisfied the four legislative provisions relating to  architecture development, transition plan development, budgetary  disclosure, and investment review; it has satisfied the provision concerning  designated approval authorities; and it is in the process of satisfying the  provision for systems costing in excess of $1 million. According to DOD,  the requirements of each provision will be fully implemented under its  incremental approach to developing the architecture and transition plan,  and its tiered accountability approach to business system investment  management. Until they are, the department’s business systems  modernization program will continue to be a high-risk endeavor. Version 3.0 also identifies some, but not all, system  interface requirements. Version 3.0 of the architecture includes a “To Be” architecture and a  transition plan; however, it does not include an “As Is” architecture, which  is essential to performing a gap analysis to identify capability and system  performance shortfalls that the transition plan is to address. However, it does not include all business processes. Transition Plan Partially Satisfies the Act, but Improvements Are Needed

The defense authorization act for fiscal year 2005 requires that DOD  develop, by September 30, 2005, a transition plan for implementing its  business enterprise architecture, and that this plan meet three  requirements. However, the plan does  not fully comply with the act’s requirements. Act’s Requirement for Delegating IT System Responsibilities and Accountabilities to Designated Approval Authorities Has Been Satisfied

The defense authorization act for fiscal year 2005 directs DOD to put in  place a specifically defined structure that is responsible and accountable  for controlling business system investments to ensure compliance and  consistency with the business enterprise architecture. DOD has satisfied this requirement under the act. Act’s Requirements for Certain IT Investment Review Structures and Processes Have Been Partially Satisfied

The defense authorization act for fiscal year 2005 also required DOD to  establish investment review structures and processes, including a  hierarchy of investment review boards, each with representation from  across the department, and a standard set of investment review and  decision-making criteria for these boards to use to ensure compliance and  consistency with the business enterprise architecture. Among other things,  it has done the following. The remaining 44 have yet to be approved. The department’s actions to review and approve business systems  investments can be viewed as work in process. This progress provides a foundation  upon which to build. Therefore, we are not making  additional recommendations at this time. Agency Comments and Our Evaluation

In its written comments on a draft of this report, signed by the Deputy  Under Secretary of Defense (Business Transformation) and reprinted in  appendix II, the department recognized that our analysis,  recommendations, guidance, and educational activities have made us a  constructive player in DOD’s business transformation efforts. While not  commenting on most of the findings in the report, the department also  stated that it disagreed with us on two points—the level of development of  an “As Is” architecture and consistency within and between the business  enterprise architecture and the transition plan. Consistent with the act and as agreed with congressional  defense committees’ staffs, we evaluated DOD’s efforts relative to six  provisions in the act: (1) development of an enterprise architecture that  includes an information infrastructure enabling DOD to support specific  capabilities, such as data standards and system interface requirements;  (2) development of a transition plan for implementing the enterprise  architecture that includes specific elements, such as the acquisition  strategy for new systems; (3) inclusion of business system information in  DOD’s fiscal year 2006 budget submission; (4) establishment of a business  system investment approval and accountability structure;  (5) establishment of a business system investment review process; and  (6) approval of defense business system investments in excess of  $1 million. To determine whether the transition plan addresses the requirements  specified in the act, we reviewed the transition plan approved on  September 28, 2005. List of the DOD Architecture Framework Products

Executive-level summary information on the scope, purpose, and context of the  architecture Architecture data repository with definitions of all terms used in all products High-Level Operational Concept Graphic High-level graphical/textual description of what the architecture is supposed to  do, and how it is supposed to do it Graphic depiction of the operational nodes (or organizations) with needlines that  indicate a need to exchange information Information exchanged between nodes and the relevant attributes of that  exchange Command structure or relationships among human roles, organizations, or  organization types that are the key players in an architecture  Operations that are normally conducted in the course of achieving a mission or a  business goal, such as capabilities, operational activities (or tasks), input and  output flows between activities, and input and output flows to/from activities that  are outside the scope of the architecture One of three products used to describe operational activity—identifies business  rules that constrain operations One of three products used to describe operational activity—identifies business  process responses to events One of three products used to describe operational activity—traces actions in a  scenario or sequence of events Documentation of the system data requirements and structural business process  rules of the operational view Identification of systems nodes, systems, and systems items and their  interconnections, within and between nodes Specific communications links or communications networks and the details of  their configurations through which systems interface Relationships among systems in a given architecture; can be designed to show  relationships of interest (e.g., system-type interfaces, planned versus existing  interfaces)
Mapping of relationships between the set of operational activities and the set of  system functions applicable to that architecture Characteristics of the system data exchanged between systems Systems Performance Parameters Matrix Quantitative characteristics of systems and systems hardware/software items,  their interfaces, and their functions Planned incremental steps toward migrating a suite of systems to a more efficient  suite, or toward evolving a current system to a future implementation Emerging technologies and software/hardware products that are expected to be  available in a given set of time frames and that will affect future development of  the architecture One of three products used to describe system functionality—identifies  constraints that are imposed on systems functionality due to some aspect of  systems design or implementation One of three products used to describe system functionality—identifies  responses of a system to events One of three products used to describe system functionality—lays out the  sequence of system data exchanges that occur between systems (external and  internal), system functions, or human role for a given scenario Physical implementation of the Logical Data Model entities (e.g., message  formats, file structures, and physical schema)

GAO Contact and Staff Acknowledgments

	GAO Contact

	Acknowledgments

In addition to the contacts named above, key contributors to this report  were Cynthia Jackson and Darby Smith, Assistant Directors, and Beatrice  Alff, Barbara Collier, Francine DelVecchio, Neelaxi Lakhmani, Anh Le, Mai  Nguyen, Tarunkant Mithani, Freda Paintsil, Randolph Tekeley, and William  Wadsworth.
Why GAO Did This Study

For many years, the Department of Defense (DOD) has been attempting to modernize its business systems, and GAO has made numerous recommendations to help it do so. To further assist DOD, Congress included provisions in the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 aimed at ensuring that DOD develop a well-defined business enterprise architecture and transition plan by September 30, 2005, as well as establish and implement effective structures and processes for managing information technology (IT) business system investments. In response to the act's mandate, GAO is reporting on DOD's compliance with requirements relating to DOD's architecture, transition plan, budgetary disclosure, and business system review and approval structures and processes. Given GAO's existing recommendations, it is not making additional recommendations at this time. In comments on a draft of this report, DOD recognized that GAO has been a constructive player in its business transformation efforts. While not specifically commenting on most of the report's findings and its conclusions, DOD also said that it disagreed with two points: the level of development for its "As Is" architecture and instances of nonintegration within the architecture and transition plan. However, it also commented that it is committed to addressing what GAO views to be the underlying basis of both points.

What GAO Found

In its efforts to comply with the act's provisions, DOD has made important progress in establishing needed modernization management capabilities. However, much more remains to be done. The latest version of the business enterprise architecture (Version 3.0), which the department approved on September 28, 2005, partially satisfies the conditions of the act, but not entirely. For example, while Version 3.0 includes a target or "To Be" architecture, as required, it does not include a current ("As Is") architecture. Without this element, DOD could not analyze the gaps between the two architectures--critical input to a comprehensive transition plan. However, this version of the architecture represents significant progress and provides a foundation upon which the department can build. The transition plan associated with the current version of the architecture partially satisfies the act, but improvements are needed. Specifically, although it includes certain required information (such as milestones for major projects), it is inconsistent with the architecture in various ways. For instance, it identifies target systems (those that are to be included in the "To Be" architecture), but these are not always the same as those identified in the architecture itself. In addition, the transition plan does not include system performance metrics aligned with the plan's strategic goals and objectives. The department's fiscal year 2006 budget discloses some but not all required information. For example, it does not identify the approval authority for all business systems investments. DOD has satisfied some of the act's requirements regarding its business systems investments, but it either has not satisfied or is still in the process of satisfying others. For example, the department has fulfilled the act's requirement for delegating IT system responsibility and accountability to designated approval authorities as specified. In addition, DOD has largely satisfied the act's requirement to establish certain structures and define certain processes to review and approve IT investments. However, some of these structures are not yet in place, and some reviews and approvals to date have not followed the criteria in the act. DOD agrees that additional work is required and states that under its incremental approach to developing the architecture and transition plan, and under its tiered accountability structure for reviewing and approving business system investments, improvements will occur in its architecture, transition plan, budgetary disclosure, and investment management and oversight. If these improvements do not occur, DOD's business systems modernization will continue to be a high-risk program.