On May 15, 1997, Treasury submitted its modernization blueprint to the Congress. Investment Decision Management. First, IRS does not yet have detailed process definitions for any of the SLC phases. For instance, IRS has not clearly defined how requirements will be formulated and how they will be assessed and prioritized; how projects will be controlled and evaluated; what data will be required and what evaluation criteria will be used; how system designs will be assessed and how system developments and acquisitions will be managed; and how architectural compliance will be determined and enforced. Moreover, as discussed later in more detail, neither the CIO nor any other organizational entity has sufficient authority to implement SLC processes and enforce architectural compliance agencywide. Blueprint Products Are a Good Start but Are Incomplete or Insufficient

While the products constituting IRS’ May 15, 1997, modernization blueprint represent a good first step and a foundation upon which to build, none are complete. To IRS’ credit, some of these requirements provide for significant improvements in IRS’ financial management capabilities. Traceability is critical to ensuring that systems meet users needs. The architecture has other positive attributes. As a result, it is not yet known which of the system components will satisfy which of the requirements, or how it will do so. In particular, the CIO does not have budgetary and organizational authority over all IRS systems development, research and development, and maintenance activities. As a result, the components do not yet provide an adequate basis for effectively and efficiently developing or acquiring systems. However, the CIO does not have the authority needed to enforce the modernization blueprint (once it is completed) agencywide. Recommendations

To ensure that IRS develops a complete blueprint for modernizing its information systems, we recommend that the Commissioner of Internal Revenue require the IRS CIO to: complete the definition and implementation of all SLC processes, including processes for ensuring disciplined software development and acquisition and for validating SLC products; for each phase of the modernization, define business requirements and complete the architecture with sufficient detail and precision to build or acquire systems; formulate a sequencing plan that specifies (1) phase and release cost and schedule estimates, (2) projects that constitute the phases and releases, (3) project cost and schedule estimates, (4) project interdependencies, (5) the evolution of architectural subfunctions, and (6) the projects that replace legacy systems that are eliminated; and validate the business requirements, architecture, and sequencing plan using the completed and implemented SLC processes. IRS also agreed that (1) the blueprint is not yet complete and does not provide sufficient detail and precision for building or acquiring new systems and (2) the SLC needs to be completed and implemented as a precondition to completing and validating the blueprint as well as proceeding with the modernization. Objectives, Scope, and Methodology

Pursuant to congressional direction in the conference report accompanying the fiscal year 1997 Omnibus Consolidated Appropriations Act (P.L. 104-208), on May 15, 1997, IRS issued a blueprint for defining, directing, and controlling its modernization.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the modernization blueprint that the Internal Revenue Service (IRS) prepared pursuant to the conference report accompanying the fiscal year 1997 Omnibus Consolidated Appropriations Act.

What GAO Found

GAO noted that: (1) IRS' May 15, 1997, modernization blueprint is a good first step and provides a solid foundation from which to determine precise business requirements, a complete target architecture, and a discipline set of processes and detailed plans for validating, implementing, and enforcing the architecture; (2) similarly, the blueprint's business requirements specify needed improvements in such areas as financial management, and the architecture and sequencing plan include several positive attributes, including traceability between business requirements and systems and high-level descriptions of data and security subarchitectures; (3) however, the blueprint is not yet complete and does not provide sufficient detail and precision for building or acquiring new systems; (4) in particular, IRS' systems life cycle (SLC) does not define in sufficient detail any of the SLC processes needed to manage technology investments; (5) as a result, IRS does not yet know: (a) how systems will actually be designed, developed, tested, or acquired; (b) how compliance with standards will be assessed and ensured; (c) how progress on projects will be determined; or (d) how key SLC products will be validated; (6) additionally, IRS plans for each of the three remaining blueprint components--business requirements, architecture, and sequencing plan--to include four levels of progressively greater detail; (7) as of May 15, 1997, IRS had completed the first two levels; (8) as a result, information that is critical to effective and efficient systems modernization is not yet known, essential decisions have not yet been made, and needed actions have not yet been taken; (9) IRS' Chief Information Officer (CIO) has acknowledged that essential elements are missing from the May 15, 1997, blueprint, and stated that he has begun addressing these voids; (10) however, even though IRS has given the CIO increased responsibility and accountability for managing and controlling systems development, acquisition, and maintenance, neither the CIO nor any other IRS organizational entity has budgetary and organizational authority over all IRS systems activities; and (11) as a result, it is unlikely that IRS will be able to institutionally implement and enforce its modernization blueprint once it is completed.