OMB subsequently agreed with our  recommendation. Toward this end, the selected departments had taken steps to establish  policies and procedures that addressed the common baseline  requirements established by OMB; however, most of the departments, or  their component agencies, lacked comprehensive policies and  procedures that fully addressed all of the requirements. Gaps in Departments’ FITARA Implementation and Delegation Plans

The shortcomings in the four departments’ policies and procedures  related to CIO visibility into IT resources, CIO input into IT resource  planning, and CIO review and approval of the IT budget request were  due, in part, to having not addressed in their FITARA implementation and  delegation plans how they intended to implement the OMB common  baseline requirements. Selected Departments Demonstrated Mixed Implementation of IT Budgeting Requirements in Developing Fiscal Year 2017 Budgets for a Sample of Investments

While it is important for federal agencies to establish policies and  procedures that describe how they are to carry out IT budgeting  requirements identified in FITARA and OMB guidance, it is equally  important for them to implement the requirements when planning and  budgeting for individual IT investments and to retain supporting  documentation that would demonstrate that they have done so. For example, HHS could not demonstrate that it  had described the department-level non-major investment’s IT resources. The CIO Reviews Whether the Investment’s Estimates of IT Resources in the Portfolio and Budget Request Are Appropriate

The selected departments varied in the extent to which they could  demonstrate that the CIO took steps to review whether the investment’s  estimates of IT resources in the portfolio and budget request were  appropriate. All of the four selected departments—DOE, HHS, DOJ, and Treasury— lacked quality assurance processes to ensure government labor costs  have been accurately reported, align contract costs with IT investments,  and utilize budget data to capture all IT programs. If implemented effectively, this approach could also provide  departments additional assurance that their budgets are being informed  by relevant IT costs. Until the departments establish  policies and procedures that address all requirements, they risk  inconsistently applying requirements that are key to providing their CIOs  visibility into resources, input to resource plans, and meaningful review  and approval of IT budgets. While DOJ fully  demonstrated implementation for the selected requirements for the  majority of the investments we sampled, HHS and Treasury partially  demonstrated implementation for a majority of their investments, and  DOE had not demonstrated implementation for the majority of its  investments. As a result, departments were not always able to show that  these CIOs had adequate input to resource plans and review of their IT  budgets. Finally, the four selected departments lacked quality assurance  processes for ensuring their IT budgets are informed by reliable cost  information. This resulted in billions of dollars that were requested without  departments having comprehensive information to support those  requests. Among other things, this was due to a lack of processes for  periodically reviewing data quality and estimation methods for  government labor estimates, as well as a lack of processes to cross-walk  IT spending data in their procurement and accounting systems with  investment data in their IT portfolio management systems. The Administration’s new approach of using a standard set of low-level  cost categories to group IT spending could help departments address  their lack of processes if properly implemented. One department (DOE) partially agreed with one  recommendation and agreed with the other recommendations made to it,  as well as with the recommendations made to its component agency  (NNSA). In addition, one department (Treasury) neither agreed nor  disagreed with the recommendations. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which selected federal  agencies (1) established policies and procedures in place that address  the information technology (IT) budgeting requirements of the Federal  Information Technology Acquisition Reform Act (FITARA) and related  Office of Management and Budget (OMB) IT budget guidance, (2) could  demonstrate that they had developed fiscal year 2017 IT budgets for  sampled investments consistent with FITARA and OMB guidance, and  (3) implemented processes to ensure that annual IT budgets are informed  by reliable cost information. In addition, for each of these four departments, we selected their  component agencies that had the largest fiscal year 2017 IT budget  request. The components within the four selected departments were:  (1) the National Nuclear Security Administration (NNSA) within DOE,  (2) the Centers for Medicare and Medicaid Services (CMS) within HHS,  (3) the Federal Bureau of Investigation (FBI) within DOJ, and (4) the  Internal Revenue Service (IRS) within Treasury. The eight OMB common baseline requirements within budget formulation  and execution that we identified and selected are: establish the level of detail with which IT resources are to be  described in order to inform the CIO during the planning and  budgeting processes; establish agency-wide policy for the level of detail with which planned  expenditures for all transactions that include IT resources are to be  reported to the CIO;  include the CIO in the planning and budgeting stages for programs  that are fully or partially supported with IT resources;  include the CIO as a member of governance boards that inform  decisions regarding all IT resources, including component-level  governance boards; document the processes by which program leadership works with the  CIO to plan an overall portfolio of IT resources; ensure the CIO has reviewed and approved the major IT investments  portion of the budget request; ensure the CIO has reviewed IT resources that are to support major  program objectives and significant increases and decreases in IT  resources; and ensure the CIO has reviewed whether the IT portfolio includes  appropriate estimates of all IT resources included in the budget  request. With regard to our second objective, we determined whether the selected  departments had implemented key IT budgeting requirements for a  non-generalizable sample of investments in their fiscal year 2017 budget  formulation. To address our third objective, we assessed the selected departments’  efforts to develop their fiscal year 2017 budget with reliable cost  information by comparing the department’s IT capital planning and  budgeting processes against best practices identified by us and the  International Organization for Standardization—such as capturing  government labor costs, aligning contract costs with investments, and  utilizing budget object class data. However,  NNSA had not established such policies and procedures. However, at the time of our review, procedures to do  so had not yet been established. DOJ did not document procedures for this requirement.
Why GAO Did This Study

In December 2014, Congress enacted FITARA, which was intended to improve covered agencies' acquisitions of IT. FITARA also provided an opportunity to strengthen the authority of CIOs to provide needed direction and oversight of agencies' IT budgets.
GAO was asked to review whether CIOs' IT budgeting practices are consistent with FITARA and OMB's implementing guidance. This report addresses the extent to which selected federal agencies (1) established policies and procedures that address IT budgeting requirements, (2) could demonstrate that they had developed fiscal year 2017 IT budgets for sampled investments consistent with FITARA and OMB guidance, and (3) implemented processes to ensure that annual IT budgets are informed by reliable cost information.
GAO selected four departments to review. These departments had the two highest and the two lowest average initial selfassessments scores of compliance with OMB's FITARA guidance, as well as a fiscal year 2017 IT budget of at least $1 billion. Within each of the departments, GAO also selected the component agencies with the largest fiscal year 2017 IT budget. For each selected department and component agency, GAO reviewed relevant IT budget policies and procedures, analyzed a sample of major and non-major investment proposals against key OMB requirements, and determined whether selected departments captured government labor costs, among other things.

What GAO Found

The departments GAO reviewed—the Departments of Energy (DOE), Health and Human Services (HHS), Justice (DOJ), and the Treasury (Treasury)—took steps to establish policies and procedures that align with eight selected Office of Management and Budget (OMB) requirements intended to implement information technology (IT) acquisition reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act, or FITARA) and to provide the chief information officer (CIO) visibility into and oversight over the IT budget. For example, of the eight OMB requirements, all four departments had established policies and procedures related to the level of detail with which IT resources are to be described in order to inform the CIO during the planning and budgeting processes. Agencies varied, however, as to how fully they had established policies and procedures related to some other OMB requirements, and none of the four departments had yet established procedures for ensuring that the CIO had reviewed whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (See table.)
Where the departments had not fully established policies and procedures, it was due, in part, to having not addressed in their FITARA implementation and delegation plans how they intended to implement the OMB requirements. Until departments develop comprehensive policies and procedures that address IT budgeting requirements established by OMB, they risk inconsistently applying requirements that are intended to facilitate the CIO's oversight and approval of the IT budget.
Departments varied in the extent to which they could demonstrate implementation of key IT budgeting requirements when developing fiscal year 2017 funding requests for sampled investments. Specifically, while DOJ demonstrated that it had fully implemented the selected requirements for the majority of the investments GAO sampled, HHS and Treasury partially demonstrated implementation for a majority of the sampled investments, and DOE could not demonstrate implementation for the majority of the sampled investments. For example, DOE, HHS, and Treasury were not able to fully show that their CIOs had reviewed whether estimates of IT resources included in the budget request were appropriate for two of their respective departments' largest fiscal year 2017 IT investments. Departments often could not demonstrate that they had implemented selected IT budgeting requirements at the investment level because they had not established comprehensive policies and procedures that required them to do so. As a result, departments could not show that CIOs were sufficiently involved in planning fiscal year 2017 IT expenditures at the individual investment level.
All four selected departments lacked quality assurance processes for ensuring their IT budgets were informed by reliable cost information. Specifically, the selected departments did not have IT capital planning processes for (1) ensuring government labor costs have been accurately reported, (2) aligning contract costs with IT investments, and (3) utilizing budget object class data to capture all IT programs. This resulted in billions of dollars in requested IT expenditures without departments having comprehensive information to support those requests, and nearly $4.6 billion in IT contract spending that was not explicitly aligned with investments in selected departments' IT portfolios. This was due to a lack of processes for periodically reviewing data quality and estimation methods for government labor estimates, as well as a lack of mechanisms to cross-walk IT spending data in their procurement and accounting systems with investment data in their IT portfolio management systems. In August 2017, OMB developed a new approach of using a standard set of categories to group IT spending that, if properly implemented, has the potential to provide departments and CIOs enhanced visibility into IT costs across the portfolio. Nevertheless, until departments establish processes for assessing or otherwise ensuring the quality of relevant IT cost data used to inform their IT budgets, department CIOs will have less assurance that their budget includes appropriate and comprehensive estimates of IT resources.

What GAO Recommends

GAO is making 43 recommendations to the eight selected departments and component agencies to address gaps in their IT budgeting policies and procedures, demonstrate implementation of OMB requirements, and establish procedures to ensure IT budgets are informed by reliable cost information. HHS, the Centers for Medicare and Medicaid Services, DOJ, the Federal Bureau of Investigation, and the Internal Revenue Service agreed with our recommendations. DOE partially agreed with one recommendation and agreed with the other recommendations made to it, as well as with the recommendations made to its component agency—the National Nuclear Security Administration. Treasury neither agreed nor disagreed with the recommendations.