Specifically, in April 2017, DOD identified 10 of 34 total MAIS programs  as business programs and the Director, Acquisition Resources and  Analysis announced that these programs would adhere to DOD’s  Instruction 5000.75 policy for management and oversight. For  example, while the policy for non-business MAIS programs is consistent  in its adherence to all four of the leading IT management practices, the  policy for MAIS business programs is consistent in its adherence to only  two of the four practices. Until DOD updates its policy for MAIS business programs to adhere to  leading practices on the establishment of baseline estimates on cost and  schedule to include threshold estimates on cost and schedule to identify  when programs may be at high risk, stakeholders may not have the  information they need to manage and oversee MAIS business programs. All Selected MAIS Programs Had Changes in Cost and Schedule Estimates, and Most Programs Had Met Performance Targets

All of the 15 selected MAIS programs had either increased or decreased  their planned cost estimates, and 10 of them had delays in their planned  schedule estimates when comparing the first acquisition program  baseline to the most recent acquisition program baseline estimates. The  changes in the cost estimates ranged from a decrease of $1.6 billion (-41  percent) to an increase of $1.5 billion (163 percent), and slippages in the  schedule estimates ranged from a delay of 5 years to a delay of 5  months. Of those 9, 6 programs reported that they had met all of their  performance targets. Program officials reported that reductions in planned cost estimates were  due to changes in program scope. Underestimating development and test efforts. Further, three programs reported that they met several, but not all, of their  performance targets. Conclusions

While DOD’s policy for non-business MAIS programs adheres to all four  leading IT management practices, the department’s policy for MAIS  business programs does not adhere to two leading practices on  establishing initial and current baseline estimates on cost and schedule  and predetermining threshold estimates, as well as reporting periodically  on performance information to stakeholders. DOD partially concurred with the first recommendation on updating the  policy or guidance for MAIS business programs. Appendix I: Objectives, Scope, and Methodology

The National Defense Authorization Act for Fiscal Year 2012 mandated  that we select, assess, and report on selected major automated  information systems (MAIS) programs annually through March 2018. Our objectives were to: (1) assess the Department of Defense’s (DOD)  policy for the management and oversight of MAIS programs; (2) describe  the extent to which selected MAIS programs have changed their planned  cost and schedule estimates and met performance targets; and (3)  assess the extent to which selected MAIS programs have used leading  information technology (IT) acquisition practices, including requirements  and risk management. We then compared DOD’s policies used to manage and oversee the  department’s non-business MAIS programs and MAIS business programs against these leading IT management practices.
Why GAO Did This Study

DOD's MAIS programs are intended to help the agency sustain its key operations. In April 2017, recognizing that MAIS programs met different mission needs, DOD categorized its MAIS programs into business and non-business systems.
The National Defense Authorization Act for Fiscal Year 2012 includes a provision for GAO to select, assess, and report on DOD's MAIS programs annually through March 2018. GAO's objectives, among others, were to (1) assess DOD's policies for managing and overseeing MAIS programs and (2) describe the extent to which selected MAIS programs have changed their planned cost and schedule estimates and met technical performance goals. To address these objectives, GAO compared DOD's policies for managing and overseeing all 34 MAIS programs (24 non-business programs and 10 business programs) to leading IT management practices. GAO also compared 15 selected programs' initial cost, schedule, and performance baselines to their current acquisition program estimates.

What GAO Found

The strength of Department of Defense's (DOD) policies for managing and overseeing major automated information system (MAIS) programs varies. Specifically, the policy for managing 24 non-business MAIS programs adheres to leading information technology (IT) management practices, but the policy for managing 10 MAIS business programs does not always do so (see table).
When DOD categorized 10 of the 34 MAIS programs as MAIS business programs, it also directed these programs to adhere to DOD's business systems policy (DOD Instruction 5000.75). However, the department directed those programs to use a policy for the management and oversight of MAIS business programs that was not fully comprehensive. Until DOD updates its business systems policy to address gaps in establishing performance information such as baseline estimates on program cost and schedule goals, identifying thresholds to identify high risk, and requiring periodic reports to be provided to stakeholders at regular intervals, stakeholders will likely not have all the information they need to manage and oversee MAIS business programs.
While all 15 business and non-business MAIS programs had either increased or decreased their planned cost estimates and the majority had delays in their planned schedule estimates, the majority of the 9 programs that had performance targets met those performance goals. Specifically, the decreases and increases in cost estimates ranged from a decrease of $1.6 billion (-41 percent) to an increase of $1.5 billion (163 percent). The decreases in planned cost were largely due to scope reduction, while cost increases were due to underestimating levels of effort and contracting issues. The slippages in schedule estimates ranged from a delay of 5 years to 5 months; these delays were caused by unrealistic expectations or unplanned changes. Six of the 9 programs that had performance targets met all of them, while the other 3 met several but not all of their performance targets. The other 6 programs were in the early stages of system development and had not begun performance testing.

What GAO Recommends

GAO is making three recommendations, including that DOD update its policy for managing MAIS business programs to include baseline estimates. DOD partially concurred with this recommendation, and fully concurred with the other two recommendations. GAO continues to believe that all the recommendations are warranted.