As previously mentioned, recognizing the severity of issues related to the  government-wide management of IT, Congress enacted FITARA in December 2014. The 22 selected agencies identified 78,249 IT-related contracts, to which  they obligated approximately $14.7 billion in fiscal year 2016. The percentage of additional IT contract obligations that we identified  varied among the selected agencies. For instance, the Department of  State (State) did not identify 1 percent of its IT contract obligations. In addition, the majority of the selected agencies that did not identify the  $4.5 billion in IT obligations also did not follow OMB’s guidance to have  the CAO identify all IT acquisitions for CIO review and approval. Of the 21 selected agencies that did not identify  the approximately $4.5 billion in IT obligations, 8 involved the acquisition  offices in the identification of their IT acquisitions. In recognition of the  importance of establishing guidance to assist agency officials in  identifying IT, 14 of the 22 selected agencies issued such guidance. However, 7 agencies did not. Until agencies involve the acquisition office in their IT identification  processes, and establish and effectively implement supporting guidance,  they will likely not be able to ensure that all IT acquisitions are identified. Of 96 randomly selected IT contracts at 10 agencies, only 11 acquisitions  associated with these contracts had been reviewed and approved as  required by OMB. The acquisitions associated with 85 contracts, with a  total possible value of approximately $23.8 billion, did not receive the  appropriate level of review. Until agencies fully satisfy FITARA and OMB’s requirements by ensuring  that CIOs, or their appropriate designees, review and approve IT  acquisitions, CIOs risk continuing to have limited visibility and input into  their agencies’ planned IT expenditures and not being able to use the  increased authority that FITARA’s contract approval provision is intended  to provide. In addition, agencies are missing an opportunity to strengthen  CIOs’ authority and to provide needed direction and oversight of their IT  acquisitions. As a result, agencies may award IT contracts that are  duplicative, wasteful, or poorly conceived. Without proper  identification of IT acquisitions, agencies and CIOs cannot effectively  provide oversight of them. One other agency (Commerce) did not provide  comments on the report. These  recommendations called for the department to (1) ensure that the  office of the CAO is involved in the process to identify IT acquisitions,  (2) issue specific guidance to ensure IT-related acquisitions are  properly identified, and (3) ensure that IT acquisition plans or  strategies are reviewed and approved according to OMB’s guidance. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) federal agencies  identify information technology (IT) contracts and how much is invested in  them, and (2) federal agency Chief Information Officers (CIO) are  reviewing and approving IT acquisitions. In addition to the obligations that agencies reported  to us, we identified an additional $4.5 billion in obligations for contracts  with IT-related product and service codes, raising the total amount  obligated to IT contracts in fiscal year 2016 to at least approximately  $19.2 billion. Appendix IV: Agency Acquisition Processes Used to Review and Approve IT Acquisitions

The Federal Information Technology Acquisition Reform Act (FITARA)  and the Office of Management and Budget’s (OMB) associated  implementation guidance require major civilian agency chief information  officers (CIO) to review and approve acquisitions of information  technology (IT) either directly, or as full participants in the agency’s  governance processes.
Why GAO Did This Study

The federal government invested more than $90 billion on IT in fiscal year 2016. However, prior IT expenditures have produced failed projects. Recognizing the severity of issues, in December 2014 Congress enacted IT acquisition reform legislation (referred to as the Federal Information Technology Acquisition Reform Act, or FITARA). Among other things, OMB's FITARA implementation guidance requires covered agencies' chief acquisition officers to identify IT contracts for the CIOs to review and approve.
GAO's objectives were to determine the extent to which (1) federal agencies identify IT contracts and how much is invested in them, and (2) federal agency CIOs are reviewing and approving IT acquisitions. To do so, GAO reviewed data on IT contracts from fiscal year 2016 at 22 agencies and compared agency actions to law and OMB guidance.

What GAO Found

Most of the 22 selected agencies did not identify all of their information technology (IT) contracts. The selected agencies identified 78,249 IT-related contracts, to which they obligated $14.7 billion in fiscal year 2016. However, GAO identified 31,493 additional contracts with $4.5 billion obligated, raising the total amount obligated to IT contracts in fiscal year 2016 to at least $19.2 billion (see figure).The percentage of additional IT contract obligations GAO identified varied among the selected agencies. For example, the Department of State did not identify 1 percent of its IT contract obligations. Conversely, 8 agencies did not identify over 40 percent of their IT-related contract obligations.
Many of the selected agencies that did not identify these IT acquisitions did not follow Office of Management and Budget's (OMB) guidance. Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for Chief Information Officer (CIO) review, as required by OMB. In addition, 7 agencies did not establish guidance to aid officials in recognizing IT. Until agencies involve the acquisitions office in their IT identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions. Without proper identification of IT acquisitions, agencies and CIOs cannot effectively provide oversight of these acquisitions.
In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB's requirement that the CIO review and approve IT acquisition plans or strategies. Further, only 11 of 96 randomly selected IT contracts at 10 agencies that GAO evaluated were CIO-reviewed and approved as required by OMB's guidance. The 85 IT contracts not reviewed had a total possible value of approximately $23.8 billion. Until agencies ensure that CIOs review and approve IT acquisitions, CIOs will continue to have limited visibility and input into their agencies' planned IT expenditures and will not be able to use the increased authority that FITARA's contract approval provision is intended to provide. Further, agencies will likely miss an opportunity to strengthen CIOs' authority and the oversight of IT acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived.

What GAO Recommends

GAO is making 39 recommendations, including that agencies ensure that acquisition offices are involved in identifying IT and issue related guidance; and to ensure IT acquisitions are reviewed according to OMB guidance. OMB and 20 agencies generally agreed with or did not comment on the recommendations. One agency agreed with one recommendation, but disagreed with another. GAO believes this recommendation is warranted. One agency disagreed with two recommendations. GAO subsequently removed one of these, but believes the other recommendation is warranted, as discussed in the report.