This is the accessible text file for GAO report number GAO-09-675 entitled 'Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment' which was released on July 31, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Committees: United States Government Accountability Office: GAO: July 2009: Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment: GAO-09-675: GAO Highlights: Highlights of GAO-09-675, a report to congressional committees. Why GAO Did This Study: Information technology (IT) plays a critical role in the Department of Housing and Urban Development’s (HUD) ability to carry out its home ownership and community development mission, which was recently expanded under the Housing and Economic Recovery Act of 2008. Pursuant to a congressional mandate to study HUD’s IT environment, GAO reviewed the adequacy of key IT management and modernization controls within the department, including strategic planning and performance measurement, investment management, human capital management, enterprise architecture development and use, and modernization program office establishment. To do so, GAO compared HUD policies, guidance, plans, reports, and other products and actions to relevant aspects of statutory requirements, federal guidance, and related best practices. What GAO Found: The department has to varying degrees established key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. Specifically, HUD has: * developed an IT strategic plan, with strategic goals and related activities and performance targets, but it has not assessed its IT performance since fiscal year 2007, and its assessment at that time showed performance shortfalls. For example, it reported that it was behind schedule or not making progress on about one-half of the activities needed to achieve its IT strategic goals. * established policies and procedures for creating portfolios of IT investments, but it lacks related practices to effectively control them. For example, criteria to evaluate the performance of its portfolio do not exist. * analyzed gaps in its IT workforce and developed a strategy for addressing them, but the analysis was based on an incomplete and outdated inventory of human capital skill levels, thus rendering its strategy unreliable. * established an enterprise architecture program—to connect strategic plans with individual programs and system solutions—that meets key aspects of related best practices, but its efforts to extend its architecture by adding the level of detail needed to implement modernization projects, referred to as segment architectures, are not sufficient. For example, while HUD has identified and prioritized segments to be modernized, it has not adhered to these priorities, and the segments developed do not reflect important elements of federal guidance, and most are out of date. * identified the need for a modernization program office with the responsibility for managing its modernization efforts but has not established this office. Department officials acknowledged these shortcomings and stated that efforts to address them have been constrained by such factors as turnover in IT leadership and, until recently, limited modernization resources and initiatives. Until it strengthens these IT management controls, the performance of its existing IT environment and the success of its recent and future efforts to modernize this environment will be at risk. What GAO Recommends: GAO recommends that the HUD Secretary strengthen the IT management controls discussed in this report and completes recommended steps to address shortcomings with each control. In commenting on a draft of this report, HUD agreed with GAO’s recommendations. View [hyperlink, http://www.gao.gov/products/GAO-09-675] or key components. For more information, contact Randolph C. Hite at (202) 512- 3439 or hiter@gao.gov. [End of section] Contents: Letter: Background: Key IT Management and Modernization Controls Have Not Been Fully Established: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Objective, Scope, and Methodology: Appendix II: Descriptions of HUD Segment Architectures: Appendix III: Comments from the Department of Housing and Urban Development: Appendix IV: GAO Contact and Staff Acknowledgments: Tables: Table 1: HUD OCIO Offices and Their Roles and Responsibilities: Table 2: Stage 3 Critical Processes--Developing a Complete Investment Portfolio: Table 3: Summary of Policies and Procedures for Stage 3 Critical Processes--Developing a Complete Investment Portfolio: Table 4: Summary of Key Practices for Evaluating the Portfolio (Stage 3 Critical Process): Table 5: Summary of HUD's Segments: Table 6: Status of HUD Segment Architectures: Table 7: Summary of Extent to Which HUD Segment Architectures Address OMB Guidance: Table 8: Developed Segment Architectures and Year Completed: Table 9: Descriptions of HUD Segment Architectures: Figures: Figure 1: Simplified HUD Organizational Chart: Figure 2: HUD OCIO Organizational Chart: Figure 3: WCF Direct Appropriations and Program Transfers for Fiscal Years 2005-2009: Figure 4: Percentage of WCF Obligations for Fiscal Year 2005-2008 Going Toward Maintenance of Existing IT Versus Development of New IT: Abbreviations: CIO: Chief Information Officer: EA: enterprise architecture: EPMO: Enterprise Program Management Office: FHA: Federal Housing Administration: Ginnie Mae: Government National Mortgage Association: HUD: Department of Housing and Urban Development: IPT: Integrated Project Team: IT: information technology: ITIM: Information Technology Investment Management: OCIO: Office of the Chief Information Officer: OMB: Office of Management and Budget: TIBEC: Technology Investment Board Executive Committee: TIBWG: Technology Investment Board Working Group: WCF: working capital fund: [End of section] United States Government Accountability Office: Washington, DC 20548: July 31, 2009: The Honorable Patty Murray: Chair: The Honorable Christopher Bond: Ranking Member: Subcommittee on Transportation, Housing and Urban Development, and Related Agencies: Committee on Appropriations: United States Senate: The Honorable John W. Olver: Chairman: The Honorable Tom Latham: Ranking Member: Subcommittee on Transportation, Housing and Urban Development, and Related Agencies: Committee on Appropriations: House of Representatives: The Department of Housing and Urban Development (HUD) performs a range of significant home ownership and community development missions that are integral to our nation's economic recovery. To accomplish these missions, HUD relies extensively on information technology (IT) and has been attempting to modernize its IT infrastructure and systems to enhance its ability to do so. The Explanatory Statement that accompanies the Department of Housing and Urban Development Appropriations Act, 2008,[Footnote 1] identifies concerns about HUD's capacity to manage its IT modernization and directs GAO to review HUD's information systems. As agreed, our objective was to determine if HUD has adequately established institutional management controls needed to manage and modernize its existing IT environment. To address this objective, we focused on key IT institutional management controls that our research and experience across the federal government have shown are hallmarks of successful organizations (strategic planning and performance measurement, portfolio-based investment management, human capital management, enterprise architecture development and use, and a responsible and accountable modernization program office). For each control, we compared pertinent agency documentation, such as policies, procedures, and plans, to statutory requirements, federal guidance, and related best practices. Details on our objective, scope, and methodology are in appendix I. We conducted this performance audit from July 2008 to July 2009, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: HUD's mission is to increase home ownership, support community development, and increase access to affordable housing free from discrimination. To these ends, it has established six strategic goals: (1) increasing home ownership opportunities; (2) promoting decent affordable housing; (3) strengthening communities; (4) ensuring equal opportunity in housing; (5) embracing high standards of ethics, management, and accountability; and (6) promoting participation of faith-based and community organizations. HUD works with other federal agencies and branches of government, as well as with local governments, faith-based and community organizations, and the private sector to achieve these goals. To carry out its mission, HUD is organized into five main program areas: Housing, Community Planning and Development, Fair Housing and Equal Opportunity, Public and Indian Housing, and the Government National Mortgage Association. * Office of Housing: This office oversees the Federal Housing Administration (FHA) and regulates certain aspects of the housing industry. Among other things, its mission is to contribute to building and preserving healthy neighborhoods and communities; maintain and expand home ownership, rental housing, and health care opportunities; and stabilize credit markets in times of economic disruption. The office is composed of two mission areas: single-family housing and multifamily housing. Single-family housing programs provide mortgage insurance on loans to purchase homes. Multifamily programs provide mortgage insurance to lenders on loans for the development of housing projects and health care facilities. * Office of Community Planning and Development: The office's mission is to provide decent housing, a suitable living environment, and economic opportunities for people of low and moderate income. To accomplish this, it engages in partnerships with all levels of government, the private sector, and nonprofit organizations. * Office of Fair Housing and Equal Opportunity: The office's mission is to administer and enforce federal laws that prohibit discrimination in housing, such as the Fair Housing Act[Footnote 2] and the Civil Rights Act of 1964.[Footnote 3] To accomplish this, it establishes and enforces policies intended to ensure that all Americans have equal access to housing of their choice. * Office of Public and Indian Housing: The office's mission is to ensure safe, decent, and affordable housing and create opportunities for residents' self-sufficiency and economic independence. Among other things, this office administers and manages programs authorized by the Housing Act of 1937[Footnote 4] to provide housing to over 1.3 million households. * Government National Mortgage Association (Ginnie Mae): This HUD-owned corporation's mission is to expand affordable housing by linking global capital markets to the nation's housing markets. While Ginnie Mae does not issue loans or mortgage-backed securities, it guarantees investors timely payment and interest on mortgage-backed securities backed by federally insured or guaranteed loans. HUD also consists of a number of mission support offices, such as the Office of Healthy Homes and Lead Hazard Control and the Office of Faith- Based and Community Initiatives, as well as administrative offices, such as the Office of the Chief Procurement Officer and the Office of the Chief Information Officer (OCIO). Figure 1 provides a simplified view of the department's organizational structure. Figure 1: Simplified HUD Organizational Chart: [Refer to PDF for image: organizational chart] HUD Organizational Chart: Top level: Secretary[A]. Second level, reporting to the Secretary: Deputy Secretary. Third level, reporting to the Deputy Secretary: Fair Housing and Equal Opportunity; Housing; Chief Financial Officer; Chief Procurement Officer; Community Planning and Development; Government National Mortgage Association; Public and Indian Housing; Chief Information Officer; Other support offices[B]. Source: GAO based on HUD data. [A] Other offices exist that directly report to the Office of the Secretary, such as the Office of Hearings and Appeals. [B] Other support offices include: Administration, Center for Faith- Based and Community Initiatives, Congressional and Intergovernmental Affairs, Departmental Equal Employment Opportunity, Departmental Operations and Coordination, Field Policy and Management, General Counsel, Healthy Homes and Lead Hazard Control, Inspector General, Policy Development and Research, and Public Affairs. [End of figure] HUD's fiscal year 2008 appropriation was about $37.6 billion, while its fiscal year 2009 appropriation is about $41.5 billion. HUD's budget request for fiscal year 2010 is about $46.3 billion. The department has approximately 8,500 employees in 81 field offices that are resident in all 50 states, the District of Columbia, and Puerto Rico. Recent Economic Recovery Legislation Has Increased HUD's Mission Responsibilities and Funding for IT Support: During the past year, legislation has been enacted to stimulate our nation's economy, in part through strengthening the housing market. Under this legislation, HUD was given new responsibilities and additional funding to help meet these new responsibilities. Specifically, the Housing and Economic Recovery Act of 2008[Footnote 5] established a program at FHA intended to help families avoid home foreclosure by refinancing them into FHA-insured mortgages. The act also authorized $25 million for each of fiscal years 2009 through 2013 for improvements to FHA's IT, among other things. In addition, the American Recovery and Reinvestment Act of 2009 provided roughly $11.6 billion to HUD across a range of programs, and authorized HUD to, depending on the program, use either up to 1/2 percent or up to 1 percent of the funds for IT and other administrative costs related to most of these programs. As such, the act recognizes that HUD's ability to effectively implement these programs depends in part on its simultaneous delivery of enhanced IT support. According to OCIO officials, of the approximately $61 million made available for IT under this act, about 2.5 percent or $1.5 million will be spent on the development of a new system[Footnote 6] supporting reporting requirements mandated by the act, while the remainder is planned to be used to maintain or enhance existing systems. HUD Relies Extensively on IT to Support Its Mission Operations and on OCIO to Provide This Support: IT plays a critical role in HUD's ability to carry out its missions, supporting data collection and dissemination throughout the department and to external partners. For instance, the department reports that its business areas rely on IT to process over 50,000 loan requests per week, over 12,000 service calls per month, and more than 7,000 grant requests annually for each of its major grant programs. Further, the department's increased responsibilities under the Housing and Economic Recovery Act of 2008 will introduce greater processing requirements for FHA loan applications and new budget reporting requirements, and thus further increase its reliance on IT. OCIO is responsible for supporting HUD programs, services, and management processes by providing high-quality IT solutions and services. To this end, OCIO has established four IT strategic goals: (1) rapidly modernizing IT to support key HUD business initiatives; (2) transforming the IT infrastructure to adapt to and adopt emerging technologies; (3) developing a cadre of highly capable IT professionals with mission critical competencies; and (4) providing secure, rapid, and reliable data and information to customers, citizens, and business partners. OCIO consists of the Chief Information Officer (CIO), two Deputy Chief Information Officers, and eight offices. These offices are responsible for systems integration and efficiency; policy and E-government; IT governance and investment; IT operations; enterprise architecture (EA); IT strategic planning and communication; administrative services; and IT security. (See figure 2 for an OCIO organizational chart depicting key positions; see table 1 for a summary of each office's roles and responsibilities.) Figure 2: HUD OCIO Organizational Chart: [Refer to PDF for image: organizational chart] HUD OCIO Organizational Chart: Top level: Chief Information Officer. Second level, reporting to the Chief Information Officer: General Deputy Chief Information Officer. Third level, reporting to the General Deputy Chief Information Officer: Deputy Chief Information Officer for Information Technology Operations. Fourth level, reporting to the Deputy Chief Information Officer for Information Technology Operations: Administrative Services; Strategic Planning; Information Security Office; Office of Systems Integration and Efficiency; Office of Investment Strategies, Policy, and Management; Office of IT Operations; Office of Enterprise Architecture; Office of IT Reform. Source: HUD. [End of figure] Table 1: HUD OCIO Offices and Their Roles and Responsibilities: Office: Office of Systems Integration and Efficiency; Roles and responsibilities: Advises the CIO on IT systems engineering and is the focal point for information systems modernization. Office: Office of Investment Strategies, Policy, and Management; Roles and responsibilities: Advises the CIO on IT policy and management, including compliance with IT related legislation, such as the Clinger-Cohen Act of 1996, and is the focal point with the Office of Management and Budget concerning the department's IT policies. Office: Office of IT Reform; Roles and responsibilities: Advises the CIO on all aspects of IT reform including the IT investment strategy and capital planning program and provides leadership to departmentwide governance boards on IT investment matters. Office: Office of IT Operations; Roles and responsibilities: Delivers technical assistance and overall support for initiatives and daily operations including maintaining and monitoring IT infrastructure. Office: Office of Enterprise Architecture; Roles and responsibilities: Informs, guides, and governs the business and IT strategic decisions for the enterprise. Office: Strategic Planning; Roles and responsibilities: Designs, develops, and manages the IT strategic planning process and short-term to long-term guidance on development of IT strategy. Office: Administrative Services; Roles and responsibilities: Provides basic resource management in the areas of personnel, training, budget, travel, space, and other essential resource-related needs of the OCIO workforce. Office: Information Security Office; Roles and responsibilities: Develops and implements security and privacy programs, policies, and procedures to ensure the security, reliability, and accessibility of information and IT resources. Source: GAO analysis of HUD data. [End of table] Overview of the Department's IT Environment: HUD's current IT environment does not effectively support its ongoing business operations. According to the department's recent operating plans and budget submissions to Congress, its information systems are overlapping and duplicative, are not integrated, necessitate manual workloads, and employ antiquated technologies that are costly to maintain. More specifically: * It consists of over 200 information systems, many of which perform the same functions and thus are duplicative. For example, it has at least 16 financial management systems that it plans to consolidate. * It consists of stove-piped, nonintegrated systems. For example, multiple systems support grants management and cannot share related data. * It provides insufficient support for key business processes, such as grants management, thus necessitating reliance on manual processing. Specifically, four of its offices perform most of their own grants management operations manually, about $7 billion in annual low-income, housing, project-based contracts are renewed using a paper intensive process, and about $16 billion per year is managed using a spreadsheet application. * It consists of antiquated and complex systems that are costly to maintain. For example, HUD relies on several different operating systems and 35 different programming languages, each of which requires specialized skills to operate and maintain. In addition, a 2007 study of HUD's IT environment found that the average age of its information systems was nearly 15 years, which is more than twice that of other agencies (6 years). Summary of HUD's Recent IT Funding: HUD funds its IT operations through its working capital fund (WCF). [Footnote 7] The WCF is funded through both direct appropriations and program transfers from HUD mission-focused programs. As illustrated in figure 3, the majority of WCF funding has consistently been through direct appropriations, although funding from program transfers has increased steadily. As also illustrated, until fiscal year 2009, the level of total IT funding had declined. Figure 3: WCF Direct Appropriations and Program Transfers for Fiscal Years 2005-2009: [Refer to PDF for image: stacked vertical bar graph] Fiscal year: 2005; Direct appropriations: $270 million; Program Transfers: $61 million. Fiscal year: 2006; Direct appropriations: $197 million; Program Transfers: $67 million. Fiscal year: 2007; Direct appropriations: $197 million; Program Transfers: $67 million. Fiscal year: 2008; Direct appropriations: $155 million; Program Transfers: $79 million. Fiscal year: 2009; Direct appropriations: $224 million; Program Transfers: $121 million. Source: GAO analysis of HUD appropriations. [End of figure] Funding for HUD's IT environment can be split into two categories: maintenance and development. Maintenance of its existing IT environment includes application operations support for approximately 200 existing systems; infrastructure costs for shared IT services across the department and regional locations, such as hardware support, disaster recovery, and facilities management; and salaries and indirect expenses for 255 full-time equivalent OCIO positions, as well as certain staff who provide management support to IT services from the Office of the Chief Procurement Officer and the Office of the Chief Financial Officer. Development includes modernizing systems to better support HUD's mission and business priorities. As illustrated in figure 4, the percentage of funds obligated for new development (i.e., modernization) has consistently been a small percentage of total IT obligations, particularly in fiscal year 2008 when only about 2 percent of IT obligations was for development. Figure 4: Percentage of WCF Obligations for Fiscal Year 2005-2008 Going Toward Maintenance of Existing IT Versus Development of New IT: [Refer to PDF for image: stacked vertical bar graph] Fiscal year: 2005; Maintenance: $89 million; Development: $11 million. Fiscal year: 2006; Maintenance: $87 million; Development: $13 million. Fiscal year: 2007; Maintenance: $85 million; Development: $15 million. Fiscal year: 2008; Maintenance: $98 million; Development: $2 million. [End of figure] HUD's fiscal year 2010 budget request provides for increases in IT funding under what it refers to as its "Transformation Initiative." This initiative consists of four related components, one of which focuses on modernizing IT systems in order to decrease HUD's reliance on its legacy environment. According to the budget request, the initiative's funding is to be 1 percent of HUD's total budget, or approximately $434 million. HUD officials stated that the potential exists for as much as one-half of this amount (or about $217 million) to be used for modernization of its IT systems. Effective Maintenance and Modernization of IT Depends on Institutionalizing Key IT Management Controls: A federal agency's ability to effectively and efficiently maintain and modernize its existing IT environment depends in large part on how well it employs certain IT management controls that are embodied in statutory requirements, federal guidance, and best practices. Among other things, these controls include strategic planning and performance measurement, portfolio-based investment management, human capital management, enterprise architecture (and supporting segment architecture) development and use, and establishing responsibility and accountability for modernization management. The purpose of each of these controls is as follows: * Strategic planning and performance measurement are intended to ensure that an organization's IT strategic goals are aligned with its overall mission goals and outcomes and that these IT goals are supported by clearly defined (1) activities aimed at accomplishing the goals and (2) measures for determining performance in accomplishing these activities and goals. These principles are reinforced through statutory requirements.[Footnote 8] By establishing such activities and measures and then monitoring actual-versus-expected performance, an organization can better understand progress, and thus the need for corrective action, in achieving its IT strategic goals. * Investment management is aimed at selecting, controlling, and evaluating investments in IT in a manner that better ensures that they produce business value, reduce investment-related risks, and increase accountability and transparency in the investment decision-making process. In 2004, we issued a framework for assessing federal agencies' investment management practices[Footnote 9] that consists of five progressive stages of maturity, with Stage 1 representing immature and undisciplined investment management structures and processes, and Stage 5 representing optimized maturity focused on continuous improvement. Stage 3--our focus in this report--is where an organization moves from project-centric to portfolio-based investment processes. Through a portfolio-based approach, the organization can consider new investment proposals, along with previously funded investments, and identify the appropriate mix and synergies of these investments to best meet mission needs, technology needs, and priorities for improvement. Organizations that have implemented Stage 3 practices have capabilities in place that assist in the establishment of selection, control, and evaluation structures, policies, procedures, and practices that are consistent with the investment management provisions of the Clinger-Cohen Act. [Footnote 10] * Human capital management is intended to ensure that an organization has the employees with the appropriate knowledge and skills to effectively execute critical IT functions. It involves assessing IT workforce needs, inventorying existing staff's knowledge and skills and identifying any gaps between needs and existing capabilities, and developing strategies and plans to fill any gaps. * EA development and use is aimed at establishing a corporate blueprint for investing that connects strategic plans with individual programs and system solutions. As such, this blueprint provides the information details needed to guide and constrain investments in a consistent, coordinated, and integrated fashion--thereby improving interoperability, reducing duplicative efforts, and optimizing mission operations. In brief, an EA includes descriptions of an organization's current or "as is" environment and its target or "to be" environment. The architecture also includes a transition or sequencing plan, which is based on an analysis of the gaps between the "as is" and "to be" environments. In 2003, we issued a framework for assessing and improving an organization's EA management that includes five stages of maturity for developing, maintaining, and implementing an architecture. [Footnote 11] One approach to providing the EA information details needed to adequately inform, and thus guide and direct, program and system solution implementations is to divide the architecture into segments and to develop more detailed architectures for each segment. As such, segment architectures can be used to provide a bridge between the corporate frame of reference captured in the EA and each individual program and system investment. The Office of Management and Budget (OMB) has issued guidance related to segment architectures.[Footnote 12] As part of its guidance, agencies are to group their segments into three categories: core mission areas (e.g., single-family housing), business services (e.g., financial management), and enterprise services (e.g., records management). * Effective modernization management includes having clearly defined and assigned responsibilities. This often involves a modernization program office that is accountable for planning, evaluating, executing, and tracking an enterprise's modernization efforts. Key IT Management and Modernization Controls Have Not Been Fully Established: The department has, to varying degrees, established certain key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. HUD officials are aware of the need to strengthen each of these controls, but they stated that a combination of turnover in OCIO senior leaders and a pre-2009 decline in IT resources constrained their efforts to do so. Because these controls are critical to managing an organization's existing IT environment and to modernizing it, and given HUD's recent and planned increases in modernization-related activities, it is important for the department to fully establish each control. Until it does, the performance of HUD's existing IT environment, as well as its efforts to modernize this environment, will be at risk. HUD Has Stopped Assessing Performance in Meeting Its IT Strategic Goals, and Its Most Recent Assessment Showed Performance Shortfalls: Effective IT strategic planning and performance measurement can help an organization effectively and efficiently leverage IT in meeting mission goals and achieving performance outcomes. To this end, executive agencies are to establish goals for improving the efficiency and effectiveness of their operations through the effective use of IT, [Footnote 13] annually submit to Congress a report on their progress in achieving these goals,[Footnote 14] and establish and apply performance measures to determine how well IT supports their programs.[Footnote 15] In addition, HUD guidance[Footnote 16] emphasizes the importance of regularly assessing progress in implementing its IT strategic plan and provides for quarterly and annual CIO reporting on progress against its strategic goals. To its credit, HUD established goals and performance measures, as required. Specifically, it developed an IT strategic plan in January 2006 that defines four strategic goals that are intended to improve IT's contribution to program productivity, efficiency, and effectiveness. These goals are to (1) rapidly modernize IT to support key HUD business initiatives; (2) transform the IT infrastructure to adapt to and adopt emerging technologies; (3) develop a cadre of highly capable IT professionals with mission critical competencies; and (4) provide secure, rapid, and reliable data and information to customers, citizens, and business partners. In addition, the plan identifies a range of activities necessary to achieve each of these goals. For example, to transform the IT infrastructure to adapt to and adopt emerging technologies, HUD intends to increase the reuse of its components, improve program management, identify infrastructure requirements, and perform customer training for new technologies. The plan also includes performance measures for each strategic goal, which according to HUD, are to serve as indicators of the extent to which the IT goals are being met and how well IT is supporting the department's mission. For example, for this same strategic goal, two of its performance measures are "100 percent of contract actions are completed on time" and "infrastructure collaborates with 100 percent of program areas/project managers and developers to ensure project plans and architectures are agreed upon." However, HUD did not assess and report on performance against its four IT strategic goals in fiscal year 2008, as required.[Footnote 17] Moreover, while HUD assessed and reported on its IT performance in fiscal year 2007, this assessment showed that it was either behind schedule or not making progress in 46 percent of the activities it defined as needed to achieve its IT strategic goals. At the same time, the basis for those assessments is not clear. For example, for its strategic goal to develop a cadre of highly capable IT professionals with mission critical competencies, HUD only reported that it was "not progressing in establishing a team to support customer service management," and thus did not relate the specific status of this activity to measurable commitments. In addition, the fiscal year 2007 assessment did not address how well IT supports the department's mission outcomes, and it did not measure performance against any of the indicators in the IT strategic plan. OCIO officials attributed the agency's performance measurement weaknesses to, among other things, turnover in OCIO senior leaders. According to these officials, efforts are under way to redefine HUD's process for measuring the performance and progress of IT operations, and this new process is to be implemented by the end of fiscal year 2010. In the meantime, HUD reports that it has commenced efforts to assess performance during fiscal year 2009. However, no plan exists that defines how performance in fiscal year 2009 will be assessed or how this new process is to be developed and implemented, including a schedule of activities and resource needs. Until HUD regularly assesses and reports progress against its strategic IT performance measures and activities, it will not be in compliance with a statutory requirement and will not know how well it is achieving its IT strategic goals and where it needs to improve. Thus, its ability to effectively and efficiently support HUD mission operations may be impaired. Policies and Procedures for Developing Investment Portfolios Are Largely Established, but Key Policies and Practices to Effectively Control Them Have Not Been Implemented: If managed effectively, IT investments can have a dramatic impact on an organization's performance and accountability. If mismanaged, they can result in wasteful spending and lost opportunities for achieving mission goals and improving mission performance. According to our Information Technology Investment Management (ITIM) framework,[Footnote 18] an organization that has reached Stage 3 of maturity manages projects as a portfolio of investments, treating them as integrated packages of competing investment options and thereby pursuing those that best meet the organization's strategic goals and mission. Managing IT investments as portfolios also allows an organization to make more informed decisions about which projects to begin funding and continue funding based on analyses of the relative organizational value and risks of all projects, including those that are proposed, under development, and in operation. Our prior work has shown that the absence of a portfolio-based approach to IT investment management can contribute to duplication in programs and equipment that do not operate effectively together.[Footnote 19] Stage 3 maturity involves implementation of four critical processes: (1) defining the portfolio criteria; (2) creating the portfolio; (3) evaluating (i.e., controlling) the portfolio; and (4) conducting postimplementation reviews. Table 2 summarizes the purpose of each of these processes. To effectively manage a portfolio of investments, an organization should establish policies and procedures to address each of these critical processes, as well as the key practices needed to evaluate its portfolio. Table 2: Stage 3 Critical Processes--Developing a Complete Investment Portfolio: Critical process: Defining the portfolio criteria; Purpose: To ensure that the organization develops and maintains IT portfolio selection criteria that support its mission, organizational strategies, and business priorities. Critical process: Creating the portfolio; Purpose: To ensure that IT investments are analyzed according to the organization's portfolio selection criteria and to ensure that an optimal IT investment portfolio with manageable risks and returns is selected and funded. Critical process: Evaluating the portfolio; Purpose: To review the performance of the organization's investment portfolio(s) at agreed-upon intervals and to adjust the allocation of resources among investments as necessary. Critical process: Conducting postimplementation reviews; Purpose: To compare the results of recently implemented investments with the expectations that were set for them and to develop a set of lessons learned from these reviews. Source: GAO. [End of table] To HUD's credit, it has established the range of necessary policies and procedures needed to execute three of the four critical processes associated with developing a complete investment portfolio--defining the portfolio, creating the portfolio, and conducting postimplementation reviews. However, it has not established policies and procedures and is not executing five of the six key practices needed to satisfy the fourth--evaluating the portfolio. * For defining portfolio criteria, HUD's ITIM process guide identifies an annual time frame and responsibilities for creating and modifying investment selection criteria. Specifically, the OCIO is to develop proposed criteria, the Technology Investment Board Working Group (TIBWG) is responsible for reviewing and commenting on the criteria, and the Technology Investment Board Executive Committee (TIBEC) approves the final criteria. The process guide also states that the criteria are to reflect HUD strategies, modernization goals, and OMB exhibit 300 criteria.[Footnote 20] * For creating the portfolio, the TIBWG is to annually analyze and compare IT projects to be included in the portfolio using, among other things, IT portfolio selection criteria, funding requests, and departmental priorities identified by the TIBEC. The group's recommendations for the portfolio, including recommended project priorities, are to be provided to the TIBEC for an approval decision. This decision is to be guided by HUD's policy that identifies a series of questions, such as "Does the portfolio reflect HUD's strategic priorities?" and "Have potential funding constraints been considered?" To maintain the portfolio, HUD's guidance states that, as a result of ongoing control reviews, recommendations can be made to the TIBEC to maintain or adjust the IT portfolio, including the cancellation of a project. * For conducting postimplementation reviews, HUD has developed detailed guidance. For example, these reviews are to be conducted within 6 to 18 months after the implementation of a project to validate actual investment results and extract lessons learned for ITIM process improvement. These reviews are to be conducted by designated teams that are selected annually by ITIM staff using identified criteria and represent a cross section of representatives from various disciplines, such as EA and IT operations. The guide also provides a step-by-step process for conducting the reviews, as well as detailed evaluation criteria to be applied to help formulate findings. The results of this review process are to be provided to the reviewed project's sponsors, managers, and other stakeholders, and a summary of the results is to be provided to the TIBWG. * For evaluating the portfolio, HUD does not have policies and procedures for reviewing, evaluating, and improving the performance of its portfolio. Specifically, while the TIBEC charter establishes that it is responsible for conducting regular reviews to assess and improve the performance of HUD's investment portfolio, policies and procedures that address this responsibility have not been established. (See table 3 for a summary of our analysis relative to HUD's policies and procedures for each Stage 3 critical process.) Table 3: Summary of Policies and Procedures for Stage 3 Critical Processes--Developing a Complete Investment Portfolio: Critical process: Defining the portfolio criteria; Key practice: The organization has documented policies and procedures for creating and modifying IT portfolio selection criteria; Rating: Executed; Summary of evidence: HUD's ITIM guide identifies an annual process for creating and modifying portfolio selection criteria based on HUD strategies, modernization goals, and OMB exhibit 300 criteria. Critical process: Creating the portfolio; Key practice: The organization has documented policies and procedures for analyzing, selecting, and maintaining the investment portfolio(s); Rating: Executed; Summary of evidence: HUD has policies and procedures for the annual creation of its portfolio. This includes an application of the portfolio selection criteria by the TIBWG and final approval by the TIBEC. Critical process: Evaluating the portfolio; Key practice: The organization has documented policies and procedures for reviewing, evaluating, and improving the performance of the portfolio(s); Rating: Not Executed; Summary of evidence: HUD does not have policies and procedures for reviewing, evaluating, and improving the performance of its portfolio. Critical process: Conducting postimplementation reviews; Key practice: The organization has documented policies and procedures for conducting postimplementation reviews; Rating: Executed; Summary of evidence: HUD has developed a postimplementation review guide that provides specific details for conducting these reviews. This includes a step-by-step process for conducing postimplementation reviews, as well as detailed evaluation criteria to be applied to help formulate findings. Source: GAO analysis of HUD practices. [End of table] Moreover, the department is not executing five of the six additional key practices associated with evaluating its portfolio. Specifically, the department does not evaluate performance of its overall investment portfolio on a continuing basis and has not established criteria for assessing overall portfolio performance. (See table 4 for a summary of our analysis of the practices related to the evaluating the portfolio critical process, with the exception of the establishment of policies and procedures, which is addressed in table 3.) Table 4: Summary of Key Practices for Evaluating the Portfolio (Stage 3 Critical Process): Type of practice: Prerequisite; Key practice: Adequate resources, including people, funding, and tools have been provided for reviewing the investment portfolio and its projects; Rating: Not executed; Summary of evidence: According to HUD, a lack of funding has limited its ability to create portfolio evaluation criteria. Type of practice: Prerequisite; Key practice: Board members are familiar with the process for evaluating and improving the portfolio's performance; Rating: Type of practice: Not executed; Summary of evidence: Type of practice: HUD does not evaluate the performance of its overall portfolio. As a result, this practice cannot be executed. Type of practice: Prerequisite; Key practice: Results of relevant oversight reviews of individual investments are provided to the investment board; Rating: Type of practice: Executed; Summary of evidence: Type of practice: HUD conducts several individual investment reviews, the results of which are provided to its investment boards. This includes monthly reports on cost and schedule variances, detailed project reviews on select investments, and an annual strategic portfolio review. Type of practice: Prerequisite; Key practice: Criteria for assessing portfolio performance are developed, reviewed, and modified at regular intervals to reflect current performance expectations; Rating: Not executed; Summary of evidence: HUD does not have criteria for assessing portfolio performance. As a result, this practice cannot be executed. Type of practice: Activities; Key practice: IT portfolio performance measurement data are defined and collected consistent with portfolio performance criteria; Rating: Not executed; Summary of evidence: HUD does not have criteria for assessing portfolio performance. As a result, this practice cannot be executed. Type of practice: Activities; Key practice: Adjustments to the IT investment portfolio are executed in response to actual portfolio performance; Rating: Not executed; Summary of evidence: HUD does not evaluate the performance of its overall portfolio. As a result, this practice cannot be executed. Source: GAO analysis of HUD practices. [End of table] The OCIO's Director of ITIM attributed these portfolio management weaknesses to limitations in resources. The Director of ITIM also stated that the department recognizes the need to improve IT portfolio investment management, adding that a plan will be developed within the next 12 months to address the key practice weaknesses that we identified. Without having defined and implemented practices for evaluating the performance of its IT investment portfolios, HUD will be limited in its ability to control the risks and achieve the benefits associated with the mix of legacy system and modernization investments that it selects. HUD Is Not Adequately Managing Its IT Human Capital: Effective human capital management requires a strategic and proactive approach to meeting current and future human capital needs. By employing such an approach, organizations can be better positioned to have the people with the right knowledge, skills, and abilities to support mission operations both today and in the future. The success or failure of federal programs depends, in large part, on having the right number of people with the right mix of knowledge and skills. Since 2001, we have designated the strategic management of human capital as a governmentwide high-risk area.[Footnote 21] We have previously reported on principles for strategic workforce planning,[Footnote 22] which outline guidance for human capital management. Strategic workforce planning involves (1) determining the critical skills and competencies needed to achieve current and future program results, (2) analyzing the gaps between current skills and future needs, and (3) developing strategies for filling gaps. If performed effectively, these activities can collectively create a strategic and proactive approach to human capital management. OCIO has not adequately performed most of these activities: * The office assessed its needed IT workforce skills and competencies (requirements) in fiscal year 2008, based on interviews with most, but not all, OCIO managers. * The office performed an analysis of the gaps between its IT workforce requirements and skills (inventory) in fiscal year 2008 using an outdated inventory of human capital skills, thus rendering the identified gaps unreliable. Specifically, OCIO's IT workforce skills inventory was based on a 2006 governmentwide survey conducted by the Office of Personnel Management and the Federal Chief Information Officer's Council.[Footnote 23] However, this inventory only covered about 48 percent of HUD's IT workforce. Moreover, since then, HUD has reduced its IT workforce by about 26 percent, and this reduction, according to the Acting CIO, mostly affected persons with specialized skills who operate and maintain existing systems and are difficult to replace. According to OCIO officials, they plan to conduct an inventory of IT workforce skills, as well as to participate in a follow-up to the 2006 governmentwide survey that is to begin in early 2010. However, they did not have a plan or time frame for completing their own inventory. * The office developed a strategy for closing the gaps, including steps, activities, and related milestones. However, the strategy is based on the aforementioned unreliable gap analysis, and it has yet to be implemented. OCIO officials did not know when implementation of this strategy would begin or be completed. Aspects of this strategy not yet implemented include developing and implementing performance metrics for gauging HUD's IT project management capability by December 2008 and a training plan for building its IT investment management capability by January 2009. OCIO officials cited various reasons for these weaknesses in its IT human capital management, including the expense of conducting an inventory of current IT workforce skills and limitations in resources available to implement its strategy for closing its human capital gaps. Without effective IT human capital management, it is unlikely that HUD will have the people it needs to effectively operate and maintain existing systems and to deliver modernized systems, thus impairing its ability to provide the department's mission operations with effective and efficient IT support. HUD Has Yet to Develop Sufficient Architectural Context to Guide and Manage Modernization Projects: A key aspect of HUD's approach to modernizing its IT environment is to extend its EA to include what are referred to as segment architectures, which are to provide the modernization details needed to develop and implement system solutions for portions, or segments, of a department or agency. Such a "divide and conquer" approach to modernizing is advocated by OMB. To this end, HUD has established a departmentwide EA that largely satisfies relevant federal guidance, and it has identified and prioritized 37 segments, as provided for in federal guidance. However, it has only developed architectures for 8 of its segments, and not all of these 8 are its highest priority segments. Moreover, the majority of the segment architectures developed thus far are out of date and do not fully address key aspects of federal guidance, such as provisions for performance goals and measurement. At the same time, HUD is investing in modernization projects in at least 3 of these segments in fiscal year 2009. Unless HUD develops well-defined segment architectures to guide and constrain modernization projects, it risks investing time and resources in systems that do not reflect department priorities, are not well integrated, are potentially duplicative, and do not optimally support mission operations and performance. The Department's EA Management Program Largely Satisfies Relevant Guidance: In August 2006,[Footnote 24] we reported that HUD had largely established an EA program but was nevertheless missing two key aspects. Since then, HUD has taken steps to address these aspects and additional steps are planned. As noted earlier, our EA Management Maturity Framework[Footnote 25] provides a five-stage approach to managing the development, maintenance, and implementation of an architecture and understanding the extent to which effective architecture management practices are being performed and where an organization is progressing toward having a well-managed architecture program. In short, the framework consists of 31 core elements that relate to architecture governance, content, use, and measurement. These elements reflect research by us and others showing that architecture programs should be founded upon institutional architecture commitment and capabilities, and on measured and verified products and results. Satisfying the framework's core elements helps organizations reduce the risk of investing in IT assets that are duplicative, are not well-integrated, and do not optimally support mission operations. To HUD's credit, it had satisfied the vast majority of the core elements described in our framework as of August 2006, as the following examples illustrate: * HUD established a committee or group representing the enterprise and responsible for directing, overseeing, and approving the EA, and thereby demonstrating the organization's commitment to obtaining buy-in for the EA from across the organization, and providing vested ownership and accountability for the EA and its use as a transformational tool at the most senior levels of the organization. * The department developed EA plans that called for describing the enterprise in terms of business, performance, information/data, application/service, technology, and security. Having such descriptions is consistent with recognized frameworks governing EA content, including OMB's EA "reference models." In short, these models collectively provide for defining an enterprise's operations in both business terms (e.g., business processes, business rules, information needs and flows, shared business services, and work locations and users) as well as technical terms (e.g., hardware, software, data, and security attributes and standards). * It measured and reported on the quality of its EA products, which is important for informing senior leadership about EA progress and thus providing a means for timely and appropriate actions to address deviations from established goals. * It established the EA as an integral part of the IT investment management process, thus ensuring that the organization approves those investments that move it toward the target architecture, as defined in the sequencing plan. * It developed the EA using a framework, methodology, and automated tool, thereby helping to ensure that its architecture was developed according to a defined structure and nomenclature, as well as explicit and consistent steps, and that the architecture is captured in a repository that is accessible and can be updated. Nevertheless, we also reported that HUD had not addressed two important elements. First, HUD had yet to adequately incorporate information security into its EA. Since that time, HUD issued an Enterprise Security Architecture in April 2007 that provides a target conceptual framework for information protection. For example, it contains the architecture's goals and objectives and generally (1) discusses security drivers (e.g., external threats such as hackers and cyber terrorists); (2) describes security governance (e.g., roles and responsibilities of key players with references to HUD security policy, standards, and guidelines); (3) identifies the purpose of the HUD security concept of operations, planning, and risk management, noting that each is resident in other HUD procedural and process guidance; and (4) describes a target security environment (e.g., types of security services and the security impact levels for categories of data). In addition, HUD's Enterprise Security Architecture states that segment architectures are to be the primary means of implementing its security architecture, and thus the details surrounding how target concepts will be implemented and achieved will be specified in these segment architectures. Of the 8 HUD segment architectures developed to date, each of which are discussed later in this report, only its single- family housing segment architecture addresses information security, while the others do not. According to HUD's Director of EA, security will be addressed in the remaining segment architectures, as new ones are developed and existing ones are updated. However, no schedule exists defining when this will occur. Adequately incorporating security into the EA and related segment architectures is important because security is an integral aspect of an architecture's performance, business, information/data, application/service, and technical models, and needs to be reflected thoroughly and consistently across each of them to ensure that new and existing investments meet the department's information assurance needs. Second, we also reported that HUD had yet to submit its EA products and management processes to independent verification and validation. Since that time, HUD developed an independent verification and validation plan, and a HUD OCIO organization has reviewed three EA products, including the Enterprise Security Architecture document. However, OCIO officials told us independent verification and validation activities were discontinued in 2007 because of resource limitations. As a result, HUD continues to lack important information about the quality of its architecture products and management processes that are needed to have a mature EA program. HUD Has Begun to Extend Its EA by Identifying and Prioritizing Modernization Segments: HUD is approaching its business modernization efforts through the development of segment architectures, which can be viewed as subsets of an EA or a bridge between the EA and IT investments. According to OMB guidance,[Footnote 26] agencies should (1) define enterprise segments as components of their EA planning activities and (2) prioritize segments by focusing first on those that will help the agency perform its mission most effectively. Further, it identifies three segment types: core mission areas, business services (e.g., financial management), and enterprise services (e.g., information sharing). It also states that agencies (1) must have a structured process to determine high-priority segments that is based on such factors as statutory requirements, the agency's strategic plan and its IT strategic plan, impact on mission performance, and cost efficiency opportunities and (2) should initiate development of architectures for high-priority segments after the CIO has approved segment priorities. HUD's 2005 EA transition plan, which was approved by the TIBEC, identifies, classifies, and prioritizes 37 segments. According to the plan, the priorities were based on the following considerations: business transformation impact, financial impact, impact on execution of other high-priority transition activities, resource availability, opportunities for early success, and the ability to leverage work in progress. Further, the priorities were determined using a scale of 1 to 5, with 5 as the highest priority. (See table 5 for these priorities and appendix II for descriptions of each segment.) Table 5: Summary of HUD's Segments: Type of segment: Core Mission Area; Segment: Single-family housing; Priority score: 3.7. Type of segment: Core Mission Area; Segment: Multifamily housing finance; Priority score: 2.9. Type of segment: Core Mission Area; Segment: Rental housing assistance; Priority score: 2.9. Type of segment: Core Mission Area; Segment: Community and economic development; Priority score: 2.9. Type of segment: Core Mission Area; Segment: Fair housing; Priority score: 2.5. Type of segment: Core Mission Area; Segment: Secondary mortgage market; Priority score: 2.1. Type of segment: Business Service; Segment: Financial management; Priority score: 4.6. Type of segment: Business Service; Segment: Controls and oversight; Priority score: 4.4. Type of segment: Business Service; Segment: Human resources management; Priority score: 3.7. Type of segment: Business Service; Segment: Grants management; Priority score: 3.6. Type of segment: Business Service; Segment: Enforcement; Priority score: 3.6. Type of segment: Business Service; Segment: Loan insurance; Priority score: 3.5. Type of segment: Business Service; Segment: Planning and resource allocation; Priority score: 2.9. Type of segment: Business Service; Segment: Information and technology management; Priority score: 2.9. Type of segment: Business Service; Segment: Acquisition management; Priority score: 2.5. Type of segment: Business Service; Segment: Internal risk management and mitigation; Priority score: 2.1. Type of segment: Business Service; Segment: Public affairs; Priority score: 2.1. Type of segment: Business Service; Segment: Administrative management; Priority score: 2.1. Type of segment: Business Service; Segment: Subsidies management; Priority score: 2.1. Type of segment: Business Service; Segment: Loan guarantees; Priority score: 2.0. Type of segment: Business Service; Segment: Direct loans; Priority score: 1.5. Type of segment: Business Service; Segment: Market research and analysis; Priority score: 1.0. Type of segment: Business Service; Segment: Regulatory development; Priority score: 1.0. Type of segment: Business Service; Segment: Legislative relations; Priority score: 1.0. Type of segment: Business Service; Segment: Revenue collection; Priority score: 1.0. Type of segment: Enterprise Service; Segment: Tracking and workflow; Priority score: 4.4. Type of segment: Enterprise Service; Segment: Integrated enterprise data management; Priority score: 4.0. Type of segment: Enterprise Service; Segment: Identity management; Priority score: 4.0. Type of segment: Enterprise Service; Segment: Portal; Priority score: 3.8. Type of segment: Enterprise Service; Segment: Electronic document and records management; Priority score: 3.8. Type of segment: Enterprise Service; Segment: Business partner management; Priority score: 3.8. Type of segment: Enterprise Service; Segment: Knowledge management/collaboration; Priority score: 3.6. Type of segment: Enterprise Service; Segment: Reporting; Priority score: 3.5. Type of segment: Enterprise Service; Segment: Asset management; Priority score: 3.3. Type of segment: Enterprise Service; Segment: Survey; Priority score: 2.9. Type of segment: Enterprise Service; Segment: Decision support/business intelligence; Priority score: 2.6. Type of segment: Enterprise Service; Segment: Geospatial data management and analysis; Priority score: 1.9. Source: GAO analysis of HUD data. [End of table] Segment Architectures Have Not Been Developed According to Established Priorities: To date, HUD has developed 8 segment architectures. However, the 8 segments are not the department's 8 highest priorities (see table 6). Specifically, HUD has developed an architecture for its highest priority segment, financial management, but its next 4 highest segment priorities (controls and oversight, tracking and workflow, integrated enterprise data management, and identity management), each with priority scores of 4.0 or above, do not yet have architectures. Moreover, HUD has developed architectures for only 4 of the next 10 highest priority segments, each with scores between 3.5 and 4. At the same time, it has developed architectures for 3 segments with priority scores of less than 3. Table 6: Status of HUD Segment Architectures: Segment: Financial management; Reported maturity of segment[A]: Completed; Priority score: 4.6. Segment: Controls and oversight; Reported maturity of segment[A]: Notional[B]; Priority score: 4.4. Segment: Tracking and workflow; Reported maturity of segment[A]: Notional; Priority score: 4.4. Segment: Integrated enterprise data management; Reported maturity of segment[A]: Notional; Priority score: 4.0. Segment: Identity management; Reported maturity of segment[A]: Notional; Priority score: 4.0. Segment: Portal; Reported maturity of segment[A]: Notional; Priority score: 3.8. Segment: Electronic document and records management; Reported maturity of segment[A]: Completed; Priority score: 3.8. Segment: Business partner management; Reported maturity of segment[A]: Notional; Priority score: 3.8. Segment: Single-family housing; Reported maturity of segment[A]: Completed; Priority score: 3.7. Segment: Human resources management; Reported maturity of segment[A]: Completed; Priority score: 3.7. Segment: Grants management; Reported maturity of segment[A]: Completed; Priority score: 3.6. Segment: Enforcement; Reported maturity of segment[A]: Notional; Priority score: 3.6. Segment: Knowledge management/collaboration; Reported maturity of segment[A]: Notional; Priority score: 3.6. Segment: Loan insurance; Reported maturity of segment[A]: Notional; Priority score: 3.5. Segment: Reporting; Reported maturity of segment[A]: Notional; Priority score: 3.5. Segment: Asset management; Reported maturity of segment[A]: Notional; Priority score: 3.3. Segment: Multifamily housing finance; Reported maturity of segment[A]: Completed; Priority score: 2.9. Segment: Rental housing assistance; Reported maturity of segment[A]: Completed; Priority score: 2.9. Segment: Community and economic development; Reported maturity of segment[A]: Notional; Priority score: 2.9. Segment: Planning and resource allocation; Reported maturity of segment[A]: Notional; Priority score: 2.9. Segment: Information and technology management; Reported maturity of segment[A]: Planned; Priority score: 2.9. Segment: Survey; Reported maturity of segment[A]: Notional; Priority score: 2.9. Segment: Decision support/business intelligence; Reported maturity of segment[A]: Notional; Priority score: 2.6. Segment: Acquisition management; Reported maturity of segment[A]: Completed; Priority score: 2.5. Segment: Fair housing; Reported maturity of segment[A]: Notional; Priority score: 2.5. Segment: Secondary mortgage market; Reported maturity of segment[A]: Notional; Priority score: 2.1. Segment: Internal risk management and mitigation; Reported maturity of segment[A]: Notional; Priority score: 2.1. Segment: Public affairs; Reported maturity of segment[A]: Notional; Priority score: 2.1. Segment: Administrative management; Reported maturity of segment[A]: Notional; Priority score: 2.1. Segment: Subsidies management; Reported maturity of segment[A]: Notional; Priority score: 2.1. Segment: Loan guarantees; Reported maturity of segment[A]: Notional; Priority score: 2.0. Segment: Geospatial data management and analysis; Reported maturity of segment[A]: Notional; Priority score: 1.9. Segment: Direct loans; Reported maturity of segment[A]: Notional; Priority score: 1.5. Segment: Market research and analysis; Reported maturity of segment[A]: Notional; Priority score: 1.0. Segment: Regulatory development; Reported maturity of segment[A]: Notional; Priority score: 1.0. Segment: Legislative relations; Reported maturity of segment[A]: Notional; Priority score: 1.0. Segment: Revenue collection; Reported maturity of segment[A]: Notional; Priority score: 1.0. Source: GAO analysis of HUD documentation. [A] OMB guidance on agency submission of segment architecture information, Enterprise Architecture Segment Report Instruction Guide, Version 1.1, February 2009, defines four segment maturity levels: completed, in-progress, planned, or notional. [B] Notional indicates that only a conceptual view of the segment exists and that development of the segment is currently not planned. [End of table] OCIO's Director of EA stated that because IT funding has not been available to develop segment architectures according to the established priorities, HUD's development of segment architectures has been driven by whether individual business units make funds available for their respective segments. For example, even though acquisition management ranks as 24th out of 37 in priority, it is one of the eight developed architectures because the Office of the Chief Procurement Officer provided funding for its development. According to the Director of EA, HUD is currently developing a structured methodology for prioritizing segments, and once this process is approved by the TIBWG and TIBEC, the department will begin implementing it. Until the department begins developing segment architectures in accordance with defined priorities, it will increase the risk of investing limited IT resources in a manner that does not reflect the department's priorities. Segment Architectures Have Not Been Developed According to Key Aspects of Federal Guidance: The development and maintenance of the eight segment architectures do not reflect key aspects of relevant federal guidance. According to relevant guidance,[Footnote 27] a segment architecture is to be developed and maintained by an integrated project team (IPT) that consists of key stakeholders, such as a program manager, business subject matter experts, and enterprise architects. In this regard, the guidance states that this team is critical to successful segment architecture development and should be involved in each step of development process and responsible for making decisions relative to defining business and technology requirements and achieving these requirements. In addition to requiring an IPT, this guidance also specifies the following key activities relative to analyzing and developing each segment architecture:[Footnote 28] * Prioritized opportunities--The IPT is to consider current change drivers, such as key strategic, legislative, and management requirements, to identify and prioritize opportunities to achieve performance improvements within the context of the current operating environment. These prioritized opportunities are to be used to define the scope of the segment architecture and help the IPT make informed decisions about the potential reuse of common or shared business processes, data, and services. * Performance goals--The IPT is to establish performance goals that include target measures and time frames for achieving them. The performance goals are to provide the basis for developing the performance layer of the target segment architecture, and they are to be reconciled with the agency EA and agency strategic plan to ensure consistency. They are also to be used to determine the segment performance gaps that need to be closed. * Target architecture--The IPT is to develop a target segment architecture that establishes the business, data, services, and technology architecture layers to support the performance layer of the architecture. The target architecture should, among other things, describe the systems that are required, including those to be consolidated. These targets are to be used by the IPT to develop the segment transition strategy. * Segment transition strategy--The IPT is to use the target segment architecture to define the specific projects needed to close identified performance gaps and achieve the target state. Among other things, the strategy is to include project priorities, project dependencies, and project sequencing. The IPT and the agency's Chief Architect are to jointly reconcile the segment architecture and transition strategy with the agency's EA to ensure consistency. The transition strategy is to be used to prepare project funding strategies and business cases. None of the eight segment architectures that HUD has developed incorporates all of these key activities, with only one (acquisition management) fully addressing most of the elements. The remaining seven segment architectures fully address no more than two elements and either partially address or did not address the others. (See table 7 for a summary of the extent to which the eight segment architectures reflect OMB guidance.) The extent to which the eight reflect each of the key activities is discussed in detail following the table. Table 7: Summary of Extent to Which HUD Segment Architectures Address OMB Guidance: Segment architecture: Acquisition management; Integrated project team: [A]; Prioritized opportunities: [A]; Performance goals: [B]; Target architecture: [A]; Segment transition strategy: [A]. Segment architecture: Electronic document and records management; Integrated project team: [A]; Prioritized opportunities: [C]; Performance goals: [B]; Target architecture: [B]; Segment transition strategy: [C]. Segment architecture: Financial management; Integrated project team: [A]; Prioritized opportunities: [B]; Performance goals: [Empty]; Target architecture: [B]; Segment transition strategy: [B]. Segment architecture: Grants management; Integrated project team: [A]; Prioritized opportunities: [B]; Performance goals: [Empty]; Target architecture: [B]; Segment transition strategy: [B]. Segment architecture: Human resources management; Integrated project team: [A]; Prioritized opportunities: [B]; Performance goals: [B]; Target architecture: [B]; Segment transition strategy: [C]. Segment architecture: Multifamily housing; Integrated project team: [A]; Prioritized opportunities: [B]; Performance goals: [C]; Target architecture: [B]; Segment transition strategy: [B]. Segment architecture: Rental housing assistance; Integrated project team: [A]; Prioritized opportunities: [C]; Performance goals: [B]; Target architecture: [C]; Segment transition strategy: [C]. Segment architecture: Single-family housing; Integrated project team: [A]; Prioritized opportunities: [C]; Performance goals: [C]; Target architecture: [A]; Segment transition strategy: [C]. [A] Segment architecture addresses this element of the OMB guidance. [B] Segment architecture addresses some, but not all aspects of this element of the OMB guidance. [C] Segment architecture does not address this element of the OMB guidance. Source: GAO analysis of HUD documentation. [End of table] * OCIO's Director of EA stated that all eight segment architectures were developed by IPTs. However, two of the segment architectures (financial management and human resources management) did not have charters or any other form of documentation demonstrating that key stakeholders were involved in developing the architectures. * One of the segment architectures (acquisition management) identifies and prioritizes opportunities for improvement, while four (financial management, grants management, human resources management, and multifamily housing) identify opportunities for improvement but do not prioritize these opportunities. The remaining three do not identify opportunities for improvement. * None of the segment architectures identify performance goals and time frames. While four (acquisition management, electronic records and documents management, human resources management, and rental: * housing assistance) have performance goals, none of the four include time frames to achieve these goals. The remaining four do not establish performance goals or time frames. * Two of the segment architectures (acquisition management and single- family housing) define their respective target states to be achieved, while five others (electronic records and documents management, financial management, grants management, human resources management, and multifamily housing) partially define these targets. For example, the grants management segment architecture identifies the systems required in the target environment but does not address any impact to existing systems. The rental housing assistance segment architecture does not define any aspects of its target architecture in support of the performance goals it identified. * One segment architecture (acquisition management) has a complete transition strategy, while three others (financial management, grants management, and multifamily housing) have partial strategies. For example, the financial management and grants management architectures identify, prioritize, and sequence projects, and the multifamily housing architecture identifies projects to be completed; however, none of the three identify dependencies among projects. The remaining four segment architectures do not identify any aspects of a transition strategy. The extent to which the majority of the eight segment architectures reflect relevant federal guidance is attributable to the fact that the architectures were developed prior to the issuance of federal guidance (only the acquisition management architecture was developed after this guidance was issued). Accordingly, in a June 2008 strategic portfolio review,[Footnote 29] HUD recognized the need to update the segment architectures to reflect relevant guidance.[Footnote 30] Moreover, this review recognized that seven of the eight segment architectures (all except acquisition management) were not current. For example, 4 of the segment architectures are 4 or more years old (see table 8). According to federal guidance,[Footnote 31] regular maintenance of segment architectures is important to ensuring that they reflect the current direction of the agency. Table 8: Developed Segment Architectures and Year Completed: Segment architecture: Rental housing assistance; Year completed: 2004. Segment architecture: Financial management; Year completed: 2005. Segment architecture: Human resources management; Year completed: 2005. Segment architecture: Single-family housing; Year completed: 2005. Segment architecture: Electronic document and records management; Year completed: 2006. Segment architecture: Grants management; Year completed: 2006. Segment architecture: Multifamily housing; Year completed: 2006. Segment architecture: Acquisition management; Year completed: 2008. Source: HUD. [End of table] The Director of EA said that, since June 2008, efforts have been initiated to update one of the segment architectures--human resources management. Specifically, the Director of EA said that an IPT is being formed and will begin to update this segment architecture this summer. However, the department did not have a plan to update the remaining segment architectures. The need to develop segment architectures that are complete and current is significant because HUD currently has three major investments under way in its financial management, rental housing assistance, and grants management segments. In fiscal year 2009, these investments total about $50 million in development as follows: * Financial management--Approximately $27 million is being used to develop a single core financial system that integrates the programmatic and financial information of four existing financial systems. * Rental housing assistance--Approximately $16 million is being used to develop a system for HUD's rental housing assistance program to support management of public housing assets. * Grants management--Approximately $7 million is being used to develop a system for HUD's grants programs to support the administration of grants and the automation of redundant processes. Until HUD's segment architectures are defined in accordance with applicable federal guidance and kept current, they will not provide a sufficient basis for guiding and directing segment projects in a manner to ensure that both system enhancements and new development efforts are, among other things, properly sequenced, well integrated, and not duplicative. HUD Has Yet to Assign Responsibility and Accountability for Modernization Management: Effective systems modernization requires a structured management approach, to include clearly defined and assigned responsibility and accountability for enterprisewide modernization management. Our experience in reviewing large-scale system modernization programs in other federal departments and agencies, such as the Internal Revenue Service[Footnote 32] and Department of Defense,[Footnote 33] shows that this often involves, among other things, establishing a modernization program management office. In addition, independent research recommends establishing a modernization management office before attempting an enterprisewide modernization effort.[Footnote 34] According to this research, this type of office brings structure and support to evaluating, justifying, defining, planning, tracking, and executing an IT modernization effort, and it facilitates interaction among senior leaders, program managers, and project managers. To HUD's credit, its EA transition plan identifies the need for an Enterprise Program Management Office (EPMO) to manage its modernization projects, calling this office a critical success factor to delivering modernized systems. Specifically, the plan states that the size and complexity of the department's modernization efforts will introduce a paradigm shift and that this office is a "foundational enabler" to these efforts and would, among other things, ensure that independent segments are pursued in an integrated manner. To date, the department has not established its EPMO and thus has not assigned responsibility and authority for management of its modernization efforts. While OCIO has identified a range of functions that this office would need to perform, such as establishing a systematic, standardized, repeatable process for management of IT projects across the enterprise, and included these responsibilities as a contract task in an existing contract awarded in August 2007, OCIO officials told us that this EPMO task was not executed due to funding constraints. These officials also stated that alternative contract solutions to meeting the department's EPMO needs will be examined. However, they did not have a plan defining how and when this would occur, stating that it is dependent on funding available in fiscal year 2010. Without an EPMO, HUD will be challenged in its ability to successfully deliver modernized systems. Conclusions: HUD's ability to effectively and efficiently perform mission-critical operations, including those integral to our nation's economic recovery and reinvestment activities, is constrained by its current IT environment. To overcome these limitations and maximize IT support to HUD programs, such as those that involve home mortgages and provide rental assistance, it is essential for the department to have the capability and capacity to manage both its existing IT environment and its ongoing and future IT modernization efforts. Currently, it does not, as evidenced by limitations in a number of core IT controls that are instrumental to managing both an organization's existing IT environment and its IT modernization efforts. In particular, HUD is not effectively measuring whether it is meeting its IT goals and, as a result, is not in compliance with a statutory requirement. HUD is also not adequately controlling its IT investment portfolios to ensure that they optimally deliver mission capabilities and value and is not taking key steps to ensure that it has an adequate workforce to both operate and maintain its existing systems and to deliver modernized systems. Moreover, it has not ensured that modernization projects are governed by well-defined segment architectures and that responsibility and accountability for enterprisewide modernization management has been assigned. To HUD's credit, it is aware of the need to improve many of these IT management controls, but its IT resources have in recent years been almost exclusively directed to sustaining its existing IT environment, and it has yet to develop specific plans for strengthening each of these management controls. Given the recent increase in modernization resources available this year and, with further increases envisioned for future years, it is important that building this capability and capacity be treated as a department priority. Until HUD establishes effective and mature structures, processes, practices, and tools for managing IT, it will be challenged in its ability to effectively modernize its IT environment and thus provide IT support to critical mission operations. Recommendations for Executive Action: To ensure that HUD has an IT environment that effectively and efficiently supports its mission operations, we recommend that the Secretary of Housing and Urban Development ensure that recent and anticipated increases in IT resources be allocated to strengthening each of the IT management controls discussed in this report. To these ends, we further recommend that the Secretary take the following five actions: 1. Direct the CIO to develop a plan for developing and implementing the department's new performance management framework, including an implementation schedule of key activities and related resource needs, and to ensure that this plan provides for complying with the statutory requirement for annual reporting of progress in achieving IT strategic goals. 2. Direct the Deputy Secretary, as the TIBEC chairperson, to develop and implement a plan to address the IT portfolio investment management weaknesses that we identified. This plan should address the following: a. instituting policies and procedures for reviewing, evaluating, and improving the performance of the department's portfolio of investments; b. establishing resources for reviewing the investment portfolio, including people, funding, and tools and ensuring board members are familiar with the process for evaluating and improving portfolio performance; c. developing criteria for assessing portfolio performance and reviewing and modifying them at regular intervals to reflect current performance expectations; d. defining and collecting IT portfolio performance measurement data consistent with the portfolio performance criteria; and: e. executing adjustments to the IT investment portfolio in response to actual portfolio performance. 3. Direct the CIO to establish and execute IT human capital gap closure strategies that are based on a complete and current inventory of its existing IT workforce skills. 4. Direct the Deputy Secretary, as the TIBEC chairperson, to: a. report to the Secretary on actions planned to address our prior EA recommendations on defining a security architecture and performing independent verification and validation, and: b. develop a plan for reexamining segment priorities and updating and developing segment architectures in accordance with these priorities and relevant guidance. 5. Direct the CIO to establish an enterprisewide program office with the responsibility and authority for managing the department's modernization efforts. Agency Comments and Our Evaluation: In written comments on a draft of our report signed by the Deputy Chief Information Officer, the department agreed with our recommendations, adding that it will dedicate resources to implementing each of them. In addition, it provided largely technical comments to clarify, correct, or update information in the report, which we have incorporated in the report as appropriate, and address more specifically in appendix III. However, it also offered a comment relative to our finding that HUD's segment architectures do not include performance goals, stating that such segment performance goals are updated each year in HUD's performance architecture, and major investment performance goals are provided in its annual budget submissions. We agree with this comment. However, the point of our finding is that the segment architectures themselves do not include performance goals and related time frames, as required by OMB guidance. As a result, we have not modified our report to reflect this comment. We are sending copies of this report to interested congressional committees; and the Secretary of Housing and Urban Development. The report also is available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your offices have questions on matters discussed in this report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Signed by: Randolph C. Hite: Director: Information Technology Architecture and Systems Issues: [End of section] Appendix I: Objective, Scope, and Methodology: Our objective was to determine if the Department of Housing and Urban Development (HUD) has adequately established institutional information technology (IT) management controls needed to manage and modernize its existing IT environment. To meet this objective, we focused on the following management controls: IT strategic planning and performance measurement; portfolio-based IT investment management; IT human capital management; architecture development and use; and responsibility and accountability for modernization management. * To evaluate HUD's IT strategic planning and performance measurement, we reviewed HUD's agencywide strategic plan and its IT strategic plans, its IT strategic implementation plan, and available assessments of its progress in achieving IT strategic goals. We also interviewed HUD officials including the Office of the Chief Information Officer's (OCIO) Strategic Planner. We assessed this information against provisions in the Clinger-Cohen Act[Footnote 35] and Paperwork Reduction Act[Footnote 36] related to defining IT strategic goals and plans, assessing progress toward achieving IT strategic goals, and measuring performance of IT operations. * To evaluate HUD's IT investment management (ITIM) practices associated with portfolio management, we used GAO's ITIM framework [Footnote 37] and assessed the extent to which HUD had established the policies and procedures needed to effectively manage its investments as a portfolio, as well as the key practices needed to control its portfolio (practices specific to the evaluating the portfolio critical process of Stage 3). To conduct our assessment, we reviewed relevant HUD policies, procedures, guidance, and documentation--including HUD's investment management guide, related process guides, such as its ITIM select guide, postimplementation review guide, investment board charters, budget documents, and project reviews and presentations. We also interviewed HUD's Director of ITIM and the Associate Deputy Chief Information Officer for Business and Information Technology Modernization. We then compared this information with the selected key practices in the ITIM framework to determine the extent to which the department was employing effective IT investment portfolio management practices. We rated ITIM key practices as "executed" on the basis of whether the agency demonstrated (by providing evidence of performance) that it had fully met the criteria of the key practice. A key practice was rated as "not executed" when we found insufficient evidence of a practice during the review or when we determined that there were significant weaknesses in HUD's execution of the key practices. We provided HUD an opportunity to produce evidence for the key practices that we rated as "not executed." * To evaluate HUD's IT human capital management, we reviewed IT human capital management plans and related documentation, such as a workforce needs assessment, gap analyses, and gap closure strategies. We also interviewed HUD officials, including the Office of CIO's Director of Administrative Services. We assessed this information against strategic workforce planning principles established in prior GAO work.[Footnote 38] * To evaluate HUD's enterprise architecture (EA) development and use, we relied on our previous report on HUD's EA,[Footnote 39] updating this report relative to two weaknesses that we reported--security in its EA and independent verification and validation of EA products and management processes. To do so, we reviewed HUD EA work products, including security and independent verification and validation plans and products. In addition, we reviewed EA transition plans, segment architectures, performance architecture, and segment architecture development guidance, and interviewed officials. We assessed this information against relevant criteria in federal guidance, such as the Office of Management and Budget's (OMB) Federal Enterprise Architecture Practice Guidance[Footnote 40] and its EA assessment framework, [Footnote 41] and best practices in GAO's EA Framework.[Footnote 42] Specific to segment architecture development, we assessed the extent to which HUD's segment architectures addressed elements of segment development guidance in OMB's Federal Enterprise Architecture Practice Guidance. Specifically, we determined the extent to which segment architectures addressed the element (addresses all aspects of the element); partially addressed the element (addresses some, but not all aspects of the element); or did not address the element (does not address any aspect of the element). * To evaluate HUD's modernization management office, we reviewed published reports[Footnote 43] and research on having such an office [Footnote 44] and HUD plans for establishing this office, including EA transition plans and an acquisition contract for program management support. We also interviewed the Associate Deputy CIO for Business and Information Technology Modernization, the Director of Enterprise Architecture, and the Director of Information Technology Systems Integration and Efficiency. We assessed this information to determine the extent to which HUD had established responsibility and accountability for modernization management. We conducted this performance audit from July 2008 to July 2009, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Descriptions of HUD Segment Architectures: Table 9 provides descriptions of segment architectures as identified by HUD. Table 9: Descriptions of HUD Segment Architectures: Type of segment: Core Mission Area; Segment: Single-family housing; Description: Provides mortgage insurance to lenders on loans for the development/purchase/refinancing of new or existing homes, condominiums, and manufactured housing; financing of houses needing rehabilitation; and for reverse mortgages to elderly homeowners. Type of segment: Core Mission Area; Segment: Multifamily housing finance; Description: Provides mortgage insurance to HUD-approved lenders to facilitate the construction, rehabilitation, purchase, and refinancing of multifamily housing properties and health care facilities. Type of segment: Core Mission Area; Segment: Rental housing assistance; Description: The processes, systems, and technologies that allow HUD to provide decent and affordable rental housing to low-income families, primarily through the use of grants and subsidies. Type of segment: Core Mission Area; Segment: Community and economic development; Description: Supports efforts by states, local communities, and other HUD partners for the construction and rehabilitation of homes, community structures and infrastructure, and other community revitalization and job creating projects. Type of segment: Core Mission Area; Segment: Fair housing; Description: Promotes, monitors, and enforces fair and equal housing opportunities, practices, and laws, respectively. In addition, it equips HUD with the capabilities to develop policies and introduce legislation that ensure equal access to housing. Type of segment: Core Mission Area; Segment: Secondary mortgage market; Description: Promotes homeownership by managing programs responsible for channeling funds from investors into the mortgage industry, thereby establishing a secondary mortgage market that creates an abundant supply of mortgage funds for potential homeowners. Type of segment: Business Service; Segment: Financial management; Description: Enables HUD to manage its financial control activities and the flow of financial information across its information systems. Type of segment: Business Service; Segment: Controls and oversight; Description: Type of segment: Allows HUD to maintain close oversight for the programs and funds for which it is responsible, including the performance management of its highly distributed business partners. Type of segment: Business Service; Segment: Human resources management; Description: Allows the management of human resources across HUD to ensure that HUD employees are used in the most effective manner possible. Type of segment: Business Service; Segment: Grants management; Description: Type of segment: The activities, processes, systems, and technologies that support the administration and management of grants programs to develop fair, safe, and affordable housing and to expand economic opportunity. Type of segment: Business Service; Segment: Enforcement; Description: Involves monitoring HUD partners, the general housing industry, and individuals subject to housing laws or regulations, and resolving issues through conciliation, arbitration, and enforcement. Type of segment: Business Service; Segment: Loan insurance; Description: Involves the provision of loan insurance for the financing of property improvement, manufactured housing, and community development projects. Type of segment: Business Service; Segment: Planning and resource allocation; Description: Enables HUD to determine its strategic direction, identify and establish its programs and processes, and allocate resources (capital and labor) among these programs and processes. Type of segment: Business Service; Segment: Information and technology management; Description: Enables HUD to properly orchestrate the information technology resources (i.e., hardware and infrastructure) and systems it requires to effectively provide its services and execute its mission. Type of segment: Business Service; Segment: Acquisition management; Description: Allows HUD to effectively manage the physical goods and contracted services it acquires in support of delivering its services and executing its programs. This includes the capability to manage the private sector contractors that perform much of its outsourced work. Type of segment: Business Service; Segment: Internal risk management and mitigation; Description: Permits HUD to analyze its exposure to risk and develop appropriate mitigation and countermeasure strategies. Type of segment: Business Service; Segment: Public affairs; Description: Enables HUD to effectively communicate with and exchange information between its stakeholders, business partners, citizens, and other government entities in direct support of its programs, services, and policies. Type of segment: Business Service; Segment: Administrative management; Description: Enables HUD to perform many of the back-office type activities that support the execution of its primary, mission-critical business operations. Type of segment: Business Service; Segment: Subsidies management; Description: Encompasses the activities associated with the provision of vouchers and other types of subsidies to individuals and public housing bodies in support of rental assistance, housing modernization, and home ownership. Type of segment: Business Service; Segment: Loan guarantees; Description: Encompasses activities to provide liquidity to the secondary mortgage market by attracting capital from the nation's capital markets to residential mortgage markets. Type of segment: Business Service; Segment: Direct loans; Description: Type of segment: Activities associated with HUD lending funds directly to nongovernmental entities for affordable housing, home ownership, and community development activities. Type of segment: Business Service; Segment: Market research and analysis; Description: Type of segment: Allows HUD to perform the research and analysis of housing markets, industry trends, community needs, demographics, legislation, policies, programs, and the economy. Type of segment: Business Service; Segment: Regulatory development; Description: Type of segment: Allows HUD to perform activities associated with developing regulations, policies, and guidance to implement laws. Type of segment: Business Service; Segment: Legislative relations; Description: Enables HUD to perform activities aimed at the development, tracking, and amendment of public laws by effectively communicating and managing its relationship with Congress. Type of segment: Business Service; Segment: Revenue collection; Description: Provides HUD with capabilities to acquire, monitor, track, and sell its housing properties (e.g., land, multifamily buildings, and single-family homes) to nongovernmental entities. Type of segment: Enterprise Service; Segment: Tracking and workflow; Description: Defines the set of capabilities for automatic monitoring and routing of documents to the users responsible for working on them to support each step of the business cycle. Type of segment: Enterprise Service; Segment: Integrated enterprise data management; Description: Type of segment: Defines the set of capabilities that support the usage, processing, and general administration of unstructured information. Type of segment: Enterprise Service; Segment: Identity management; Description: Includes capabilities that support obtaining information about those parties attempting to log on to a system or application for security purposes and includes validation of those users. Type of segment: Enterprise Service; Segment: Portal; Description: Type of segment: Allows HUD's business partners, citizens, and internal users the ability to conveniently and efficiently interact with HUD via a single electronic interface. Type of segment: Enterprise Service; Segment: Electronic document and records management; Description: Enables HUD to effectively manage all of its documents and records in a consistent, legal, and logical manner, from creation to final disposition, using a common set of tools, standards and policies. Type of segment: Enterprise Service; Segment: Business partner management; Description: Enables HUD to effectively manage and control its communications and information about internal/external customers and clients and vendors and further provide holistic coordination with its program participants (e.g., business partners). Type of segment: Enterprise Service; Segment: Knowledge management/collaboration; Description: Type of segment: Defines the set of capabilities that support the identification, gathering, and transformation of documents, reports, and other sources into meaningful information. Type of segment: Enterprise Service; Segment: Reporting; Description: Type of segment: Defines the set of capabilities that support the organization of data into useful information. Type of segment: Enterprise Service; Segment: Asset management; Description: Type of segment: Defines the set of capabilities that support the acquisition, oversight, and tracking of an organization's assets. Type of segment: Enterprise Service; Segment: Survey; Description: The set of capabilities that are used to collect useful information from an organization's customers. Type of segment: Enterprise Service; Segment: Decision support/business intelligence; Description: Defines the set of capabilities that support the analysis of information and predicts the impact of decisions before they are made. Type of segment: Enterprise Service; Segment: Geospatial data management and analysis; Description: Integrates geospatial and geographic information services with data management and analytical capabilities to provide users with the ability to capture, view, and analyze programmatic information based on location and associated characteristics. Source: GAO analysis of HUD documentation. [End of table] [End of section] Appendix III: Comments from the Department of Housing and Urban Development: Note: GAO comments supplementing those in the report text appear at the end of this appendix. U.S. Department Of Housing And Urban Development: Chief Information Officer: Washington, D.C. 20410-3000: [hyperlink, http://www.hud.gov] July 22, 2009: Mr. James R. Sweetman, Jr. Assistant Director: Information Technology: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Mr. Sweetman: Thank you for the opportunity to comment on the Government Accountability Office (GAO) draft report entitled, Information Technology: HUD Needs to Strengthen its Capacity to Manage and Modernize its Environment (GAO-09-675). The Department of Housing and Urban Development reviewed the draft report and concurs with the recommendations for Executive Actions. I note GAO's acknowledgement that the Department has established key IT management and modernization controls needed to ensure that the IT environment maintains mission-critical operations and that HUD's efforts to modernize have been successful. However, HUD provides the following comments to address sections in the draft report found to be inaccurate or ambiguous. I invite your attention to strengthening these sections: Page 7 - states that, "According to OCIO officials, of the approximately $61 million made available for IT under this act, about $13 million will be spent on the development of a new system supporting reporting requirements mandated by the act, while the remainder is planned to be used to maintain or enhance existing systems. " This statement is inaccurate. HUD is developing one new system to support the American Recovery and Reinvestment Act (ARRA). The funding amount for that system, the Recovery Act Management and Performance System (RAMPS), is $1.5 million. The $61 million ARRA Administrative/IT set- aside is spread among several HUD program areas, including the Office of the Chief Information Officer (OCIO). [See comment 1] Page 9 -The HUD OCIO Organizational Chart (Figure 2) is out-of-date. The current OCIO Organizational Chart is enclosed. [See comment 2] Page 10 - The Overview of the Department's IT Environment leads with the assertion that "HUD's current IT environment is not sufficient to support its ongoing business operations," this assertion is attributed to "the Department's own reports." Please clarify what report(s) contain this claim. Only one general citation is provided at the end of the section. The referenced report is a Gartner Consulting report, 1T Application Support and Strategic Sourcing Review: Baseline Total Cost of Ownership and Benchmark, March 2007. Gartner's report recognizes the challenges HUD faces, including system and business process complexity and the unclear alignment with key business processes. However, Gartner's report does not claim that HUD's IT environment cannot support business operations. [See comment 3] Page 18 - 2nd paragraph. Comment: As a point of clarification, HUD's OCIO has begun the process of assessing performance in a more robust way with the development of the Performance Architecture within the Enterprise Architecture (EA) modernization plan. HUD began this activity in Fiscal Year (FY) 2009. [See comment 4] Page 24 - second bullet: A point of clarification - OCIO officials plan to conduct their own inventory of IT workforce skills analysis and intend to participate in a follow-up governmentwide IT workforce inventory effort. This governmentwide survey is scheduled to begin in early 2010. [See comment 5] Page 25 - bottom paragraph, Comment: Performance goals and measurements are identified in the Performance Architecture that HUD updates annually for segments and/or major investments. Additionally, through the OMB 300 process, all of HUD's major investments identify and update performance goals and measurements annually. [See comment 6] Page 35 - 2nd bullet, Comment: This paragraph is inaccurate. HUD updates all of its performance goals and time frames, annually, in the Performance Architecture and in the OMB 300 process. [See comment 7] The Department remains committed to strengthening existing IT management and modernization controls through its policies and procedures. To this end, we will dedicate resources toward achieving the five Executive Actions recommended by GAO. More definitive information with timelines will he provided once the final report has been issued. If you have any questions or require additional information, please contact Jerry E. Williams. Chief Information Officer, at 202-708-0306. Sincerely, Lynn Allen: Deputy, Chief Information Officer: The following are GAO's comments on the Department of Housing and Urban Development dated July 22, 2009. GAO Comments: 1. We revised our report to reflect this comment. 2. We revised our report to reflect HUD's current OCIO organizational structure. 3. We clarified our report by explicitly identifying the HUD reports that cite the limitations in HUD's IT environment. 4. We clarified our report to reflect this comment. 5. We clarified our report to reflect this comment. 6. We agree that performance goals are identified in HUD's performance architecture relative to segments and are included in budget submissions to OMB for HUD's major investments. However, our point is that the performance goals and related time frames are not included in the segment architectures. According to federal guidance, the establishment of performance goals and time frames for achieving these goals is to occur during the development of a segment architecture, and thereby provide the basis for the goals in the performance architecture and budget submissions. Therefore, we have not modified our report in response to this comment. 7. See comment 6. [End of section] Appendix IV: GAO Contact and Staff Acknowledgments: GAO Contact: Randolph C. Hite, (202) 512-3439, hiter@gao.gov: Staff Acknowledgments: In addition to the individual named above, key contributions were made to this report by James Sweetman, Assistant Director; Jamey Collins; Eric Costello; Kristin English; Michael Holland; Lowell Labaro; Anh Le; Lee McCracken; Sabine Paul; and Glenn Spiegel. [End of section] Footnotes: [1] Title II of Div. K of the Consolidated Appropriations Act, 2008, Pub. L. No. 110-161. [2] Title VIII of the Civil Rights Act of 1968 (Fair Housing Act), as amended, prohibits discrimination in the sale, rental, and financing of dwellings, and in other housing-related transactions, based on race, color, national origin, religion, sex, familial status (including children under the age of 18 living with parents or legal custodians, pregnant women, and people securing custody of children under the age of 18), and handicap (disability). [3] Title VI of the Civil Rights Act of 1964 prohibits discrimination on the basis of race, color, or national origin in programs and activities receiving federal financial assistance. [4] Under the U. S. Housing Act of 1937, as amended, Congress created the federal public housing program to provide decent and safe rental housing for eligible low-income families, the elderly, and persons with disabilities. [5] Pub. L. No. 110-289, Sec. 2126. [6] This system is known as the Recovery Act Management and Performance System (RAMPS). It is to allow HUD to transmit to the American Recovery and Reinvestment Act Web site [hyperlink, http://www.recovery.gov] information related to HUD projects that are funded by the act. [7] 42 U.S.C. § 3535(f) establishes the working capital fund at HUD. [8] 40 U.S.C. §§ 11313(1), (2), and (3). See also 44 U.S.C. § 3506(b)(3)(C). [9] GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington, D.C.: March 2004). [10] 40 U.S.C. §§ 11312-11313. [11] GAO, Information Technology: A Framework for Assessing and Improving Enterprise Architecture Management (Version 1.1), [hyperlink, http://www.gao.gov/products/GAO-03-584G] (Washington, D.C.: April 2003). [12] OMB, Federal Enterprise Architecture Practice Guidance (November 2007); OMB, Improving Agency Performance Using Information and Information Technology (Enterprise Architecture Assessment Framework v3.0) (December 2008); and Federal Segment Architecture Working Group and OMB, Federal Segment Architecture Methodology (January 2009). [13] 40 U.S.C. § 11313(1). See also 44 U.S.C. § 3506(b)(3)(C). [14] 40 U.S.C. § 11313(2). [15] 40 U.S.C. § 11313(3). See also 44 U.S.C. § 3506(b)(3)(C). [16] HUD, Information Technology Strategic Planning Process Guide (Apr. 26, 2005). [17] 40 U.S.C. § 11313. [18] [hyperlink, http://www.gao.gov/products/GAO-04-394G]. [19] GAO, Best Practices: An Integrated Portfolio Management Approach to Weapon System Investments Could Improve DOD's Acquisition Outcomes, [hyperlink, http://www.gao.gov/products/GAO-07-388] (Washington, D.C.: Mar. 30, 2007). [20] The exhibit 300, also known as the Capital Asset Plan and Business Case, is an OMB budget submission intended to, among other things, demonstrate that a given IT investment is employing good project management, is architecturally aligned, and is economically justified. [21] GAO, High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-01-263] (Washington, D.C.: January 2001). [22] GAO, Human Capital: Key Principles for Effective Strategic Workforce Planning, [hyperlink, http://www.gao.gov/products/GAO-04-39] (Washington, D.C.: Dec. 11, 2003). [23] The results of this survey are published by the Office of Personal Management and the Federal Chief Information Officer's Council in the Federal IT Workforce Survey (2006) Data Analysis Report: Information for Human Capital Planning. [24] GAO, Enterprise Architecture: Leadership Remains Key to Establishing and Leveraging Architectures for Organizational Transformation, [hyperlink, http://www.gao.gov/products/GAO-06-831] (Washington, D.C.: Aug. 14, 2006). [25] [hyperlink, http://www.gao.gov/products/GAO-03-584G]. [26] OMB, Improving Agency Performance Using Information and Information Technology (Enterprise Architecture Assessment Framework 3.0) (December 2008); OMB, Federal Enterprise Architecture Practice Guidance (November 2007). [27] OMB, Federal Enterprise Architecture Practice Guidance (November 2007). [28] OMB's guidance provides key activities relative to the following four major steps (1) architecture analysis, (2) architecture definition, (3) investment and funding strategy, and (4) program management and execution. [29] This review focuses on the extent to which major IT investments align with HUD's target architecture. [30] In October 2007, HUD updated its Business and IT Modernization Plan Development Guidance, which addresses the activities called for in federal guidance. [31] CIO Council, A Practical Guide to Federal Enterprise Architecture (February 2001). [32] GAO, Tax Systems Modernization: Results of Review of IRS' March 7, 2000 Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-175] (Washington, D.C.: May 24, 2000). [33] GAO, Defense Management: Foundational Steps Being Taken to Manage DOD Business Systems Modernization, but Much Remains to be Accomplished to Effect True Business Transformation, [hyperlink, http://www.gao.gov/products/GAO-06-234T] (Washington, D.C.: Nov. 9, 2005). [34] Organize to Modernize: The Roles Project Management Offices Can Play in IT Modernization, [hyperlink, http://www.gartner.com/], ID Number: G00157601 (May 23, 2008). [35] 40 U.S.C. §§ 11313(1), (2), and (3). [36] 44 U.S.C. § 3506(b)(3)(C). [37] [hyperlink, http://www.gao.gov/products/GAO-04-394G]. [38] [hyperlink, http://www.gao.gov/products/GAO-04-39]. [39] [hyperlink, http://www.gao.gov/products/GAO-06-831]. [40] OMB, Federal Enterprise Architecture Practice Guidance (November 2007). [41] OMB, Improving Agency Performance Using Information and Information Technology (Enterprise Architecture Assessment Framework v3.0) (December 2008). [42] GAO, Information Technology: A Framework for Assessing and Improving Enterprise Architecture Management (Version 1.1), [hyperlink, http://www.gao.gov/products/GAO-03-584G] (Washington, D.C.: Apr. 1, 2003). [43] GAO, Defense Management: Foundational Steps Being Taken to Manage DOD Business Systems Modernization, but Much Remains to be Accomplished to Effect True Business Transformation, [hyperlink, http://www.gao.gov/products/GAO-06-234T] (Washington, D.C.: Nov. 9, 2005); Tax Systems Modernization: Results of Review of IRS' March 7, 2000 Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-175] (Washington, D.C.: May 24, 2000). [44] Gartner Group,Organize to Modernize: The Roles Project Management Offices Can Play in IT Modernization, [hyperlink, http://www.gartner.com/], ID Number: G00157601 (May 23, 2008). [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: