This is the accessible text file for GAO report number GAO-11-72 entitled 'Information Technology: HUD Needs to Better Define Commitments and Disclose Risks for Modernization Projects in Future Expenditure Plans' which was released on November 23, 2010. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to Congressional Committees: November 2010: Information Technology: HUD Needs to Better Define Commitments and Disclose Risks for Modernization Projects in Future Expenditure Plans: Information Technology: GAO-11-72: GAO Highlights: Highlights of GAO-11-72, a report to congressional committees. Why GAO Did This Study: Information technology (IT) is critical to the Department of Housing and Urban Development’s (HUD) ability to carry out its home ownership and community development mission. By statutory mandate, HUD is to develop and submit to Congress an expenditure plan for its efforts to modernize the department’s IT environment that satisfies certain conditions, including being reviewed by GAO. GAO’s objectives were to determine the extent to which (1) HUD’s expenditure plan meets statutory conditions and (2) HUD has in place key institutional IT modernization management capabilities. To accomplish this, GAO assessed the plan against the statutory conditions and assessed department documentation of efforts to institutionalize IT modernization management capabilities against open GAO recommendations. What GAO Found: The extent to which the fiscal year 2010 HUD expenditure plan met statutory conditions placed on the use of appropriated funds varied by IT modernization project. Specifically, the plan varied in the degree to which it described capabilities, expected mission benefits, estimated lifecycle costs, and key milestones for each of its eight modernization projects. Overall, however, it did not adequately satisfy all elements of the first of two conditions. For example, the plan described the expected mission benefits for three projects, but did not present specific and measurable benefits for the other five. Moreover, the plan, in combination with project management documentation, did not satisfy the second statutory condition that each project demonstrate that it is compliant with HUD’s enterprise architecture, being managed in accordance with applicable lifecycle management policies, subject to HUD’s capital planning and control requirements, and supported by an adequately staffed project office. Specifically, neither of the two projects assessed by GAO fully satisfied more than one of the elements of this condition. Officials attributed limitations in the plan’s scope and content to the department ’s interpretation of the statutory requirements, as well as the unavailability of certain project documentation, and they stated that more detailed information would be included in future plans. Nevertheless, the plan is limited as a congressional oversight and decision-making mechanism. HUD has a range of actions under way to address GAO’s prior recommendations and to evolve and strengthen its IT modernization management capabilities. However, it has yet to institutionalize these controls. Officials attributed the state of its controls largely to the fact that its new IT leadership team had only recently been established, and it is still in the process of introducing management improvements. Specifically, HUD: * is redefining its enterprise architecture around core business functions, which is consistent with its modernization plans. However, the development of this new version has yet to commence, and HUD has not established a date for when it will be available. * has developed a conceptual construct for a new investment and lifecycle management framework, but is still developing the policies and process guidance needed to understand and consistently implement it. * is developing an approach to controlling investment portfolios and expects to begin implementing this approach by October 2010. * has begun developing a strategic IT human capital management plan, but it has not yet defined skill gap closure strategies and established milestones for completing and implementing the plan. The absence of institutionalized controls introduces risk to the success of HUD’s modernization projects, and to the extent that future plans provide for expanded investment in the existing eight projects and additional ones, the risks associated with HUD’s modernization efforts will increase. What GAO Recommends: GAO is recommending that HUD ensure that future expenditure plans (1) fully satisfy all statutory conditions or disclose why any condition is not satisfied, along with any associated project risks and mitigation plans; and (2) describe the status of HUD’s efforts to institutionalize key modernization management controls. GAO is also recommending that the number and scope of HUD’s IT projects reflect the department’s institutional capacity to manage them. In written comments on a draft of this report, HUD concurred with GAO’s recommendations. View [hyperlink, http://www.gao.gov/products/GAO-11-72] or key components. For more information, contact Randolph C. Hite at (202) 512-3439 or hiter@gao.gov. [End of section] Contents: Letter: Conclusions: Recommendations for Executive Action: Agency Comments: Appendix I: Briefing for Staff Members of the Subcommittees on Transportation, Housing and Urban Development, and Related Agencies, Senate and House Committees on Appropriations: Appendix II: Comments from the Department of Housing and Urban Development: Appendix III: GAO Contact and Staff Acknowledgments: Abbreviations: CIO: chief information officer: EA: enterprise architecture: FHA: Federal Housing Administration: HUD: Department of Housing and Urban Development: IT: information technology: NGVMS: Next Generation Voucher Management System: OCIO: Office of the Chief Information Officer: [End of section] November 23, 2010: The Honorable Patty Murray: Chair: The Honorable Christopher Bond: Ranking Member: Subcommittee on Transportation, Housing and Urban Development, and Related Agencies: Committee on Appropriations: United States Senate: The Honorable John W. Olver: Chairman: The Honorable Tom Latham: Ranking Member: Subcommittee on Transportation, Housing and Urban Development, and Related Agencies: Committee on Appropriations: House of Representatives: The Department of Housing and Urban Development (HUD) submitted to Congress on April 26, 2010, the first of a planned series of incremental expenditure plans for information technology (IT) modernization pursuant to the provisions in the Consolidated Appropriations Act, 2010.[Footnote 1] IT plays a critical role in HUD's ability to carry out its home ownership and community development mission. For instance, the department reports that its business areas rely on IT to process over 50,000 loan requests per week, over 12,000 service calls per month, and more than 7,000 grant requests annually for each of its grant programs. Despite this role, HUD's current IT environment does not effectively support its ongoing business operations. As we recently reported,[Footnote 2] its information systems are overlapping and duplicative, are not integrated, necessitate manual workloads, and employ antiquated technologies that are costly to maintain. HUD is currently working to address these issues and stated that its incremental IT expenditure plans will allow the department to develop a strategy and operating plan for enterprise transformation while beginning targeted new projects and existing system modifications that are needed to respond to pressing mission needs and statutory mandates. As required by the appropriations act, we reviewed HUD's first incremental fiscal year 2010 expenditure plan. We also reviewed the department's capacity for IT modernization management. Our objectives were to determine the extent to which (1) HUD's expenditure plan meets statutory conditions[Footnote 3] and (2) HUD has in place key institutional IT modernization management capabilities. On August 24, 2010, we provided the results of our review, including our findings, conclusions, and recommendations, in a written briefing to the staffs of the Senate and House Appropriations Subcommittees on Transportation, Housing and Urban Development, and Related Agencies, and we met with them on September 16, 2010, to discuss the briefing. This letter summarizes and transmits the written briefing, which is reprinted in appendix I. We performed this performance audit from March 2010 to November 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Details on our scope and methodology are in the briefing, which is reprinted in appendix I. In summary, we made the following major points: * The extent to which HUD has satisfied the statutory conditions placed on its expenditure plan varies by modernization project, but overall the plan is limited as a congressional oversight and decision- making mechanism. Specifically: - According to the statute, the plan is to identify functional and performance capabilities, expected mission benefits, estimated lifecycle costs, and key milestones for all IT modernization projects [Footnote 4] covered in the plan. However, the plan does not adequately satisfy all elements of the statutory condition for all projects. The HUD Deputy Chief Information Officer (CIO) attributed these limitations in the information provided by the plan to the department's interpretation and understanding of the project-level information needed to satisfy the conditions of the appropriations act. The Deputy CIO further stated, and we confirmed, that additional detailed capability, benefit, cost, and milestone information on several projects exists. According to the CIO, HUD intends to include this more detailed information in future plans. - According to the statute, the plan is to demonstrate that each IT modernization project is, among other things, being managed in accordance with applicable lifecycle management policies and guidance, subject to HUD's capital planning and investment control requirements, and supported by an adequately staffed project office. However, the plan, in combination with project management documentation, does not fully satisfy this statutory condition. Specifically, neither of the two projects[Footnote 5] that we assessed fully satisfied more than one of the condition's elements. This can be attributed to the fact that HUD has yet to institutionalize each of the IT management controls that are needed to meet this condition (as discussed below). In the interim, HUD officials have employed compensatory measures to minimize projects' exposure to risk, but neither the risks nor the compensating measures are addressed in the expenditure plan. * HUD has yet to institutionalize key IT modernization management capabilities. We previously reported that an organization's ability to effectively modernize its IT environment greatly depends on the extent to which it has established and implemented a number of institutional management controls or capabilities, including enterprise architecture development and use, systems lifecycle management, IT investment management, and IT human capital management.[Footnote 6] In July 2009, we reported[Footnote 7] that HUD had to varying degrees established many of these controls but that none had been fully defined and implemented. Accordingly, we made recommendations aimed at defining and implementing them. HUD's actions to evolve and strengthen each of these controls and implement our recommendations are discussed below: - Enterprise architecture: We previously reported that HUD's prior version of its architecture had identified segments aligned with HUD business units (e.g., single-family housing) and that only a few segment architectures had been developed. Since then, HUD has moved to defining its enterprise architecture around cross-department business functions, and intends to develop a new version of its architecture. However, development of this new version has yet to commence, although related efforts are under way that should help to inform this new version. HUD has to yet to establish when a new version of its enterprise architecture will be available. - Systems lifecycle management: Thus far, HUD has developed the conceptual construct for a new integrated investment and lifecycle management framework, but the policies and process guidance needed to understand and consistently implement it are under development. HUD reports that this framework will be defined to the point that projects can consistently implement it by October 2010. - IT investment management: We previously reported that while HUD had defined and implemented IT investment management policies and procedures to support the selection of investment portfolios, it had yet to define and implement policies and procedures to control the execution of these portfolios of investments. Since then, HUD reports that while it is working to define and implement portfolio-based investment control policies and procedures, it does not expect to begin implementing them until October 2010. - IT human capital: We previously reported that HUD had analyzed gaps in its IT workforce but that this analysis was based on an incomplete and outdated skills inventory. Since then, HUD has begun to develop a strategic IT human capital plan, which includes an updated assessment of knowledge and skills of current staff, but it has yet to define skill gap closure strategies. Further, it has not established milestones for completing and implementing this plan. HUD officials attribute the state of the department's institutional controls largely to the fact that the new HUD IT leadership team has only recently been put in place, and it is still in the process of introducing IT modernization management improvements. Conclusions: HUD has fallen short of the statutorily-mandated conditions placed on its fiscal year 2010 IT modernization expenditure plan. As a result, the utility of HUD's first incremental plan as an oversight, decision- making, and accountability tool is limited. Until HUD can submit an expenditure plan that satisfies the statutory conditions, as well as discloses the risks associated with each project and plans for mitigating them, its House and Senate Appropriations Subcommittees will not have the information that they need to oversee HUD's modernization projects and hold the department accountable for project results. Beyond the plan, and notwithstanding HUD's efforts to date to establish key IT modernization management capabilities, much remains to be accomplished before these capabilities can be considered sufficiently institutionalized to reasonably ensure that each modernization project is successfully completed. While HUD's new IT leadership team has made important progress in developing these capabilities, the extent to which future expenditure plans provide for expanded investment in the eight modernization projects covered in the first plan, while also proposing investment in additional projects, will increase the risks associated with HUD's near-term modernization efforts. As a result, it is important for HUD to balance the number of projects in the plan, and the extent to which they are allowed to proceed beyond definition and early design, with its institutional capacity to execute them. Recommendations for Executive Action: To increase the usability and value of HUD's next expenditure plan to its House and Senate Appropriations Subcommittees, we recommend that the Secretary of HUD direct the CIO to ensure that future plans satisfy each element of each statutory condition for each project in the plan, or disclose why any element is not satisfied, along with any associated project risks and plans for addressing those risks. Furthermore, we recommend that the Secretary direct the CIO to ensure that future plans clearly describe the status of HUD's efforts to establish and implement each of these modernization management controls, along with the project-specific risks and mitigation plans associated with this status. In addition, we recommend that the Secretary ensure that the number and scope of HUD's modernization projects are commensurate with the department's institutional capacity to execute them. Agency Comments: In written comments on a draft of this report, signed by the CIO, and reprinted in appendix II, HUD concurred with our recommendations and stated that the agency comments section of the transmitted briefing adequately represented HUD's position and that the appropriate clarifications and comments regarding HUD's compensating controls had been incorporated into the report. Moreover, HUD commented that it remained committed to establishing the key IT management and modernization controls needed to ensure that its IT environment supports mission-critical operations. We are sending copies of this report to the Chairs and Ranking Members of other Senate and House committees and subcommittees that have authorization and oversight responsibilities for HUD IT modernization. We are also sending copies to the Secretary of HUD and the Director of the Office of Management and Budget. Copies of this report will also be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you or your staffs have any questions on matters discussed in this report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who have made significant contributions to this report are listed in appendix III. Signed by: Randolph C. Hite: Director, Information Technology Architecture and Systems Issues: [End of section] Appendix I: Briefing for Staff Members of the Subcommittees on Transportation, Housing and Urban Development, and Related Agencies, Senate and House Committees on Appropriations: Information Technology: HUD Needs to Better Define Commitments and Disclose Risks for Modernization Projects in Future Expenditure Plans: Briefing for staff members of the Subcommittees on Transportation, Housing and Urban Development, and Related Agencies Senate and House Committees on Appropriations: August 24, 2010: Contents: Introduction; Scope and Methodology; Results in Brief; Background; Results; Conclusions; Recommendations for Executive Action; Agency Comments and Our Evaluation; Attachment 1: Objectives, Scope, and Methodology. Introduction: Information technology (IT) plays a critical role in the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission. For instance, the department reports that its business areas rely on IT to process over 50,000 loan requests per week, over 12,000 service calls per month, and more than 7,000 grant requests annually for each of its major grant programs. Despite this role, HUD's current IT environment does not effectively support its ongoing business operations. As we recently reported, [Footnote 8] its information systems are overlapping and duplicative, are not integrated, necessitate manual workloads, and employ antiquated technologies that are costly to maintain. HUD is currently working to address these issues through its Transformation Initiative. This initiative consists of four related components, one of which focuses on modernizing the department's IT environment. For fiscal year 2010, the department intends to invest $138 million in its modernization efforts, which is about one-half of the total expected Transformation Initiative funding for the fiscal year ($258 million). The Consolidated Appropriations Act, 2010,[Footnote 9] states that HUD may not obligate more than 25 percent of the funds made available for IT modernization until the Senate and House Committees on Appropriations receive a plan for expenditure that meets the following sets of statutory conditions. First, the plan must identify the following four elements for each modernization project: * functional and performance capabilities to be delivered, * expected mission benefits, * estimated lifecycle costs, and, * planned key milestones. Second, the plan must demonstrate the following four elements for each modernization project: * compliance with the department's enterprise architecture (EA), * management in accordance with applicable lifecycle management policies and guidance, * conformance to the department's capital planning and investment control requirements, and, * support by an adequately staffed project office. On April 26, 2010, HUD submitted what it described as the first in a planned series of incremental expenditure plans to the House and Senate Appropriations Subcommittees on Transportation, Housing and Urban Development, and Related Agencies. According to HUD, the incremental approach will allow it to develop a strategy and operating plan for enterprise transformation while beginning targeted, high- priority new projects and existing system modifications that are needed to respond to pressing mission needs and statutory mandates. The act also requires that GAO review this plan. As agreed with HUD's appropriations subcommittees, our review objectives were to determine the extent to which: * HUD's expenditure plan meets statutory conditions, and, * HUD has in place key institutional IT modernization management capabilities. Scope and Methodology: To accomplish the first objective, we compared the information for the IT modernization projects provided in the plan with each element of the two sets of conditions, as specified in the act. For both conditions, we determined whether the plan satisfied, partially satisfied, or did not satisfy each[Footnote 10] element of the condition. * For the first condition, our scope included all eight projects in the plan and focused on the contents of the plan because the act required that the plan itself contain information to address each element of the condition. * For the second condition, we focused on two projects, the Federal Housing Administration (FHA) Transformation: Infrastructure and the Next Generation Voucher Management System (NGVMS). In doing so, we analyzed information in the plan and relevant project management documents to determine whether each element of the condition was addressed. We focused on FHA Transformation: Infrastructure and NGVMS because these projects were specifically cited in the act. To accomplish the second objective, we compared available information, including HUD IT management reports and departmental policies and procedures, in draft and final form, for each of the institutional IT modernization management capabilities cited in the act with our open recommendations made in a prior report[Footnote 11] on the department's management capacity in these areas. For both of our objectives, we also interviewed cognizant officials. (See attachment 1 for more detailed information on our objectives, scope, and methodology.) We conducted this performance audit at HUD offices in Washington, D.C., from March 2010 to August 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Results in Brief: The extent to which HUD has satisfied the statutory conditions associated with its expenditure plan varies by modernization project, but overall HUD's plan is limited as a congressional oversight and decision-making mechanism. (See table 1.) Table 1: Summary of HUD's Satisfaction of Expenditure Plan Statutory Conditions: IT project: FHA Transformation: Infrastructure; Statutory condition 1: Capabilities: [A]; Statutory condition 1: Mission benefits: [A]; Statutory condition 1: Lifecycle costs: [A]; Statutory condition 1: Key milestones: [A]; Statutory condition 2: EA compliance; [C]; Statutory condition 2: Project lifecycle management: [B]; Statutory condition 2: Capital planning and control: [C]; Statutory condition 2: Project staffing: [C]. IT project: NGVMS (Phase 1); Statutory condition 1: Capabilities: [B]; Statutory condition 1: Mission benefits: [B]; Statutory condition 1: Lifecycle costs: [B]; Statutory condition 1: Key milestones: [A]; Statutory condition 2: EA compliance; [C]; Statutory condition 2: Project lifecycle management: [B]; Statutory condition 2: Capital planning and control: [C]; Statutory condition 2: Project staffing: [A]. IT project: Development Application Processing System; Statutory condition 1: Capabilities: [A]; Statutory condition 1: Mission benefits: [B]; Statutory condition 1: Lifecycle costs: [B]; Statutory condition 1: Key milestones: [C]. IT project: FHA Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering; Statutory condition 1: Capabilities: [A]; Statutory condition 1: Mission benefits: [A]; Statutory condition 1: Lifecycle costs: [A]; Statutory condition 1: Key milestones: [A]. IT project: HUD Integrated Core Financial Management Improvement Project; Statutory condition 1: Capabilities: [C]; Statutory condition 1: Mission benefits: [B]; Statutory condition 1: Lifecycle costs: [B]; Statutory condition 1: Key milestones: [C]. IT project: Human Resources End-to-End Solution (Phase 1); Statutory condition 1: Capabilities: [A]; Statutory condition 1: Mission benefits: [A]; Statutory condition 1: Lifecycle costs: [C]; Statutory condition 1: Key milestones: [B]. IT project: Improvement to Current Tenant-based Rental Assistance System (Sept. 2010 Release); Statutory condition 1: Capabilities: [B]; Statutory condition 1: Mission benefits: [B]; Statutory condition 1: Lifecycle costs: [C]; Statutory condition 1: Key milestones: [A]. IT project: Transformation Initiative/IT Project Assessment and Program Support Services; Statutory condition 1: Capabilities: [B]; Statutory condition 1: Mission benefits: [C]; Statutory condition 1: Lifecycle costs: [A]; Statutory condition 1: Key milestones: [C]. Source: GAO analysis based on HUD data. [A] Satisfies all aspects of this element. [B] Satisfies some, but not all, aspects of this element. [C] Does not satisfy any aspect of this element. [End of table] Results in Brief: HUD's Deputy Chief Information Officer (CIO) attributed limitations in the plan's scope and content to the department's interpretation and understanding of the project-level information needed to satisfy the act's conditions as well as the unavailability of project management documentation for several projects. The CIO also stated, and we confirmed, that more detailed capability, benefit, cost, and milestone information exists for several of the eight projects, and added that such information is to be included in future expenditure plans. Without an expenditure plan that provides HUD's appropriations committees with sufficient insight and visibility into key aspects of the modernization projects under way, or otherwise discloses the unavailability of this information and the associated risks and plans to mitigate these risks, the committees will lack the means for effectively overseeing and making informed funding decisions. HUD has a range of actions under way to evolve and strengthen its IT governance approach; however, it has yet to institutionalize key IT modernization management capabilities. Specifically: * HUD intends to award a contract to develop a new version of its EA because the current version is business-unit-based (e.g., single- family housing) rather than core business function-based (e.g., grants management), and thus is not consistent with its modernization plans. However, this contract's award was recently protested, and thus HUD does not yet know when it will have the first version of its new EA. In the interim, HUD has EA-related work under way to analyze its existing portfolio of 29 Transformation Initiative projects to, among other things, identify potential duplication across the projects and develop a target architecture, including an enterprise data management strategy and a project transition strategy. According to HUD, this work will, among other things, help to inform the next version of its EA. * HUD has developed the conceptual construct for a new integrated investment and lifecycle management framework, but all the policies and process guidance needed to understand and consistently implement it are under development. HUD reports that this framework will be defined to the point that projects can consistently implement it by October 2010. * HUD has defined and implemented IT investment management policies and procedures to support selection of investment portfolios, but not to control these portfolios of investments. HUD expects to have defined and to begin implementing portfolio-based investment control policies and procedures by October 2010. * HUD has begun to develop a strategic IT human capital management plan (e.g., it has mapped existing IT staff skill sets to its strategic Office of the Chief Information Officer (OCIO) goals). However, it has yet to define skill gap closure strategies. Further, it has not established milestones for completing and implementing this human capital management plan. HUD's Deputy CIO attributed the state of the department's institutional IT management controls to the limited amount of time that the new IT leadership team has had to correct longstanding weaknesses in the each of the areas, as well as competing demands for key OCIO staff. The CIO also stated that these governance reforms are significant in nature and thus will take time to accomplish. The absence of any one of these institutional IT management controls introduces an element of risk to each modernization project; however, the combination of these missing capabilities introduces greater risk that projects will not perform as intended and will cost more and take longer than necessary to implement. While this risk is mitigated somewhat by OCIO actions to implement interim, compensatory IT management steps, such as the work on an enterprise transformation operating plan which will inform the direction of the new EA, as well as the fact that five of the eight projects in the expenditure plan are still early in their lifecycles, it is nevertheless extremely important for HUD to move quickly to follow through on its intentions to establish and implement more robust IT governance before its projects advance much further in their lifecycles. To assist HUD in developing its next expenditure plan and striking a proper balance between its need to introduce modernized systems and prudently manage the risks inherent in doing so, we are recommending that future expenditure plans (1) fully satisfy each set of statutory conditions or otherwise disclose why any element of a statutory condition is not satisfied, along with any associated project risks and mitigation plans, and (2) describe the status of HUD's efforts to institutionalize key modernization management controls, along with any associated project risks and mitigation plans. We are also recommending that HUD ensure that future plans reflect its institutional capacity to manage the number and scope of projects in the plans. In commenting on a draft of this briefing, HUD officials did not explicitly agree or disagree with our recommendations. However, they emphasized that our findings and conclusions relative to the plan's satisfaction of the statutory conditions do not indicate that the projects in the plan are being poorly managed. Further, they stated that the draft briefing did not sufficiently recognize the compensatory measures that have been taken to mitigate risks associated with the lack of institutionalized governance controls, and they provided clarifying statements and documentation relative to these measures, as well as a range of technical comments. We agree with HUD's first comment on our findings relative to the plan's satisfaction of statutory conditions. Accordingly, our conclusions and recommendations are confined to the plan's value as an oversight and accountability tool. With respect to the second comment on compensatory measures, we have incorporated the additional information that HUD provided, as appropriate, throughout the briefing. Background: HUD Organization: To carry out its mission, HUD is organized into five main components. In carrying out their mission duties, these offices perform a range of core business functions, such as grants management and voucher processing management. The five components and their missions are described below. * Office of Housing Contributes to building and preserving healthy neighborhoods and communities; maintains and expands home ownership, rental housing, and health care opportunities; and stabilizes credit markets in times of economic disruption. This office is composed of two mission areas: - Single-family housing programs provide mortgage insurance on loans to purchase homes and refinance existing mortgages. - Multifamily programs provide mortgage insurance to lenders on loans for the development of housing projects and health care facilities. * Office of Community Planning and Development: Provides housing, living environment, and economic opportunities for people of low and moderate income through partnerships with all levels of government, the private sector, and nonprofit organizations. * Office of Fair Housing and Equal Opportunity: Administers and enforces federal laws that prohibit discrimination in housing, such as the Fair Housing Act of 1968[Footnote 12] and the Civil Rights Act of 1964.[Footnote 13] Establishes and enforces policies intended to ensure that all Americans have equal access to housing of their choice. * Office of Public and Indian Housing: Administers and manages programs authorized by the Housing Act of 1937[Footnote 14] to provide housing to approximately 3.4 million households in order to ensure housing and create opportunities for residents' self-sufficiency and economic independence. * Government National Mortgage Association: Expands affordable housing by linking global capital markets to the nation's housing markets. Guarantees investors timely payment and interest on mortgage-backed securities backed by federally insured or guaranteed loans. HUD also consists of a number of mission support offices, such as the Office of Healthy Homes and Lead Hazard Control and the Office of Faith-Based and Community Initiatives, as well as administrative offices, such as the Office of the Chief Financial Officer, Office of Chief Procurement Officer, and the OCIO. Figure 1 provides a simplified view of the department's organizational structure. Figure 1: Simplified HUD Organizational Chart: [Refer to PDF for image: organizational chart] Top level: * Secretary[A]. Second level, reporting to Secretary: * Deputy Secretary. Third level, reporting to Deputy Secretary: * Fair Housing and Equal Opportunity; * Housing; * Chief Procurement Officer; * Chief Financial Officer; * Community Planning and Development; * Government National Mortgage Association; * Public and Indian Housing; * Chief Information Officer; * Other support offices[B]. Source GAO based on HUD data. [A] Other offices exist that directly report to the Office of the Secretary, such as the Office of Hearings and Appeals. [B] Other support offices include: Administration, Center for Faith- Based and Community Initiatives, Congressional and Intergovernmental Affairs, Departmental Equal Employment Opportunity, Departmental Operations and Coordination, Field Policy and Management, General Counsel, Healthy Homes and Lead Hazard Control, Inspector General, Policy Development and Research, and Public Affairs. [End of figure] Background: HUD OCIO: HUD's OCIO is responsible for the department's IT environment. To this end, OCIO has established four IT strategic goals: (1) rapidly modernizing IT to support key HUD business initiatives; (2) transforming the IT infrastructure to adapt to and adopt emerging technologies; (3) developing a cadre of highly capable IT professionals with mission critical competencies; and (4) providing secure, rapid, and reliable data and information to customers, citizens, and business partners. To accomplish these goals, OCIO is in the process of being reorganized, and according to OCIO officials, the new organization structure is being used to manage the IT modernization projects. Further, they stated that the reorganization reflects an improved focus on OCIO service to HUD's mission areas and a more streamlined and transparent approach to investment decision-making. Background: Institutional IT Modernization Management Controls and Risks: As we have previously reported, an organization's ability to effectively and efficiently maintain and modernize its existing IT environment depends in large part on how well it employs certain IT management controls or disciplines that are embodied in statutory requirements, federal guidance, and best practices. Key components of an effective management structure include (1) IT strategic planning, (2) EA development and use, (3) IT investment management, (4) systems development and acquisition management, (5) information security management, (6) information management, and (7) IT human capital management.[Footnote 15] Further, the severity of the risks associated with investing in IT systems without these management controls in place and operating depends on where projects are in their lifecycles. [Footnote 16] While such risks are not as severe early in a project's lifecycle, when it is being planned (project definition and preliminary system design), they escalate as a project is designed, developed, and deployed. Background: HUD Expenditure Plan: HUD submitted the first incremental expenditure plan to its House and Senate Appropriations Subcommittees on April 26, 2010. This plan seeks to obligate about $28.1 million in Transformation Initiative funding across eight projects, which HUD officials described as those projects that are most critical to their transformation efforts. (See table 3 for a description of the eight projects, along with each project's estimated obligations under the first incremental plan and total estimated use of fiscal year 2010 appropriated funds.) According to HUD officials, several of these projects receive additional funds through HUD's Working Capital Fund. For example, the HUD Integrated Core Financial Management Improvement Project is also receiving about $26 million in working capital funds for fiscal year 2010. Table 3: Summary of the April 2010 HUD Expenditure Plan: IT modernization project: FHA Transformation: Infrastructure; Purpose: To define a future technical infrastructure to support FHA and related HUD services; Estimated obligations for the first increment: $2.0 million; Total estimated fiscal year 2010 appropriations[C]: $18.5 million. IT modernization project: NGVMS (Phase 1)[A]; Purpose: To define a future technical infrastructure to support HUD services related to rental housing assistance (phase 1). The other two phases are the development and implementation of the system (phase 2), and the independent validation and verification testing of the system (phase 3); Estimated obligations for the first increment: $6.5 million; Total estimated fiscal year 2010 appropriations[C]: $28.0 million. IT modernization project: Development Application Processing System; Purpose: To enhance the existing system with the ability to identify the various HUD offices processing FHA insurance applications; ensure the accuracy of the amount of funds being awarded; and ensure that all available funds are awarded in accordance with published criteria; Estimated obligations for the first increment: $0.4 million; Total estimated fiscal year 2010 appropriations[C]: $0.4 million. IT modernization project: FHA Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering; Purpose: To analyze current environment and make recommendations on IT solutions that streamline and optimize Office of Multifamily Housing operations; Estimated obligations for the first increment: $2.0 million; Total estimated fiscal year 2010 appropriations[C]: $2.0 million. IT modernization project: HUD Integrated Core Financial Management Improvement Project[A]; Purpose: To implement an integrated financial management system to bring HUD into full compliance with the relevant financial management laws and regulations; Estimated obligations for the first increment: $10.0 million; Total estimated fiscal year 2010 appropriations[C]: $10.0 million. IT modernization project: Human Resources End-to-End Solution (Phase 1)[A]; Purpose: To replace HUD’s current human resources system provided by the Department of the Treasury with an in-house system using a phased migration approach; phase one is to provide staffing and classification services across HUD; Estimated obligations for the first increment: $3.6 million; Total estimated fiscal year 2010 appropriations[C]: $10.0 million. IT modernization project: Improvement to Current Tenant-based Rental Assistance System (Sept. 2010 Release)[A]; Purpose: To incrementally modify the current Voucher Management System. The first release of the modified system, set for Sept. 17, 2010, is to include the addition of new fields, enhancements to the user interface, and the addition of forecasting and reporting capability; Estimated obligations for the first increment: $0.6 million; Total estimated fiscal year 2010 appropriations[C]: $3.0 million. IT modernization project: Transformation Initiative/IT Project Assessment and Program Support Services[B]; Purpose: To provide analytical and consulting services related to architecture development and also to provide management support to HUD’ s modernization project teams. Among other things, it includes analysis of the scope and potential duplication across the 29 modernization projects in the Transformation Initiative portfolio, development of target architecture concepts and direction, and development of a Transformation Initiative Operating Plan; Estimated obligations for the first increment: $3.0 million; Total estimated fiscal year 2010 appropriations[C]: $3.0 million. Total: Estimated obligations for the first increment: $28.1 million; Total estimated fiscal year 2010 appropriations[C]: $74.9 million. Source: GAO analysis of HUD data. [A] This project also receives HUD Working Capital Funds. [B] According to HUD officials, this effort is not a project in the sense of delivering a modernized system solution, and it was included as a project in the expenditure plan because they wanted to ensure transparency of all Transformation Initiative funding. [C] These appropriations are available for obligation through September 30, 2012. [End of table] Objective 1: Statutory Conditions: First Set of Conditions: Condition 1. The expenditure plan varies in the degree to which it describes functional and performance capabilities, expected mission benefits, estimated lifecycle costs, and key milestones for each of the eight IT projects, but overall does not adequately satisfy all elements of the condition for all projects. (See table 4.) Table 4: Summary of GAO Assessment of HUD's Expenditure Plan against Statutory Condition 1: IT project: FHA Transformation: Infrastructure; Capabilities: Satisfies all aspects of this element; Mission benefits: Satisfies all aspects of this element; Lifecycle costs: Satisfies all aspects of this element; Key milestones: Satisfies all aspects of this element. IT project: NGVMS (Phase 1); Capabilities: Satisfies some, but not all, aspects of this element; Mission benefits: Satisfies some, but not all, aspects of this element; Lifecycle costs: Satisfies some, but not all, aspects of this element; Key milestones: Satisfies all aspects of this element. IT project: Development Application Processing System; Capabilities: Satisfies all aspects of this element; Mission benefits: Satisfies some, but not all, aspects of this element; Lifecycle costs: Satisfies some, but not all, aspects of this element; Key milestones: Does not satisfy any aspect of this element. IT project: FHA Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering; Capabilities: Satisfies all aspects of this element; Mission benefits: Satisfies all aspects of this element; Lifecycle costs: Satisfies all aspects of this element; Key milestones: Satisfies all aspects of this element. IT project: HUD Integrated Core Financial Management Improvement Project; Capabilities: Does not satisfy any aspect of this element; Mission benefits: Satisfies some, but not all, aspects of this element; Lifecycle costs: Satisfies some, but not all, aspects of this element; Key milestones: Does not satisfy any aspect of this element. IT project: Human Resources End-to-End Solution (Phase 1); Capabilities: Satisfies all aspects of this element; Mission benefits: Satisfies all aspects of this element; Lifecycle costs: Key milestones: Satisfies some, but not all, aspects of this element. IT project: Improvement to Current Tenant-based Rental Assistance System (Sept. 2010 Release); Capabilities: Satisfies some, but not all, aspects of this element; Mission benefits: Satisfies some, but not all, aspects of this element; Lifecycle costs: Does not satisfy any aspect of this element; Key milestones: Satisfies all aspects of this element. IT project: Transformation Initiative/IT Project Assessment and Program Support Services; Capabilities: Satisfies some, but not all, aspects of this element; Mission benefits: Does not satisfy any aspect of this element; Lifecycle costs: Satisfies all aspects of this element; Key milestones: Does not satisfy any aspect of this element. Source: GAO analysis of HUD data. [End of table] Functional and Performance Capabilities: As we have previously reported,[Footnote 17] system capabilities can be viewed in terms of what the system is to do (functions) and how well the system is to perform these functions (performance). To facilitate project oversight, decision-making, and accountability, information about these capabilities should be defined to a level that permits meaningful understanding of what capabilities are to be delivered and measurement of progress in doing so. For four of the eight projects, the plan describes the functional and performance capabilities that are to be delivered. For example, the plan states that the Development Application Processing System project is to modify the first 11 reports generated by this system to clearly identify the name of the field office that processed a case. However, the plan does not include similarly detailed information for the other four projects. For example, for the Improvements to Current Tenant-based Rental Assistance Systems (Sept. 2010 Release) project, the plan only states that it is to provide unspecified enhancements to the user interface and forecasting/reporting capabilities. Similarly, for the HUD Integrated Core Financial Management Improvement Project, the plan states that the project will deliver a modern IT infrastructure for current and future financial management applications, and that the resulting system will be fully compliant with relevant financial management laws and regulations and will provide accurate and timely information. However, it does not provide any information on what constitutes modern capabilities, such as the processing capacity, and it does not specify any of the functions needed to comply with applicable laws and regulations or what the relevant laws and regulations are. Further, it does not specify the performance levels needed for the information to be accurate and timely. Mission Benefits: As we have previously reported,[Footnote 18] the benefits to accrue from a proposed system solution should be specific and measurable, and they should be linked to specific capabilities. The plan describes expected mission benefits for three of the eight projects. For example, the Human Resource End-to-End Solution project links measurable benefits to explicit system capabilities. Specifically, the plan states that this project is to deliver a reengineered staff acquisition process that will decrease the number of the customer complaints to no more than three per employee during a rating period and will reduce the average time to hire candidates from 110 days to 79 days. However, the plan does not present benefits that are specific and measurable for the other five projects. For example, the plan states that the Transformation Initiative/IT Project Assessment and Program Support Services project will improve employee skills in program and project management and consolidated business requirements. However, these improved skills are not linked to expected outcomes (i.e., benefits) that can be measured, such as reductions in project and program cost and schedule variances. Estimated lifecycle costs: As we have previously reported,[Footnote 19] a project's lifecycle cost estimate should include all direct and indirect costs associated with planning, designing, developing, procuring, deploying, operating and maintaining, and disposing of the system. To support project oversight, decision-making, and accountability, information about this estimate should include enough detail to understand and measure the expenditure funds for major project work activities and deliverables. The plan contains estimated lifecycle costs for three of the eight projects. For example, for the FHA Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering project, a $2 million lifecycle cost estimate is provided. Moreover, this estimate is decomposed into meaningful work activities, such as the following three phases: business process reengineering, change management, and program management support. For the remaining five projects, the plan cites estimated project costs for just fiscal year 2010, as well as what portion of these costs are for a given lifecycle phase (e.g., definition or acquisition phases). However, a total lifecycle cost estimate is not provided for these projects. Further, the decomposition of each project's costs is not consistent. For example, the Development Application Processing System project's costs are broken down by general work areas, such as design specifications, development (coding), and testing, while the Human Resources End-to-End Solution project's costs are broken down by the contract's base year and option years. Milestones: As we have previously reported,[Footnote 20] project milestones should be tied to the capabilities to be delivered and should permit progress to be measured. The plan describes key milestones for four of the eight projects. For example, for the Improvements to Current Tenant- based Rental Assistance Systems (Sept. 2010 Release) project, the plan shows a schedule that contains a series of key milestones, including system design (April 20, 2010—April 30, 2010), integration and test (June 10, 2010—August 31, 2010), and installation and deployment (August 30, 2010—September 30, 2010). For the other four projects, the plan does not sufficiently specify key milestones. For example, the plan shows that the development phase for the Development Application and Processing System project is to be completed sometime between June 1, 2010, and November 15, 2010. Moreover, it does not cite interim milestones associated with completing system development activities, such as when key test events will occur. HUD's Deputy CIO attributed these limitations in the plan's scope and content to the department's interpretation and understanding of the project-level information needed to satisfy the act's conditions and to the unavailability of more detailed project management information for several projects. The CIO also stated, and we confirmed, that more detailed capability, benefit, cost, and milestone information on several projects, such as the HUD Integrated Core Financial Management Improvement Project, does exist. Further, the CIO stated that HUD intends to include this more detailed project information in future expenditure plans. Objective 1: Statutory Conditions: Second Set of Conditions: Condition 2. The expenditure plan, in combination with project management documentation, does not satisfy the statutory condition that each project demonstrate that it is (a) compliant with the department's EA, (b) being managed in accordance with applicable lifecycle management policies and guidance, (c) subject to the department's capital planning and control requirements, and (d) supported by an adequately staffed project office. Specifically, neither the FHA Transformation: Infrastructure nor the NGVMS project fully satisfies more than one of the elements of the condition. (See table 5.) Table 5: Summary of GAO Assessment of Two HUD Modernization Projects against Statutory Condition 2: IT Project: FHA Transformation: Infrastructure; EA compliance: Does not satisfy any aspect of this element; Project lifecycle management: Satisfies some, but not all, aspects of this element; Capital planning and control: Does not satisfy any aspect of this element; Project staffing: Does not satisfy any aspect of this element. IT Project: NGVMS (Phase 1); EA compliance: Does not satisfy any aspect of this element; Project lifecycle management: Satisfies some, but not all, aspects of this element; Capital planning and control: Does not satisfy any aspect of this element; Project staffing: Satisfies all aspects of this element. Source: GAO analysis of HUD data. [End of table] The degree to which the plan and project management documentation satisfy this condition can be attributed to the fact that each of the four corporate IT management controls that are needed to meet this condition has yet to be institutionalized, as discussed later in this briefing. In the interim, HUD officials have employed compensatory measures to minimize the project's exposure to risk, which are also described later in this briefing. However, neither this risk exposure nor the compensating measures are addressed in the expenditure plan. The extent to which the plan and project management documentation meets each element of the condition is discussed in more detail below. EA Compliance: Neither the plan nor available project documentation demonstrates that the FHA Transformation: Infrastructure and NGVMS projects are currently in compliance with the HUD EA because the department's current version of its EA is no longer operative and a new version has yet to be developed. (The status of HUD's EA is discussed later in this briefing.) Specifically, * The plan does not address EA compliance for the FHA Transformation: Infrastructure project, and according to FHA officials, the project has not been assessed for compliance. However, the project has defined the FHA "as-is" and "to-be" (or target) architectures, and conducted market research of commercially available system solutions. In addition, officials stated that the HUD Chief Architect is a member of the FHA integrated project team and that FHA has an active leadership role in the new EA development effort. * The plan states that NGVMS EA compliance will not be determined until October 2011. NGVMS officials told us that EA compliance analysis any sooner than this would be premature since the project is very early in its lifecycle (e.g., business process reengineering and requirements definition have yet to begin). However, given that project definition activities are currently under way, and are to produce a number of artifacts that should be traceable to and aligned with the EA, such as business processes and requirements, data requirements and definitions, process performance measures, and a technology architecture, it is not clear why a compliance determination will not occur for more than a year. Lifecycle Management: The plan, in combination with project documentation, partially demonstrates that these two projects are being managed in accordance with applicable lifecycle management policies and guidance. Specifically, * The plan provides a schedule for the FHA Transformation: Infrastructure project that reflects the lifecycle phases in HUD's recently defined conceptual framework for integrated investment lifecycle management. For example, the plan states that the FHA Concept of Operations, a key deliverable under this framework for exiting the need/concept phase, was to be completed in May 2010. Based on project documentation, it was completed in May 2010. * The plan discusses the NGVMS project in the context of HUD's prior systems development methodology framework. However, project officials told us that the project is transitioning to the new lifecycle management framework. To this end, project documentation shows that the project work breakdown structure has been revised to reflect the new lifecycle phases and work activities. However, because HUD has not yet fully defined key aspects of its new lifecycle management process, as is discussed in the next section of this briefing, these projects' adoption of this process remains a work in progress. Capital Planning and Investment Control: The plan does not provide any information as to whether the FHA Transformation: Infrastructure or NGVMS projects are subject to HUD's capital planning and investment control requirements. Moreover, OCIO officials told us that neither project was subject to HUD's new investment management process (details of which are discussed later in this briefing). According to these officials, this is because the expenditure plan was submitted while its revised IT governance approach was being established, and thus these projects could not be subjected to the formal executive reviews and investment evaluation criteria associated with this new structure and approach. Instead, OCIO officials explained that these projects were subject to compensatory management control measures. Specifically, they were managed and reviewed by the HUD Integrated Product Team, which is a review body comprised of various technical, programmatic, financial, and procurement officials. According to these officials, this team determined each project's readiness to proceed based on the completion and quality of their respective project plans, detailed budgets, and requirements. OCIO officials further stated that the HUD Integrated Product Team continues to review these projects and provides progress updates and recommendations on the advancement of these projects to the oversight boards that are part of HUD's new in-process governance structure. Nevertheless, these compensatory measures were not described in the plan. Project Office Staffing: While the plan does not demonstrate that the FHA Transformation: Infrastructure project or the NGVMS project is currently supported by an adequately staffed project office, project management documentation does show that this latter project is at least adequately staffed for the current fiscal year. Specifically, * The plan does not provide information as to whether the FHA Transformation: Infrastructure project is adequately staffed. Instead, the plan identifies the names of key project management personnel, including the executive sponsor and IT project manager. While project officials told us that they believe that the project is adequately staffed, this position was not supported by any documented analysis of strategic gaps in staffing needs versus capabilities. According to project officials, should additional staff be needed, they will work with OCIO informally to address these needs. * The plan does not provide information on the adequacy of NGVMS project staffing. However, the project office completed an analysis of its staffing levels for fiscal years 2010 through 2016, and based on this analysis, the project is adequately staffed in 2010, but may not be in future years. Specifically, the analysis shows that multiple staff will be expected to perform tasks well in excess of a normal work day in later stages of the project, which is an indication of future staffing challenges. Objective 2: HUD's Institutional IT Modernization Capabilities: HUD Has Yet to Fully Establish Key Institutional IT Modernization Management Capabilities: As we have previously reported,[Footnote 21] an organization's ability to effectively modernize its IT environment greatly depends on the extent to which it has established and implemented a number of institutional IT modernization management controls or capabilities. These controls include EA development and use, systems lifecycle management, IT investment management, and IT human capital management. To date, HUD has yet to adequately establish any of these corporate IT management controls, in large part because a new HUD IT leadership team has only recently been put in place, and it is still in the process of introducing a new approach to IT governance, which HUD described as significant in nature and requiring time to accomplish. Nevertheless, HUD continues to invest in multiple IT modernization projects, and may expand on the number of projects in the near term. As we have previously reported,[Footnote 22] the absence of these institutional modernization management controls introduces an unnecessary element of modernization risk that while manageable early in a project's lifecycle, increases exponentially as a project progresses to later lifecycle stages. With regard to HUD's first expenditure plan, five of the eight projects are very early in their lifecycles, and thus their exposure to risk is not as significant as the other three. However, it is extremely important for HUD to expeditiously establish and implement each of these institutional controls across its projects before any of the projects proceed beyond early definition and design, and before more projects are initiated. To do less increases the risk that the projects will ultimately encounter cost, schedule, and performance shortfalls. According to the CIO, pursuit of its institutional IT governance reforms in parallel with its modernization projects will be challenging, and to address this challenge its OCIO will work closely with the mission-area teams that are responsible for the projects to minimize the associated risks. Enterprise Architecture: An EA is a corporate blueprint for modernizing IT systems and transforming mission operations and serves as a bridge between an organization's strategic plans and its implementation of individual programs and system solutions. As such, it provides the information details needed to guide and constrain investments in a consistent, coordinated, and integrated fashion—thereby improving interoperability, reducing duplicative efforts, and optimizing mission operations. One approach to developing the EA content needed to adequately inform program and system solution implementations is to divide the architecture into segments and to develop more detailed architectures for each segment. In July 2009, we reported[Footnote 23] that HUD had a version of its EA that identified and prioritized segments that were aligned with HUD business units (e.g., single-family housing, multifamily housing finance). However, only a few segment architectures had been developed, segment priorities were not being adhered to, and those segments that had been developed were out of date and did not reflect important elements of federal guidance. Accordingly, we made recommendations aimed at improving HUD's segment architectures. Since then, HUD's OCIO has decided to reexamine and redefine the department's EA segments based on HUD business functions that transcend business units (e.g., business intelligence, grants management, and workflow management). To accomplish this, HUD intended to award a contract to develop a new version of its EA in March 2010. However, this contract's award was recently protested, and thus HUD does not yet know when it will have an initial version of its new EA. In the interim, HUD has EA-related work under way as part of its Transformation Initiative/IT Project Assessment and Program Support Services project, which is to among other things, develop an enterprise transformation operating plan and inform the direction of the new EA. According to the statement of work, the contractor is to analyze HUD's existing portfolio of 29 Transformation Initiative projects to, among other things, identify potential duplication across the projects and develop a target architecture, including (1) an enterprise data management strategy, (2) project transition strategy, and (3) restructured EA segments. HUD officials stated that this work will be completed by October 2010. Notwithstanding the value of this work in informing HUD's EA, it is not clear when the department will have an initial version of this EA. Without it to guide and constrain IT modernization projects, HUD will be at increased risk of investing in systems that are not well integrated, are potentially duplicative, and do not support optimized mission operations. Systems Lifecycle Management: Following a disciplined lifecycle management process in which key activities and phases of a project are conducted in a logical and orderly process and are fully documented helps ensure that IT modernization programs achieve intended goals within acceptable levels of cost and risk.[Footnote 24] Such a process typically begins with initial concept definition and continues through requirements determination and system design and development, including testing, and concludes with final testing, deployment, and operations and maintenance. HUD has not yet fully defined and implemented comprehensive lifecycle management policies and procedures. Specifically, HUD has developed a conceptual construct for a new integrated investment management lifecycle framework that identifies eight major phases: need/concept, definition, financial planning, acquisition, design, development, deployment, and operations and maintenance. This conceptual framework specifies some of the activities and project artifacts associated with each of these phases, such as an IT project planning template to support standardization across new projects. However, work is still under way to define the remaining process guidance needed to understand and consistently implement the framework. Among other things, OCIO officials told us the majority of project tools and standard templates expected to be used by the IT project teams have not been developed. They also said the framework will be defined to the point that projects can begin to consistently implement it by October 2010. However, the CIO also acknowledged that the project-related contracts already in place are aligned to the prior lifecycle model, and thus while new contracts and option year actions on existing contracts will incorporate the new lifecycle management language, OCIO will need to work with the project teams on a one-on-one basis to ensure appropriate practices are employed to the extent possible to minimize risks on other existing contracts. Until the framework is defined and consistently implemented, HUD will not have the kind of repeatable process needed to ensure that each modernization project is executed in a rigorous and disciplined manner across the department. IT Investment Management: Investment management includes the selection and control of investments to ensure that they produce business value in the investment decision-making process. If managed effectively, IT investments can have a dramatic impact on an organization's performance and accountability. Our framework[Footnote 25] for assessing federal agencies' IT investment management practices consists of five progressive stages of maturity, with Stage 1 representing immature and undisciplined processes, and Stage 5 representing optimized maturity focused on continuous improvement. Stage 3, which is the focus of our review, is where an organization moves from project-centric to portfolio-based investment processes. Through a portfolio-based approach, the organization can consider new investment proposals, along with previously funded investments, and identify the appropriate mix and synergies of these investments to best meet mission needs. This level of investment involves the implementation of four critical processes: (1) defining the portfolio criteria; (2) creating the portfolio; (3) evaluating (i.e., controlling) the portfolio; and (4) conducting post-implementation reviews. In July 2009, we reported[Footnote 26] that HUD had executed all but one of these four critical investment processes. In particular, HUD had established the IT investment management policies and procedures for developing investment portfolios but not for effectively controlling them. As such, we made recommendations aimed at improving HUD's IT portfolio evaluation processes. HUD is in the process of addressing our recommendations. For example, work is under way to establish a new IT governance structure intended to increase portfolio transparency and facilitate portfolio decision- making. Specifically, * The Executive Investment Board (also called the Transformation Initiative Fund Board), which is chaired by the HUD Secretary and includes the Chief Financial Officer, CIO, and Chief Operating Officer, has been established. This board is responsible for developing and implementing HUD's strategic plan and making final funding decisions. * The Customer Care Committee, which is chaired by the CIO and includes the General Deputy Assistant Secretaries, Associate CIOs, and program/mission representatives, has been established. This board is responsible for ensuring investments and projects are aligned to HUD's strategic plan by managing and monitoring the performance of the IT portfolio and providing portfolio and funding recommendations to the Executive Investment Board. * Investment Review and Technical Review Subcommittees, which are comprised of OCIO and project leadership, have been established. These two subcommittees are responsible for providing all necessary analysis to the Customer Care Committee related to IT investment and portfolio reviews and IT project control gate reviews, respectively. The charters for these governing boards (outlining their membership and detailed roles and responsibilities) have been drafted but are not yet approved. However, we have confirmed that, with the exception of the Technical Review Subcommittee, these boards have been actively meeting since February 2010 as an interim control measure. According to OCIO, approved charters for these groups, as well as the implementation of the remaining subcommittee, will occur by October 2010. OCIO officials stated that until the Technical Review Subcommittee is in place, the HUD Integrated Product Team (as discussed earlier in this briefing) serves as the review body to determine the completion and quality of tasks and documentation for each phase of the integrated investment management lifecycle. HUD is also in the process of restructuring and combining its inventory of modernization and business mission projects under a single IT investment portfolio, which it reports should be completed by October 2010. In addition, OCIO stated that they have drafted procedures for evaluating portfolios, and expect department-level approval by late August 2010, and to define and begin implementing criteria for assessing portfolio performance by October 2010. Notwithstanding these efforts to improve IT investment portfolio governance, the department will continue to be limited in its ability to control the risks and achieve the benefits associated with its portfolios until it has institutionalized its governance boards and defined and implemented IT investment portfolio control practices, including criteria for assessing portfolio performance. IT Human Capital Management: Having a sufficient IT workforce is essential to a successful systems modernization program. As we have previously reported, accomplishing this involves determining the critical skills and competencies needed to deliver current and future project results, analyzing the gaps between current skills and future needs, and developing strategies for filling gaps.[Footnote 27] If performed effectively, these activities can ensure that organizations have the right people, at the right time, and with the right skills to execute projects and portfolios of projects. We previously reported[Footnote 28] that HUD had analyzed gaps in its IT workforce in fiscal year 2008 and developed a strategy for addressing them but that this analysis was based on an incomplete and outdated inventory of human capital skill levels. Accordingly, we recommended that HUD establish and execute IT human capital gap closure strategies based on a complete and current inventory of its existing IT workforce skills. In May 2010, HUD began work on a strategic IT human capital management plan. Thus far, OCIO has mapped the knowledge and skills of its current staff to its four strategic goals to determine whether resource gaps exist, and has awarded a contract for expert advice and assistance in preparing this plan. Among other things, the contractor is expected to review and provide guidance on IT human capital gap closure strategies. However, a timeframe for completing this plan has yet to be established. As an interim measure, OCIO officials told us that the Transformation Initiative/IT Project Assessment and Program Support Services project contractor is to provide basic project management training to existing IT staff to prepare them to implement the new IT institutional management controls. Nevertheless, until HUD adopts a strategic approach to IT human capital management, it will likely not have the people it needs to successfully deliver modernized systems. HUD has fallen short of the statutorily-mandated conditions associated with its fiscal year 2010 IT modernization expenditure plan. As a result, the utility of HUD's first incremental plan as an oversight, decision-making, and accountability tool is limited. Until HUD can submit an expenditure plan that satisfies the statutory conditions, as well as discloses the risks associated with each project and plans for mitigating them, its House and Senate Appropriations Subcommittees will not have the information that they need to oversee HUD's modernization projects and hold the department accountable for project results. Beyond the plan, and notwithstanding HUD's efforts to date to establish key IT modernization management capabilities, much remains to be accomplished before these capabilities can be considered sufficiently institutionalized to reasonably ensure that each modernization project is successfully completed. While HUD's new OCIO leadership team has made important progress in developing these capabilities, it also plans to submit the next incremental expenditure plan. To the extent that this next plan provides for expanded investment in the eight modernization projects covered in the first plan, while also proposing investment in additional projects, the risks associated with HUD's near-term modernization efforts will increase. As a result, it is important for HUD to balance the number of projects in the plan, and the extent to which they are allowed to proceed beyond definition and early design, with its institutional capacity to execute them. Recommendations for Executive Action: To increase the usability and value of HUD's next expenditure plan to its House and Senate Appropriations Subcommittees, we recommend that the Secretary of Housing and Urban Development direct the CIO to ensure that future plans satisfy each element of each statutory condition for each project in the plan, or disclose why any element is not satisfied, along with any associated project risks and plans for addressing those risks. Because we have previously made recommendations addressing each of the four IT modernization management controls discussed in this briefing, we are not making additional recommendations at this time relative to institutionalizing them. However, we recommend that the Secretary direct the CIO to ensure that future plans clearly describe the status of HUD's efforts to establish and implement each of these modernization management controls, along with the project-specific risks and mitigation plans associated with this status. In addition, we recommend that the Secretary ensure that the number and scope of HUD's modernization projects are commensurate with the department's institutional capacity to execute them. Agency Comments and Our Evaluation: In commenting on a draft of this briefing, HUD officials, including the CIO, did not explicitly agree or disagree with our recommendations. However, they emphasized that our findings and conclusions relative to the plan's satisfaction of the statutory conditions do not mean that the projects addressed in the plan are not being effectively managed. Further, they stated that the draft briefing did not sufficiently recognize their management actions to compensate for the fact that new IT governance controls were not yet in place, and they provided clarifying statements and documentation relative to these compensatory governance controls. In addition, they provided a range of technical comments to improve the accuracy and currency of the briefing. We agree with HUD's first comment on our findings relative to the plan's satisfaction of statutory conditions, which is why our conclusions and recommendations relative to the plan's scope and content are explicitly confined to the plan's value as a tool for the appropriation subcommittees in overseeing HUD's modernization and holding the department accountable for results. With respect to the second comment on compensatory measures, we have modified the briefing, as appropriate, to incorporate the clarifying statements, documentation, and technical comments provided. As a result, we believe that this briefing fully recognizes both the correct status of HUD's efforts to institutionalize key IT management controls and the range of interim measures to compensate for this status. Attachment 1: Objectives, Scope, and Methodology: Our objectives were to determine the extent to which (1) the Department of Housing and Urban Development's (HUD) expenditure plan meets statutory conditions specified in the Consolidated Appropriations Act, 2010 and (2) HUD has in place key institutional IT modernization management capabilities. To accomplish our first objective, we determined whether the expenditure plan satisfies, partially satisfies, or does not satisfy the two sets of conditions, as specified in the act. Specifically, * For condition 1, we reviewed the plan to determine whether it contained, for each IT modernization project,[Footnote 29] the following four elements: a detailed accounting of the functional and performance capabilities to be delivered, expected mission benefits, estimated lifecycle costs, and planned key milestones. * For condition 2, we reviewed and analyzed information in the plan for two projects[Footnote 30] and other available programmatic documents (e.g., project plans, integrated master schedules, cost estimates, staffing plans), augmented as appropriate by interviews with cognizant officials to determine whether the plan, in combination with supporting documentation, contained sufficient basis for each of the four elements of the condition: compliance with the department's enterprise architecture (EA), management in accordance with applicable lifecycle policies and guidance, conformance with capital planning requirements, and support by an adequately staffed project office. To have satisfied, partially satisfied, or not satisfied a given element associated with condition 1, the plan had to meet all aspects of each element for a given condition, meet some (but not all) aspects of each element for a given condition, or not meet any aspect of each element for a given condition, respectively. To have satisfied, partially satisfied, or not satisfied a given element associated with condition 2, the plan, in combination with project management documentation, had to similarly meet all, some (but not all), or no aspects of each element for a given condition, respectively. To accomplish our second objective, we compared available department information related to each of the institutional IT modernization management capabilities cited in the act against our open recommendations made in a prior report[Footnote 31] on HUD's IT management controls: EA management, project lifecycle management, IT investment management, and IT human capital management. We interviewed cognizant officials to corroborate our understanding of the department's activities. More specifically: * For EA management, we reviewed available HUD architecture-related documentation, including contractor statement of work and project plans for EA-related assessment activities. * For project lifecycle management, we reviewed all relevant HUD planning documentation, where available, including the conceptual framework for the integrated investment lifecycle, project plan templates, and draft systems development methodology documents. * For IT investment management, we reviewed HUD's draft IT governance plan, past and current versions of the HUD IT Investment Management Process Guide, executive governance board charters, and meeting presentations and minutes. * For IT human capital management, we reviewed available relevant documents, including the HUD OCIO human capital assessment and program support vendor contract statement of work. We determined that project funding and schedule data provided by HUD were sufficiently reliable for the purposes of this briefing. We based our decision on an assessment for each area by questioning cognizant HUD officials about the source of the data and policies and procedures to maintain the integrity of these data. We conducted this performance audit at HUD offices in Washington, D.C., from March 2010 to August 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Comments from the Department of Housing and Urban Development: U.S. Department Of Housing And Urban Development: Chief Information Officer: Washington, DC 201410-3000: October 22, 2010: Mr. Randolph C. Hite: Director: Information Technology: Architecture and Systems Issues: U.S. Government Accountability Office: 441 G Street NW: Washington, DC 20548: Dear Mr. Hite: Thank you for the opportunity to comment on the Government Accountability Office (GAO) draft report entitled, Information Technology: HUD Needs to Better Define Commitments and Disclose Risks jOr Modernization Projects in Future Expenditure Plans (GAO-11-72). The Department of Housing and Urban Development reviewed the draft report and concurs with the recommendations for Executive Action. The "Agency Comments" in the draft report adequately represent HUD's position, and the appropriate clarifications and comments regarding HUD's compensating controls have been incorporated into the report. The Agency remains committed to the establishment of key IT management and modernization controls needed to ensure the IT environment maintains mission-critical operations. To this end, we will dedicate resources toward achieving the three Executive Actions recommended by GAO. If you have any questions or require additional information, please contact Joyce M. Little, Director, Office of Investment Strategies Policy and Management at (202) 402-7404. Sincerely, Signed by: [Illegible] for: Jerry E. Williams: Chief Information Officer: [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: Randolph C. Hite, (202) 512-3439 or hiter@gao.gov: Staff Acknowledgments: In addition to the individual named above, Carol Cha (Assistant Director), Clayton Brisson, Sher'rie Bacon, Elena Epps, Kendrick Johnson, Lee McCracken, and Freda Paintsil made key contributions to this report. [End of section] Footnotes: [1] Pub. L. No. 111-117, 123 Stat. 3034, 3093-94 (Dec. 16, 2009). [2] GAO, Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment, [hyperlink, http://www.gao.gov/products/GAO-09-675] (Washington, D.C.: July 31, 2009). [3] According to the statute, not less than $80 million and not more than $180 million shall be available for IT modernization. The statutory conditions restrict HUD from obligating funds made available for IT modernization in the 2010 appropriation until HUD submits an expenditure plan that satisfies all of the conditions. [4] These projects are: Development Application Processing System; Federal Housing Administration Transformation: Infrastructure; Federal Housing Administration Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering; HUD Integrated Core Financial Management Improvement Project; Human Resources End-to-End Solution (Phase 1); Improvement to Current Tenant- based Rental Assistance System (Sept. 2010 Release); Next Generation Voucher Management System (Phase 1); and Transformation Initiative/IT Project Assessment and Program Support Services. [5] These are the Federal Housing Administration Transformation: Infrastructure and Next Generation Voucher Management System (Phase 1) projects. [6] GAO, Department of Homeland Security: Formidable Information and Technology Management Challenge Requires Institutional Approach, [hyperlink, http://www.gao.gov/products/GAO-04-702] (Washington, D.C.: Aug. 27, 2004). [7] GAO-09-675. [8] GAO, Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment, [hyperlink, http://www.gao.gov/products/GAO-09-675] (Washington, D.C.: July 31, 2009). [9] Pub. L No. 111-117 (Dec. 16, 2009). According to the act, not less than $80 million and not more than $180 million shall be available for IT modernization. [10] For the first condition, these are (1) performance and functional capabilities, (2) mission benefits, (3) estimated lifecycle costs, and (4) key milestones. For the second condition, these are (1) compliance with the department's EA, (2) management in accordance with applicable lifecycle policies and guidance, (3) compliance with capital planning and control requirements, and (4) support by an adequately staffed project office. [11] [hyperlink, http://www.gao.gov/products/GA0-09-675]. [12] Title VIII of the Civil Rights Act of 1968 (Fair Housing Act), as amended, prohibits discrimination in the sale, rental, and financing of dwellings, and in other housing-related transactions, based on race, color, national origin, religion, sex, familial status (including children under the age of 18 living with parents or legal custodians, pregnant women, and people securing custody of children under the age of 18), and handicap (disability). [13] Title VI of the Civil Rights Act of 1964 prohibits discrimination on the basis of race, color, or national origin in programs and activities receiving federal financial assistance. [14] Under the U.S. Housing Act of 1937, Congress created a federal public housing program to provide decent and safe rental housing for eligible low-income families, the elderly, and persons with disabilities. [15] GAO, Department of Homeland Security: Formidable Information and Technology Management Challenge Requires Institutional Approach, [hyperlink, http://www.gao.gov/products/GAO-04-702] (Washington, D.C.: Aug. 27, 2004). [16] GAO, Business Systems Modernization: IRS Needs to Better Balance Management Capacity with Systems Acquisition Workload, [hyperlink, http://www.gao.gov/products/GAO-02-356] (Washington, D.C.: Feb. 28, 2002). [17] GAO, Homeland Security: U.S. Visitor and Immigrant Status Indicator Technology Program Planning and Execution Improvements Needed, [hyperlink, http://www.gao.gov/products/GAO-09-96] (Washington, D.C.: Dec. 12, 2008). [18] [hyperlink, http://www.gao.gov/products/GA0-09-96]. [19] [hyperlink, http://www.gao.gov/products/GA0-09-96]. [20] [hyperlink, http://www.gao.gov/products/GA0-09-96]. [21] [hyperlink, http://www.gao.gov/products/GA0-04-702]. [22] GAO, Information Technology: DHS Needs to Fully Define and Implement Policies and Procedures for Effectively Managing Investments, [hyperlink, http://www.gao.gov/products/GAO-07-424] (Washington, D.C.: Apr. 27, 2007) and GAO-09-675. [23] [hyperlink, http://www.gao.gov/products/GA0-09-675. [24] GAO, Aviation Security: Significant Management Challenges May Adversely Affect Implementation of the Transportation Security Administration's Secure Flight Program, [hyperlink, http://www.gao.gov/products/GAO-06-374T] (Washington, D.C.: Feb. 9, 2006). [25] GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, [hyperlink, http://www.gao.gov/products/GAO-04-394G] (Washington, D.C.: March 2004). [26] [hyperlink, http://www.gao.gov/products/GA0-09-675]. [27] GAO, Human Capital: Key Principles for Effective Strategic Workforce Planning, [hyperlink, http://www.gao.gov/products/GAO-04-39] (Washington, D.C.: Dec. 11, 2003). [28] [hyperlink, http://www.gao.gov/products/GA0-09-675]. [29] These projects are: (1) Federal Housing Administration (FHA) Transformation: Infrastructure, (2) Next Generation Voucher Management System (Phase 1), (3) Development Application Processing System, (4) FHA Transformation: Multifamily Housing Development and Automated Underwriting Business Process Reengineering, (5) HUD Integrated Core Financial Management Improvement Project, (6) Human Resources End-to- End Solution (Phase 1), (7) Improvements to Current Tenant-based Rental Assistance System (Sept. 2010 Release), and (8) Transformation Initiative/Information Technology Project Assessment and Program Support Services. [30] FHA Transformation: Infrastructure and Next Generation Voucher Management System (Phase 1). [31] [hyperlink, http://www.gao.gov/products/GA0-09-675]. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: