This is the accessible text file for GAO report number GAO-08-420 
entitled 'Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2008 Expenditure' which was released on March 11, 2008. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

March 2008: 

Business Systems Modernization: 

Internal Revenue Service's Fiscal Year 2008 Expenditure Plan: 

GAO-08-420: 

GAO Highlights: 

Highlights of GAO-08-420, a report to congressional committees. 

Why GAO Did This Study: 

The Internal Revenue Serviceís (IRS) Business Systems Modernization 
(BSM) program is a multibillion-dollar, high-risk, highly complex 
effort that involves the development and delivery of a number of 
modernized systems that are intended to replace the agencyís aging 
business and tax processing systems. As required by law, IRS submitted 
its fiscal year 2008 expenditure plan in August 2007 to congressional 
appropriations committees, requesting $235.8 million from the BSM 
account. 

GAOís objectives in reviewing the plan were to (1) determine whether it 
satisfied the conditions specified in the law, (2) determine IRSís 
progress in implementing prior expenditure plan review recommendations, 
and (3) provide additional observations about the plan and the BSM 
program. To accomplish the objectives, GAO analyzed the plan, reviewed 
related documentation, and interviewed IRS officials. 

What GAO Found: 

IRSís expenditure plan satisfies the conditions specified in the law. 
These conditions include meeting the Office of Management and Budgetís 
capital planning and investment control review requirements and 
complying with federal systems acquisition requirements and management 
practices. 

IRS has taken steps to address GAOís prior recommendations to improve 
modernization management controls and capabilities, including adding a 
new focus area to its Modernization Vision and Strategy and defining 
and beginning to implement an approach for developing a quantitative 
measure of progress in meeting project scope expectations. However, 
work remains to fully implement GAOís recommendations, including steps 
to complete the Modernization Vision and Strategy. 

GAOís observations about the expenditure plan and the BSM program 
include the following: 

* During 2007, IRS made progress in implementing BSM projects and in 
meeting cost and schedule commitments for most deliverables, but three 
project milestones experienced significant cost and schedule delays. 
Specifically, reported project costs and completion dates showed that 
13 of the 14 associated project milestones that were scheduled for 
completion during this time were completed within 10 percent of cost 
estimates, and 11 of the 14 milestones were delivered within 10 percent 
of schedule estimates. However, a milestone for the Customer Account 
Data Engine (the new taxpayer information database) exceeded its 
planned schedule by 66 percent and experienced a 15 percent cost 
increase; another milestone for the same project incurred a 153 percent 
schedule delay, and a milestone for Modernized e-File (an electronic 
filing system) experienced a 41 percent schedule delay. 

* IRS continues to make progress in addressing high-priority BSM 
program improvement initiatives. This program improvement process 
continues to be an effective means of regularly assessing, 
prioritizing, and incrementally addressing BSM issues and challenges. 
Key focus areas for high-priority initiatives recently included IT 
human capital and information security. 

* Efforts are under way to address human capital challenges, but more 
work remains. IRS developed an IT human capital strategy that addresses 
hiring critical personnel, employee training, leadership development, 
and workforce retention, and stated that it plans to undertake a number 
of initiatives to support this strategy. However, a specific plan with 
time frames for implementing the initiatives has not been developed. 
Such a plan would help guide IRSís efforts in addressing IT human 
capital goals and would be useful in measuring progress in implementing 
the goals. 

What GAO Recommends: 

GAO recommends that the Commissioner of Internal Revenue direct the 
Chief Information Officer to complete a plan with specific time frames 
for implementing the initiatives supporting its information technology 
(IT) human capital strategy. In providing comments on a draft of this 
report, the Acting Commissioner agreed with the recommendation and 
outlined actions that IRS is planning to take to address it. IRS also 
provided technical comments. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.GAO-08-420]. For more information, contact David 
A. Powner at (202) 512-9286 or pownerd@gao.gov. 

[End of section] 

Contents: 

Letter: 

Recommendation for Executive Action: 

Agency Comments: 

Appendixes: 

Appendix I: Briefing Slides from the January 8, 2008, Briefing to the 
Senate and House Appropriations Subcommittee Staffs: 

Appendix II: Comments from the Internal Revenue Service: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 
Project Milestones: 

Abbreviations: 

AD: Applications Development: 

AMS: Accounts Management Services: 

BSM: Business Systems Modernization: 

CADE: Customer Account Data Engine: 

EA: enterprise architecture: 

ELC: enterprise life cycle: 

F&PC: Filing and Payment Compliance: 

IRS: Internal Revenue Service: 

IT: information technology: 

MeF: Modernized e-File: 

MV&S: Modernization Vision and Strategy: 

OMB: Office of Management and Budget: 

[End of section] 

March 7, 2008: 

The Honorable Richard J. Durbin: 
Chairman: 
The Honorable Sam Brownback: 
Ranking Minority Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations: 
United States Senate: 

The Honorable Josť E. Serrano: 
Chairman: 
The Honorable Ralph Regula: 
Ranking Minority Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations House of Representatives: 

As required by law, the Internal Revenue Service (IRS) submitted its 
fiscal year 2008 expenditure plan in August 2007 to the congressional 
appropriations committees, requesting $235.8 million from the Business 
Systems Modernization (BSM) account.[Footnote 1] Our objectives in 
reviewing the plan were to (1) determine whether the plan satisfied the 
conditions specified in the law,[Footnote 2] (2) determine IRS's 
progress in implementing our prior recommendations, and (3) provide any 
other observations about the plan and IRS's BSM program. 

On January 8, 2008, we briefed the cognizant congressional 
appropriations subcommittee staffs on the results of our review. This 
report transmits the materials we used at the briefing and provides the 
recommendation that we made to the Commissioner of Internal Revenue. 
The full briefing materials, including our scope and methodology, are 
included as appendix I. At the request of IRS, we have removed 
completion dates for project milestones planned for fiscal year 2008 
from the briefing because these dates were determined before funding 
was approved by Congress. 

In summary, we made the following major points: 

* IRS's fiscal year 2008 plan satisfies each of the six legislative 
conditions. These conditions include meeting the Office of Management 
and Budget's capital planning and investment control review 
requirements and complying with federal systems acquisition 
requirements and management practices. 

* IRS has taken steps to address our prior recommendations to improve 
its modernization management controls and capabilities, including 
adding a new focus area to its Modernization Vision and Strategy and 
defining and beginning to implement an approach for developing a 
quantitative measure of progress in meeting project scope expectations. 
However, work remains to fully implement our recommendations, including 
steps to complete the Modernization Vision and Strategy. 

* IRS has made progress in implementing BSM projects and in meeting 
cost and schedule commitments for most deliverables, but three project 
milestones[Footnote 3] experienced significant cost or schedule delays. 
During 2007, IRS completed milestones of the Filing and Payment 
Compliance (F&PC) (a tax collection case analysis support system), 
Modernized e-File (MeF) (an electronic filing system), Customer Account 
Data Engine (CADE) (the new taxpayer information database), and 
Accounts Management Services (AMS) (a system intended to provide 
applications for IRS employees and taxpayers to access, validate, and 
update accounts on demand). Our analysis of reported project costs and 
completion dates showed that 13 of the 14 associated project milestones 
that were scheduled for completion during this time were completed 
within 10 percent of cost estimates, and 11 of the 14 milestones were 
delivered within 10 percent of schedule estimates. However, a milestone 
for CADE exceeded its planned schedule by 66 percent and experienced a 
15 percent cost increase; another milestone for the same project 
incurred a 153 percent schedule delay; and a milestone for MeF 
experienced a 41 percent schedule delay (see fig. 1). 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 
Project Milestones: 

This figure is a bar graph showing summary of cost and schedule 
performances for fiscal year 2007 project milestones. 

[See PDF for image] 

Source: GAO analysis of IRS data. 

[End of figure] 

* Future BSM project releases continue to face significant risks and 
issues, which IRS is addressing. Specifically, the agency has 
identified significant risks and issues with planned system deliveries 
of CADE and AMS and reports that maintaining alignment between the two 
systems will be a significant challenge and source of risk for the BSM 
program. IRS recognizes the potential impact of identified risks and 
issues on its ability to deliver projects within cost and schedule 
estimates and has developed mitigation strategies to address them. 
While mitigation strategies have been developed, the risks and 
challenges confronting future releases of CADE and AMS are nevertheless 
significant, and we will continue to monitor them and actions to 
address them. 

* IRS continues to make progress in addressing high-priority BSM 
program improvement initiatives. This program improvement process 
continues to be an effective means of regularly assessing, 
prioritizing, and incrementally addressing BSM issues and challenges. 
In September 2007, IRS completed another cycle of initiatives and 
initiated a new cycle, which will be completed at the end of March 
2008. Initiatives that were addressed in the 6-month cycle ending in 
September 2007 included information technology (IT) human capital, 
information security, and process improvements (e.g., developing and 
implementing standardized earned value management[Footnote 4] practices 
for major projects). 

* Efforts to address human capital challenges continue, but more work 
remains. IRS developed an IT human capital strategy that addresses 
hiring critical personnel, employee training, leadership development, 
and workforce retention, and agency officials stated that they plan to 
undertake a number of human capital initiatives in support of their 
human capital strategy, including conducting analyses of turnover rates 
and continuing efforts to replace key leaders lost to retirement by 
expanding the Succession Management Program. However, a specific plan 
with time frames for implementing these initiatives has not been 
developed. Such a plan would help guide IRS's efforts in addressing its 
IT human capital gaps and be useful in measuring progress in 
implementing them. 

* Security weaknesses affect IRS's modernization environment. As we 
reported in November 2007,[Footnote 5] the agency continues to have 
weaknesses in its information security controls. In addition, IRS has 
identified security weaknesses through its high-priority initiatives 
program. While actions to address our report findings and the high- 
priority initiatives help to improve IRS's security posture, the 
modernization environment will continue to be at risk until the agency 
fully implements its security program. 

Recommendation for Executive Action: 

To allow for more effective congressional oversight of the BSM program, 
we recommend that the Commissioner of Internal Revenue direct the Chief 
Information Officer to complete a plan with specific time frames for 
implementing the initiatives supporting its IT human capital strategy. 
Such a plan would help guide IRS's efforts and measure progress in 
implementing them. 

Agency Comments: 

In providing written comments on a draft of this report, the Acting 
Commissioner of Internal Revenue agreed with our recommendation and 
outlined actions that IRS is planning to take to address it. IRS also 
provided technical comments which we addressed, as appropriate. The 
Acting Commissioner's written comments are reprinted in appendix II. 

We are sending copies of this report to the Chairmen and Ranking 
Minority Members of the Senate and House committees and subcommittees 
that have appropriations, authorization, and oversight responsibilities 
for the IRS. We are also sending copies to the Commissioner of Internal 
Revenue, the Secretary of the Treasury, the Chairman of the IRS 
Oversight Board, and the Director of OMB. We also will make copies 
available to others upon request. In addition, the report will be 
available at no charge on the GAO Web site at [hyperlink, 
http://www.gao.gov]. 

Should you or your offices have questions on matters discussed in this 
report, please contact me at (202) 512-9286 or at pownerd@gao.gov. 
Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. GAO staff who 
made key contributions to this report are listed in appendix III. 

Signed by: 

David Powner: 

Director, Information Technology Management Issues: 

[End of section] 

Appendixes: 

Appendix I Briefing Slides from the January 8, 2008, Briefing to the 
Senate and House Appropriations Subcommittee Staffs: 

Review of IRSís Fiscal Year 2008 Business Systems Modernization 
Expenditure Plan: 

Briefing for the Staffs of the Subcommittee on Financial Services and 
General Government Senate Committee on Appropriations and
Subcommittee on Financial Services and General Government House 
Committee on Appropriations: 

January 8, 2008: 

This briefing has been modified to incorporate editorial changes on 
pages 3, 4, 13, 18, 19, 22, and 37. At the request of IRS, we have also 
removed completion dates for project milestones planned for fiscal year 
2008 from the briefing because these dates were determined before 
funding was approved by Congress.

Briefing Contents: 

Introduction and Objectives; 

Results in Brief; 

Background; 

Scope and Methodology; 

Results; 

Conclusions; 

Recommendation for Executive Action; 

Agency Comments; 

Appendixes: 

* I Ė Description of Business Systems Modernization Projects and 
Program-level Initiatives; 

* II Ė Additional Detail on IRSís Fiscal Year 2008 BSM Expenditure 
Plan; 

* III Ė IRS Reported Project Cost/Schedule Changes for Projects 
Scheduled for Completion in Fiscal Year 2007; 

Introduction and Objectives: 

The Internal Revenue Service (IRS) has long relied on obsolete 
automated systems for key operational and financial management 
functions, and its attempts to modernize these computer systems span 
several decades. IRSís multibillion-dollar Business Systems 
Modernization (BSM) program, initiated in fiscal year 1999, is the 
agencyís latest attempt to modernize its systems. IRS contracted with 
Computer Sciences Corporation as the PRIME systems integration support 
contractor to assist with designing, developing, and integrating a new 
set of information systems that are intended to replace IRSís aging 
business and tax processing systems. BSM is a high-risk, highly complex 
program that involves the development and delivery of a number of 
modernized tax administration, internal management, and core 
infrastructure projects that are intended to provide improved and 
expanded service to taxpayers and internal business efficiencies for 
IRS. 

Under the Financial Services and General Government Appropriations Act, 
2008,[Footnote 6] appropriations for the IRS BSM program for fiscal 
year 2008 are not available for obligation (except for labor costs) 
until IRS submits a modernization expenditure plan to the congressional 
appropriations committees and obtains their approval. This plan must:  

* meet the capital planning and investment control review requirements 
established by the Office of Management and Budget (OMB); 

* comply with IRSís enterprise architecture;[Footnote 7] 

* conform with IRSís enterprise life cycle methodology;[Footnote 8] 

* comply with federal acquisition rules, requirements, guidelines, and 
systems acquisition management practices;

* be approved by IRS, the Department of the Treasury, and OMB; and: 

* be reviewed by GAO. 

Since mid-1999, IRS has submitted a series of expenditure plans 
requesting release of BSM-appropriated funds. To date, about $2.3 
billion has been appropriated and released for BSM. 

On August 13, 2007, IRS submitted its fiscal year 2008 expenditure plan 
to the relevant House and Senate appropriations subcommittees, seeking 
release of $235.8 million from the BSM account.[Footnote 9] 

As agreed with IRSís appropriations subcommittees, our objectives were 
to: 

* determine whether IRSís fiscal year 2008 expenditure plan satisfies the 
legislative conditions specified in IRSís appropriations,

* determine IRSís progress in implementing our prior expenditure plan 
review recommendations, and: 

* provide any other observations about the plan and the BSM program. 

Results in Brief: 

IRSís fiscal year 2008 plan satisfies each of the six legislative 
conditions. 

IRS has taken steps to address our prior recommendations to improve its 
modernization management controls and capabilities, including adding a 
new focus area to its Modernization Vision and Strategy and defining 
and beginning to implement an approach for developing a quantitative 
measure of progress in meeting project scope expectations. However, 
steps remain to fully implement our recommendations. Until our 
recommendations are fully implemented, the risk that IRSís 
modernization program will not be managed effectively will remain and 
Congress may not have the information it needs to effectively assess 
IRSís performance in implementing BSM. 

We have five observations related to the BSM program and fiscal year 
2008 expenditure plan: 

IRS has made progress in implementing BSM projects and in meeting cost 
and schedule commitments for most deliverables, but three project 
milestones[Footnote 10] experienced significant cost and/or schedule 
delays. During 2007, IRS completed milestones of Filing and Payment 
Compliance (a tax collection case analysis support system), Modernized 
e-File (MeF) (an electronic filing system), Customer Account Data 
Engine (CADE) (the new taxpayer information database), and Accounts 
Management Services (AMS) (a system intended to provide applications 
for IRS employees and taxpayers to access, validate, and update 
accounts on demand). Our analysis of IRSí reported project costs and 
completion dates showed that 13 of the 14 associated project milestones 
that were scheduled for completion during this time were completed 
within 10% of cost estimates and 11 of the 14 milestones were delivered 
within 10% of schedule estimates. However, a milestone for CADE 
exceeded its planned schedule by 66% and experienced a 15% cost 
increase; another milestone for the same project incurred a 153% 
schedule delay, and a milestone for MeF experienced a 41% schedule 
delay. 

Future BSM project releases[Footnote 11] continue to face significant 
risks and issues, which IRS is addressing. IRS has identified 
significant risks and issues with planned system deliveries of CADE and 
AMS. For example, IRS reported that integration testing and system 
acceptance testing for the release of CADE intended to support taxpayer 
returns processing for the 2008 filing season was in jeopardy partly 
because of delays resulting from, among other things, defects and data 
errors that required correction. IRS recognizes the potential impact of 
identified risks and issues on its ability to deliver projects within 
cost and schedule estimates, and has developed mitigation strategies to 
address them. While IRS has developed mitigation strategies, the risks 
and challenges confronting future releases of CADE and AMS are 
nevertheless significant and we will continue to monitor them and IRSís 
actions to address them. 

IRS continues to make progress in addressing high-priority BSM program 
improvement initiatives. IRSís program improvement process continues to 
be an effective means of regularly assessing, prioritizing, and 
incrementally addressing BSM issues and challenges. In September 2007, 
IRS completed another cycle of initiatives and initiated a new cycle, 
which will be completed at the end of March 2008. Initiatives that are 
currently being addressed include standardizing the use of earned value 
management[Footnote 12] across major projects. 

Efforts to address human capital challenges continue, but more work 
remains. IRS stated that it plans to undertake a number of human 
capital initiatives during fiscal year 2008 and beyond in support of 
its human capital strategy, including conducting analyses of turnover 
rates and continuing efforts to replace key leaders lost to retirement 
by expanding its Succession Management Program. However, a specific 
plan with time frames for implementing these initiatives has not been 
developed. Such a plan would help guide IRSís efforts in addressing its 
information technology (IT) human capital gaps and be useful in 
measuring progress in implementing them. 

Security weaknesses affect IRSís modernization environment. As we 
reported in November 2007, IRS continues to have weaknesses with its 
information security controls.[footnote 13] In addition, IRS has 
identified security weaknesses through its high priority initiatives 
program. While actions to address our report findings and the high 
priority initiatives help to improve IRSís security posture, the 
modernization environment will continue to be at risk until the agency 
fully implements its security program. 

To allow for more effective congressional oversight of the BSM program, 
we are recommending that the Commissioner of Internal Revenue direct 
the Chief Information Officer to complete a plan with specific time 
frames for implementing the initiatives supporting its human capital 
strategy. Such a plan would help guide IRSís efforts and measure 
progress in implementing them. 

In e-mail comments on a draft of this briefing, the Associate Chief 
Information Officer for Applications Development stated that it 
addresses many of BSMís positive accomplishments from 2007. She also 
provided clarifying and technical comments that we addressed, as 
appropriate. 

Background: 

Since 1999, we have reviewed and reported on 14 BSM expenditure plans. 
In particular, we have reported on program management capabilities and 
controls that are critical to the effective management of the BSM 
program. They include: 

* cost and schedule estimates: we reported that IRS did not have 
effective procedures for validating contractor-developed cost and 
schedule estimates;[Footnote 14] 

* contract management: we reported that IRS did not have effective 
processes for determining the type of task order to be awarded in 
acquiring modernized systems;[Footnote 15] 

* requirements development and management: we reported that IRS did not 
have adequate policies and procedures in place to guide its system 
modernization projects in developing and managing 
requirements;[Footnote 16] and: 

* post implementation reviews: we reported that post implementation 
reviews conducted were incomplete and did not follow IRS procedures. 
[Footnote 17]  

In our reports, we have made recommendations aimed at strengthening 
IRSís program management controls and capabilities. Over the years, IRS 
has addressed several of these recommendations. However, more work 
remains for some capabilities and controls to be fully 
institutionalized or implemented. 

IRSís Applications Development (AD) organization has primary 
responsibility for managing and delivering the BSM program. This group, 
within the Office of the Chief Information Officer, was established in 
2006 and integrates Business Systems Modernizationówhose primary 
mission was delivering IRS modernizationówith the Business Systems 
Development Divisionówhose primary focus was maintaining the current 
production systems environment. It is headed by the Associate Chief 
Information Officer for Applications Development. 

The AD organization includes three core competency areas: 

Domains: focus on a major functional mission area of the IRS that 
provides IT legacy and modernized systems in support of the business 
(e.g., Compliance and Customer Service). 

Matrix domains: support functions for the primary operating domains and 
are tasked with improving the effectiveness of AD operations (e.g., the 
Test, Assurance, and Documentation Office and the Program Management 
Office).

Front office teams: perform administrative, human resources, and 
financial management functions for the entire organization (e.g., 
Resource Management). 

IRSís fiscal year 2008 expenditure plan describes the agencyís efforts 
to: 

* continue ongoing program-level initiatives (e.g., architecture and 
integration and program management) and core infrastructure projects 
(e.g., infrastructure shared services), 

* fund internal management projects (i.e., common services),[Footnote 18] 

* continue nine tax administration project releases to their next 
milestones, and: 

* begin five new tax administration project releases. 

Key tax administration projects include: 

* Modernized e-File, which is to provide a single standard for filing 
electronic tax returns; 

* Customer Account Data Engine, which is intended to provide the 
modernized database foundation to replace the existing Individual 
Master File processing system that contains the repository of 
individual taxpayer information; and: 

* Accounts Management Services, which is intended to enhance the Customer 
Account Data Engine by providing applications for IRS employees and 
taxpayers to access, validate, and update accounts on demand. 

Details on these and other BSM projects and program-level initiatives 
are provided in appendix 1. 

Table 1 shows a financial summary of the plan. 

Table 1: Summary of IRSís Fiscal Year 2008 BSM Expenditure Plan[A]  

Tax administration projects: Modernized e-File; 
Amount requested (in thousands): $55,802. 

Tax administration projects: Customer Account Data Engine; 
Amount requested (in thousands): $58,500. 

Tax administration projects: Accounts Management Services; 
Amount requested (in thousands): $28,983. 

Subtotal-tax administration projects; 
Amount requested (in thousands): $143,285. 

Core infrastructure projects: Development, Integration, and Testing 
Environments; 
Amount requested (in thousands): $13,167. 

Core infrastructure projects: Infrastructure Shared Services; 
Amount requested (in thousands): $25,983. 

Subtotal-core infrastructure projects; 
Amount requested (in thousands): $39,150. 

Architecture, integration, and management: Architecture and 
integration; 
Amount requested (in thousands): $13,784. 

Architecture, integration, and management: Business integration; 
Amount requested (in thousands): $4,753. 

Architecture, integration, and management: Business rules; 
Amount requested (in thousands): $3,169.

Architecture, integration, and management: Management processes; 
Amount requested (in thousands): $3,549.

Architecture, integration, and management: Federally funded research 
and development center; 
Amount requested (in thousands): $6,883.

Architecture, integration, and management: Program management; 
Amount requested (in thousands): $2,962.

Subtotal-architecture, integration, and management; 
Amount requested (in thousands): $35,100.

Internal management projects; 
Amount requested (in thousands): $16,000. 

Management reserve; 
Amount requested (in thousands): $2,310. 

Total; 
Amount requested (in thousands): $235,845.

Source: IRS.

[A] See appendix II for additional details on the plan. 

[End of figure] 

Scope and Methodology: 

To accomplish our objectives, we: 

* reviewed the fiscal year 2008 expenditure plan submitted by IRS in 
August 2007;[Footnote 19] 

* analyzed the plan for compliance with the legislative conditions; 

* interviewed IRS program and project management officials to corroborate 
our understanding of the plan and other BSM activities; 

* analyzed available evidence on recent agency efforts to implement our 
prior recommendations, including progress on improving its 
modernization management controls and capabilities; 

* reviewed and analyzed modernization program review and project 
management briefings and related documentation to assess 
program/project status and associated issues and risks; and: 

* reviewed program management reports to assess the progress IRS has made 
in completing actions and implementing program management improvements 
related to the BSM highest priority initiatives. 

To assess the reliability of the cost and schedule information 
contained in this expenditure plan, we interviewed IRS officials in 
order to gain an understanding of the data and discuss our use of the 
data. In addition, we checked that information in the plan was 
consistent with information contained in IRS internal briefings. We did 
not, however, assess the accuracy and reliability of the information 
reported in these briefings.

We performed our work between September and December 2007, in 
Washington, D.C., in accordance with generally accepted government 
auditing standards. 

Results: 

Legislative Conditions: 

Objective 1: The plan satisfies the conditions applicable to IRSís 
fiscal year 2008 appropriations. 

Table 2: Fiscal Year 2008 Expenditure Plan Provisions for Satisfying 
Legislative Conditions: 

Legislative conditions: 1. Meets OMB capital planning and investment 
control review requirements; 
Expenditure plan provisions: IRSís fiscal year 2008 expenditure plan 
identifies funding for managing IT investments as part of a single
portfolio through its capital planning and investment control process. 
This includes conducting periodic reviews to select and control IT 
investments. IRS also stated that it plans to conduct post 
implementation reviews on CADE release 2.2 in mid-fiscal year 2008 and 
on AMS release 1.1 at the end of fiscal year 2008. These planned 
actions are consistent with OMB capital planning and investment control 
review requirements.  

Legislative conditions: 2. Complies with IRSís enterprise architecture; 
Expenditure plan provisions: The plan identifies funding for complying 
with IRSís enterprise architecture by providing for continued
definition and implementation of the EA. For example, it identifies 
funding needed for:

* finalizing and publishing updates to the EA based on change requests,

* supporting the performance of EA compliance certification activities, 
and: 

* improving the IRS enterprise transition strategy and release 
architecture. 

Legislative conditions: 3. Conforms with IRSís enterprise life cycle 
(ELC) methodology; 
Expenditure plan provisions: The plan conforms with IRSís enterprise 
life cycle methodology in that it calls for meeting the requirements in
IRSís ELC management program. For example, the plan calls for: 

* maintaining responsibility for coordinating, tracking, and 
integrating all programwide costs, schedules, releases, issues, and 
risks and: 

* maintaining and enhancing the ELC. For example, according to the 
plan, IRS intends to update the ELC to reflect modifications to testing 
policies, procedures, processes, plans, and schedule due to the
assumption of the integrator role. 

Legislative conditions: 4. Complies with the acquisition rules, 
requirements, guidelines, and systems acquisition management practices 
of the federal government; 
Expenditure plan provisions: As part of the ELC, IRS has defined 
processes, roles, and responsibilities for implementing Carnegie Mellon
Universityís Software Engineering Institute Software Acquisition 
Capability Maturity ModelTM practices for the key process areas within 
the repeatable level (level 2) of the 5-stage model.a These practices 
are consistent with federal acquisition requirements and management 
practices, and the plan calls for implementation of the ELC on all 
projects. 

Legislative conditions: 5. Approved by IRS, the Department of the 
Treasury, and OMB; 
Expenditure plan provisions: 
* IRSóJuly 30, 2007; 
* TreasuryóAugust 3, 2007; 
* OMBóAugust 2, 2007. 

Legislative conditions: 6. Reviewed by GAO; 
Expenditure plan provisions: 
* GAOóJanuary 8, 2008, briefing to IRSís appropriations subcommittees. 

Source: The Financial Services and General Government Appropriations 
Act, 2008, appropriations for IRSís BSM program for fiscal years 2008-
2010, as provided in the Consolidated Appropriations Act, 2008, Pub. L. 
No. 110-161, div. D, title 1, 121 Stat. 1844, 1972 (Dec. 26, 2007), and 
IRSís fiscal year 2008 expenditure plan submitted to Congress in August 
2007. 

[A] These key process areas are acquisition planning, solicitation, 
requirements development and management, project management, contract 
tracking and oversight, evaluation, and transition to support. For this 
condition, we did not determine whether the expenditure plan comports 
with the Federal Acquisition Regulation or other federal requirements 
beyond those encompassed by the Software Engineering Instituteís 
Capability Maturity Model. 

[End of table] 

Prior Recommendations Status: 

Objective 2: IRS has made progress in addressing recommendations to 
improve its modernization management controls and capabilities, but 
steps remain to fully implement them. 

During 2007, IRS made progress in addressing our recommendations to 
improve its modernization management controls and capabilities from 
prior expenditure plan reviews. For example, it has developed and begun 
to implement an approach for developing a quantitative measure of scope 
performance. However, steps remain to fully implement them. 

Table 3: Status of IRSís Progress in Implementing Prior GAO 
Recommendations Prior GAO recommendations: 

Prior GAO Recommendations: Requirements development and 
managementóEnsure that BSM completes the delivery of policies and
procedures for requirements development and management as planned; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See p. 15. 

Prior GAO Recommendations: Post implementation reviewsóPerform analyses 
of investment data to determine whether completed projects have 
achieved expected benefits; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See p. 16. 

Prior GAO Recommendations: Modernization vision and strategyóFully 
revisit the vision and strategy for the BSM program and develop a
new set of long-term goals, strategies, and plans that
are consistent with the budgetary outlook and IRSís
management capabilities; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See pp. 17. 

Prior GAO Recommendations: Quantitative measures of progress in 
scopeóEnsure that future expenditure plans include a quantitative
measure of progress in meeting project scope
expectations; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See pp. 18-19. 

Source: GAO analysis of IRS data. 

[End of table] 

Requirements Development and Management: 

In March 2006, we recommended that IRS complete requirements 
development and management policies and procedures.[Footnote 20] IRS 
agreed with our recommendation, and in response, developed policies, 
procedures, and tools for developing and managing project requirements 
through its Business Rules and Requirements Management office. 
Specifically, IRS developed (1) a standardized process for the 
elicitation and documentation of requirements; (2) guidance on 
establishing and maintaining full bidirectional requirements 
traceability; (3) guidance on tracking cost and schedule impacts of 
changes to requirements; and (4) a process for ensuring that formal 
peer reviews are planned and completed for key requirements. IRS stated 
that it started using these policies, procedures, and tools to manage 
requirements for several projects, including CADE and AMS, and that it 
plans to deploy the capabilities it has developed to a wider range of 
projects and also develop programwide reusable requirements during 
fiscal year 2008. We are currently reviewing the policies, procedures, 
and tools that IRS has developed to determine the extent to which they 
address our recommendations.

Post Implementation Reviews: 

In November 2004, we recommended that post implementation reviews of 
deployed BSM projects include an analysis of quantitative and 
qualitative investment data to determine whether expected benefits were 
achieved.[21] IRS agreed with our recommendation, and, in response 
developed a new procedure for conducting PIRs and conducted a pilot PIR 
which identified process improvement opportunities. IRS also recently 
stated that, due to fiscal year 2007 constraints and other priorities, 
it plans to conduct streamlined PIRs on CADE release 2.2 and AMS 
release 1.1 12-18 months after those releases are deployed. 
Specifically, for CADE release 2.2, IRS expects to conduct the PIR in 
mid-fiscal year 2008, and for AMS release 1.1, it expects to start the 
PIR at the end of the fiscal year. For other projects, IRS stated that 
it would conduct lessons learned activities and implement changes based 
on those activities. We believe that these are reasonable plans given 
resource constraints and other priorities and will monitor IRSís 
actions to implement them.

Modernization Vision and Strategy: 

In July 2005, we recommended that IRS fully revisit the vision and 
strategy for the BSM program and develop a new set of long-term goals, 
strategies, and plans consistent with the budgetary outlook and IRSís 
management capabilities.[Footnote 22] We also noted that the vision and 
strategy should include time frames for consolidating and retiring 
legacy systems. IRS agreed with our recommendation, and, in response, 
developed an initial cycle of its Modernization Vision and Strategy 
(MV&S) and 5-year enterprise transition strategy in fiscal year 
2006[Footnote 23] to guide IT investment decisions during fiscal years 
2007 through 2011. The MV&S framework was built on a functional 
segmentation of IRS into core mission business functions (business 
domains) supported by services necessary for their effective and secure 
execution (service domains). The Enterprise Transition Strategy 
described the overall IRS vision and strategy and how existing and 
proposed investments align to it. It also documented the scope, 
business challenges, current and transition architectures, redesign 
opportunities, strategy, proposed projects and associated release 
strategies, and the planned evolution (i.e., reuse, consolidation, 
retirement) of related key current production environment systems for 
each of the MV&S business domains. During 2007, IRS updated its 5-year 
Enterprise Transition Strategy.[Footnote 24] The strategy includes 
security and privacy (a new service domain), planned business domains, 
and opportunities for retirement. IRS also developed an initial list of 
systems for consolidation and retirement for fiscal year 2008 but 
stated that it plans to develop a methodology for doing this on an 
annual basis. IRS also stated that it is building on the current 
retirement efforts by application development and efforts to address 
OMBís directive for a segment architecture for each business domain in 
2008 for the filing payment and compliance business domain. Lessons 
learned from this activity are to be incorporated into the methodology 
for retiring and consolidating systems. While these actions are 
positive steps, actions remain for IRS to fully address our 
recommendation, including developing long-term plans for completing BSM 
and finalizing and implementing the methodology for consolidating and 
retiring legacy systems. 

Quantitative Measure of Progress in Meeting Scope Expectations: 

In February 2007, we recommended that IRS ensure that future 
expenditure plans include a quantitative measure of progress in meeting 
scope expectations.[Footnote 25] We also recommended that, in 
developing this measure, IRS consider using earned value management 
[Footnote 26] since this is a proven technique required by 
OMB for measuring cost, schedule, and functional performance (i.e., 
scope of work) against plans. While IRS agreed with our recommendation 
to develop a quantitative measure of progress in meeting scope 
expectations, it has stated that it does not believe earned value 
management would provide this measure, given the manner in which the 
technique is being used at the agency.[Footnote 27] Instead, IRS has 
developed an incremental approach to address our recommendation. 
Specifically, as an initial step, it has proposed a more detailed 
qualitative measure than previously used that would consist in showing 
the difference between a project releaseís planned and delivered 
capabilities. This was implemented in the fiscal year 2008 expenditure 
plan. As a next step, IRS stated that it plans to leverage its 
requirements management tools to assign quantitative values to the 
capabilities. IRS intends to implement this approach for the fiscal 
year 2009 expenditure plan. While these are steps in the right 
direction, until IRS fully implements them, Congress may not have the 
information it needs to effectively assess IRSís performance in 
implementing BSM. For the long-term, IRS should consider using earned 
value management to measure progress in meeting scope expectations as 
required by OMB policy as this is a proven technique for doing so. 

Observations: 

Objective 3: Observations about IRSís BSM Program and Expenditure Plan 
Observation 1: IRS made additional progress in implementing BSM 
projects and in meeting cost and schedule commitments for most 
deliverables, but three project milestones experienced significant cost 
and/ or schedule delays. 

During 2007, IRS completed releases and milestones of its modernized 
systems that have provided benefits to the taxpayers and the agency. 
For example, according to IRS, 

Release 1.1 of F&PC provides IRS with an automated standalone system 
used to analyze tax collection cases and route selected cases to 
private collection agencies and then tracks their success in resolving 
the cases. 

Release 1.2 of F&PC was completed and became the first modernized 
application to use the enterprise application integration 
broker[Footnote 28] for integration with the legacy systems in support 
of assigning cases to private collection agencies. This release fully 
implemented inventory management capabilities using the IRS 
infrastructure and during fiscal year 2007, according to IRS officials, 
gross revenue received as a result of the Private Debt Collection 
program amounted to approximately $31 million. 

Release 4 of MeF allows the processing of Form 1065 (U.S. Return of 
Partnership Income), 1065-B (U.S. Return of Income for Electing Large 
Partnerships) and associated forms and schedules for tax year 2006 
submissions.

Release 1.2 of AMS includes a new inventory and workflow that automates 
the assignment, research, resolution, and closure for internally 
generated cases currently worked in a paper-based manual process. 

Release 1.3 of AMS provides for the migration of current platform and 
software products to the enterprise architecture standard products. 

IRS continued to make progress in meeting cost and schedule commitments 
for completing project milestones during 2007, but 3 of the 14 project 
milestones that were scheduled to be completed experienced significant 
cost and/or schedule delays. Specifically, our analysis of IRSís 
reported project costs and completion dates shows that 13 of the 14 
associated project milestones that were scheduled for completion during 
this time were completed within 10% of cost estimates and 11 of the 14 
milestones were delivered within 10% of schedule estimates. However, a 
milestone for CADE release 2.2 exceeded its planned schedule by 66% and 
experienced a15% cost increase; a milestone for MeF release 5 
experienced a 41% schedule delay; and a milestone for CADE release 3 
incurred a 153% schedule delay. Figure 1 shows the cost and schedule 
variances of the project milestones that were scheduled to be delivered 
during fiscal year 2007. 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 
Project Milestones: 

This figure is a bar graph showing the summary of cost and schedule 
performance for fiscal year 2007 project milestones. 

[See PDF for image] 

Source: GAO analysis of IRS data. 

Note: Variances for projects through milestone 3 are based on rough 
order of magnitude estimates. Post-milestone 3 variances are based on 
more specific estimates. 

[End of figure] 

Following are details on the project milestones that experienced 
significant cost and/or schedule delays: 

* CADE: Release 2.2 of CADE began supporting the 2007 filing season in 
March but completed milestone 4 (development) 123 days behind schedule. 
This delay amounted to a 66% increase over the planned schedule for 
completing milestone 4 and was accompanied by a final cost that was 15% 
greater than budgeted. According to IRS, the overrun was caused by the 
complexity of the requirements, which extended the requirements 
elicitation process and delayed the physical design phase and resulted 
in delays through the rest of the development life cycle. The delay in 
full implementation impacted the number of returns that could be 
processed through the speedier CADE system. IRS had originally intended 
CADE to post 33 million taxpayer returns during the 2007 filing season 
(more than four times the estimated 7.4 million posted by CADE during 
2006), but as of September, the system had posted only about 11.2 
million returns. 

The demand on available resources to complete release 2.2 also impacted 
the planned schedule for subsequent releases of CADE. As a result, 
milestone 3 of release 3 of CADE was completed 214 days behind schedule.

* MeF: Milestone 3 of release 5 of MeF was completed 30 days behind 
schedule.[Footnote 29] According to IRS, this was due primarily to 
delays in getting started that occurred early in the design phase and 
IRS is currently indicating no change in the projected completion date 
for milestones 4 and 5. Details on the cost and schedule status of 
project releases as reported by IRS are in appendix III. 

Observation 2: Future BSM project releases continue to face significant 
risks and issues, which IRS is addressing. 

IRS has reported that challenges and risks continue to confront future 
planned project releases. For example: 

CADE: The August 2007 results of an independent assessment IRS 
commissioned to examine its plans for completing the core functionality 
of the release of CADE intended to support taxpayer returns processing 
starting in January 2008 (release 3.2) noted the following concerns: 

* the potential lack of resource availability with parallel testing 
activities; 

* the insufficient use of project management and control artifacts to 
help identify where schedule risk exists and facilitate predicting the 
outcome; and: 

* the lack of a detailed, executable contingency plan in the event 
significant difficulty is encountered in delivering the release. 

In addition, as of September, IRS reported that integration testing for 
the first build[Footnote 30] was in jeopardy due to delays resulting in 
part from defects and data errors that required correction. Systems 
acceptance testing for data conversion was also in jeopardy. 

Future releases of AMS: IRS reports that future releases of AMS are 
expected to increase in complexity. According to IRS, maintaining 
alignment between the CADE and AMS programs will also be a significant 
challenge and source of risk for the BSM program, and will require 
careful monitoring and management of both programs. 

IRS recognizes the potential impact of these project risks and issues 
on its ability to deliver planned functionality within cost and 
schedule estimates, and has developed mitigation strategies to address 
them. For example, to address the risks and issues confronting CADE 
release 3.2, IRS developed a task network for use in managing risk and 
also began working with the PRIME contractor to develop detailed 
contingency plans in the event that delivery of this release becomes 
seriously threatened. Status meetings are also held weekly to ensure 
early visibility of potential problems and to optimize the opportunity 
to devise and implement effective mitigating strategies. ďTiger teamsĒ 
were also established to help minimize schedule delays in both these 
areas. The independent assessment of CADE release 3.2 noted that, as a 
result of the mitigation steps being taken, there was no reason to 
shift directions for the release, and IRS officials stated that they 
expect to deploy the release on time for the filing season. To address 
the challenge of maintaining alignment between CADE and AMS releases, 
IRS developed a release content master plan that defines the 
relationship between releases of CADE and AMS. According to IRS, 
several factors, stemming largely from the delay in deployment of CADE 
release 2.2, have led to a need to modify the plan. During our review, 
IRS told us that this plan would be updated by November 2007. However, 
as of December, officials reported that it was still undergoing review. 

While IRS has developed mitigation strategies, the risks and challenges 
facing future releases of CADE and AMS are nevertheless significant and 
we will continue to monitor them and IRSís actions to address them. 

Observation 3: IRS continues to make progress in addressing high-
priority BSM program improvement initiatives. 

IRSís high-priority program improvement initiatives process[Footnote 
31] continues to be an effective means of regularly assessing, 
prioritizing, and incrementally addressing BSM issues and challenges. 
In September 2007, IRS completed another cycle of high priority 
initiatives and is currently working on a cycle that is scheduled to be 
completed by the end of March 2008. The key focus areas for the most 
recent cycle included: 

* human capital improvements (developing succession and staffing plans 
across organizational levels and reducing the hiring gap), 

* security improvements (updating the ELC to embed security processes, 
procedures, and tools throughout the entire life cycle), and: 

* process improvements (developing and implementing standardized earned 
value management practices for all major applications development 
projects). 

Observation 4: Efforts are under way to address human capital 
challenges, but more work remains. 

In March 2007, IRS developed the Applications Development Strategic 
Plan 2007-2011[Footnote 32] to establish a road map to ensure that 
applications development decisions are focused on delivering the 
mission in a manner consistent with the organizationís vision. This 
document includes a human capital strategy that addresses hiring 
critical personnel, employee training, leadership development, and 
workforce retention. 

To support this strategy, IRS undertook high priority initiatives, 
including convening a tiger team to identify challenges to the hiring 
process and establishing the Executive Hiring Council to coordinate 
recruitment actions and strategies to address the hiring gap for the 
Modernization Information Technology Services organization. In 
addition, IRS stated that during fiscal year 2008, it plans to conduct 
analyses of turnover rates, use a cost index model to determine the 
cost and drivers of turnover, and increase the hiring base for mission 
critical positions through automation, simplification of the 
application process, and the use of hiring incentives and continue its 
efforts to quickly replace key leaders lost to retirement by expanding 
its Succession Management Program and expanding use of its Leadership 
Succession Review tool to levels below senior executive. 

While IRS has identified these initiatives, it has not developed a 
specific plan, including time frames for addressing them across the AD 
organization. During our review, officials told us that such a plan 
would be completed by the end of fiscal year 2007. However, it was not 
completed by that date, and IRS has not specified a new completion 
date. Until IRS develops a plan for addressing its various human 
capital initiatives, it may be challenged in having the staff resources 
it needs to effectively support BSM. 

Observation 5: Security weaknesses affect IRSís modernization 
environment. 

IRS has security weaknesses affecting its modernization environment. 
Specifically, in November 2007, we reported that IRS continued to have 
weaknesses with its information security controls.[Footnote 33,34] For 
example, we noted that there were significant control weaknesses that 
allowed unauthorized users to access sensitive information, including 
user IDs, passwords, and software code for mission critical 
applications without having to login to the network. We identified a 
key reason for the presence of these and other weaknesses as the lack 
of a fully implemented security program. 

In written comments on a draft of our report, IRSís Deputy Commissioner 
agreed that our report fairly represented IRSís challenges and noted 
actions it has taken to address the issues we identified including 
establishing the Office of Privacy, Information Protection, and Data 
Security to provide direction and oversight of the security and 
protection of sensitive information; developing an integrated IT 
security schedule and plan and a comprehensive IRS security strategy; 
and encrypting all laptop data and tapes used in electronic data 
exchange, and implementing an enterprise anti-virus Internet gateway 
solution to detect and quarantine malicious content from invading 
systems. 

IRS has also identified security weaknesses through its high priority 
initiatives program, and, to its credit, it is working to address them. 
For example, through this program, IRS recently updated its enterprise 
life cycle methodology to incorporate processes, procedures, and tools 
into the early stages of the enterprise life cycle.[Footnote 35] 
Through its high priority initiatives program, IRS is also addressing 
these three additional security practices across the enterprise life 
cycle: 

Implementing the first phase of a comprehensive audit trails program. 
This effort will establish program- level requirements and create 
release plans that apply to enterprise audit trail capture, storage, 
and management for all IRS Federal Information Security Management Act 
systems. 

Realigning the Modernization Information Technology Services General 
Support Systems boundaries to improve security accountability and 
ensure that acceptable levels of security are maintained. 

Establishing an enterprisewide strategy and phased implementation plan 
to automate security posture monitoring for major systems and network 
platforms. Develop security posture monitoring plans that address the 
compliance of security configurations, vulnerability management, and 
patch management. 

While actions to address our report findings and the high priority 
initiatives help to improve its security posture, IRSís modernization 
environment will continue to be at risk until the agency fully 
implements its security program.

Conclusions: 

During 2007, IRS continued to make progress in delivering BSM projects 
that provided benefits to both taxpayers and the agency. IRS also 
continued to improve its management capabilities and controls by, among 
other things, taking steps to address our recommendations from prior 
expenditure plan reviews and addressing its high priority initiatives. 
These actions will likely result in more effective management of BSM 
and help mitigate the risks inherent in managing such a large and 
complex program. However, IRS is still facing significant challenges in 
consistently meeting its cost and schedule commitments, managing 
project- specific risks, addressing high priority initiatives, and 
securing its many systems. In addition, it has not yet fully 
implemented recommendations we have made. To bolster its human capital 
efforts, IRS has developed a strategy to address hiring critical 
personnel, employee training, leadership development, and workforce 
retention. However, a specific plan with time frames for implementing 
initiatives supporting this strategy has not yet been developed. 

Recommendation for Executive Action: 

To allow for more effective congressional oversight of the BSM program, 
we are recommending that the Commissioner of Internal Revenue direct 
the Chief Information Officer to complete a plan with specific time 
frames for implementing the initiatives supporting its human capital 
strategy. Such a plan would help guide IRSís efforts and measure 
progress in implementing them. 

Agency Comments: 

In e-mail comments on a draft of this briefing, the Associate Chief 
Information Officer for Applications Development stated that it 
addresses many of BSMís positive accomplishments from 2007. She also 
provided clarifying and technical comments that we addressed, as 
appropriate. 

Appendix I: 

Table: Description of BSM Projects and Program-level Initiatives: 

Proposed modernization initiative: Tax administration projects: 
Modernized e-File; 
Description: Is to provide a single standard for filing electronic tax 
returns. Initial releases will address large corporations, small 
businesses, and tax-exempt organizations. Its ultimate goal is the 
conversion of IRSís 1040 e-file program. 
 
Proposed modernization initiative: Tax administration projects: 
Customer Account Data Engine; 
Description: Is to build the modernized database foundation to replace 
the existing Individual Master File processing system that contains the 
repository of individual taxpayer information. Accounts Management 
Services Is to deliver improved customer support and functionality by 
leveraging existing IRS applications (Desktop Integration and 
Correspondence Imaging System) and new technologies to bridge the gap 
between modernization initiatives, such as the Customer Account Data 
Engine and legacy systems. Accounts Management Services is to enhance 
the Customer Account Data Engine by providing applications for IRS 
employees and taxpayers to access, validate, and update accounts on 
demand. 
 
Proposed modernization initiative: Tax administration projects: 
Internal management projects; 
Description: Is to provide a new portal infrastructure. The 
infrastructure will replace the existing three vendor-hosted external 
portals, whose contracts expired in May 2006. 
 
Proposed modernization initiative: Internal management projects: Common 
Services; 
Description: Is to provide a new portal infrastructure. The 
infrastructure will replace the existing three vendor-hosted external 
portals, whose contracts expired in May 2006. 

Proposed modernization initiative: Core infrastructure projects: 
Development, Integration, and Testing and Environments; 
Description: Is to provide oversight for laboratory environments that 
support evaluation, development, Environments and testing of components 
from multiple projects: (1) Virtual Development Environment provides a 
software development environment and a standardized set of tools and 
(2) Enterprise Integration and Test Environment provides an integration 
and testing environment for all projects. 

Proposed modernization initiative: Core infrastructure projects: 
Infrastructure Shared Services; 
Description: Is to deliver, in incremental releases over multiple 
years, a fully integrated, shared IT infrastructure to include 
hardware, software, shared applications, data, telecommunications, 
security, and an enterprise approach to systems and operations 
management.

Proposed modernization initiative: Architecture, integration, and 
management: Architecture and integration; 
Description: Is to ensure that systems solutions meet IRS business 
needs and that the development projects are effectively integrated into 
the business environment. 

Proposed modernization initiative: Architecture, integration, and 
management: Business integration; 
Description: Is to ensure that IRSís BSM program is aligned with the 
business unitsí vision and delivers the desired business results. It 
provides support to key activities such as transition management, 
business rules enterprise management, and requirements development and 
management operations. 
 
Proposed modernization initiative: Architecture, integration, and 
management: Business rules; 
Description: Is to support business process analysis and redesign, 
business rules harvesting and management, and business requirements 
definition. 

Proposed modernization initiative: Architecture, integration, and 
management: Management processes; 
Description: Is to provide sustaining support for program-level 
management processes, including quality assurance, risk management, 
program control and process management, and enterprise life cycle 
maintenance and enhancements. 

Proposed modernization initiative: Architecture, integration, and 
management: Federally funded research and development center; 
Description: Is to provide program management and systems engineering 
support. 

Proposed modernization initiative: Architecture, integration, and 
management: Program management; 
Description: Is to ensure that projects achieve their objectives; 
provide the management information and IT infrastructure that supports 
risk management, project cost and schedule estimating, and financial 
management; and provide procurement management for the PRIME contract 
and associated task orders. 

Appendix II: 

Table: Additional Detail on IRSís Fiscal Year 2008 BSM Expenditure 
Plan: 

[See PDF for image] 

Source: IRS. 

[A] Releases are software versions that provide a subset of the total 
planned project functionality. 

[B] Milestones correspond to phases within IRSís enterprise life cycle 
(0 Ė vision and strategy/enterprise architecture, 1 Ė project 
initiation, 2 Ė domain architecture, 3 Ė preliminary design, 4a Ė 
detailed design, 4b Ė system development, 5 Ė system deployment). 

[C] Core infrastructure projects and management initiatives are funded 
on a fiscal year basis rather than by milestone. 

[D] If the fiscal year 2008 BSM request is approved, $4.2 million from 
MeF release 6, milestone 2-3 will transfer to management reserve and 
the balance will be reprogrammed. 

[End of figure] 

Appendix III: 

IRS Reported Cost/Schedule for Projects Scheduled for Completion in 
Fiscal Year 2007: 

This table shows the projects completed in fiscal year 2007. The 
highlighted rows indicate project segments where actual reported costs 
and/or schedules differ from planned by more than 10%. 

Note: Variances for projects through milestone 3 are based on rough 
order of magnitude estimates. Post-milestone 3 variances are based on 
more specific estimates. 

Source: GAO analysis of IRS data. 

[End of figure] 

Appendix II Comments from the Internal Revenue Service: 

Department Of The Treasury: 
Internal Revenue Service: 
Washington. D.C. 20224: 

February 22, 2008: 

Mr. David Powner: 
Director, Information Security Issues: 
U.S. General Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Powner: 

I have reviewed the Government Accountability Office (GAO) draft report 
titled "Business Systems Modernization (BSM): Internal Revenue 
Service's Fiscal Year 2008 Expenditure Plan," GAO-08-420 (Job Code No. 
310871). We continue to appreciate the sound and balanced work of the 
GAO and are pleased that the GAO: 

* Confirmed that our fiscal year 2008 expenditure plan satisfies the 
conditions specified in the law that includes meeting the Office of 
Management and Budget's capital planning and investment control review 
requirements and complying with the federal systems acquisition 
requirements and management practices;

* Recognized that we have taken steps to address the GAO's prior 
recommendations to improve modernization management controls and 
capabilities that include adding a new focus area to our Modernization 
Vision and Strategy and defining an approach for developing a 
quantitative measure of progress in meeting project scope expectations, 
which we have begun implementing;

* Acknowledged our progress in implementing BSM projects and in meeting 
cost and schedule commitments for most deliverables; 

* Validated our continued progress in addressing high-priority BSM 
program improvement initiatives and that our high-priority improvement 
initiatives continue to be an effective means of assessing, 
prioritizing, and incrementally addressing BSM issues and challenges; 
and: 

* Reported our current efforts to address human capital challenges such 
as the development of an IT human capital strategy that addresses 
hiring critical personnel, employee training, leadership development, 
and workforce retention. 

We agree with your report's recommendation as described in the 
enclosure, that we need to develop specific time frames for 
implementing our human capital initiatives and have begun that process. 
In FY 2007, the ACIO, Applications Development (AD), identified 
workforce retention and development as one of our most significant 
challenges. The ACIO, AD, developed a strategy to address this 
challenge and has taken aggressive steps to define the gaps and to 
minimize the impact. 

We appreciate your continued support and the assistance and guidance 
from your staff. If you have any questions, or if you would like to 
discuss our response in more detail, please contact me or call Arthur 
L. Gonzalez, Chief Information Officer, at (202) 622- 6800.

Sincerely,

Linda E. Stiff: 
Acting Commissioner of Internal Revenue: 

Enclosure: 

Draft Report - Business Systems Modernization Internal Revenue 
Service's Fiscal Year 2008 Expenditure Plan (Audit #310871, GAO-08-
420):  

Recommendation #1: To allow for more effective congressional oversight 
of the BSM program, we recommend that the Commissioner of Internal 
Revenue direct the Chief Information Officer to complete a plan with 
specific time frames for implementing the initiatives supporting its IT 
human capital strategy. Such a plan would help guide IRS's efforts and 
measure progress in implementing them. 

Corrective Action: We agree with this recommendation. In FY 2007, the 
ACIO, Applications Development (AD), identified workforce retention and 
development as one of our most significant challenges. The ACIO, AD, 
developed a strategy to address this challenge and has taken aggressive 
steps to define the gaps and to minimize the impact. 

The ACIO, Management, will coordinate with the ACIO, AD, to refine our 
Human Resources plan to include specific timeframes for implementing 
the human capital initiatives. 

Implementation Date: October 1, 2008; 

Responsible Official: ACIO, Management; 

Corrective Action Monitoring Plan: We will monitor this corrective 
action as part of our internal management control system. We will enter 
accepted corrective actions into the Joint Audit Management Enterprise 
System (JAMES) and monitor them monthly until completion. 

[End of section] 

Appendix III GAO Contact and Staff Acknowledgments: 

GAO Contact: 

David A. Powner, (202) 512-9286, or p [Hyperlink, pownerd@gao.gov] 
ownerd@gao.gov: 

Staff Acknowledgments: 

In addition to the individual named above, Sabine R. Paul, Assistant 
Director; Neil Doherty; Nancy Glover; Sairah R. Ijaz; Rebecca LaPaze; 
and Paul B. Middleton made key contributions to this report. 

[End of section] 

Footnotes: 

[1] See the Financial Services and General Government Appropriations 
Act, 2008, contained in the Consolidated Appropriations Act, 2008, Pub. 
L. No. 110-161, div. D. title I, 121 Stat. 1844, 1972 (Dec. 26, 2007), 
which provides a new level of funding for BSM. (At the time of our 
briefing, IRS reported that it was updating its plans to reflect this 
new level of funding.) 

[2] BSM funds (except labor costs) are unavailable until IRS submits a 
modernization expenditure plan to the congressional appropriations 
committees and obtains their approval. This plan must (1) meet the 
Office of Management and Budget's (OMB) capital planning and investment 
control review requirements; (2) comply with IRS's enterprise 
architecture; (3) conform with IRS's enterprise life cycle methodology; 
(4) comply with federal acquisition rules, requirements, guidelines, 
and systems acquisition management practices; (5) be approved by IRS, 
the Department of the Treasury, and OMB; and (6) be reviewed by GAO. 
IRS's fiscal year 2008 funding is provided under the Consolidated 
Appropriations Act, 2008, div. D, title I, Pub. L. No. 110-161, 121 
Stat. 1844, 1972 (Dec. 26, 2007). These conditions for BSM funding 
availability have been in effect for several years, including the 
immediately preceding fiscal year. 

[3] Milestones correspond to phases within IRS's enterprise life cycle 
(0--vision and strategy/enterprise architecture, 1--project initiation, 
2--domain architecture, 3--preliminary design, 4a-- detailed design, 
4b--system development, 5--system deployment). 

[4] Earned value management is a project management tool that 
integrates the investment scope of work with schedule and cost elements 
for investment planning and control. This method compares the value of 
work accomplished during a given period with that of the work expected 
in the period. Differences between accomplishments and expectations are 
measured in both cost and schedule variances. 

[5] GAO, Financial Audit: IRS's Fiscal Years 2007 and 2006 Financial 
Statements, GAO-08-166 (Washington, D.C.: Nov. 9, 2007). Since we 
briefed the congressional committees, GAO has issued a report focusing 
on IRS's information security program (GAO, Information Security: IRS 
Needs to Address Pervasive Weaknesses, GAO-08-211 (Washington, D.C.: 
Jan. 8, 2008). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability.  

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "Subscribe to Updates."  

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:  

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548:  

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061:  

To Report Fraud, Waste, and Abuse in Federal Programs:  

Contact:  

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470:  

Congressional Relations:  

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548:  

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: