Information Technology:

FDA Needs to Establish Key Plans and Processes for Guiding Systems Modernization Efforts

GAO-09-523: Published: Jun 2, 2009. Publicly Released: Jun 2, 2009.

Additional Materials:

Contact:

Valerie C. Melvin
(202) 512-6304
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

The Food and Drug Administration (FDA) relies heavily on information technology (IT) to carry out its responsibility for ensuring the safety and effectiveness of certain consumer products. Recognizing limitations in its IT capabilities that had been previously identified in studies by FDA and others, the agency has begun various initiatives to modernize its IT systems. GAO was asked to (1) evaluate the agency's overall plans for modernizing its IT systems, including the extent to which the plans address identified limitations or inadequacies in the agency's capabilities, and (2) assess to what extent the agency has put in place key IT management policies and processes to guide the implementation of its modernization projects. GAO analyzed FDA's plans to determine whether they followed best practices and addressed capability limitations, reviewed key management policies and processes, and interviewed agency officials.

In response to federal law and guidance and urgent mission needs, FDA is pursuing numerous modernization projects (including 16 enterprisewide initiatives), many of which are in early stages. However, FDA does not have a comprehensive IT strategic plan to coordinate and manage these initiatives and projects. Such a plan would describe what the agency seeks to accomplish, identify the strategies it will use to achieve desired results, and provide results-oriented goals and performance measures that permit it to determine whether it is succeeding. FDA has developed two high-level planning documents that include some of these elements, but not all: (1) The agency's Strategic Action Plan provides high-level goals and objectives related to modernization of infrastructure and systems, but it does not provide details on IT initiatives, such as milestones and performance measures. (2) An IT plan for FDA's user fee program for drugs and biological products focuses on selected projects in greater detail, but these projects are only a subset of the agency's modernization initiatives. As reflected by its projects and high-level plans, FDA intends to address most of the limitations in its IT systems and infrastructure that had been previously identified. However, successfully overcoming these limitations depends in part on the agency's developing and implementing appropriately detailed plans. A comprehensive IT strategic plan, including results-oriented goals and performance measures, is vital for guiding and coordinating the agency's numerous ongoing modernization projects and activities. Until it develops such a plan, the risk is increased that the agency's IT modernization may not adequately meet the agency's urgent mission needs. FDA has made mixed progress in establishing important IT management capabilities that are essential in helping ensure a successful modernization. These capabilities include investment management, information security, enterprise architecture development, and human capital management. For example, as part of a move to an enterprisewide approach to IT management, FDA has put policies in place for investment management and project management, and it is making progress in addressing information security. However, significant work remains with regard to enterprise architecture (that is, establishing modernization blueprints describing the organization's operation in terms of business and technology), particularly its "to be" architecture--a blueprint of where it wants to go in the future. Further, the agency is not strategically managing IT human capital--it has not determined its IT skills needs or analyzed gaps between skills on hand and future needs. In both these areas (enterprise architecture and human capital management), the agency's vision for the future, as captured in an IT strategic plan, would be an important asset. Without an effective enterprise architecture and strategic human capital management, FDA has less assurance that it will be able to modernize effectively and will have the appropriate IT staff to effectively implement and support its modernization efforts.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: Consistent with this recommendation, FDA took steps to accelerate the development of its segment and enterprise architectures. For example, the agency provided evidence that, in Fiscal Year 2013, it had developed its "as is" and "to be" enterprise architectures in terms of business and applications, and it had proposed solution architectures for segments, including Adverse Events Analysis and Reporting and Regulatory Science. Further, FDA reported in its July 2012 Enterprise Architecture Program Management Plan that it intends to complete the development of its enterprise architecture and enterprise transition plan by the end of Quarter 1 Fiscal Year 2014, and in an update to the Plan, that it intends to complete the segment architectures by the end of Quarter 4 Fiscal Year 2014. In addition, FDA took steps to manage the increased risks of proceeding without an architecture. For example, it formed an Engineering Review Board to discuss and reach mutual agreement on architectural solutions for modernization projects to reduce risks by promoting interoperability among systems. Further, the FDA centers jointly conduct reviews of solutions currently in progress to agree upon what IT capabilities can be reused to avoid duplication. By taking these steps, FDA is better positioned to reduce risks and, thus, ensure that its modernization solutions will be defined, developed, and deployed in a way that maximizes reuse of IT services and capabilities and minimizes overlap and duplication.

    Recommendation: To help ensure the success of FDA's modernization efforts, the Commissioner of FDA should require the CIO to take expeditious actions to accelerate development of the segment and enterprise architecture, including "as is," "to be," and transition plans, and in the meantime develop plans to manage the increased risk to modernization projects of proceeding without an architecture to guide and constrain their development.

    Agency Affected: Department of Health and Human Services: Public Health Service: Food and Drug Administration

  2. Status: Closed - Implemented

    Comments: In response to this recommendation, FDA identified relevant HHS segment scoring criteria for use in setting priorities for the architecture segments. Further, as of September 2013, the agency had completed architecture development for its two highest priority segments and planned to prioritize the remaining segments. These actions should better position the agency to develop its segment architectures based on the agency's business needs and priorities, and reduce risks to the success of its systems modernization efforts.

    Recommendation: To help ensure the success of FDA's modernization efforts, the Commissioner of FDA should require the CIO to take expeditious actions to complete the criteria for setting priorities for the segment architecture and prioritize the segments.

    Agency Affected: Department of Health and Human Services: Public Health Service: Food and Drug Administration

  3. Status: Closed - Implemented

    Comments: FDA took steps that addressed this recommendation. In particular, FDA completed its Enterprise Architecture Program Management Plan, dated July 2012, that outlines the agency's key enterprise architecture initiatives and program management functions, including a work breakdown of the major tasks, activities, time frames, and key staff responsible for developing the enterprise architecture. The agency also included in the FDA Segment Architecture Funding and Resource Plan, dated September 2013, an estimate of $3.6 million for funding needed to accomplish enterprise architecture activities. By taking these steps, FDA should be better positioned to ensure that it will be able to effectively and efficiently manage its enterprise architecture development.

    Recommendation: To help ensure the success of FDA's modernization efforts, the Commissioner of FDA should require the CIO to take expeditious actions to develop a documented enterprise architecture program management plan that includes a detailed work breakdown of the tasks, activities, and time frames associated with developing the architecture, as well as the funding and staff resources needed.

    Agency Affected: Department of Health and Human Services: Public Health Service: Food and Drug Administration

  4. Status: Closed - Implemented

    Comments: FDA has taken actions that addressed this recommendation. Specifically, in September 2012, the agency's Office of Information Management (OIM) issued the Information Management Strategic Plan, Version 1.1, Fiscal Year 2012 - Fiscal Year 2016. The plan identified four goals regarding technology projects and activities. For example, one goal is to provide technology on demand via the modernization of the internal infrastructure and the provisioning of external capabilities that optimize the productivity of the FDA workforce. For each goal, the plan included the corresponding objectives, strategies, performance measures, and milestones. Additionally, OIM stated in the plan that it is developing and utilizing more detailed internal documents that provide more specificity for its implementation process. OIM also stated that it intends to publish annual updates and use this plan as a living document. By taking these steps to establish a strategic plan, FDA has begun to put the necessary planning in place to guide its modernization efforts.

    Recommendation: To help ensure the success of FDA's modernization efforts, the Commissioner of FDA should require the Chief Information Officer (CIO) to take expeditious actions to set milestones and a completion date for developing a comprehensive IT strategic plan, including results-oriented goals, strategies, milestones, performance measures, and an analysis of interdependencies among projects and activities, and use this plan to guide and coordinate its modernization projects and activities.

    Agency Affected: Department of Health and Human Services: Public Health Service: Food and Drug Administration

  5. Status: Closed - Implemented

    Comments: Consistent with this recommendation, FDA's Office of Information Management (OIM) has taken steps to implement a strategic approach to IT human capital planning. Specifically, in September 2013, the agency provided evidence that it had identified critical skill shortages, including determining that cyber security skills are insufficient and that network, engineering, and infrastructure operations skills are outdated. In addition, OIM provided a template documenting its plans to use a field in employees' SharePoint profiles as an inventory tool to collect skills information on an ongoing basis. Further, in September 2013, OIM provided evidence that it had conducted a skills gaps analysis and identified gaps relating to eight job descriptions in two of its office components. It also had taken actions to address the skills gaps, including offering Project Management certification training. Beyond these actions, FDA's Information Management Strategic Plan, dated September 2012, included plans for implementing individual training, skills development, and professional development and career management programs. FDA stated in the plan that it intends to implement active recruitment, hiring, and retention processes that are built upon a skills inventory, needs assessment, and gap analysis. By taking these steps, OIM has made important progress toward a strategic approach to managing IT human capital.

    Recommendation: To help ensure the success of FDA's modernization efforts, the Commissioner of FDA should require the CIO to take expeditious actions to develop a skills inventory, needs assessment, and gap analysis, and develop initiatives to address skills gaps as part of a strategic approach to IT human capital planning.

    Agency Affected: Department of Health and Human Services: Public Health Service: Food and Drug Administration

 

Explore the full database of GAO's Open Recommendations »

Sep 25, 2014

Sep 23, 2014

Jun 10, 2014

May 22, 2014

May 12, 2014

May 8, 2014

May 7, 2014

Apr 2, 2014

Looking for more? Browse all our products here