This is the accessible text file for GAO report number GAO-03-768 entitled 'Business Systems Modernization: IRS Has Made Significant Progress in Improving Its Management Controls, but Risks Remain' which was released on June 27, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Committees: June 2003: Business Systems Modernization: IRS Has Made Significant Progress in Improving Its Management Controls, but Risks Remain: GAO-03-768: GAO Highlights: Highlights of GAO-03-768, a report to congressional committees Why GAO Did This Study: As required by law, the Internal Revenue Service (IRS), in November 2002 and March 2003, submitted to the congressional appropriations committees its initial and revised fiscal year 2003 expenditure plans, respectively, requesting about $378 million for the Business Systems Modernization (BSM) program. GAO reviewed the plans to (1) determine whether the plans were prepared in accordance with the law, (2) determine what progress IRS had made in implementing modernization management controls and capabilities, and (3) provide any other observations about the plans and IRS’s BSM program. What GAO Found: IRS’s initial (November 2002) and revised (March 2003) fiscal year 2003 expenditure plans were prepared in accordance with the law. IRS made significant progress in improving its modernization management controls and capabilities and implementing GAO’s recommendations. For example: * IRS implemented 20 of 23 commitments and is implementing the remaining 3 commitments that address previously reported weaknesses and recommendations. Significant among these efforts were IRS’s achievements in improving its software acquisition practices. * IRS deployed 3 modernized systems that are currently providing benefits that (1) improve telecommunications infrastructure, including telephone call management, call routing, and customer self-service; (2) provide off-the-shelf software to IRS revenue agents to allow them to accurately compute complex corporate transactions; and (3) improve customer self-service by providing instant refund status information and instructions for resolving refund problems via the Internet. * IRS also took steps to balance the scope and pace of the BSM program with the management capacity of IRS and its prime contractor. These steps included reassessing the portfolio of projects that IRS had planned to proceed with during the remainder of fiscal year 2002 and reducing the planned scope and pace of the BSM program for fiscal year 2003. Although significant progress has been made, certain controls and capabilities for modernization have not yet been fully implemented, including human capital management and validation of cost and schedule estimates. Weaknesses in these controls and capabilities contributed, in part, to cost, schedule, and performance shortfalls in the BSM program. For example, in the revised fiscal year 2003 expenditure plan, IRS disclosed that 75 percent of program-level initiatives and acquisition project milestones had cost increases and/or schedule delays exceeding 10 percent of the estimated cost and duration specified in the fiscal year 2002 expenditure plan. Schedule delays affect the delivery of benefits. For example, (1) the opportunity for Form 1040EZ filers to enjoy faster refunds, as promised by the first release of the project that is to replace IRS’s master files of taxpayer information, has been delayed for an additional 13 months and (2) schedule delays for the first release of the e-Services project will defer the provision of easy-to-use electronic products and services targeted at tax practitioners who inform, educate, and provide services to the taxpaying public. What GAO Recommends: GAO recommends that the Commissioner of Internal Revenue direct the Chief Information Officer (CIO) to continue improvements in IRS’s modernization management controls. GAO also recommends that the Commissioner direct the CIO to promptly update the enterprise transition strategy to conform to other changes in IRS’s enterprise architecture and establish and implement a process for determining the type of task order to be awarded in acquiring modernized systems. The Commissioner agreed with GAO’s findings and commented on actions to address the recommendations. www.gao.gov/cgi-bin/getrpt?GAO-03-768. To view the full product, including the scope and methodology, click on the link above. For more information, contact Robert F. Dacey at (202) 512-3317 or daceyr@gao.gov [End of section] Letter: Recommendations for Executive Action: Agency Comments: Appendixes: Appendix I: Briefing Slides from the December 18, 2002, Briefing to the Senate and House Appropriations Subcommittee Staffs: Appendix II: Briefing Slides from the April 14, 2003, Briefing to the Senate and House Appropriations Subcommittee Staffs: Appendix III: Comments from the Internal Revenue Service: Appendix IV: GAO Contacts and Staff Acknowledgments: GAO Contact: Staff Acknowledgments: BSM: Business Systems Modernization: CIO: Chief Information Officer : IRS: Internal Revenue Service: OMB: Office of Management and Budget: PRIME: PRIME Systems Integration Support contractor: Letter June 27, 2003: The Honorable Richard Shelby Chairman The Honorable Patty Murray Ranking Member Subcommittee on Transportation, Treasury and General Government Committee on Appropriations United States Senate: The Honorable Ernest J. Istook, Jr. Chairman The Honorable John W. Olver Ranking Minority Member Subcommittee on Transportation, Treasury and Independent Agencies Committee on Appropriations House of Representatives: As required by law, the Internal Revenue Service (IRS), in November 2002 and March 2003, submitted to the congressional appropriations committees its initial and revised fiscal year 2003 expenditure plans, respectively, requesting about $378 million from its Business Systems Modernization (BSM) fund. Our objectives in reviewing the plans were to (1) determine whether the plans satisfied the conditions specified in the law,[Footnote 1] (2) determine what progress IRS had made in implementing modernization management controls and capabilities, and (3) provide any other observations about the initial and revised plans and IRS's BSM program. On December 18, 2002, and April 14, 2003, we briefed your respective offices on the results of our reviews. This report transmits the materials used at those briefings and reiterates the recommendations that we made to the then-Acting Commissioner of Internal Revenue that we specified in our December 2002 briefing.[Footnote 2] The full briefing materials, including our scope and methodology, are reprinted in appendixes I and II. In summary, we made the following four major points in our December 2002 briefing on the results of our review of IRS's initial expenditure plan for fiscal year 2003: * IRS's initial expenditure plan satisfied each of the six legislative conditions. * IRS had made significant progress in improving its modernization management controls and capabilities and implementing our recommendations. For example, IRS had implemented 20 of 23 commitments and is in the process of implementing the remaining 3 commitments that address previously reported weaknesses and recommendations. Significant among these efforts was IRS's achievements in improving its software acquisition practices. * IRS also had taken steps to balance the scope and pace of the BSM program with the management capacity of IRS and the PRIME Systems Integration Support contractor (PRIME). In accordance with our recommendation, IRS completed a reassessment of the fiscal year 2002 BSM program in May 2002 and took actions to better balance the system acquisition workload with the management capacity. Specifically, IRS (1) deferred the start of five new projects until fiscal years 2003 and 2004 to reduce IRS/PRIME resource demands, (2) reapplied a portion of these deferred financial resources toward PRIME management processes and support of the federally funded research and development center to accelerate correcting modernization management control weaknesses, and (3) increased its own efforts and executive focus on management process improvement. * Although significant progress had been made, certain modernization management controls and capabilities--related to configuration management,[Footnote 3] enterprise transition strategy,[Footnote 4] human capital management, and cost and schedule estimate validation-- had not yet been fully implemented. Weaknesses in these controls and capabilities increase the risk of cost, schedule, and performance shortfalls in the BSM program. We also made the following five observations related to the BSM program and the initial fiscal year 2003 expenditure plan: * The number of project milestones experiencing cost and schedule changes was increasing. * BSM was entering a critical, high-risk phase as the scope and complexity of the program continued to grow. * Opportunities for using performance-based contracts in acquiring modernized systems were increasing. * IRS had improved the format of its expenditure plan. * Internal IRS costs of the BSM program, paid from other IRS appropriations, were expected to increase, but were not tracked or known. In our April 2003 briefing on the results of our review of IRS's revised fiscal year 2003 expenditure plan, we reported that IRS had deployed three modernized systems that provide benefits that (1) improve telecommunications infrastructure, including telephone call management, call routing, and customer self-service; (2) provide off-the-shelf software to IRS revenue agents to allow them to accurately compute complex corporate transactions; and (3) improve customer self-service by providing instant refund status information and instructions for resolving refund problems via the Internet. In addition, we made the following four major points in the April 2003 briefing: * IRS's revised plan satisfied the conditions specified under the law. * IRS continued to take steps to balance the pace of the program with management capacity by reducing the planned scope of the BSM program for fiscal year 2003. Between November 2002 and March 2003, IRS deferred four new project releases, discontinued two ongoing project releases, absorbed one new release into an ongoing project release, and transferred one ongoing project to another appropriation. Moreover, IRS reduced the scope of BSM program-level initiatives and core infrastructure projects. As a result, IRS reduced the initial BSM funding request for fiscal year 2003 by about $72 million. * Most initiatives/project milestones continued to experience cost increases and/or schedule delays. In the revised fiscal year 2003 expenditure plan, IRS disclosed that 75 percent of program-level initiatives and acquisition project milestones had cost increases and/ or schedule delays exceeding 10 percent of the estimated cost and duration specified in the fiscal year 2002 expenditure plan. * Schedule delays affected the delivery of benefits. For example, (1) the opportunity for the first set of taxpayers (single, Form 1040EZ filers) to enjoy faster refunds, as promised by the first release of the project that is to replace IRS's master files of taxpayer information, has been delayed an additional 13 months; (2) schedule slippages for the first release of the e-Services project will delay the provision of easy-to-use electronic products and services targeted at tax practitioners that inform, educate, and provide services to the taxpaying public; and (3) remediation of material weaknesses may be delayed. Recommendations for Executive Action: To improve IRS's modernization management controls and capabilities, we recommend that the Commissioner of Internal Revenue direct the Chief Information Officer (CIO) to complete actions to: * institutionalize configuration management procedures for the Business Systems Modernization Office; * implement plans for obtaining, developing, and retaining requisite human capital resources; and: * implement effective procedures for validating contractor-developed cost and schedule estimates. In addition, we recommend that the Commissioner of Internal Revenue direct the CIO to: * promptly update the enterprise transition strategy to conform to other changes in IRS's enterprise architecture and: * establish and implement a process for determining the type of task order to be awarded in acquiring modernized systems. Agency Comments: In providing written comments on a draft of this report, the Commissioner of Internal Revenue agreed with this report's findings and commented on the actions IRS is taking to implement our recommendations. The Commissioner's comments are reprinted in appendix III. : We are sending copies of this report to the Chairmen and Ranking Minority Members of other Senate and House committees and subcommittees that have appropriations, authorization, and oversight responsibilities for the Internal Revenue Service. We are also sending copies to the Commissioner of Internal Revenue, the Secretary of the Treasury, the Chairman of the IRS Oversight Board, and the Director of the Office of Management and Budget. Copies are also available at no charge on the GAO Web site at http://www.gao.gov. Should you or your offices have questions on matters discussed in this report, please contact me at (202) 512-3317. I can also be reached by E-mail at daceyr@gao.gov. Key contributors to this report are listed in appendix IV. Sincerely, Robert F. Dacey Director, Information Security Issues: Signed by Robert F. Dacey: [End of section] Appendixes : Appendix I: Briefing Slides from the December 18, 2002, Briefing to the Senate and House Appropriations Subcommittee Staffs: [See PDF for image] [End of figure] [End of section] Appendix II: Briefing Slides from the April 14, 2003, Briefing to the Senate and House Appropriations Subcommittee Staffs: [See PDF for image] [End of figure] [End of section] Appendix III: Comments from the Internal Revenue Service: DEPARTMENT OF THE TREASURY INTERNAL REVENUE SERVICE WASHINGTON, D.C. 20224: COMMISSIONER: June 19, 2003: Mr. Robert F. Dacey: Director, Information Security Issues U.S. General Accounting Office: 441 G Street N.W. Washington, DC 20548: Dear Mr. Dacey: I have reviewed the General Accounting Office (GAO) draft report entitled IRS has Made Significant Progress In Improving its Management Controls But Risks Remain, (GAO-03-768, June 2003). We are pleased that the GAO: * Validated that we satisfied the six legislative conditions as specified in Congressional appropriations; * Acknowledged the significant improvements made in the modernization management controls and capabilities and our implementation of past recommendations; * Confirmed that we are balancing the scope and pace of the BSM program with the management capacity of the IRS and the PRIME contractor; and * Acknowledged that the deployment of three modernized systems provides benefits to taxpayers and to our employees. We agree with your report's findings. Both the IRS and the PRIME have appointed senior executives to coordinate within and across our respective organizations to ensure that we give priority to completing your recommendations. We believe this focus was a key factor in achieving our Level 2 rating in the Software Engineering Institute's Software Acquisition - Capability Maturity Model (SA-CMM). We are the first federal civilian agency and multi-project program to achieve a Level 2 rating distinction. The PRIME contractor is the first company in the world to achieve SA-CMM Level 3. We will continue to provide the GAO with monthly dashboard reports on our progress in maturing these and other management processes, as we have been doing for the past 15 months. We will continue our bi-weekly meetings on specific modernization topics. I would like to briefly comment on each of the five recommendations in your report. * Institutionalize configuration management procedures for the Business Systems Modernization Office (BSMO): We continue to make progress in this area by improving the speed with which we address change requests, the quality of impact assessments on change requests, and reporting on the causes for change requests. We are undertaking internal assessments of the effectiveness of Configuration Management (CM) procedures on each project to ensure broad program compliance. We established a MITS- wide Change Control Board about six months ago to reflect the critical connection that BSM has with the rest of our systems maintenance and operations. * Implement plans for obtaining, developing, and retaining requisite human capital resources: One of the reasons I established a new Deputy Commissioner for Operations was to give attention to our human capital practices. In addition, we have made good progress in BSMO by increasing the quantity and quality of its staff to provide better services. Last February, the BSM program, in concert with the Department of Treasury, rolled out the first phase of a new Human Resources system to more than 18,000 IRS employees. * Implement effective procedures for validating contractor-developed cost and schedule estimates: We are working with the PRIME contractor to develop and deploy best practice estimating capabilities consistent with: Carnegie Mellon University's Software Engineering Institute (SEI). In fact, we briefed your staff on our progress just last week. Unfortunately, though critical to improving our cost and schedule estimates, implementing these capabilities is taking longer than we had hoped, but our progress to date is good. * Promptly update the enterprise transition strategy to conform to other changes in IRS' enterprise architecture: The Core Business Systems Executive Steering Committee (CBS ESC), BSM's top-level governance council, approved Release 2.1 of the BSM Enterprise Architecture last week. This release brings the enterprise transition strategy to being reasonably current. Of course, it will need to be adjusted as we work through our FY04 and FY05 plans in the coming months. * Establish and implement a process for determining the type of task order to be awarded in acquiring modernized systems: All new BSM contracts for applications software development of over $1 million are now incentive-based. We are working with the PRIME in a Contracting Executive Council to institutionalize best contracting processes across the whole program. We appreciate your continued support, and the valuable assistance and guidance from your staff. If you have any questions, or if you would like to discuss this response in more detail, please contact Fred Forman, Associate Commissioner for Business Systems Modernization, at (202) 622-3378. Sincerely, Mark W. Everson: Signed by Mark W. Everson: [End of section] Appendix IV: GAO Contacts and Staff Acknowledgments: GAO Contact: Gregory C. Wilshusen (202) 512-6244: Staff Acknowledgments: In addition to the individual named above, other key contributors were Bernard R. Anderson, Timothy D. Hopkins, and Chetna Lal. : (310190): : : FOOTNOTES [1] BSM funds are unavailable until IRS submits to congressional appropriations committees for approval a modernization expenditure plan that (1) meets the Office of Management and Budget's (OMB) capital planning and investment control review requirements; (2) complies with IRS's enterprise architecture; (3) conforms with IRS's enterprise life- cycle methodology; (4) is approved by IRS, the Department of the Treasury, and OMB; (5) is reviewed by GAO; and (6) complies with federal acquisition rules, requirements, guidelines, and systems acquisition management practices. See P.L. 108-7 (Feb. 20, 2003), and intervening continuing resolutions for fiscal year 2003 funding, and P.L. 107-67 (Nov. 12, 2001), for fiscal year 2002 funding. [2] Since the time of our briefings, a new Commissioner of Internal Revenue has been confirmed. [3] Configuration management is the means for ensuring the integrity and consistency of system modernization program and project products throughout their life cycles. Through effective configuration management, for example, integration among related projects and alignment between projects and the enterprise architecture can be achieved. [4] An enterprise transition strategy describes how an organization will migrate from its current operating environment to its future operating environment.