This is the accessible text file for GAO report number GAO-03-571R entitled 'Information Technology: Observations on Department of Defense's Draft Enterprise Architecture' which was released on March 28, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products’ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. March 28, 2003: The Honorable John Ensign: Chairman: The Honorable Daniel K. Akaka: Ranking Minority Member: Subcommittee on Readiness and Management Support: Committee on Armed Services: United States Senate: Subject:Information Technology: Observations on Department of Defense’s Draft Enterprise Architecture: The fiscal year 2003 Defense Authorization Act[Footnote 1] requires the Department of Defense (DOD) to develop by May 1, 2003, a financial management enterprise architecture, including a transition plan, that meets certain requirements. The act also requires that we submit to congressional defense committees an assessment of the architecture and transition plan within 60 days of their approval. (See enclosure I for the requirements of this law.) As part of our ongoing work to satisfy this legislative requirement and at the request of your staff, we briefed your offices on March 4, 2003, on our preliminary assessment of the DOD draft architecture products dated February 7, 2003. As further requested by your staff, this letter transmits the observations we made during the briefing. (See enclosure II for a summary of our assessment approach.): An enterprise architecture provides a clear and comprehensive picture of an entity, whether it is an organization (e.g., federal department or agency) or a functional or mission area that cuts across more than one organization (e.g., financial management or homeland security). This picture consists of snapshots of both the enterprise’s current operational and technological environment and its target environment, as well as a capital investment road map for transitioning from the current to the target environment. These snapshots further consist of “views,” which are basically one or more architecture products that provide conceptual or logical representations of the enterprise. Based on our preliminary assessment of DOD’s draft architecture products, we made the following observations during our March 4, 2003, briefing to your staff. To DOD’s credit, it is: * following its Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance Architecture framework and planning to develop most of the products called for by this framework; * using an automated tool to create and maintain the architecture products; and: * following a defined process for identifying the federal regulatory and legal requirements associated with federal accounting standards and financial management and reporting requirements (e.g., Joint Financial Management Improvement Program and Title 10 U.S. Code--Armed Forces) for the seven business process areas[Footnote 2] within the “to be” architecture. However, we also stated that the department had yet to provide a clear definition of the intended purpose of the April 30, 2003, architecture, which, according to federal guidance, is needed to establish the architecture’s scope and depth (i.e., the boundaries and level of detail to be provided in the architecture). Further, according to DOD officials’ statements and DOD’s architecture plans and schedules, the April 30, 2003, version of the architecture will not fully satisfy the requirements contained within Section 1004 of Public Law 107-314. (See enclosure III for a summary of DOD’s architecture development and implementation schedule.): In addition, we stated that the draft architecture did not include a number of items recommended by relevant architectural guidance,[Footnote 3] such as: * the “as is” architecture environment, including descriptions of existing business operations and supporting technology; * a “to be” security architecture view, which defines the security requirements (e.g., policies, procedures, and controls), including relevant standards to be applied in implementing these controls; * “to be” architecture descriptions for all key stakeholders (e.g., DOD top executives and the Congress), which are intended to provide each with sufficient understanding of the architecture to allow for meaningful input; * “to be” architecture organization and location views, which define the entities/people who will perform the functions, processes, and activities, and specify the locations where the functions, processes, and activities will be performed; * an explicit definition of architecture drivers and governing principles, which are the constraints and requirements that lead to major decisions about the “to be” architecture (e.g., the use of centralized versus distributed processing, and the standardization of business rules to minimize effect on implementation); and: * defined structure and linkages among “to be” architecture views, such as the linkages among (1) applications and services, (2) organizations using the applications and services, and (3) applicable technical standards.[Footnote 4] Given that the draft architecture products are not intended to be complete, we also noted that our assessment and observations were limited to the state of the draft products as of February 7, 2003, and that because these products are still being developed, later versions may include missing views and items. In commenting on a draft of this letter, DOD Comptroller officials, including the Director, Business Management Systems Integration Office, stated that they generally agreed with our assessment of the February 7, 2003, draft architecture products. The director also commented that the state of DOD’s “as is” architecture products is appropriate at this point in time and that DOD accepts the risk of not investing further in defining these products until development of the transition plan requires it to do so. We agree that further development of the “as is” can coincide with the development of the transition plan, but also note that not having defined “as is” operations and technology at this juncture is risky because it defers too late in the architecture development cycle a very important set of tasks. The director also commented that the April 30, 2003, version of the architecture would address all the requirements of the act, but that the degree to which they are addressed would vary and that subsequent versions of the architecture would provide missing details. We agree that the April 30, 2003, version of the architecture will likely address, to some degree, the architecture requirements in the act. However, our observation was that this version of the architecture would not fully satisfy the act’s requirements. DOD’s comment is consistent with our observations. We will be sending copies of this letter to interested congressional committees and the Director, Office of Management and Budget. This letter will also be available at no charge on our Web site at www.gao.gov. If you have any questions concerning this information, please contact us at (202) 512-3439 or (202) 512-9095, respectively. We can also be reached by E-mail at hiter@gao.gov or kutzg@gao.gov. GAO contacts and key contributors to this letter are listed in appendix IV. Randolph C. Hite: Director, Information Technology Architecture and Systems Issues: Gregory D. Kutz: Director, Financial Management and Assurance: Signed by Randolph C. Hite and Gregory D. Kutz: Enclosures: SEC. 1004. [of Public Law 107-314] DEVELOPMENT AND IMPLEMENTATION OF FINANCIAL MANAGEMENT ENTERPRISE ARCHITECTURE. (a) REQUIREMENT FOR ENTERPRISE ARCHITECTURE AND FOR TRANSITION PLAN--: Not later than May 1, 2003, the Secretary of Defense shall develop--: (1) a financial management enterprise architecture for all budgetary, accounting, finance, enterprise resource planning, and mixed information systems of the Department of Defense; and: (2) a transition plan for implementing that financial management enterprise: architecture. (b) COMPOSITION OF ENTERPRISE ARCHITECTURE--: (1) The financial management enterprise architecture developed under subsection (a)(1) shall describe an information infrastructure that, at a minimum, would enable the Department of Defense to--: (A) comply with all Federal accounting, financial management, and reporting requirements; (B) routinely produce timely, accurate, and reliable financial information for management purposes; (C) integrate budget, accounting, and program information and systems; and: (D) provide for the systematic measurement of performance, including the ability to produce timely, relevant, and reliable cost information. (2) That enterprise architecture shall also include policies, procedures, data standards, and system interface requirements that are to apply uniformly throughout the Department of Defense. (c) COMPOSITION OF TRANSITION PLAN--The transition plan developed under: subsection (a)(2) shall include the following: (1) The acquisition strategy for the enterprise architecture, including specific time-phased milestones, performance metrics, and financial and nonfinancial resource needs. (2) A listing of the mission critical or mission essential operational and: developmental financial and nonfinancial management systems of the Department of Defense, as defined by the Under Secretary of Defense (Comptroller), consistent with budget justification documentation, together with--: (A) the costs to operate and maintain each of those systems during fiscal year 2002; and: (B) the estimated cost to operate and maintain each of those systems during fiscal year 2003. (3) A listing of the operational and developmental financial management systems of the Department of Defense as of the date of the enactment of this Act (known as ‘legacy systems’) that will not be part of the objective financial and nonfinancial management system, together with the schedule for terminating those legacy systems that provides for reducing the use of those legacy systems in phases. (d) CONDITIONS FOR OBLIGATION OF SIGNIFICANT AMOUNTS FOR FINANCIAL SYSTEM IMPROVEMENTS--An amount in excess of $1,000,000 may be obligated for a defense financial system improvement only if the Under Secretary of Defense (Comptroller) makes a determination regarding that improvement as follows: (1) Before the date of an approval specified in paragraph (2), a determination that the defense financial system improvement is necessary for either of the following reasons: (A) To achieve a critical national security capability or address a critical requirement in an area such as safety or security. (B) To prevent a significant adverse effect (in terms of a technical matter, cost, or schedule) on a project that is needed to achieve an essential capability, taking into consideration in the determination the alternative solutions for preventing the adverse effect. (2) On and after the date of any approval by the Secretary of Defense of a financial management enterprise architecture and a transition plan that satisfy the requirements of this section, a determination that the defense financial system improvement is consistent with both the enterprise architecture and the transition plan. (e) CONGRESSIONAL REPORTS--Not later than March 15 of each year from 2004 through 2007, the Secretary of Defense shall submit to the congressional defense committees a report on the progress of the Department of Defense in implementing the enterprise architecture and transition plan required by this section. Each report shall include, at a minimum--: (1) a description of the actions taken during the preceding fiscal year to implement the enterprise architecture and transition plan (together with the estimated costs of such actions); (2) an explanation of any action planned in the enterprise architecture and transition plan to be taken during the preceding fiscal year that was not taken during that fiscal year; (3) a description of the actions taken and planned to be taken during the current fiscal year to implement the enterprise architecture and transition plan (together with the estimated costs of such actions); and: (4) a description of the actions taken and planned to be taken during the next fiscal year to implement the enterprise architecture and transition plan (together with the estimated costs of such actions). (f) COMPTROLLER GENERAL REVIEW--Not later than 60 days after the approval of an enterprise architecture and transition plan in accordance with the requirements of subsection (a), and not later than 60 days after the submission of an annual report required by subsection (e), the Comptroller General shall submit to the congressional defense committees an assessment of the extent to which the actions taken by the Department comply with the requirements of this section. (g) DEFINITIONS--In this section: (1) The term ‘defense financial system improvement’ means the acquisition of a new budgetary, accounting, finance, enterprise resource planning, or mixed information system for the Department of Defense or a modification of an existing budgetary, accounting, finance, enterprise resource planning, or mixed information system of the Department of Defense. Such term does not include routine maintenance and operation of any such system. (2) The term ‘mixed information system’ means an information system that supports financial and non-financial functions of the Federal Government as defined in Office of Management and Budget Circular A-127 (Financial management Systems). (h) REPEAL--(1) Section 2222 of title 10, United States Code, is repealed. The table of sections at the beginning of chapter 131 of such title is amended by striking the item relating to such section. (2) Section 185(d) of such title is amended by striking ‘has the meaning given that term in section 2222(c)(2) of this title’ and inserting ‘means an automated or manual system from which information is derived for a financial management system or an accounting system’. Summary of Assessment Approach: As part of our ongoing work under Section 1004 of Public Law 107-314, we performed a preliminary assessment of Department of Defense (DOD) draft enterprise architecture products dated February 7, 2003. This assessment included analyzing relevant criteria[Footnote 5] to identify the architecture views that are needed to provide key stakeholders a complete understanding of the architecture and searching all the draft products to determine whether these views existed. In searching the products, we specifically focused on governing principles, standards, and security, because they are fundamental elements of a well-defined and enforceable architecture. In addition, we traced linkages between the different views to determine if these linkages had been specifically identified to ensure ease of stakeholder navigation and understanding. We also reviewed DOD’s schedule of deliverables and its October 2002 transition plan strategy to ascertain the department’s future plans for later versions of the architecture. To determine whether DOD had a defined process for identifying the federal regulatory and legal requirements associated with federal accounting standards and financial management and reporting (e.g., Joint Financial Management Improvement Program and Title 10 U.S. Code- -Armed Forces), we obtained and performed a preliminary review of the traceability matrices prepared by the DOD program office that documented these requirements for each of the seven business process areas within the “to be” architecture. We also interviewed program officials to obtain an understanding of the methodology being used to identify, track, validate, and update the information contained within these matrices. We did not evaluate the completeness or validity of the requirements developed as part of the draft architecture. Also, we did not review the process related to investment management as described in Section 1004 of Public Law 107-314. Additionally, because we assessed draft architecture products as of February 7, 2003, our observations are limited to the state of these products as of that date. We performed our work from February 2003 through March 2003 in accordance with generally accepted government auditing standards. Summary of Architecture Development and Implementation Schedule: Notes: GAO analysis based on DOD information. OV is Operational View. OV is to depict the organization-wide business environment and activities that need to occur to achieve the “to be” state. SV is Systems View. SV is to describe the set of system capabilities that are to provide DOD with accurate, reliable, and timely access to business management and associated financial information. TV is Technical View. TV is to contain the set of rules that govern system implementation and operation. According to DOD, subsequent architecture versions (9/30/2003) will include (1) relevant standards (e.g., data) to guide projects and investments, (2) life-cycle costs for systems, and (3) security in OV and SV products. GAO Contacts and Staff Acknowledgments: GAO ContactsCynthia Jackson, (202) 512-5086 Jenniffer Wilson, (202) 512-9192: AcknowledgmentsIn addition to the individuals named above, key contributors to this letter included Nabajyoti Barkakati, Barbara Collier, Neelaxi Lakhmani, Anh Le, Evelyn Logue, Mai Nguyen, Stacey Smith, Al Steiner, Randolph Tekeley, and William Wadsworth. (310253): FOOTNOTES [1] Section 1004 of Public Law 107-314. [2] The seven business process areas are (1) accounting; (2) collection, accounts receivable, and cash management; (3) financial and management reporting; (4) human resource management; (5) logistics; (6) procurement, payables, acquisition, and disbursing; and (7) strategic planning and budgeting. [3] See, for example, Institute of Electrical and Electronics Engineers Standard 1471; Software Engineering Institute Open Systems publications; Federal Enterprise Architecture Framework; Zachman Framework; and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance Architecture framework. [4] Technical standards provide the set of rules that govern system implementation and operation. [5] See, for example, Institute of Electrical and Electronics Engineers Standard 1471, Software Engineering Institute Open Systems publications, Federal Enterprise Architecture Framework, Zachman Framework, and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance Architecture framework.