Information Technology: FDA Needs to Establish Key Plans and Processes for Guiding Systems Modernization Efforts

FDA has taken actions that addressed this recommendation. Specifically, in September 2012, the agency's Office of Information Management (OIM) issued the Information Management Strategic Plan, Version 1.1, Fiscal Year 2012 - Fiscal Year 2016. The plan identified four goals regarding technology projects and activities. For example, one goal is to provide technology on demand via the modernization of the internal infrastructure and the provisioning of external capabilities that optimize the productivity of the FDA workforce. For each goal, the plan included the corresponding objectives, strategies, performance measures, and milestones. Additionally, OIM stated in the plan that it is developing and utilizing more detailed internal documents that provide more specificity for its implementation process. OIM also stated that it intends to publish annual updates and use this plan as a living document. By taking these steps to establish a strategic plan, FDA has begun to put the necessary planning in place to guide its modernization efforts.

FDA took steps that addressed this recommendation. In particular, FDA completed its Enterprise Architecture Program Management Plan, dated July 2012, that outlines the agency's key enterprise architecture initiatives and program management functions, including a work breakdown of the major tasks, activities, time frames, and key staff responsible for developing the enterprise architecture. The agency also included in the FDA Segment Architecture Funding and Resource Plan, dated September 2013, an estimate of $3.6 million for funding needed to accomplish enterprise architecture activities. By taking these steps, FDA should be better positioned to ensure that it will be able to effectively and efficiently manage its enterprise architecture development.

In response to this recommendation, FDA identified relevant HHS segment scoring criteria for use in setting priorities for the architecture segments. Further, as of September 2013, the agency had completed architecture development for its two highest priority segments and planned to prioritize the remaining segments. These actions should better position the agency to develop its segment architectures based on the agency's business needs and priorities, and reduce risks to the success of its systems modernization efforts.

Consistent with this recommendation, FDA took steps to accelerate the development of its segment and enterprise architectures. For example, the agency provided evidence that, in Fiscal Year 2013, it had developed its "as is" and "to be" enterprise architectures in terms of business and applications, and it had proposed solution architectures for segments, including Adverse Events Analysis and Reporting and Regulatory Science. Further, FDA reported in its July 2012 Enterprise Architecture Program Management Plan that it intends to complete the development of its enterprise architecture and enterprise transition plan by the end of Quarter 1 Fiscal Year 2014, and in an update to the Plan, that it intends to complete the segment architectures by the end of Quarter 4 Fiscal Year 2014. In addition, FDA took steps to manage the increased risks of proceeding without an architecture. For example, it formed an Engineering Review Board to discuss and reach mutual agreement on architectural solutions for modernization projects to reduce risks by promoting interoperability among systems. Further, the FDA centers jointly conduct reviews of solutions currently in progress to agree upon what IT capabilities can be reused to avoid duplication. By taking these steps, FDA is better positioned to reduce risks and, thus, ensure that its modernization solutions will be defined, developed, and deployed in a way that maximizes reuse of IT services and capabilities and minimizes overlap and duplication.

Consistent with this recommendation, FDA's Office of Information Management (OIM) has taken steps to implement a strategic approach to IT human capital planning. Specifically, in September 2013, the agency provided evidence that it had identified critical skill shortages, including determining that cyber security skills are insufficient and that network, engineering, and infrastructure operations skills are outdated. In addition, OIM provided a template documenting its plans to use a field in employees' SharePoint profiles as an inventory tool to collect skills information on an ongoing basis. Further, in September 2013, OIM provided evidence that it had conducted a skills gaps analysis and identified gaps relating to eight job descriptions in two of its office components. It also had taken actions to address the skills gaps, including offering Project Management certification training. Beyond these actions, FDA's Information Management Strategic Plan, dated September 2012, included plans for implementing individual training, skills development, and professional development and career management programs. FDA stated in the plan that it intends to implement active recruitment, hiring, and retention processes that are built upon a skills inventory, needs assessment, and gap analysis. By taking these steps, OIM has made important progress toward a strategic approach to managing IT human capital.