Skip to Highlights
Highlights

The National Aeronautics and Space Administration's (NASA) nonintegrated financial management systems have weakened its ability to oversee its contractors, and its contract management has been on GAO's high-risk list since 1990. In April 2000, NASA began its Integrated Financial Management Program (IFMP), its third attempt in recent years at modernizing financial management processes and systems. GAO was asked to review whether NASA was following key best practices in acquiring IFMP components and implementing one of the first components--the core financial module.

Skip to Recommendations

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
National Aeronautics and Space Administration 1. Given that NASA has already largely deployed and placed into production the IFMP commercial components acquired to date, the NASA Administrator should direct the Program Executive Officer for IFMP to focus near-term attention on stabilizing the operational effectiveness of these deployed commercial components.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 2. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for identifying known and potential risks.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 3. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for assessing the severity of the risks on the basis of probability and impact.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 4. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for developing risk mitigation strategies.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 5. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for assigning accountability and responsibility for implementing these strategies.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 6. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for tracking progress in implementing these strategies.
Closed - Implemented
Since our April 2003 report, NASA officials have developed and implemented a corrective action plan to mitigate risk that incorporates all aspects of our recommendation. Specifically, they have prepared a Risk Management Plan that outlines the standard processes and techniques for identifying, analyzing, and handling risks, as well as assigning responsibility for and tracking progress in mitigating risks. These processes are being applied to the Core Financial Upgrade. As a result, NASA should be able to effectively control risks to this project and significantly increase the likelihood of its success.
National Aeronautics and Space Administration 7. Specifically, to mitigate the risks associated with relying on already-deployed IFMP commercial components and to expeditiously stabilize these components' operational capability and performance, the Administrator should direct the Program Executive Officer for IFMP to develop and implement a corrective action plan. At a minimum, this plan should provide for reporting progress regularly and frequently to relevant congressional committees.
Closed - Not Implemented
NASA has not developed a corrective action plan to identify known and potential risks. According to IFMP officials, they have an overall risk mitigation strategy related to IFMP that they use for this purpose and do not think it necessary to revise their strategy based on GAO's recommendations. Although NASA has begun to implement GAO's recommendations to improve its requirements management and cost-estimating processes, which, if implemented properly, could help to mitigate the risk associated with relying on already-deployed IFMP components, GAO continues to believe that a comprehensive corrective action plan would aid NASA in its effort to stabilize the system and improve the functionality of IFMP.
National Aeronautics and Space Administration 8. Additionally, this plan should provide for developing and properly documenting requirements that are consistent, verifiable, and traceable, and that contain the necessary specificity to minimize requirement-related defects.
Closed - Implemented
Based on our recent audit work, NASA has now developed, documented, and implemented a requirements management process that complies with applicable standards and NASA internal requirements. NASA provided documentation that they are following these processes for the Contract Management Module Project. As a result, NASA should have more detailed, traceable requirements for this project, which should significantly decrease the amount of rework needed and help the project meet its objectives.
National Aeronautics and Space Administration 9. Additionally, this plan should provide for conducting thorough regression testing before placing modified components into production.
Closed - Implemented
Based on our recent audit work, NASA has now implemented both disciplined requirements management processes and effective testing procedures. NASA officials are applying these new procedures to the IEMP Contract Management Module project and have indicated that they intend to follow these procedures for upcoming projects as well. As a result of these improved processes, NASA should be able to ensure significantly fewer defects and obtain reasonable assurance that an application is working as expected when new IEMP modules are put into operation.
National Aeronautics and Space Administration 10. Additionally, this plan should provide for implementing a metrics program that will identify and address the root causes of system defects.
Closed - Implemented
Based on our recent audit work, NASA has implemented validation processes that capture necessary metrics and allow officials to evaluate the effectiveness of processes. NASA officials have applied these new processes to the Contract Management Module project and indicated that they will be used for other IEMP projects as well. As a result, NASA should be able to more readily identify and address the root causes of system defects, which in turn should help the agency meet its cost, schedule, and performance goals for IEMP.
National Aeronautics and Space Administration 11. Additionally, this plan should provide for reengineering acquisition management processes, particularly with respect to the consistency and detail of budget and actual cost and schedule data provided by contractors.
Closed - Not Implemented
According to NASA, to fully meet this recommendation it will need to complete its new program/project management policy and guideline development, update its technical and financial data structures, implement an integrated budget, cost, schedule, and reporting capability, and implement an integrated asset management and supply chain management system.
National Aeronautics and Space Administration 12. Additionally, this plan should provide for engaging stakeholders--including program managers, cost estimators, and the Congress--in developing a complete and correct set of user requirements.
Closed - Implemented
NASA has implemented this recommendation. The IFM program has enhanced the method and approach used to engage all levels of stakeholders and developed new program management requirements.
National Aeronautics and Space Administration 13. To mitigate future risks, the Administrator should require the Program Executive Officer for IFMP, before the acquisition of any additional IFMP components, to establish and implement a methodology for commercial system component dependency analysis and decision making.
Closed - Implemented
The agency has established a methodology for analyzing and understanding the interdependencies of commercial components prior to acquiring Integrated Enterprise Management Program (IEMP) components. The methodology describes steps for risk management and requirements development and management, and references supporting tools, techniques, methods, and practices for integrating multiple commercial component products to fulfill a set of user requirements. Further, NASA issued an IEMP Quality Assurance Plan on August 7, 2006, that provides for the iterative prototyping and development approach, which is an important aspect of effective analysis of commercial component dependency analysis. According to an agency official, this approach was used for the SAP Version Upgrade IEMP component and is to be used on future IEMP projects. The agency also provided a Software Component Dependency Analysis Process document that describes, at a high-level, the technical procedures associated with software component integration efforts. By taking these actions, the agency has met the intent of the recommendation.
National Aeronautics and Space Administration 14. To mitigate future risks, the Administrator should require the Program Executive Officer for IFMP, before the acquisition of any additional IFMP components, to evaluate the suitability of already acquired, but not yet implemented, IFMP component products within the context of a component dependency analysis methodology.
Closed - Implemented
According to NASA, the eTravel project, an IEMP component, has been reviewed against NASA's methodology for analyzing and understanding the interdependencies of commercial components and its Software Component Dependency Analysis Process document. The review verifies that the component dependency analysis processes are being used as a part of this effort. NASA's IEMP documentation also describes how this process was used for the NASA Account Management System prototype and the Identify Management System prototype. By taking these actions, the agency has met the intent of the recommendation.

Full Report