VA Software Asset Management: Adherence to Leading Management Practices Needed to Achieve Intended Outcomes
Fast Facts
The Department of Veterans Affairs planned to spend almost a billion dollars on software last year. We previously reported that VA needs to manage its commercial software licenses better.
In 2023, VA created an enterprise software asset management program to change how it manages software. The program includes a centralized software inventory project that could help it manage licenses more effectively.
But VA is at risk of missing out on cost savings and other benefits because it hasn't fully implemented some leading management practices for the program or this project.
We recommended ways to improve VA's plans for these efforts.
Laptop displaying seal of the Department of Veterans Affairs
Highlights
What GAO Found
The Department of Veterans Affairs (VA) has not fully implemented selected leading planning and management practices for its enterprise software asset management (eSAM) program. eSAM is a department-wide effort intended to change how VA manages software assets by, among other things, requiring VA offices to coordinate with, and centrally report software license data to, VA’s IT management organization. This will require a change in organizational practices, given that VA programs have historically acquired their software independently.
Department of Veterans Affairs’ (VA) Implementation of Selected Leading Program Planning and Management Practice Areas for the Enterprise Software Asset Management (eSAM) Program
|
Selected practice area |
Overall assessment |
|---|---|
|
Strategic alignment |
◔ Minimally implemented |
|
Stakeholder engagement |
◑ Partially implemented |
|
Life cycle management planning |
◑Partially implemented |
|
Managing changes needed to support the program |
◔ Minimally implemented |
|
Governance framework |
○ Not implemented |
|
Software license management |
◔ Minimally implemented |
Source: GAO analysis of VA eSAM program documentation. | GAO-26-108641
In addition, VA has not fully implemented selected leading planning and management practices for its software license inventory project. Of the six selected practice areas, VA partially implemented two areas (scope management and risk management) and minimally implemented the other four areas (project governance, stakeholder engagement, resource management, and software license management). For example, VA documented certain project risks but did not document all identified risks in a register. It also did not develop planned responses (e.g., mitigation strategies) for them all, which limits VA’s ability to address the risks before they become issues. Further, VA has not engaged with all stakeholders to identify their needs, nor developed plans for doing so. As such, eSAM is at risk of performing work that does not meet stakeholder needs.
Part of the reason for the shortfalls noted in the practice areas is that VA did not perform oversight to ensure that eSAM and the inventory project (1) finalized and received approval for several key plans and (2) followed the leading practices. VA officials stated that turnover in the IT management organization—including the absence of a permanent Chief Information Officer (CIO) since January 2025—impacted VA’s oversight of eSAM and the project. VA officials anticipated that, once a permanent CIO is on board, VA would consider implementing a new (1) IT governance board to oversee programs such as eSAM and (2) IT governance process. However, there are opportunities for current VA officials to provide oversight to the program and inventory project to ensure they continue moving forward to meet intended outcomes. Until VA fully implements the selected practices for eSAM and the inventory project, it may not achieve departmentwide software asset management. As such, it is also at risk of missing opportunities to achieve significant cost savings possible from analyzing departmentwide software license data to make informed investment decisions.
Why GAO Did This Study
VA spends billions of dollars annually on its IT and cyber-related investments, including for purchases of commercial software licenses. For fiscal year 2025, the department planned to spend about $985 million on software, including commercial software licenses.
In 2015, GAO identified the management of software licenses as a focus area in its High-Risk report. GAO has also previously reported on the need for VA to ensure better management of software licenses. VA has taken actions intended to improve its software license management, including establishing the eSAM program, which includes a project to implement a centralized software license inventory, among other things.
GAO was asked to review VA’s software asset management policies and practices. This report examines the extent to which VA implemented selected leading planning and management practices for its (1) eSAM program and (2) software license inventory project.
GAO reviewed industry guidance on program and project management and leading software license management practices identified in its prior work and selected 12 planning and management practice areas to review (six for the eSAM program and six for the inventory project). The selected areas and practices relate to early planning and execution of the program and inventory project. GAO compared the guidance in these 12 areas to VA documentation and interviewed VA officials.
Recommendations
GAO is making 18 recommendations to VA to fully implement selected leading planning and management practices for eSAM and the software license inventory project. VA concurred with all 18 recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology updates the eSAM program charter to identify (1) the program's components (e.g., IT projects); (2) the approach for realizing the program's benefits; (3) how the program is to manage interdependencies among the outputs of its components; (4) how the program's goals and objectives align with VA's strategic objectives; and (5) program assumptions, constraints, and dependencies. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology updates (as necessary) and finalizes the draft eSAM program management plans and program roadmap. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology establishes a stakeholder register for the eSAM program and regularly reviews, updates, and analyzes the register as the program progresses. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology develops a detailed strategy and guidelines for stakeholder engagement on the eSAM program, including how it plans to reach agreement with stakeholders on program requirements, and shares the strategy, guidelines, and other relevant program information with stakeholders to establish common, high-level expectations for the delivery of program benefits. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology requires the eSAM program to log or document its engagement with stakeholders and track stakeholder issues and concerns to help the entire program team understand stakeholder feedback. The CIO should also require the eSAM program to document this requirement in a finalized stakeholder management plan. (Recommendation 5) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology establishes a baseline cost estimate for the eSAM program. (Recommendation 6) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology establishes a baseline integrated master schedule for the eSAM program and maintains it throughout the implementation of the program. (Recommendation 7) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology updates and implements the eSAM performance management plan to call for managing performance against cost and schedule baselines and include related metrics for assessing when the program needs corrective action to get back on track. (Recommendation 8) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology conducts a change readiness assessment to identify the need for changes to support the eSAM program, including assessing known risks, such as the potential for resistance to process changes for how software acquisitions and licenses are managed, and to the involvement of OIT in the acquisition and management of software that VA programs have historically acquired without OIT. (Recommendation 9) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to (1) ensure that the eSAM program sponsor has sufficient authority, influence, and power to resolve any conflicts (e.g., stakeholder resistance to process changes) impeding the successful implementation of the eSAM program, and (2) clearly define the roles and responsibilities for the executive sponsor, program manager, and VA leadership responsible for supporting the program. (Recommendation 10) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should develop and implement a governance framework that establishes how the department will review, oversee, and approve the eSAM program. (Recommendation 11) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should update VA's software asset management policy to ensure that it fully addresses the seven elements of a comprehensive software licensing policy and incorporates the software license management leading practices described in this report. (Recommendation 12) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to review plans and progress for the software inventory project. (Recommendation 13) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology fully develops, approves, and implements plans for managing the eSAM software license inventory project—or use the eSAM program management plans and modify as needed to create sub-plans for the project—to define the framework within which decisions will be made and define how the project will be executed, monitored and controlled, and closed. (Recommendation 14) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology develops, implements, and maintains a detailed plan for identifying and managing stakeholders for the eSAM software license inventory project that addresses the leading stakeholder engagement practices included in our review. (Recommendation 15) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to direct that the Office of Information and Technology ensures that the inventory project (1) collaborates with all stakeholders to fully identify their needs and requirements and (2) follows established processes for evaluating and approving new requirements. (Recommendation 16) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology develops, implements, and maintains plans for estimating and managing resources needed for the eSAM software license inventory project, including identifying the type, quantity, and characteristics of resources needed. (Recommendation 17) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should direct the department's CIO to ensure that the Office of Information and Technology establishes and maintains a comprehensive risk register for the eSAM software license inventory project that: (1) documents all project risks, (2) includes an analysis of the potential degree of impact and probability of occurrence for each risk, (3) documents mitigation strategies for each risk, and (4) assigns responsibility for risks to individual risk owners. (Recommendation 18) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|