Department of State IRM: Strategic Approach Needed to Better Support
Agency Mission and Business Needs (Letter Report, 12/22/94,
GAO/AIMD-95-20).
Information and information technology are crucial to the State
Department's ability to meet its mission and business needs. However,
State has a poor history of managing information resources and, as a
result, continues to rely on inadequate and obsolete information
technology. This situation has led to critical information shortfalls
as well as interruption of operations. State has several initiatives,
such as automating name-checking for visa applicants and modernizing
systems departmentwide, aimed at overcoming these problems. However, by
not following the best information resources management (IRM) practices,
State has jeopardized the success of these efforts. State must commit to
strategic information management. This approach would require State to
anchor IRM planning in mission goals and objectives and integrate
planning and budgeting functions. The approach would also require
establishing an organizational framework that includes a senior
management partner to lead and direct IRM and an investment and
oversight process that significantly involves senior managers from
regional and functional bureaus. Until such changes are made, critical
mission and business functions--such as the identification of terrorists
prior to visa issuance--will continue to be undermined by inaccurate,
untimely, and incomplete information.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-95-20
TITLE: Department of State IRM: Strategic Approach Needed to
Better Support Agency Mission and Business Needs
DATE: 12/22/94
SUBJECT: Management information systems
Information resources management
Strategic information systems planning
Agency missions
ADP procurement
Mission budgeting
Chief information officers
*******************************************************************************
* This file contains an ASCII representation of the text of a GAO *
* report. Delineations within the text indicating chapter titles, *
* headings, and bullets are preserved. Major divisions and subdivisions *
* of the text, such as Chapters, Sections, and Appendixes, are *
* identified by double and single lines. The numbers on the right end *
* of these lines indicate the position of each of the subsections in the *
* document outline. These numbers do NOT correspond with the page *
* numbers of the printed product. *
* *
* No attempt has been made to display graphic images, although figure *
* captions are reproduced. Tables are included, but may not resemble *
* those in the printed version. *
* *
* A printed copy of this report may be obtained from the GAO Document *
* Distribution Facility by calling (202) 512-6000, by faxing your *
* request to (301) 258-4066, or by writing to P.O. Box 6015, *
* Gaithersburg, MD 20884-6015. We are unable to accept electronic orders *
* for printed documents at this time. *
*******************************************************************************
Cover
========================================================================== COVER
Report to the Chairman, Legislation and National Security Subcommittee,
Committee on Government Operations, House of Representatives
December 1994
DEPARTMENT OF STATE IRM - STRATEGIC
APPROACH NEEDED TO BETTER SUPPORT
AGENCY MISSION AND BUSINESS NEEDS
GAO/AIMD-95-20
State IRM
Abbreviations
========================================================================= ABBREV
CD-ROM - compact disk-read only memory
CIO - Chief Information Officer
DPA - delegation of procurement authority
DSO - Designated Senior Official
FMFIA - Federal Managers' Financial Integrity Act
GAO - General Accounting Office
GSA - General Services Administration
IFMS - Integrated Financial Management System
IRM - information resources management
Letter
========================================================================= LETTER
B-257517
December 22, 1994
The Honorable John Conyers, Jr.
Chairman, Legislation and
National Security Subcommittee
Committee on Government Operations
House of Representatives
Dear Mr. Chairman:
This report responds to your February 3, 1994, request that we evaluate the
Department of State's information resources management (IRM) program and
ongoing improvement efforts. We conducted our review using our May 1994
executive guide on the best practices of leading public and private
organizations as a framework.\1 This report complements our August 1994 report
on State's financial management systems planning.\2
--------------------
\1 Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology (GAO/AIMD-94-115, May 1994).
\2 Financial Management: State's Systems Planning Needs to Focus on Correcting
Long-standing Problems (GAO/AIMD-94-141, August 12, 1994).
RESULTS IN BRIEF
---------------------------------------------------------------------- Letter :1
Information and information technology are crucial to the Department of State's
ability to meet its mission and business needs. However, State has a poor
history of managing information resources and, as a result, continues to rely
on inadequate and obsolete information technology. Such reliance has resulted
in critical information shortfalls as well as interruption of operations.
State has a number of initiatives, including efforts to automate namechecking
for visa applicants and modernize systems departmentwide, aimed at resolving
such problems. However, by not following the best IRM practices, State has put
such initiatives at risk of failure.
Rather than continue in this manner, the Department must commit to strategic
information management. This approach would require State to anchor IRM
planning in mission goals and objectives and integrate planning and budgeting
functions. The approach would also require establishing an organizational
framework that includes (1) a senior management partner to provide leadership
and direction for IRM and (2) an investment and oversight process with
significant involvement of senior managers from regional and functional
bureaus.
Such changes will not be easy; however, they are key to achieving lasting
improvement. The Under Secretary for Management recently initiated several
efforts to provide high-level direction and oversight for IRM. While these
efforts are a good start, for State to be successful it must commit to a
departmentwide approach, addressing long-standing, fundamental barriers to
effective IRM. Until then, it will face the risk of continuing systems
failures and high system maintenance costs. In addition, critical mission and
business functions--such as the identification of terrorists prior to visa
issuance--will continue to be impaired by inaccurate, untimely, and incomplete
information; and the Department will be constrained in meeting its foreign
policy leadership objectives.
BACKGROUND
---------------------------------------------------------------------- Letter :2
The Department of State's primary mission is to advise the President in the
formulation and execution of foreign policy and to ensure the advancement and
protection of U.S. interests abroad. The Department is also responsible for
conducting consular operations, including visa services for foreign nationals;
managing embassies and other real property--with a current estimated value of
about $12 billion; and providing support services to at least 24 other federal
agencies who have offices overseas. To meet these responsibilities, the
Department must be able to (1) quickly and accurately, analyze and interpret
political, economic, and societal events taking place all over the world, and
(2) assess the potential effects of these events on the U.S. Complicating
completion of these responsibilities is the current operating environment of
shrinking budgets and reduced staffing. In this context, effective IRM is key
to successful accomplishment of State's critical missions.
Twenty-one bureaus,\3 as well as over 260 foreign posts and other offices,
support State's worldwide program and administrative responsibilities. By
delegating responsibilities to the bureaus and offices, State has given each a
significant amount of operational control for IRM. For example, many bureaus
and offices have their own IRM staff, as well as budgetary authority, to
independently undertake systems initiatives. Of the Department's fiscal year
1994 total reported IRM expenditures--excluding salaries--58 percent, or
approximately $149.1 million, was managed by State's IRM office, while the
remainder was allocated among the bureaus.
The IRM office is responsible for guiding, coordinating, and providing
technical support for the bureaus' and offices' IRM activities. The IRM office
also is responsible for providing the infrastructure necessary for the bureaus
and offices to achieve their individual IRM goals.
State relies on a variety of information resources to help it carry out its
responsibilities and support its decentralized operations. For instance, State
has numerous systems to help with its consular activities, which include
managing immigrant and nonimmigrant visas and preventing their issuance to
terrorists, drug traffickers, and others who are not entitled to them. State
also accounts for and controls its annual appropriation of about $5 billion on
a reported 33 domestic and overseas financial systems and subsystems. Further,
State has a variety of systems to help it account for and manage both its
overseas real properties and over 25,000 full-time employees, here and abroad.
Several federal agencies, including the Department of Defense, the United
States Information Agency, and the Agency for International Development, also
depend on information from State's automated systems. In fiscal year 1994,
State reported spending about $372 million on its IRM activities.
State supports its systems on a variety of hardware platforms. Its corporate
systems\4 are operated on mainframe computers at data processing centers in the
Washington, D.C. area and overseas. Domestic bureaus and overseas posts are
also equipped to varying degrees with mini-computers and office automation
equipment, which State purchased over a 15-year period almost exclusively from
one vendor--Wang. Foreign Service Officers rely on this equipment for
electronic mail, word processing, and other functions to develop reports and
communicate information in support of State's foreign policy objectives.
Even though State relies on information and technology to meet its mission and
business needs, its management of these resources has historically been poor.
GAO, the General Services Administration, the Office of Management and Budget,
and State's Office of Inspector General have all reported broad IRM problems at
State related to planning, budgeting, organization, acquisition, and
information security. The reports also discussed problems in State's financial
management, property, and consular systems. The reports stated that because of
these problems, managers often did not have the accurate, timely, integrated
information they needed to meet administrative and foreign policy objectives.
State too has recognized that it has many long-standing IRM problems. It
reported a number of these material and high-risk weaknesses to the President
and the Congress under provisions of the Federal Managers' Financial Integrity
Act (FMFIA) and its implementing guidance. These weaknesses and State's
efforts to address them include the following:
In 1993, State reported that the Department relied heavily upon proprietary
computer systems and associated software for all of its major applications
(that is, finance, consular, personnel, and other administrative systems).
State also reported that this Wang equipment was technically obsolete and prone
to failure. The Department's modernization initiative is aimed at replacing
the Wang systems, reducing maintenance costs, and improving system reliability.
Since 1987, State has reported that outdated technology and inadequate
management controls and oversight of visa processing increased vulnerability to
illegal immigration and diminished the integrity of the U.S. visa. State
currently has an effort aimed at automating visa namechecking systems at all
posts worldwide and eliminating out-dated microfiche systems that are currently
at 72 posts. This effort is intended to reduce the risk of issuing visas to
terrorists, drug traffickers, and others.
Over the past decade, State had reported 42 material weaknesses and
nonconformances in its core and subsidiary accounting systems. The Department
manages six financial management systems worldwide. It has reported that its
general ledger has never properly reflected the agency's financial position.
The Integrated Financial Management System initiative is intended to integrate
State's various financial management and related systems, providing managers
with accurate and timely information to be used in making program decisions.
State has reported for the past decade that the absence of backup capabilities
for mainframe systems jeopardized the Department's domestic information
infrastructure in the event of an emergency. State has an effort underway to
acquire mainframe backup to provide for processing if the mainframes at State's
data processing centers fail.
Appendix II provides further details on these four initiatives and the problems
they are intended to correct.
--------------------
\3 The bureaus within State include the Bureau of Administration, the Bureau of
Finance and Management Policy, Bureau of Intelligence and Research, Bureau of
Personnel, Bureau of Diplomatic Security, and regional and policy bureaus such
as the Bureau of African Affairs, Bureau of East Asian and Pacific Affairs, and
Bureau of European and Canadian Affairs.
\4 State's corporate systems include most of the large-scale information
processing systems that are centrally managed and/or used throughout the
Department. These systems help support the Department's core foreign affairs,
consular, financial management, administrative, and information services
functions.
SCOPE AND METHODOLOGY
---------------------------------------------------------------------- Letter :3
To assess the adequacy of State's current IRM program and improvement
initiatives in meeting agency and business needs, we focused on a recent GAO
report of 11 best IRM practices of leading public and private organizations.
(See appendix III for a list of these best practices.) Using this report, as
well as other federal IRM guidance, we identified management elements we
believe to be critical and relevant to IRM success at State. These elements
include
top-level management commitment to improving IRM;
a strategic IRM planning process that is based on mission and business needs
and that integrates the planning and budgeting functions;
an acquisition process in accordance with legal requirements and applicable
policy guidance; and
an organizational framework that includes leadership and authority for IRM, an
executive-level review process to prioritize and oversee investment projects,
and an IRM organization that provides adequate guidance and support for
agencywide customers.
To obtain information on State's IRM program for evaluation against these
management elements, we interviewed senior agency officials, IRM managers,
technical personnel, and bureau representatives. We conducted our work between
January 1994 and November 1994, in accordance with generally accepted
government auditing standards. Appendix I provides further details on our
scope and methodology.
STATE NEEDS A STRATEGIC APPROACH TO
OVERCOMING IRM PROBLEMS
---------------------------------------------------------------------- Letter :4
While the State Department depends on information to conduct its various
missions, its management of information technology over the years has been
poor. Problems have gone unresolved and managers have not had information when
they need it to perform mission-critical and business needs. Moreover,
improvement efforts focused on addressing these problems have not been
successful, have taken too long, or have had only minimal impact on operations.
Many of these problems are similar to ones we have seen throughout the federal
government. We recently studied a number of leading private and public
organizations to determine how they managed information resources to improve
mission performance.\5 We identified practices that, when used together, led to
significant improvements in mission performance. These practices include
top-level management
recognizing the need to change and taking steps to ensure sustained commitment
throughout the organization;
establishing an outcome-oriented, integrated strategic information management
process; and
establishing organizationwide information management capabilities to ensure
that information technology meets mission and business needs.
--------------------
\5 Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology (GAO/AIMD-94-115, May 1994).
TOP-LEVEL MANAGEMENT AT STATE
MUST COMMIT TO IMPROVING IRM
-------------------------------------------------------------------- Letter :4.1
A basic step toward improving information management is top executives
recognizing that business as usual will not suffice and that the need to change
is both real and urgent. Senior executives should (1) recognize the value of
improving IRM, (2) evaluate IRM practices against those of leading
organizations, and (3) dedicate themselves, and the organization, to
improvement. Initiating and maintaining activities focused on rapid
improvement requires investing in, identifying, and adopting new techniques,
new processes, and new ways of doing business.
The lack of top-level management commitment to improving IRM has long been a
problem at State, as evidenced by the Department's failure to resolve material,
high risk, and other IRM weaknesses. Despite repeated criticisms from
oversight agencies over the past decade, State has not had a sustained effort
to improve IRM departmentwide. For example, the Department identified serious
weaknesses in its financial and accounting systems over a decade ago that have
not yet been corrected. These weaknesses include the general ledger not
properly reflecting the agency's financial position, deficiencies in data
quality, and inadequate support of mission performance. Our recent report on
the Integrated Financial Management System project, which is intended to
correct these weaknesses, concluded that the project held a high risk of
failure because of a lack of departmentwide IRM leadership and strategic
planning. As a result, financial information that managers increasingly
require to make informed program decisions in support of foreign policy
objectives will continue to be inaccurate and untimely.
Recently, however, the Under Secretary for Management, recognizing that
effectively managing State's information resources is critical for the
Department to meet its various missions, initiated several efforts to address
the Department's information management problems. These efforts include
clarifying the roles and responsibilities of senior officials to ensure that
they fulfill federal requirements for IRM, developing a process to prioritize
IRM acquisitions departmentwide, and establishing an advisory board of senior
officials to provide leadership and oversight for IRM. The Under Secretary
told us that these efforts are just first steps in resolving State's many IRM
shortcomings.
These initial steps are critical to helping resolve State's information
management problems; still, State needs to maintain the momentum for change by
obtaining commitment from senior managers in key program and support areas to
continue institutionalizing improvements. Such support will require State to
(1) analyze current performance problems and determine how information
management solutions can address these problems and (2) educate line managers
about how strategic information management can improve mission effectiveness.
STATE SHOULD ESTABLISH A
STRATEGIC INFORMATION MANAGEMENT
PROCESS
-------------------------------------------------------------------- Letter :4.2
As the need to fundamentally change is recognized and managers throughout the
organization begin to understand their responsibility for change, the
organization can begin to focus on an integrated, strategic information
management process. Key tenets of such a process include developing a
strategic planning process based on mission and business needs, and integrating
the planning and budgeting functions. Additionally, the organization should
ensure that information resource procurements and contracts are performed in
accordance with legal requirements and applicable policy guidance.
STRATEGIC PLANNING SHOULD BE
ANCHORED TO MISSION GOALS AND
OBJECTIVES
------------------------------------------------------------------ Letter :4.2.1
A basic step in an integrated information management process is building a
departmentwide strategic planning process that is anchored to an agencywide
business plan that specifies mission goals and objectives. Such a planning
process includes (1) identifying the agency's mission goals and objectives and
(2) developing an IRM plan that supports these goals and objectives.
State has not yet developed such a strategic IRM planning process. State does
not have a departmentwide plan specifying mission, goals, objectives, and
priorities, although program planning guidance provides limited information on
these. Department officials agreed that a clear statement of mission goals,
objectives, and priorities would help them in their IRM planning efforts.
The 1994 strategic IRM plan--the first issued since 1991--was developed within
the IRM office with comments from the bureaus and is largely a description of
numerous information technology projects. The plan does not prioritize State's
numerous IRM initiatives--including office automation, overseas telephone
system replacement, overseas telecommunications service, and the integrated
financial management system projects--and, thus, cannot guide executive and
operational decisions. Such prioritization is essential because funding may
not be available for all initiatives.
Recently, the Under Secretary for Management began focusing attention on
improving agencywide program planning. As previously mentioned, the Under
Secretary established an advisory board of senior officials whose first task is
to develop an IRM vision that provides direct support to the Department
mission. The Under Secretary is also considering establishing a new process
for linking program, IRM, and other planning processes. Officials in the
Bureau of Finance and Management Policy stated that the support of other Under
Secretaries will be necessary to ensure departmentwide attention to program
planning processes, because historically, planning has not been a focus in
State's culture. As one agency report stated, "... it is a rare Department
officer who is able to do much more than cope with today's crises and
issues."\6 This report further states that the Department needs to
significantly increase its strategic planning efforts, recognizing that if
State does not know where it wants to go, as well as the options for getting
there, it will not do well in the post Cold War era.
--------------------
\6 State 2000, A New Model For Managing Foreign Affairs, Report of the U.S.
Department of State Management Task Force, December 1992.
STATE SHOULD INTEGRATE IRM
PLANNING WITH BUDGET PROCESSES
------------------------------------------------------------------ Letter :4.2.2
In conjunction with focusing on mission and business goals, successful
organizations integrate the planning and budgeting processes. This reinforces
the linkage of IRM initiatives to the agency's mission, provides tight controls
during implementation, and helps ensure that projects stay on track. This also
helps ensure that budgeting does not become reactive to priorities of the
moment that have not been adequately weighed against those of the future, and
that plans do not become mere paper exercises.
The IRM planning and budgeting processes have not been linked at State. For
example, bureau IRM budgets are not developed out of a departmentwide IRM
planning process. Instead bureau IRM budgets have been developed by the
bureaus and reviewed (along with other budgetary items) and approved by the
Chief Financial Officer--without the involvement of the Designated Senior
Official for IRM or a departmentwide IRM board. Thus, State has not had a
means to analyze or eliminate duplication in IRM initiatives and funding.
State has also not had a mechanism to ensure adequate funding for initiatives
to address long-standing IRM problems. Projects are funded at a level
sufficient to plan them, but not to implement them, according to senior IRM
officials. These officials stated that this is a primary reason why several
large projects--including replacement of proprietary, obsolescent
mini-computers and office automation equipment in State's domestic bureaus and
overseas posts--have made little progress. (See appendix II for details on
this systems modernization effort.)
According to a March 1994 memo from the Assistant Secretary for Administration,
although the IRM support office lacked the necessary modernization funding,
individual bureaus and offices--other than the IRM office--expended $68 million
on office automation items. Without a departmentwide, integrated, IRM planning
and budgeting process, the Department could not ensure that the $68 million was
directed towards State's highest priorities. The memo further stated that such
a planning process is critical to eliminating the duplication and waste
inevitable in the current approach, and that the absence of this process
results in bureaus independently implementing modernization plans in accordance
with their own priorities and resources.
Slow progress in modernizing systems has been accompanied by difficulty in
supporting and maintaining older technology and increased vulnerability to
computer failures. The cost of supporting obsolete, proprietary office
automation equipment has been high--about $12 million in fiscal year 1994,
according to an IRM official.
State officials also said that foreign affairs operations have been affected by
computer failures. For example, in January 1994, the Bureau of Near Eastern
Affairs experienced failures of old Wang disk drives during 5 of the 10 days of
preparation prior to the Secretary's negotiations in the Middle East. The
failures resulted in delays and difficulty in providing briefings to the
Executive Secretariat. Systems were down for hours at a time and reports that
were needed to prepare for the negotiations had to be recreated because files
were deleted or could not be accessed. The old disk drives ultimately had to
be replaced with new equipment to adequately support bureau operations.
The lack of an integrated IRM planning and budgeting function has also resulted
in long-standing weaknesses related to backup for the mainframe systems. State
has reported inadequate backup as a high risk weakness under FMFIA for about 10
years. However, such backup has not been provided because of various funding
shortfalls. For example, several classified systems in Washington, D.C. do
not have backup. One classified system without back-up is the telegraphic
retrieval system. This system allows for search and retrieval of all cables
over the past 20 years. Such a system is important to users who rely on search
and retrieval for important time-critical research, such as identifying groups
who may be responsible for terrorist acts under investigation.
In 1993, State began an effort to better integrate the planning and budgeting
functions. The IRM office initiated a departmentwide planning process in which
bureau representatives met in separate groups--regional, policy, and management
bureaus--to determine spending priorities. This effort represents an
improvement from the past in that it (1) relied on decision criteria based on
mission benefits and (2) brought together bureau representatives to communicate
priorities and needs. However, this process is evolutionary and has not yet
been institutionalized as an integrated, departmentwide process for allocating
all State IRM funds.
STATE HAS A HISTORY OF POOR
ACQUISITION MANAGEMENT
------------------------------------------------------------------ Letter :4.2.3
The Federal Acquisition Regulation requires federal agencies to develop
acquisition plans to obtain the maximum extent of full and open competition in
fulfilling agency needs. The purpose of these plans is to ensure that agencies
meet their needs in the most effective, economical, and timely manner.
Historically, however, State has not conducted adequate planning and management
to meet these goals in its acquisition of information technology. About
one-half of State's Delegations of Procurement Authority\7 (DPAs) for
information technology acquisitions are sole source. In 1992 the General
Services Administration (GSA) lowered the thresholds in State's DPA-- that
allowed State to make IRM purchases without GSA's prior approval--because of
these procurement problems. For example, State's general authority to award
IRM contracts was lowered from $2.5 million to $1.5 million for competitive
procurements.
State's acquisition problems include the failure to adequately track DPAs and
request DPAs for contract extensions sufficiently in advance of the contract
expiration date. Between 1991 and 1993, about half of State's requests for
DPAs to execute contract extensions were sent to GSA less than a month before
the expiration of each contract. For example, in March 1993, State requested a
DPA for a contract extension 5 days before a contract for maintenance of
State's Foreign Affairs Data Processing Center was set to expire. State noted
in its request to GSA that, without the extension, the Department would have to
shut down operations at its Beltsville data processing site and reduce
operations at its headquarters site, with an "almost catastrophic effect on the
Department's ability to conduct business." To prevent this outcome, the
contract has been extended twice since March 1993. The December 1993 DPA for
an extension was given on the condition that State develop a management plan
for the acquisition.
State has established a Major Acquisition Program Office within the IRM office
to address major acquisition weaknesses. This office has developed a set of
new policies and procedures, currently under review by acquisition and IRM
officials, for planning major acquisitions. Further, the IRM office has an
ongoing review of acquisition management problems, although it has not yet
determined how the problems should be addressed.
--------------------
\7 Under the Federal Property and Administrative Services Act, GSA has the
primary authority to procure automated data processing equipment for federal
agencies, but may delegate its authority so that agencies can make such
purchases directly. State's records of DPAs and other GSA actions did not
provide the total number of contract extensions. Our statistics are based on
GSA records, which we did not verify. The statistics exclude a few contracts
for which information was not available.
STATE HAS NOT ESTABLISHED AN
ORGANIZATIONAL FRAMEWORK TO
PROVIDE IRM DIRECTION AND FOCUS
-------------------------------------------------------------------- Letter :4.3
Successful organizations we studied in developing our executive guide on best
practices established effective organizational frameworks to provide IRM
direction and focus. Such frameworks included positioning a Chief Information
Officer (CIO) to provide IRM leadership and authority; establishing an
executive-level investment review board to prioritize projects and oversee the
organization's various IRM activities; and ensuring that the agency's IRM
organization provides adequate guidance and support for its agencywide
customers.
STATE HAS NOT POSITIONED A CIO
AS A SENIOR MANAGEMENT PARTNER
------------------------------------------------------------------ Letter :4.3.1
A CIO positioned as a senior management partner can serve as a bridge between
top management, line managers, and information support professionals. This
includes clearly articulating the critical role information management plays in
mission improvement and focusing and advising senior executives on high-value
IRM issues, decisions, and investments. Appointing a CIO will not, in itself,
resolve problems or lead to improved mission capabilities. The CIO should have
the authority to ensure implementation of IRM initiatives and agencywide
compliance with approved IRM standards.
State has a Designated Senior Official (DSO) for IRM, rather than a CIO.
However, because of his position and other responsibilities, State's DSO has
not provided adequate leadership for IRM. The DSO is positioned several levels
down within State's hierarchy and reports to the Under Secretary for
Management, whose involvement in IRM has traditionally been limited. The DSO,
who is the Assistant Secretary of State for the Bureau of Administration, also
has a range of other responsibilities, including all administrative functions
of the Department and managing the Foreign Buildings Operations. Finally, the
DSO is at the same organizational level as the other bureau chiefs.
Without a senior IRM official, State has also not had anyone with the authority
to ensure agencywide compliance with any IRM guidance or standards that might
be approved. For example, because the DSO is equivalent to other bureau heads,
the DSO cannot ensure departmentwide compliance with data standards in an
effort to institute a departmentwide data administration program. Further, the
DSO has no means of ensuring compliance with departmentwide computer or
telecommunications standards supporting the current systems modernization
effort.
The Under Secretary for Management stated that he is acting as the CIO under
the current management structure. He believes that it is his responsibility to
create the environment and relationships necessary to effectively manage
information resources. We agree that his IRM role is critical. However, we
are concerned that leaving the CIO as an ad hoc position will not ensure that
the processes needed to effect lasting IRM improvements will be
institutionalized.
NEW INVESTMENT REVIEW PROCESS
NEEDS TO BE STRENGTHENED
------------------------------------------------------------------ Letter :4.3.2
A departmentwide process for selecting and reviewing investments is needed to
effectively carry out IRM improvement efforts. Such a process would involve an
investment review board, with significant control over decisions and balanced
representation from key program and support areas. Traditionally, IRM projects
have been thought of as individual information technology expenses. The
leading organizations we studied, however, began to think of information
systems projects, not as one-time expenses, but rather as investments to
improve mission performance. They instituted review boards with responsibility
for controlling budgets and selecting, funding, integrating, and reviewing
information management projects to ensure that they meet agencywide mission and
business objectives. Thinking of projects as investments helped to concentrate
top management's attention on measuring the mission benefits, risks, and costs
of individual projects. It also helped managers evaluate the tradeoffs between
continuing to fund existing operations and developing new performance
capabilities.
In an effort to institute a more departmentwide focus to agency IRM, the Under
Secretary for Management recently established an IRM board of senior State
officials. The board, which has met a few times, was established to develop an
IRM vision from the Department's strategic plan; approve the IRM strategic
plan; review IRM programs to ensure that program, policy, and acquisition
requirements are met; and approve and prioritize IRM acquisitions to be
presented to the Under Secretary for Management. It is too early to determine
whether the board has sufficient control over key decisions or whether its
authority should be increased beyond that of advising the Under Secretary for
Management.
In addition, State's board lacks sufficient representation from regional and
functional bureaus to ensure that mission-critical information needs receive
adequate priority. The board has 11 members of which only 3 represent mission-
critical areas. Thus, the majority of the 21 bureaus are not represented on
the board. The other eight members of the board represent support areas,
including four representatives from the Bureau of Administration, two
representatives from the Bureau of Finance and Management Policy, one
representative from the Bureau of Diplomatic Security, and the Deputy Legal
Adviser.
If the board is given sufficient oversight over IRM improvement efforts, it
could play an important role in ensuring that projects are completed
successfully. This is particularly important at State because periodic Foreign
Service Officer rotations hinder managers from seeing projects through to
completion. For example, the highest level IRM office employee devoted
full-time to the modernization effort has changed five times in the past few
years.
The board could also be an important vehicle for ensuring that important
projects, such as data administration, are adequately funded and implemented
agencywide. In the past, this has not occurred. For example, the data
administration program is intended to support the modernization effort and
address fundamental technical inefficiencies that have resulted from State's
decentralized organization and mission and business operations. With posts all
over the world managing their own specialized programs and functions, the
Department has become reliant on separate systems environments for various
overseas and domestic operations. Redundant and incompatible systems operating
within these environments produce inconsistent, inaccurate, and untimely data
that hamper departmental decision making, according to a State report. The
report further states that bureaus spend a considerable amount of time
reconciling data delivered by other bureaus. Data administration is needed to
ensure that common, integrated data and information support business and
program operations.
According to IRM officials, however, bureaus (other than the Bureau for
Financial and Management Policy) have only demonstrated a token interest in
data administration. In addition, the program has not had an official charter,
mission, and permanent staff. On several occasions, the data administration
program ran out of funds. At one point, the Bureau of Finance and Management
Policy provided some of its own operational funds to keep the project going to
meet bureau needs.
The Office of the Under Secretary for Management recently drafted proposals to
begin to bring together IRM planning and budgeting processes; however, State
officials said that agencywide commitment will be needed to implement these
initiatives. In addition, as previously mentioned, State began in 1993 to hold
separate meetings for representatives from the regional, policy, and management
bureaus to establish agencywide spending priorities and make decisions on
investments in line with mission and business objectives. These are all steps
in the right direction; however, it is too early to determine what final impact
they will have.
STATE SHOULD ENSURE CENTRAL
GUIDANCE AND SUPPORT FOR IRM
------------------------------------------------------------------ Letter :4.3.3
One of the basic responsibilities of an agency's IRM support organization is to
provide organizationwide guidance on the management of information resources.
Increasingly, IRM support organizations are also called upon to provide
information and technical architectures\8 and standards to guide the management
and acquisition of information resources.
State's IRM organization, however, has not provided adequate guidance
describing how State's various information resources should be managed. For
example, the guidance that the IRM office has provided does not address issues
such as strategic IRM planning, management of major acquisitions, or conducting
IRM evaluations in accordance with federal requirements. Policy officials are
currently revising the guidance to reflect departmental changes, reduce its
length, and ensure compliance with federal regulations. The revisions are
expected to be completed in 1995.
The IRM office also has not provided an infrastructure within which to
effectively manage information resources. Specifically, State has not
developed an enterprisewide information architecture that identifies the
information that is needed to achieve mission objectives and defines how
information systems will be integrated through common standards to satisfy
those objectives. Senior IRM officials recognized that an information
architecture was needed, but said that a project to develop one will not be
initiated for another year or two.
The IRM office is currently working to institute a technical architecture as
part of its systems modernization program. The technical architecture is to
provide a set of standards and specifications, describing the basic features
necessary to permit a wide variety of platforms to interoperate at all of
State's posts and offices worldwide. However, planning for the systems
modernization program is based on inadequate supporting analysis.
Specifically, State has not identified agencywide information and functional
requirements in planning for systems modernization. Instead, State has
unnecessarily limited its modernization options by focusing on technology
solutions. For example, the Department selected Microsoft Windows as its
systems environment at the desktop level. In conducting a requirements survey,
the IRM officials asked users whether they needed Windows--ignoring other
desktop platforms, such as Macintosh and OS/2. As a result, State does not
know whether Windows is the most appropriate system environment for meeting
users' needs.
--------------------
\8 An information architecture is a description of all functional activities to
be performed to achieve a desired mission, the automated systems elements
needed to perform the functions, and the designation of performance levels of
those systems elements. A technical architecture is a model that explains and
graphically depicts the hardware, software, and communication facilities used
to implement a system.
CONCLUSIONS
---------------------------------------------------------------------- Letter :5
With shrinking budgets and reduced staffing, the Department of State is facing
new challenges in fulfilling its worldwide responsibilities. Meeting these
challenges will require State to increase the effectiveness and efficiency of
its mission and business operations, including consular affairs operations
aimed at reducing visa fraud and financial management operations aimed at
improving financial statements. How successful State is will depend, at least
in part, on how well the Department manages its information resources.
Although the Department spends hundreds of millions of dollars on IRM
activities annually, it continues to be plagued by long-standing IRM problems.
As a result of its failure to follow the best IRM practices, major IRM
improvement initiatives remain at risk of failure. Specifically, because IRM
planning and budgeting processes have not been linked, initiatives to modernize
office automation equipment have made little progress and backup for some
mainframes is still lacking. These initiatives have been funded at levels
sufficient to plan them, but not fully implement them. While State has
recently begun a departmentwide investment review board, the board lacks
adequate representation from regional and functional bureaus to ensure adequate
support for mission-critical information needs.
To resolve its long-standing problems, State must follow the example set by
leading organizations and adopt a more strategic approach to information
management. Such an approach includes (1) a departmentwide commitment to
change, (2) an integrated management process, and (3) an organizationwide
information management capability to address mission and business needs.
The Under Secretary for Management has initiated efforts to promote change and
revise management processes and organizational structures. These are important
first steps. However, more action should be taken to sustain and support these
efforts. Managers throughout the agency must begin to work together to
identify and address information management weaknesses. State must also assess
and prioritize its mission and business needs and begin to focus on those
projects that are most needed across the Department. Only by taking an
agencywide focus will State be able to make substantive progress and break from
its history of poor information management.
RECOMMENDATIONS
---------------------------------------------------------------------- Letter :6
To institute modern information resources management practices in support of
departmentwide mission and business needs, we recommend that the Secretary of
State
designate a Chief Information Officer, above the Assistant Secretary level,
with the authority necessary to oversee the implementation of departmentwide
IRM initiatives and standards, and
strengthen the recently established new IRM investment review board by (1)
increasing regional and functional bureau representation and (2) ensuring that
the board's determinations are implemented.
We also recommend that the Chief Information Officer, in conjunction with
participants from the IRM investment review board,
ensure development of an agency business plan specifying mission goals,
objectives, and priorities to provide a sound basis for IRM planning and
business process improvements;
integrate IRM planning with budgeting and other related processes;
ensure that the IRM organization (1) issues adequate guidance to govern
agencywide IRM, including the areas of strategic planning and acquisition, and
(2) develops information and technical architectures and standards to ensure
integration of data and systems; and
require periodic evaluations of State's IRM practices against those of leading
organizations and implement necessary improvements to continually strengthen
practices.
As requested, we did not obtain written comments on a draft of this report.
However, we discussed the results of our work with the Under Secretary for
Management and senior IRM officials, who generally agreed with the information
presented.
As agreed with your office, unless you publicly announce the contents of this
report earlier, we plan no further distribution until 30 days from the date of
this letter. We will then send copies to the Secretary of State, other
interested congressional committees, and the Director of the Office of
Management and Budget. Copies will also be sent to others upon request.
Please contact me at (202) 512-6240 if you or your staff have any questions.
Other major contributors are listed in appendix IV.
Sincerely yours,
Jack L. Brock, Jr.
Director, Information Resources Management/
National Security and International Affairs
SCOPE AND METHODOLOGY
===================================================================== Appendix I
To address our objective, we focused on a recent GAO report on the best
practices of leading public and private organizations,\1 and reviewed
legislation, federal guidance, and other IRM criteria. On the basis of this
criteria, we identified elements we believe to be critical and relevant to IRM
success at State. These elements include adequate leadership and authority for
IRM, and strategic IRM planning based on the agency's mission and business
needs.
To obtain background information on the long-standing IRM problems at State, we
interviewed and collected reports from officials at the General Services
Administration, the Office of Management and Budget, and State's Office of
Inspector General. We reviewed internal reports and evaluations from State to
gain the agency's perspective on its IRM program. Further, we interviewed
State officials and observed operations at the Foreign Affairs Data Processing
Center, the Communications Center at State headquarters, and the Information
Management Center in Beltsville, Maryland.
To assess State's organizational structure, we consulted various offices
departmentwide. Specifically, we interviewed senior State officials (including
the Under Secretary for Management, the Assistant Secretary for Administration,
and the Deputy Assistant Secretary for Information Management), as well as
other IRM representatives to gain their perspectives on IRM needs and
challenges, and corresponding initiatives to address them. Further, we
analyzed documents and interviewed representatives from Consular Affairs,
Finance and Management Policy, Diplomatic Security, and the regional bureaus to
learn about the bureaus' IRM activities, support from and coordination with the
IRM office, and whether or not bureau information and technology needs are
adequately met.
To evaluate State's IRM planning, we reviewed plans and supporting
documentation and discussed IRM planning processes with relevant IRM officials.
We observed newly instituted integrated planning sessions in which users work
together to prioritize their technology needs and develop an IRM spending plan.
We interviewed program planning officials concerning the link between program
and IRM planning and the need to develop a departmentwide business plan.
Additionally, we obtained information on forums established to coordinate IRM
activities and initiatives agencywide.
To assess State's ongoing IRM improvement efforts, we reviewed and analyzed
modernization plans and supporting documents and interviewed relevant IRM
office, Diplomatic Telecommunications Service Program Office, and other bureau
officials. We consulted with officials from the National Institute of
Standards and Technology to gather information on approaches to establishing
open system environments.
We performed our work at State headquarters offices in the Washington, D.C.,
area. As requested by your office, we did not obtain written comments on a
draft of this report. However, we discussed the results of our work with the
Under Secretary for Management and senior IRM officials, who generally agreed
with the information presented.
--------------------
\1 Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology (GAO/AIMD-94-115, May 1994).
STATE'S INITIATIVES TO ADDRESS IRM
WEAKNESSES IN HIGH- RISK AREAS
==================================================================== Appendix II
State has a number of weaknesses that it has reported over the past decade as
high risks under FMFIA and its implementing guidance. These weaknesses include
(1) reliance on obsolete proprietary equipment that is increasingly vulnerable
to failure and rising maintenance costs, (2) use of out-dated microfiche to
check the names of terrorists, narcotics traffickers, and others prior to the
issuance of visas, (3) inaccurate and untimely financial information to support
program decisions, and (4) lack of backup capabilities for mainframe computers.
The Department has a number of initiatives aimed at addressing these
weaknesses.
OBSOLETE, PROPRIETARY SYSTEMS ARE
IN NEED OF MODERNIZATION
---------------------------------------------------------------- Appendix II:0.1
State's domestic bureaus and overseas posts are equipped to varying degrees
with mini-computers and office automation equipment, which State purchased over
a 15-year period almost exclusively from one vendor. Now this equipment is
obsolescent and, in many cases, costly to maintain. According to one
Department report, 92 percent of State's unclassified office automation
equipment and 72 percent of its domestic equipment fit the Federal Information
Resources Management Regulation definition of obsolete. In addition, the IRM
office reported that maintenance costs were about $12 million in fiscal year
1994.
State has consequently embarked on a program to modernize its aging information
technology infrastructure. This program, which began in 1992 and is managed by
the IRM office, is aimed at replacing State's proprietary hardware and software
systems with an open systems environment. State estimates that the program
will cost about $530 million from fiscal year 1994 through 1998. The main
goals for the overall modernization program, identified in State's March 1994
Open Systems Migration Implementation Plan, are to reduce dependency on
proprietary architectures throughout the Department, move new and existing
systems to a modern, open, technical environment, and improve support of
State's business functions.
AUTOMATED NAMECHECKING REQUIRED
TO COMBAT VISA FRAUD
---------------------------------------------------------------- Appendix II:0.2
At least 228 of State's more than 260 embassies and posts conduct consular
operations overseas. These consular operations include processing visas for
foreign nationals and providing passport services for U.S. citizens. Of these
228 posts, only 110 have an automated namechecking system that is on-line to a
central database at State headquarters. Forty-six of the posts rely on a
system known as the Distributed Name Checking System, that uses magnetic tape
and compact disk-read only memory (CD-ROM) files. One consular official told
us that these files are about 6 weeks out-of-date. Finally, 72 posts rely on
microfiche that are several months out-of-date and are so time-consuming and
difficult to use that consular staff may not check for ineligible applicants
prior to issuing a visa.
The 72 posts that do not have any automated namechecking capability
unnecessarily risk issuing visas to persons who could engage in activities that
endanger the welfare and security of United States citizens. State's Inspector
General testified before the Congress in July 1993 that IRM and procedural
shortfalls helped facilitate the issuance of at least 3 visas to Sheik Abdel
Rahman, indicted in the February 1993 World Trade Center bombing, that killed 6
people, injured more than 1,000 others, and caused damage estimated at more
than a half billion dollars.
The Inspector General testified that the first two visas were issued because
the Sheik's name was not added to the namechecking system until 7 years after
it should have been. In 1990, although his name had been added to the system,
the Khartoum post issued a visa to the Sheik without checking the microfiche
namecheck system. According to the Inspector General, because the microfiche
system is so time-consuming and cumbersome, there are probably numerous
occasions throughout the world where the microfiche is not being checked as
required.
The Foreign Relations Authorization Act for fiscal years 1994 and 1995 mandates
that all posts have automated namechecking systems by October 30, 1995. State
officials were uncertain whether it will meet the deadline due to a number of
possible hindrances cited in the Bureau program plan. These hindrances include
the following: (1) the ability to complete procurements in a timely manner,
(2) failure of the IRM office and other agencies to provide the infrastructure
to support installation, and (3) insufficient resources and/or facilities for
posts to physically collect and process funds.
INTEGRATED FINANCIAL MANAGEMENT
SYSTEM INITIATIVE AT RISK
---------------------------------------------------------------- Appendix II:0.3
State is currently developing the Integrated Financial Management System
(IFMS), which is intended to link State's worldwide operations and provide
managers at all levels with reliable financial information to plan and conduct
operations in conformance with governmentwide requirements. The system is
expected to partially address weaknesses in management and accountability of
real and personal property, worldwide disbursing and cashiering, and payroll
transactions. The Department has identified such weaknesses as high-risk areas
for the past 3 years in its annual FMFIA reports to the President and the
Congress.
We reported in August 1994, however, that State's efforts to plan and manage
the IFMS initiative have not been adequate, increasing the risk that the system
will not resolve long-standing financial management weaknesses or meet
managers' future information needs.\1 Specifically, we reported that State did
not have any documentation that described the anticipated financial management
structure, how various subsidiary systems will integrate with this structure,
or how IFMS is related to State's other long-term improvement efforts. We
reported that State also had not identified all existing financial management
systems and subsystems to be enhanced or maintained in the improvement project.
We concluded that without in-depth knowledge of the current financial
accounting and management environment and a fully articulated target structure,
it will be very difficult for State to improve its processes or correct
weaknesses.
--------------------
\1 Financial Management: State's Systems Planning Needs to Focus on Correcting
Long-standing Problems (GAO/AIMD-94-141, August 12, 1994).
BACKUP NEEDED FOR MAINFRAME
SYSTEMS
---------------------------------------------------------------- Appendix II:0.4
State has reported the lack of critical ADP safeguards, such as backup
capability, for its mainframe systems since 1984. One mainframe lacking backup
supports agencywide, classified functions at the headquarters Foreign Affairs
Data Processing Center. One system on this mainframe--the telegraphic
retrieval system--is especially important because the system allows for search
and retrieval of all cables over the past 20 years. This system is important
to users, such as the Ambassador at Large for Counter-Terrorism, who rely on
search and retrieval for important time-critical research. For example, the
system was recently queried to assist in the identification of terrorist groups
who may be responsible for terrorist acts under investigation.
State recently installed a new mainframe at the Foreign Affairs Data Processing
Center at State headquarters. State expects this mainframe to provide backup
capabilities for unclassified information systems at its Beltsville Information
Management Center by the end of 1994.
BEST IRM PRACTICES OF LEADING
ORGANIZATIONS
=================================================================== Appendix III
DECIDE TO CHANGE
--------------------------------------------------------------- Appendix III:0.1
Initiate, mandate, and facilitate major changes in information management to
improve performance.
Practice 1: Recognize and communicate the urgency to change information
management practices.
Practice 2: Get line management involved and create ownership.
Practice 3: Take action and maintain momentum.
DIRECT CHANGE
--------------------------------------------------------------- Appendix III:0.2
Establish an outcome-oriented, integrated strategic information management
process.
Practice 4: Anchor strategic planning in customer needs and mission
goals.
Practice 5: Measure the performance of key mission delivery processes.
Practice 6: Focus on process improvement in the context of an
architecture.
Practice 7: Manage information systems projects as investments.
Practice 8: Integrate the planning, budgeting, and evaluation processes.
SUPPORT CHANGE
--------------------------------------------------------------- Appendix III:0.3
Build organizationwide information management capabilities to address mission
needs.
Practice 9: Establish customer/supplier relationships between line and
information management professionals.
Practice 10: Position a Chief Information Officer as a senior management
partner.
Practice 11: Upgrade skills and knowledge of line and information
management professionals.
MAJOR CONTRIBUTORS TO THIS REPORT
==================================================================== Appendix IV
ACCOUNTING AND INFORMATION MANAGEMENT
DIVISION, WASHINGTON, D.C.
Franklin W. Deffer, Assistant Director
Sondra F. McCauley, Senior Evaluator
Beverly A. Peterson, Senior Evaluator
Kevin E. Conway, Technical Adviser
RELATED GAO PRODUCTS
Financial Management: State's Systems Planning Needs to Focus on Correcting
Long-standing Problems (GAO/AIMD-94-141, August 12, 1994).
Executive Guide: Improving Mission Performance Through Strategic Information
Management and Technology (GAO/AIMD-94-115, May 1994).
Financial Management: Serious Deficiencies in State's Financial Systems
Require Sustained Attention (GAO/AFMD-93-9, November 13, 1992).
Management of Overseas Real Property (GAO/HR-93-15, December 1992).
*** End of document. ***