Business Systems Modernization: Internal Revenue Service's Fiscal
Year 2008 Expenditure Plan (07-MAR-08, GAO-08-420).		 
                                                                 
The Internal Revenue Service's (IRS) Business Systems		 
Modernization (BSM) program is a multibillion-dollar, high-risk, 
highly complex effort that involves the development and delivery 
of a number of modernized systems that are intended to replace	 
the agency's aging business and tax processing systems. As	 
required by law, IRS submitted its fiscal year 2008 expenditure  
plan in August 2007 to congressional appropriations committees,  
requesting $235.8 million from the BSM account. GAO's objectives 
in reviewing the plan were to (1) determine whether it satisfied 
the conditions specified in the law, (2) determine IRS's progress
in implementing prior expenditure plan review recommendations,	 
and (3) provide additional observations about the plan and the	 
BSM program. To accomplish the objectives, GAO analyzed the plan,
reviewed related documentation, and interviewed IRS officials.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-08-420 					        
    ACCNO:   A81230						        
  TITLE:     Business Systems Modernization: Internal Revenue	      
Service's Fiscal Year 2008 Expenditure Plan			 
     DATE:   03/07/2008 
  SUBJECT:   Cost analysis					 
	     Cost overruns					 
	     Employee training					 
	     Human capital management				 
	     Human capital policies				 
	     Information security				 
	     IT human capital					 
	     Program evaluation 				 
	     Program management 				 
	     Risk management					 
	     Schedule slippages 				 
	     Strategic planning 				 
	     Systems analysis					 
	     Systems evaluation 				 
	     Systems management 				 
	     Technology modernization programs			 
	     Cost estimates					 
	     Program costs					 
	     Program goals or objectives			 
	     Program implementation				 
	     Business planning					 
	     Business transformation				 
	     IRS Business Systems Modernization 		 
	     Program						 
                                                                 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-08-420

   

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. 

Report to Congressional Committees: 

March 2008: 

Business Systems Modernization: 

Internal Revenue Service's Fiscal Year 2008 Expenditure Plan: 

GAO-08-420: 

GAO Highlights: 

Highlights of GAO-08-420, a report to congressional committees. 

Why GAO Did This Study: 

The Internal Revenue Serviceï¿½s (IRS) Business Systems Modernization (BSM) program is a multibillion-dollar, high-risk, highly complex effort that involves the development and delivery of a number of modernized systems that are intended to replace the agencyï¿½s aging business and tax processing systems. As required by law, IRS submitted its fiscal year 2008 expenditure plan in August 2007 to congressional appropriations committees, requesting $235.8 million from the BSM account. 

GAOï¿½s objectives in reviewing the plan were to (1) determine whether it satisfied the conditions specified in the law, (2) determine IRSï¿½s progress in implementing prior expenditure plan review recommendations, and (3) provide additional observations about the plan and the BSM program. To accomplish the objectives, GAO analyzed the plan, reviewed related documentation, and interviewed IRS officials. 

What GAO Found: 

IRSï¿½s expenditure plan satisfies the conditions specified in the law. These conditions include meeting the Office of Management and Budgetï¿½s capital planning and investment control review requirements and complying with federal systems acquisition requirements and management practices. 

IRS has taken steps to address GAOï¿½s prior recommendations to improve modernization management controls and capabilities, including adding a new focus area to its Modernization Vision and Strategy and defining and beginning to implement an approach for developing a quantitative measure of progress in meeting project scope expectations. However, work remains to fully implement GAOï¿½s recommendations, including steps to complete the Modernization Vision and Strategy. 

GAOï¿½s observations about the expenditure plan and the BSM program include the following: 

* During 2007, IRS made progress in implementing BSM projects and in meeting cost and schedule commitments for most deliverables, but three project milestones experienced significant cost and schedule delays. Specifically, reported project costs and completion dates showed that 13 of the 14 associated project milestones that were scheduled for completion during this time were completed within 10 percent of cost estimates, and 11 of the 14 milestones were delivered within 10 percent of schedule estimates. However, a milestone for the Customer Account Data Engine (the new taxpayer information database) exceeded its planned schedule by 66 percent and experienced a 15 percent cost increase; another milestone for the same project incurred a 153 percent schedule delay, and a milestone for Modernized e-File (an electronic filing system) experienced a 41 percent schedule delay. 

* IRS continues to make progress in addressing high-priority BSM program improvement initiatives. This program improvement process continues to be an effective means of regularly assessing, prioritizing, and incrementally addressing BSM issues and challenges. Key focus areas for high-priority initiatives recently included IT human capital and information security. 

* Efforts are under way to address human capital challenges, but more work remains. IRS developed an IT human capital strategy that addresses hiring critical personnel, employee training, leadership development, and workforce retention, and stated that it plans to undertake a number of initiatives to support this strategy. However, a specific plan with time frames for implementing the initiatives has not been developed. Such a plan would help guide IRSï¿½s efforts in addressing IT human capital goals and would be useful in measuring progress in implementing the goals. 

What GAO Recommends: 

GAO recommends that the Commissioner of Internal Revenue direct the Chief Information Officer to complete a plan with specific time frames for implementing the initiatives supporting its information technology (IT) human capital strategy. In providing comments on a draft of this report, the Acting Commissioner agreed with the recommendation and outlined actions that IRS is planning to take to address it. IRS also provided technical comments. 

To view the full product, including the scope and methodology, click on [hyperlink, http://www.GAO-08-420]. For more information, contact David A. Powner at (202) 512-9286 or [email protected]. 

[End of section] 

Contents: 

Letter: 

Recommendation for Executive Action: 

Agency Comments: 

Appendixes: 

Appendix I: Briefing Slides from the January 8, 2008, Briefing to the Senate and House Appropriations Subcommittee Staffs: 

Appendix II: Comments from the Internal Revenue Service: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 Project Milestones: 

Abbreviations: 

AD: Applications Development: 

AMS: Accounts Management Services: 

BSM: Business Systems Modernization: 

CADE: Customer Account Data Engine: 

EA: enterprise architecture: 

ELC: enterprise life cycle: 

F&PC: Filing and Payment Compliance: 

IRS: Internal Revenue Service: 

IT: information technology: 

MeF: Modernized e-File: 

MV&S: Modernization Vision and Strategy: 

OMB: Office of Management and Budget: 

Figure: 

Letter March 7, 2008: 

The Honorable Richard J. Durbin: 
Chairman: 
The Honorable Sam Brownback: 
Ranking Minority Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations: 
United States Senate: 

The Honorable Josï¿½ E. Serrano: 
Chairman: 
The Honorable Ralph Regula: 
Ranking Minority Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations House of Representatives: 

As required by law, the Internal Revenue Service (IRS) submitted its fiscal year 2008 expenditure plan in August 2007 to the congressional appropriations committees, requesting $235.8 million from the Business Systems Modernization (BSM) account.[Footnote 1] Our objectives in reviewing the plan were to (1) determine whether the plan satisfied the conditions specified in the law,[Footnote 2] (2) determine IRS's progress in implementing our prior recommendations, and (3) provide any other observations about the plan and IRS's BSM program. 

On January 8, 2008, we briefed the cognizant congressional appropriations subcommittee staffs on the results of our review. This report transmits the materials we used at the briefing and provides the recommendation that we made to the Commissioner of Internal Revenue. The full briefing materials, including our scope and methodology, are included as appendix I. At the request of IRS, we have removed completion dates for project milestones planned for fiscal year 2008 from the briefing because these dates were determined before funding was approved by Congress. 

In summary, we made the following major points: 

* IRS's fiscal year 2008 plan satisfies each of the six legislative conditions. These conditions include meeting the Office of Management and Budget's capital planning and investment control review requirements and complying with federal systems acquisition requirements and management practices. 

* IRS has taken steps to address our prior recommendations to improve its modernization management controls and capabilities, including adding a new focus area to its Modernization Vision and Strategy and defining and beginning to implement an approach for developing a quantitative measure of progress in meeting project scope expectations. However, work remains to fully implement our recommendations, including steps to complete the Modernization Vision and Strategy. 

* IRS has made progress in implementing BSM projects and in meeting cost and schedule commitments for most deliverables, but three project milestones[Footnote 3] experienced significant cost or schedule delays. During 2007, IRS completed milestones of the Filing and Payment Compliance (F&PC) (a tax collection case analysis support system), Modernized e-File (MeF) (an electronic filing system), Customer Account Data Engine (CADE) (the new taxpayer information database), and Accounts Management Services (AMS) (a system intended to provide applications for IRS employees and taxpayers to access, validate, and update accounts on demand). Our analysis of reported project costs and completion dates showed that 13 of the 14 associated project milestones that were scheduled for completion during this time were completed within 10 percent of cost estimates, and 11 of the 14 milestones were delivered within 10 percent of schedule estimates. However, a milestone for CADE exceeded its planned schedule by 66 percent and experienced a 15 percent cost increase; another milestone for the same project incurred a 153 percent schedule delay; and a milestone for MeF experienced a 41 percent schedule delay (see fig. 1). 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 Project Milestones: 

This figure is a bar graph showing summary of cost and schedule performances for fiscal year 2007 project milestones. 

[See PDF for image] 

Source: GAO analysis of IRS data. 

[End of figure] 

* Future BSM project releases continue to face significant risks and issues, which IRS is addressing. Specifically, the agency has identified significant risks and issues with planned system deliveries of CADE and AMS and reports that maintaining alignment between the two systems will be a significant challenge and source of risk for the BSM program. IRS recognizes the potential impact of identified risks and issues on its ability to deliver projects within cost and schedule estimates and has developed mitigation strategies to address them. While mitigation strategies have been developed, the risks and challenges confronting future releases of CADE and AMS are nevertheless significant, and we will continue to monitor them and actions to address them. 

* IRS continues to make progress in addressing high-priority BSM program improvement initiatives. This program improvement process continues to be an effective means of regularly assessing, prioritizing, and incrementally addressing BSM issues and challenges. In September 2007, IRS completed another cycle of initiatives and initiated a new cycle, which will be completed at the end of March 2008. Initiatives that were addressed in the 6-month cycle ending in September 2007 included information technology (IT) human capital, information security, and process improvements (e.g., developing and implementing standardized earned value management[Footnote 4] practices for major projects). 

* Efforts to address human capital challenges continue, but more work remains. IRS developed an IT human capital strategy that addresses hiring critical personnel, employee training, leadership development, and workforce retention, and agency officials stated that they plan to undertake a number of human capital initiatives in support of their human capital strategy, including conducting analyses of turnover rates and continuing efforts to replace key leaders lost to retirement by expanding the Succession Management Program. However, a specific plan with time frames for implementing these initiatives has not been developed. Such a plan would help guide IRS's efforts in addressing its IT human capital gaps and be useful in measuring progress in implementing them. 

* Security weaknesses affect IRS's modernization environment. As we reported in November 2007,[Footnote 5] the agency continues to have weaknesses in its information security controls. In addition, IRS has identified security weaknesses through its high-priority initiatives program. While actions to address our report findings and the high- priority initiatives help to improve IRS's security posture, the modernization environment will continue to be at risk until the agency fully implements its security program. 

Recommendation for Executive Action: 

To allow for more effective congressional oversight of the BSM program, we recommend that the Commissioner of Internal Revenue direct the Chief Information Officer to complete a plan with specific time frames for implementing the initiatives supporting its IT human capital strategy. Such a plan would help guide IRS's efforts and measure progress in implementing them. 

Agency Comments: 

In providing written comments on a draft of this report, the Acting Commissioner of Internal Revenue agreed with our recommendation and outlined actions that IRS is planning to take to address it. IRS also provided technical comments which we addressed, as appropriate. The Acting Commissioner's written comments are reprinted in appendix II. 

We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate and House committees and subcommittees that have appropriations, authorization, and oversight responsibilities for the IRS. We are also sending copies to the Commissioner of Internal Revenue, the Secretary of the Treasury, the Chairman of the IRS Oversight Board, and the Director of OMB. We also will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. 

Should you or your offices have questions on matters discussed in this report, please contact me at (202) 512-9286 or at [email protected]. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. 

Signed by: 

David Powner: 

Director, Information Technology Management Issues: 

[End of section] 

Appendixes: 

Appendix I Briefing Slides from the January 8, 2008, Briefing to the Senate and House Appropriations Subcommittee Staffs: 

Review of IRSï¿½s Fiscal Year 2008 Business Systems Modernization Expenditure Plan: 

Briefing for the Staffs of the Subcommittee on Financial Services and General Government Senate Committee on Appropriations and
Subcommittee on Financial Services and General Government House Committee on Appropriations: 

January 8, 2008: 

This briefing has been modified to incorporate editorial changes on pages 3, 4, 13, 18, 19, 22, and 37. At the request of IRS, we have also removed completion dates for project milestones planned for fiscal year 2008 from the briefing because these dates were determined before funding was approved by Congress.

Briefing Contents: 

Introduction and Objectives; 

Results in Brief; 

Background; 

Scope and Methodology; 

Results; 

Conclusions; 

Recommendation for Executive Action; 

Agency Comments; 

Appendixes: 

* I ï¿½ Description of Business Systems Modernization Projects and Program-level Initiatives; 

* II ï¿½ Additional Detail on IRSï¿½s Fiscal Year 2008 BSM Expenditure Plan; 

* III ï¿½ IRS Reported Project Cost/Schedule Changes for Projects Scheduled for Completion in Fiscal Year 2007; 

Introduction and Objectives: 

The Internal Revenue Service (IRS) has long relied on obsolete automated systems for key operational and financial management functions, and its attempts to modernize these computer systems span several decades. IRSï¿½s multibillion-dollar Business Systems Modernization (BSM) program, initiated in fiscal year 1999, is the agencyï¿½s latest attempt to modernize its systems. IRS contracted with Computer Sciences Corporation as the PRIME systems integration support contractor to assist with designing, developing, and integrating a new set of information systems that are intended to replace IRSï¿½s aging business and tax processing systems. BSM is a high-risk, highly complex program that involves the development and delivery of a number of modernized tax administration, internal management, and core infrastructure projects that are intended to provide improved and expanded service to taxpayers and internal business efficiencies for IRS. 

Under the Financial Services and General Government Appropriations Act, 2008,[Footnote 6] appropriations for the IRS BSM program for fiscal year 2008 are not available for obligation (except for labor costs) until IRS submits a modernization expenditure plan to the congressional appropriations committees and obtains their approval. This plan must 

meet the capital planning and investment control review requirements established by the Office of Management and Budget (OMB); 

comply with IRSï¿½s enterprise architecture;[Footnote 7] 

conform with IRSï¿½s enterprise life cycle methodology;[Footnote 8] 

comply with federal acquisition rules, requirements, guidelines, and systems acquisition management practices;

be approved by IRS, the Department of the Treasury, and OMB; and: 

be reviewed by GAO. 

Since mid-1999, IRS has submitted a series of expenditure plans requesting release of BSM-appropriated funds. To date, about $2.3 billion has been appropriated and released for BSM. 

On August 13, 2007, IRS submitted its fiscal year 2008 expenditure plan to the relevant House and Senate appropriations subcommittees, seeking release of $235.8 million from the BSM account.[Footnote 9] 

As agreed with IRSï¿½s appropriations subcommittees, our objectives were to: 

determine whether IRSï¿½s fiscal year 2008 expenditure plan satisfies the legislative conditions specified in IRSï¿½s appropriations,

determine IRSï¿½s progress in implementing our prior expenditure plan review recommendations, and: 

provide any other observations about the plan and the BSM program. 

Results in Brief: 

IRSï¿½s fiscal year 2008 plan satisfies each of the six legislative conditions. 

IRS has taken steps to address our prior recommendations to improve its modernization management controls and capabilities, including adding a new focus area to its Modernization Vision and Strategy and defining and beginning to implement an approach for developing a quantitative measure of progress in meeting project scope expectations. However, steps remain to fully implement our recommendations. Until our recommendations are fully implemented, the risk that IRSï¿½s modernization program will not be managed effectively will remain and Congress may not have the information it needs to effectively assess IRSï¿½s performance in implementing BSM. 

We have five observations related to the BSM program and fiscal year 2008 expenditure plan: 

IRS has made progress in implementing BSM projects and in meeting cost and schedule commitments for most deliverables, but three project milestones[Footnote 10] experienced significant cost and/or schedule delays. During 2007, IRS completed milestones of Filing and Payment Compliance (a tax collection case analysis support system), Modernized e-File (MeF) (an electronic filing system), Customer Account Data Engine (CADE) (the new taxpayer information database), and Accounts Management Services (AMS) (a system intended to provide applications for IRS employees and taxpayers to access, validate, and update accounts on demand). Our analysis of IRSï¿½ reported project costs and completion dates showed that 13 of the 14 associated project milestones that were scheduled for completion during this time were completed within 10% of cost estimates and 11 of the 14 milestones were delivered within 10% of schedule estimates. However, a milestone for CADE exceeded its planned schedule by 66% and experienced a 15% cost increase; another milestone for the same project incurred a 153% schedule delay, and a milestone for MeF experienced a 41% schedule delay. 

Future BSM project releases[Footnote 11] continue to face significant risks and issues, which IRS is addressing. IRS has identified significant risks and issues with planned system deliveries of CADE and AMS. For example, IRS reported that integration testing and system acceptance testing for the release of CADE intended to support taxpayer returns processing for the 2008 filing season was in jeopardy partly because of delays resulting from, among other things, defects and data errors that required correction. IRS recognizes the potential impact of identified risks and issues on its ability to deliver projects within cost and schedule estimates, and has developed mitigation strategies to address them. While IRS has developed mitigation strategies, the risks and challenges confronting future releases of CADE and AMS are nevertheless significant and we will continue to monitor them and IRSï¿½s actions to address them. 

IRS continues to make progress in addressing high-priority BSM program improvement initiatives. IRSï¿½s program improvement process continues to be an effective means of regularly assessing, prioritizing, and incrementally addressing BSM issues and challenges. In September 2007, IRS completed another cycle of initiatives and initiated a new cycle, which will be completed at the end of March 2008. Initiatives that are currently being addressed include standardizing the use of earned value management[Footnote 12] across major projects. 

Efforts to address human capital challenges continue, but more work remains. IRS stated that it plans to undertake a number of human capital initiatives during fiscal year 2008 and beyond in support of its human capital strategy, including conducting analyses of turnover rates and continuing efforts to replace key leaders lost to retirement by expanding its Succession Management Program. However, a specific plan with time frames for implementing these initiatives has not been developed. Such a plan would help guide IRSï¿½s efforts in addressing its information technology (IT) human capital gaps and be useful in measuring progress in implementing them. 

Security weaknesses affect IRSï¿½s modernization environment. As we reported in November 2007, IRS continues to have weaknesses with its information security controls.[footnote 13] In addition, IRS has identified security weaknesses through its high priority initiatives program. While actions to address our report findings and the high priority initiatives help to improve IRSï¿½s security posture, the modernization environment will continue to be at risk until the agency fully implements its security program. 

To allow for more effective congressional oversight of the BSM program, we are recommending that the Commissioner of Internal Revenue direct the Chief Information Officer to complete a plan with specific time frames for implementing the initiatives supporting its human capital strategy. Such a plan would help guide IRSï¿½s efforts and measure progress in implementing them. 

In e-mail comments on a draft of this briefing, the Associate Chief Information Officer for Applications Development stated that it addresses many of BSMï¿½s positive accomplishments from 2007. She also provided clarifying and technical comments that we addressed, as appropriate. 

Background: 

Since 1999, we have reviewed and reported on 14 BSM expenditure plans. In particular, we have reported on program management capabilities and controls that are critical to the effective management of the BSM program. They include: 

cost and schedule estimates: we reported that IRS did not have effective procedures for validating contractor-developed cost and schedule estimates;[Footnote 14] 

contract management: we reported that IRS did not have effective processes for determining the type of task order to be awarded in acquiring modernized systems;[Footnote 15] 

requirements development and management: we reported that IRS did not have adequate policies and procedures in place to guide its system modernization projects in developing and managing requirements;[Footnote 16] and: 

post implementation reviews: we reported that post implementation reviews conducted were incomplete and did not follow IRS procedures. [Footnote 17]  

In our reports, we have made recommendations aimed at strengthening IRSï¿½s program management controls and capabilities. Over the years, IRS has addressed several of these recommendations. However, more work remains for some capabilities and controls to be fully institutionalized or implemented. 

IRSï¿½s Applications Development (AD) organization has primary responsibility for managing and delivering the BSM program. This group, within the Office of the Chief Information Officer, was established in 2006 and integrates Business Systems Modernizationï¿½whose primary mission was delivering IRS modernizationï¿½with the Business Systems Development Divisionï¿½whose primary focus was maintaining the current production systems environment. It is headed by the Associate Chief Information Officer for Applications Development. 

The AD organization includes three core competency areas: 

Domains: focus on a major functional mission area of the IRS that provides IT legacy and modernized systems in support of the business (e.g., Compliance and Customer Service). 

Matrix domains: support functions for the primary operating domains and are tasked with improving the effectiveness of AD operations (e.g., the Test, Assurance, and Documentation Office and the Program Management Office).

Front office teams: perform administrative, human resources, and financial management functions for the entire organization (e.g., Resource Management). 

IRSï¿½s fiscal year 2008 expenditure plan describes the agencyï¿½s efforts to: 

continue ongoing program-level initiatives (e.g., architecture and integration and program management) and core infrastructure projects (e.g., infrastructure shared services), 

fund internal management projects (i.e., common services),[Footnote 18] 

continue nine tax administration project releases to their next milestones, and: 

begin five new tax administration project releases. 

Key tax administration projects include: 

Modernized e-File, which is to provide a single standard for filing electronic tax returns; 

Customer Account Data Engine, which is intended to provide the modernized database foundation to replace the existing Individual Master File processing system that contains the repository of individual taxpayer information; and: 

Accounts Management Services, which is intended to enhance the Customer Account Data Engine by providing applications for IRS employees and taxpayers to access, validate, and update accounts on demand. 

Details on these and other BSM projects and program-level initiatives are provided in appendix 1. 

Table 1 shows a financial summary of the plan. 

Table 1: Summary of IRSï¿½s Fiscal Year 2008 BSM Expenditure Plan[A]  

Tax administration projects: Modernized e-File; 
Amount requested (in thousands): $55,802. 

Tax administration projects: Customer Account Data Engine; 
Amount requested (in thousands): $58,500. 

Tax administration projects: Accounts Management Services; 
Amount requested (in thousands): $28,983. 

Subtotal-tax administration projects; 
Amount requested (in thousands): $143,285. 

Core infrastructure projects: Development, Integration, and Testing Environments; 
Amount requested (in thousands): $13,167. 

Core infrastructure projects: Infrastructure Shared Services; 
Amount requested (in thousands): $25,983. 

Subtotal-core infrastructure projects; 
Amount requested (in thousands): $39,150. 

Architecture, integration, and management: Architecture and integration; 
Amount requested (in thousands): $13,784. 

Architecture, integration, and management: Business integration; 
Amount requested (in thousands): $4,753. 

Architecture, integration, and management: Business rules; 
Amount requested (in thousands): $3,169.

Architecture, integration, and management: Management processes; 
Amount requested (in thousands): $3,549.

Architecture, integration, and management: Federally funded research and development center; 
Amount requested (in thousands): $6,883.

Architecture, integration, and management: Program management; 
Amount requested (in thousands): $2,962.

Subtotal-architecture, integration, and management; 
Amount requested (in thousands): $35,100.

Internal management projects; 
Amount requested (in thousands): $16,000. 

Management reserve; 
Amount requested (in thousands): $2,310. 

Total; 
Amount requested (in thousands): $235,845.

Source: IRS.

[A] See appendix II for additional details on the plan. 

[End of figure] 

Scope and Methodology: 

To accomplish our objectives, we: 

reviewed the fiscal year 2008 expenditure plan submitted by IRS in August 2007;[Footnote 19] 

analyzed the plan for compliance with the legislative conditions; 

interviewed IRS program and project management officials to corroborate our understanding of the plan and other BSM activities; 

analyzed available evidence on recent agency efforts to implement our prior recommendations, including progress on improving its modernization management controls and capabilities; 

reviewed and analyzed modernization program review and project management briefings and related documentation to assess program/project status and associated issues and risks; and: 

reviewed program management reports to assess the progress IRS has made in completing actions and implementing program management improvements related to the BSM highest priority initiatives. 

To assess the reliability of the cost and schedule information contained in this expenditure plan, we interviewed IRS officials in order to gain an understanding of the data and discuss our use of the data. In addition, we checked that information in the plan was consistent with information contained in IRS internal briefings. We did not, however, assess the accuracy and reliability of the information reported in these briefings.

We performed our work between September and December 2007, in Washington, D.C., in accordance with generally accepted government auditing standards. 

Results: 

Legislative Conditions: 

Objective 1: The plan satisfies the conditions applicable to IRSï¿½s fiscal year 2008 appropriations. 

Table 2: Fiscal Year 2008 Expenditure Plan Provisions for Satisfying Legislative Conditions: 

Legislative conditions: 1. Meets OMB capital planning and investment control review requirements; 
Expenditure plan provisions: IRSï¿½s fiscal year 2008 expenditure plan identifies funding for managing IT investments as part of a single
portfolio through its capital planning and investment control process. This includes conducting periodic reviews to select and control IT investments. IRS also stated that it plans to conduct post implementation reviews on CADE release 2.2 in mid-fiscal year 2008 and on AMS release 1.1 at the end of fiscal year 2008. These planned actions are consistent with OMB capital planning and investment control review requirements.  

Legislative conditions: 2. Complies with IRSï¿½s enterprise architecture; 
Expenditure plan provisions: The plan identifies funding for complying with IRSï¿½s enterprise architecture by providing for continued
definition and implementation of the EA. For example, it identifies funding needed for:

* finalizing and publishing updates to the EA based on change requests,

* supporting the performance of EA compliance certification activities, and: 

* improving the IRS enterprise transition strategy and release architecture. 

Legislative conditions: 3. Conforms with IRSï¿½s enterprise life cycle (ELC) methodology; 
Expenditure plan provisions: The plan conforms with IRSï¿½s enterprise life cycle methodology in that it calls for meeting the requirements in
IRSï¿½s ELC management program. For example, the plan calls for: 

* maintaining responsibility for coordinating, tracking, and integrating all programwide costs, schedules, releases, issues, and risks and: 

* maintaining and enhancing the ELC. For example, according to the plan, IRS intends to update the ELC to reflect modifications to testing policies, procedures, processes, plans, and schedule due to the
assumption of the integrator role. 

Legislative conditions: 4. Complies with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the federal government; 
Expenditure plan provisions: As part of the ELC, IRS has defined processes, roles, and responsibilities for implementing Carnegie Mellon
Universityï¿½s Software Engineering Institute Software Acquisition Capability Maturity ModelTM practices for the key process areas within the repeatable level (level 2) of the 5-stage model.a These practices are consistent with federal acquisition requirements and management practices, and the plan calls for implementation of the ELC on all projects. 

Legislative conditions: 5. Approved by IRS, the Department of the Treasury, and OMB; 
Expenditure plan provisions: * IRSï¿½July 30, 2007; 
* Treasuryï¿½August 3, 2007; 
* OMBï¿½August 2, 2007. 

Legislative conditions: 6. Reviewed by GAO; 
Expenditure plan provisions: * GAOï¿½January 8, 2008, briefing to IRSï¿½s appropriations subcommittees. 

Source: The Financial Services and General Government Appropriations Act, 2008, appropriations for IRSï¿½s BSM program for fiscal years 2008-2010, as provided in the Consolidated Appropriations Act, 2008, Pub. L. No. 110-161, div. D, title 1, 121 Stat. 1844, 1972 (Dec. 26, 2007), and IRSï¿½s fiscal year 2008 expenditure plan submitted to Congress in August 2007. 

[A] These key process areas are acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, evaluation, and transition to support. For this condition, we did not determine whether the expenditure plan comports with the Federal Acquisition Regulation or other federal requirements beyond those encompassed by the Software Engineering Instituteï¿½s Capability Maturity Model. 

[End of table] 

Prior Recommendations Status: 

Objective 2: IRS has made progress in addressing recommendations to improve its modernization management controls and capabilities, but steps remain to fully implement them. 

During 2007, IRS made progress in addressing our recommendations to improve its modernization management controls and capabilities from prior expenditure plan reviews. For example, it has developed and begun to implement an approach for developing a quantitative measure of scope performance. However, steps remain to fully implement them. 

Table 3: Status of IRSï¿½s Progress in Implementing Prior GAO Recommendations Prior GAO recommendations: 

Prior GAO Recommendations: Requirements development and managementï¿½Ensure that BSM completes the delivery of policies and
procedures for requirements development and management as planned; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See p. 15. 

Prior GAO Recommendations: Post implementation reviewsï¿½Perform analyses of investment data to determine whether completed projects have achieved expected benefits; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See p. 16. 

Prior GAO Recommendations: Modernization vision and strategyï¿½Fully revisit the vision and strategy for the BSM program and develop a
new set of long-term goals, strategies, and plans that
are consistent with the budgetary outlook and IRSï¿½s
management capabilities; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See pp. 17. 

Prior GAO Recommendations: Quantitative measures of progress in scopeï¿½Ensure that future expenditure plans include a quantitative
measure of progress in meeting project scope
expectations; 
Implemented: [Empty]; 
In progress: Check; 
Status as of fiscal year 2008 plan: See pp. 18-19. 

Source: GAO analysis of IRS data. 

[End of table] 

Requirements Development and Management: 

In March 2006, we recommended that IRS complete requirements development and management policies and procedures.[Footnote 20] IRS agreed with our recommendation, and in response, developed policies, procedures, and tools for developing and managing project requirements through its Business Rules and Requirements Management office. Specifically, IRS developed (1) a standardized process for the elicitation and documentation of requirements; (2) guidance on establishing and maintaining full bidirectional requirements traceability; (3) guidance on tracking cost and schedule impacts of changes to requirements; and (4) a process for ensuring that formal peer reviews are planned and completed for key requirements. IRS stated that it started using these policies, procedures, and tools to manage requirements for several projects, including CADE and AMS, and that it plans to deploy the capabilities it has developed to a wider range of projects and also develop programwide reusable requirements during fiscal year 2008. We are currently reviewing the policies, procedures, and tools that IRS has developed to determine the extent to which they address our recommendations.

Post Implementation Reviews: 

In November 2004, we recommended that post implementation reviews of deployed BSM projects include an analysis of quantitative and qualitative investment data to determine whether expected benefits were achieved.[21] IRS agreed with our recommendation, and, in response developed a new procedure for conducting PIRs and conducted a pilot PIR which identified process improvement opportunities. IRS also recently stated that, due to fiscal year 2007 constraints and other priorities, it plans to conduct streamlined PIRs on CADE release 2.2 and AMS release 1.1 12-18 months after those releases are deployed. Specifically, for CADE release 2.2, IRS expects to conduct the PIR in mid-fiscal year 2008, and for AMS release 1.1, it expects to start the PIR at the end of the fiscal year. For other projects, IRS stated that it would conduct lessons learned activities and implement changes based on those activities. We believe that these are reasonable plans given resource constraints and other priorities and will monitor IRSï¿½s actions to implement them.

Modernization Vision and Strategy: 

In July 2005, we recommended that IRS fully revisit the vision and strategy for the BSM program and develop a new set of long-term goals, strategies, and plans consistent with the budgetary outlook and IRSï¿½s management capabilities.[Footnote 22] We also noted that the vision and strategy should include time frames for consolidating and retiring legacy systems. IRS agreed with our recommendation, and, in response, developed an initial cycle of its Modernization Vision and Strategy (MV&S) and 5-year enterprise transition strategy in fiscal year 2006[Footnote 23] to guide IT investment decisions during fiscal years 2007 through 2011. The MV&S framework was built on a functional segmentation of IRS into core mission business functions (business domains) supported by services necessary for their effective and secure execution (service domains). The Enterprise Transition Strategy described the overall IRS vision and strategy and how existing and proposed investments align to it. It also documented the scope, business challenges, current and transition architectures, redesign opportunities, strategy, proposed projects and associated release strategies, and the planned evolution (i.e., reuse, consolidation, retirement) of related key current production environment systems for each of the MV&S business domains. During 2007, IRS updated its 5-year Enterprise Transition Strategy.[Footnote 24] The strategy includes security and privacy (a new service domain), planned business domains, and opportunities for retirement. IRS also developed an initial list of systems for consolidation and retirement for fiscal year 2008 but stated that it plans to develop a methodology for doing this on an annual basis. IRS also stated that it is building on the current retirement efforts by application development and efforts to address OMBï¿½s directive for a segment architecture for each business domain in 2008 for the filing payment and compliance business domain. Lessons learned from this activity are to be incorporated into the methodology for retiring and consolidating systems. While these actions are positive steps, actions remain for IRS to fully address our recommendation, including developing long-term plans for completing BSM and finalizing and implementing the methodology for consolidating and retiring legacy systems. 

Quantitative Measure of Progress in Meeting Scope Expectations: 

In February 2007, we recommended that IRS ensure that future expenditure plans include a quantitative measure of progress in meeting scope expectations.[Footnote 25] We also recommended that, in developing this measure, IRS consider using earned value management[Footnote 26] since this is a proven technique required by OMB for measuring cost, schedule, and functional performance (i.e., scope of work) against plans. While IRS agreed with our recommendation to develop a quantitative measure of progress in meeting scope expectations, it has stated that it does not believe earned value management would provide this measure, given the manner in which the technique is being used at the agency.[Footnote 27] Instead, IRS has developed an incremental approach to address our recommendation. Specifically, as an initial step, it has proposed a more detailed qualitative measure than previously used that would consist in showing the difference between a project releaseï¿½s planned and delivered capabilities. This was implemented in the fiscal year 2008 expenditure plan. As a next step, IRS stated that it plans to leverage its requirements management tools to assign quantitative values to the capabilities. IRS intends to implement this approach for the fiscal year 2009 expenditure plan. While these are steps in the right direction, until IRS fully implements them, Congress may not have the information it needs to effectively assess IRSï¿½s performance in implementing BSM. For the long-term, IRS should consider using earned value management to measure progress in meeting scope expectations as required by OMB policy as this is a proven technique for doing so. 

Observations: 

Objective 3: Observations about IRSï¿½s BSM Program and Expenditure Plan Observation 1: IRS made additional progress in implementing BSM projects and in meeting cost and schedule commitments for most deliverables, but three project milestones experienced significant cost and/ or schedule delays. 

During 2007, IRS completed releases and milestones of its modernized systems that have provided benefits to the taxpayers and the agency. For example, according to IRS, 

Release 1.1 of F&PC provides IRS with an automated standalone system used to analyze tax collection cases and route selected cases to private collection agencies and then tracks their success in resolving the cases. 

Release 1.2 of F&PC was completed and became the first modernized application to use the enterprise application integration broker[Footnote 28] for integration with the legacy systems in support of assigning cases to private collection agencies. This release fully implemented inventory management capabilities using the IRS infrastructure and during fiscal year 2007, according to IRS officials, gross revenue received as a result of the Private Debt Collection program amounted to approximately $31 million. 

Release 4 of MeF allows the processing of Form 1065 (U.S. Return of Partnership Income), 1065-B (U.S. Return of Income for Electing Large Partnerships) and associated forms and schedules for tax year 2006 submissions.

Release 1.2 of AMS includes a new inventory and workflow that automates the assignment, research, resolution, and closure for internally generated cases currently worked in a paper-based manual process. 

Release 1.3 of AMS provides for the migration of current platform and software products to the enterprise architecture standard products. 

IRS continued to make progress in meeting cost and schedule commitments for completing project milestones during 2007, but 3 of the 14 project milestones that were scheduled to be completed experienced significant cost and/or schedule delays. Specifically, our analysis of IRSï¿½s reported project costs and completion dates shows that 13 of the 14 associated project milestones that were scheduled for completion during this time were completed within 10% of cost estimates and 11 of the 14 milestones were delivered within 10% of schedule estimates. However, a milestone for CADE release 2.2 exceeded its planned schedule by 66% and experienced a15% cost increase; a milestone for MeF release 5 experienced a 41% schedule delay; and a milestone for CADE release 3 incurred a 153% schedule delay. Figure 1 shows the cost and schedule variances of the project milestones that were scheduled to be delivered during fiscal year 2007. 

Figure 1: Summary of Cost and Schedule Performance for Fiscal Year 2007 Project Milestones: 

This figure is a bar graph showing the summary of cost and schedule performance for fiscal year 2007 project milestones. 

[See PDF for image] 

Source: GAO analysis of IRS data. 

Note: Variances for projects through milestone 3 are based on rough order of magnitude estimates. Post-milestone 3 variances are based on more specific estimates. 

[End of figure] 

Following are details on the project milestones that experienced significant cost and/or schedule delays: 

* CADE: Release 2.2 of CADE began supporting the 2007 filing season in March but completed milestone 4 (development) 123 days behind schedule. This delay amounted to a 66% increase over the planned schedule for completing milestone 4 and was accompanied by a final cost that was 15% greater than budgeted. According to IRS, the overrun was caused by the complexity of the requirements, which extended the requirements elicitation process and delayed the physical design phase and resulted in delays through the rest of the development life cycle. The delay in full implementation impacted the number of returns that could be processed through the speedier CADE system. IRS had originally intended CADE to post 33 million taxpayer returns during the 2007 filing season (more than four times the estimated 7.4 million posted by CADE during 2006), but as of September, the system had posted only about 11.2 million returns. 

The demand on available resources to complete release 2.2 also impacted the planned schedule for subsequent releases of CADE. As a result, milestone 3 of release 3 of CADE was completed 214 days behind schedule.

* MeF: Milestone 3 of release 5 of MeF was completed 30 days behind schedule.[Footnote 29] According to IRS, this was due primarily to delays in getting started that occurred early in the design phase and IRS is currently indicating no change in the projected completion date for milestones 4 and 5. Details on the cost and schedule status of project releases as reported by IRS are in appendix III. 

Observation 2: Future BSM project releases continue to face significant risks and issues, which IRS is addressing. 

IRS has reported that challenges and risks continue to confront future planned project releases. For example: 

CADE: The August 2007 results of an independent assessment IRS commissioned to examine its plans for completing the core functionality of the release of CADE intended to support taxpayer returns processing starting in January 2008 (release 3.2) noted the following concerns: 

* the potential lack of resource availability with parallel testing activities; 

* the insufficient use of project management and control artifacts to help identify where schedule risk exists and facilitate predicting the outcome; and: 

* the lack of a detailed, executable contingency plan in the event significant difficulty is encountered in delivering the release. 

In addition, as of September, IRS reported that integration testing for the first build[Footnote 30] was in jeopardy due to delays resulting in part from defects and data errors that required correction. Systems acceptance testing for data conversion was also in jeopardy. 

Future releases of AMS: IRS reports that future releases of AMS are expected to increase in complexity. According to IRS, maintaining alignment between the CADE and AMS programs will also be a significant challenge and source of risk for the BSM program, and will require careful monitoring and management of both programs. 

IRS recognizes the potential impact of these project risks and issues on its ability to deliver planned functionality within cost and schedule estimates, and has developed mitigation strategies to address them. For example, to address the risks and issues confronting CADE release 3.2, IRS developed a task network for use in managing risk and also began working with the PRIME contractor to develop detailed contingency plans in the event that delivery of this release becomes seriously threatened. Status meetings are also held weekly to ensure early visibility of potential problems and to optimize the opportunity to devise and implement effective mitigating strategies. ï¿½Tiger teamsï¿½ were also established to help minimize schedule delays in both these areas. The independent assessment of CADE release 3.2 noted that, as a result of the mitigation steps being taken, there was no reason to shift directions for the release, and IRS officials stated that they expect to deploy the release on time for the filing season. To address the challenge of maintaining alignment between CADE and AMS releases, IRS developed a release content master plan that defines the relationship between releases of CADE and AMS. According to IRS, several factors, stemming largely from the delay in deployment of CADE release 2.2, have led to a need to modify the plan. During our review, IRS told us that this plan would be updated by November 2007. However, as of December, officials reported that it was still undergoing review. 

While IRS has developed mitigation strategies, the risks and challenges facing future releases of CADE and AMS are nevertheless significant and we will continue to monitor them and IRSï¿½s actions to address them. 

Observation 3: IRS continues to make progress in addressing high-priority BSM program improvement initiatives. 

IRSï¿½s high-priority program improvement initiatives process[Footnote 31] continues to be an effective means of regularly assessing, prioritizing, and incrementally addressing BSM issues and challenges. In September 2007, IRS completed another cycle of high priority initiatives and is currently working on a cycle that is scheduled to be completed by the end of March 2008. The key focus areas for the most recent cycle included: 

human capital improvements (developing succession and staffing plans across organizational levels and reducing the hiring gap), 

security improvements (updating the ELC to embed security processes, procedures, and tools throughout the entire life cycle), and: 

process improvements (developing and implementing standardized earned value management practices for all major applications development projects). 

Observation 4: Efforts are under way to address human capital challenges, but more work remains. 

In March 2007, IRS developed the Applications Development Strategic Plan 2007-2011[Footnote 32] to establish a road map to ensure that applications development decisions are focused on delivering the mission in a manner consistent with the organizationï¿½s vision. This document includes a human capital strategy that addresses hiring critical personnel, employee training, leadership development, and workforce retention. 

To support this strategy, IRS undertook high priority initiatives, including convening a tiger team to identify challenges to the hiring process and establishing the Executive Hiring Council to coordinate recruitment actions and strategies to address the hiring gap for the Modernization Information Technology Services organization. In addition, IRS stated that during fiscal year 2008, it plans to conduct analyses of turnover rates, use a cost index model to determine the cost and drivers of turnover, and increase the hiring base for mission critical positions through automation, simplification of the application process, and the use of hiring incentives and continue its efforts to quickly replace key leaders lost to retirement by expanding its Succession Management Program and expanding use of its Leadership Succession Review tool to levels below senior executive. 

While IRS has identified these initiatives, it has not developed a specific plan, including time frames for addressing them across the AD organization. During our review, officials told us that such a plan would be completed by the end of fiscal year 2007. However, it was not completed by that date, and IRS has not specified a new completion date. Until IRS develops a plan for addressing its various human capital initiatives, it may be challenged in having the staff resources it needs to effectively support BSM. 

Observation 5: Security weaknesses affect IRSï¿½s modernization environment. 

IRS has security weaknesses affecting its modernization environment. Specifically, in November 2007, we reported that IRS continued to have weaknesses with its information security controls.[Footnote 33,34] For example, we noted that there were significant control weaknesses that allowed unauthorized users to access sensitive information, including user IDs, passwords, and software code for mission critical applications without having to login to the network. We identified a key reason for the presence of these and other weaknesses as the lack of a fully implemented security program. 

In written comments on a draft of our report, IRSï¿½s Deputy Commissioner agreed that our report fairly represented IRSï¿½s challenges and noted actions it has taken to address the issues we identified including establishing the Office of Privacy, Information Protection, and Data Security to provide direction and oversight of the security and protection of sensitive information; developing an integrated IT security schedule and plan and a comprehensive IRS security strategy; and encrypting all laptop data and tapes used in electronic data exchange, and implementing an enterprise anti-virus Internet gateway solution to detect and quarantine malicious content from invading systems. 

IRS has also identified security weaknesses through its high priority initiatives program, and, to its credit, it is working to address them. For example, through this program, IRS recently updated its enterprise life cycle methodology to incorporate processes, procedures, and tools into the early stages of the enterprise life cycle.[Footnote 35] Through its high priority initiatives program, IRS is also addressing these three additional security practices across the enterprise life cycle: 

Implementing the first phase of a comprehensive audit trails program. This effort will establish program- level requirements and create release plans that apply to enterprise audit trail capture, storage, and management for all IRS Federal Information Security Management Act systems. 

Realigning the Modernization Information Technology Services General Support Systems boundaries to improve security accountability and ensure that acceptable levels of security are maintained. 

Establishing an enterprisewide strategy and phased implementation plan to automate security posture monitoring for major systems and network platforms. Develop security posture monitoring plans that address the compliance of security configurations, vulnerability management, and patch management. 

While actions to address our report findings and the high priority initiatives help to improve its security posture, IRSï¿½s modernization environment will continue to be at risk until the agency fully implements its security program.

Conclusions: 

During 2007, IRS continued to make progress in delivering BSM projects that provided benefits to both taxpayers and the agency. IRS also continued to improve its management capabilities and controls by, among other things, taking steps to address our recommendations from prior expenditure plan reviews and addressing its high priority initiatives. These actions will likely result in more effective management of BSM and help mitigate the risks inherent in managing such a large and complex program. However, IRS is still facing significant challenges in consistently meeting its cost and schedule commitments, managing project- specific risks, addressing high priority initiatives, and securing its many systems. In addition, it has not yet fully implemented recommendations we have made. To bolster its human capital efforts, IRS has developed a strategy to address hiring critical personnel, employee training, leadership development, and workforce retention. However, a specific plan with time frames for implementing initiatives supporting this strategy has not yet been developed. 

Recommendation for Executive Action: 

To allow for more effective congressional oversight of the BSM program, we are recommending that the Commissioner of Internal Revenue direct the Chief Information Officer to complete a plan with specific time frames for implementing the initiatives supporting its human capital strategy. Such a plan would help guide IRSï¿½s efforts and measure progress in implementing them. 

Agency Comments: 

In e-mail comments on a draft of this briefing, the Associate Chief Information Officer for Applications Development stated that it addresses many of BSMï¿½s positive accomplishments from 2007. She also provided clarifying and technical comments that we addressed, as appropriate. 

Appendix I: 

Table: Description of BSM Projects and Program-level Initiatives: 

Proposed modernization initiative: Tax administration projects: Modernized e-File; 
Description: Is to provide a single standard for filing electronic tax returns. Initial releases will address large corporations, small businesses, and tax-exempt organizations. Its ultimate goal is the conversion of IRSï¿½s 1040 e-file program. 
 
Proposed modernization initiative: Tax administration projects: Customer Account Data Engine; 
Description: Is to build the modernized database foundation to replace the existing Individual Master File processing system that contains the repository of individual taxpayer information. Accounts Management Services Is to deliver improved customer support and functionality by leveraging existing IRS applications (Desktop Integration and Correspondence Imaging System) and new technologies to bridge the gap between modernization initiatives, such as the Customer Account Data Engine and legacy systems. Accounts Management Services is to enhance the Customer Account Data Engine by providing applications for IRS employees and taxpayers to access, validate, and update accounts on demand. 
 
Proposed modernization initiative: Tax administration projects: Internal management projects; 
Description: Is to provide a new portal infrastructure. The infrastructure will replace the existing three vendor-hosted external portals, whose contracts expired in May 2006. 
 
Proposed modernization initiative: Internal management projects: Common Services; 
Description: Is to provide a new portal infrastructure. The infrastructure will replace the existing three vendor-hosted external portals, whose contracts expired in May 2006. 

Proposed modernization initiative: Core infrastructure projects: Development, Integration, and Testing and Environments; 
Description: Is to provide oversight for laboratory environments that support evaluation, development, Environments and testing of components from multiple projects: (1) Virtual Development Environment provides a software development environment and a standardized set of tools and (2) Enterprise Integration and Test Environment provides an integration and testing environment for all projects. 

Proposed modernization initiative: Core infrastructure projects: Infrastructure Shared Services; 
Description: Is to deliver, in incremental releases over multiple years, a fully integrated, shared IT infrastructure to include hardware, software, shared applications, data, telecommunications, security, and an enterprise approach to systems and operations management.

Proposed modernization initiative: Architecture, integration, and management: Architecture and integration; 
Description: Is to ensure that systems solutions meet IRS business needs and that the development projects are effectively integrated into the business environment. 

Proposed modernization initiative: Architecture, integration, and management: Business integration; 
Description: Is to ensure that IRSï¿½s BSM program is aligned with the business unitsï¿½ vision and delivers the desired business results. It provides support to key activities such as transition management, business rules enterprise management, and requirements development and management operations. 
 
Proposed modernization initiative: Architecture, integration, and management: Business rules; 
Description: Is to support business process analysis and redesign, business rules harvesting and management, and business requirements definition. 

Proposed modernization initiative: Architecture, integration, and management: Management processes; 
Description: Is to provide sustaining support for program-level management processes, including quality assurance, risk management, program control and process management, and enterprise life cycle maintenance and enhancements. 

Proposed modernization initiative: Architecture, integration, and management: Federally funded research and development center; 
Description: Is to provide program management and systems engineering support. 

Proposed modernization initiative: Architecture, integration, and management: Program management; 
Description: Is to ensure that projects achieve their objectives; provide the management information and IT infrastructure that supports risk management, project cost and schedule estimating, and financial management; and provide procurement management for the PRIME contract and associated task orders. 

Appendix II: 

Table: Additional Detail on IRSï¿½s Fiscal Year 2008 BSM Expenditure Plan: 

[See PDF for image] 

Source: IRS. 

[A] Releases are software versions that provide a subset of the total planned project functionality. 

[B] Milestones correspond to phases within IRSï¿½s enterprise life cycle (0 ï¿½ vision and strategy/enterprise architecture, 1 ï¿½ project initiation, 2 ï¿½ domain architecture, 3 ï¿½ preliminary design, 4a ï¿½ detailed design, 4b ï¿½ system development, 5 ï¿½ system deployment). 

[C] Core infrastructure projects and management initiatives are funded on a fiscal year basis rather than by milestone. 

[D] If the fiscal year 2008 BSM request is approved, $4.2 million from MeF release 6, milestone 2-3 will transfer to management reserve and the balance will be reprogrammed. 

[End of figure] 

Appendix III: 

IRS Reported Cost/ Schedule for Projects Scheduled for Completion in Fiscal Year 2007: 

This table shows the projects completed in fiscal year 2007. The highlighted rows indicate project segments where actual reported costs and/or schedules differ from planned by more than 10%. 

Note: Variances for projects through milestone 3 are based on rough order of magnitude estimates. Post-milestone 3 variances are based on more specific estimates. 

Source: GAO analysis of IRS data. 

[End of figure] 

Appendix II Comments from the Internal Revenue Service: 

Department Of The Treasury: 
Internal Revenue Service: 
Washington. D.C. 20224: 

February 22, 2008: 

Mr. David Powner: 
Director, Information Security Issues: 
U.S. General Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Powner: 

I have reviewed the Government Accountability Office (GAO) draft report titled "Business Systems Modernization (BSM): Internal Revenue Service's Fiscal Year 2008 Expenditure Plan," GAO-08-420 (Job Code No. 310871). We continue to appreciate the sound and balanced work of the GAO and are pleased that the GAO: 

* Confirmed that our fiscal year 2008 expenditure plan satisfies the conditions specified in the law that includes meeting the Office of Management and Budget's capital planning and investment control review requirements and complying with the federal systems acquisition requirements and management practices;

* Recognized that we have taken steps to address the GAO's prior recommendations to improve modernization management controls and capabilities that include adding a new focus area to our Modernization Vision and Strategy and defining an approach for developing a quantitative measure of progress in meeting project scope expectations, which we have begun implementing;

* Acknowledged our progress in implementing BSM projects and in meeting cost and schedule commitments for most deliverables; 

* Validated our continued progress in addressing high-priority BSM program improvement initiatives and that our high-priority improvement initiatives continue to be an effective means of assessing, prioritizing, and incrementally addressing BSM issues and challenges; and: 

* Reported our current efforts to address human capital challenges such as the development of an IT human capital strategy that addresses hiring critical personnel, employee training, leadership development, and workforce retention. 

We agree with your report's recommendation as described in the enclosure, that we need to develop specific time frames for implementing our human capital initiatives and have begun that process. In FY 2007, the ACIO, Applications Development (AD), identified workforce retention and development as one of our most significant challenges. The ACIO, AD, developed a strategy to address this challenge and has taken aggressive steps to define the gaps and to minimize the impact. 

We appreciate your continued support and the assistance and guidance from your staff. If you have any questions, or if you would like to discuss our response in more detail, please contact me or call Arthur L. Gonzalez, Chief Information Officer, at (202) 622- 6800.

Sincerely,

Linda E. Stiff: 
Acting Commissioner of Internal Revenue: 

Enclosure: 

Draft Report - Business Systems Modernization Internal Revenue Service's Fiscal Year 2008 Expenditure Plan (Audit #310871, GAO-08-420):  

Recommendation #1: To allow for more effective congressional oversight of the BSM program, we recommend that the Commissioner of Internal Revenue direct the Chief Information Officer to complete a plan with specific time frames for implementing the initiatives supporting its IT human capital strategy. Such a plan would help guide IRS's efforts and measure progress in implementing them. 

Corrective Action: We agree with this recommendation. In FY 2007, the ACIO, Applications Development (AD), identified workforce retention and development as one of our most significant challenges. The ACIO, AD, developed a strategy to address this challenge and has taken aggressive steps to define the gaps and to minimize the impact. 

The ACIO, Management, will coordinate with the ACIO, AD, to refine our Human Resources plan to include specific timeframes for implementing the human capital initiatives. 

Implementation Date: October 1, 2008; 

Responsible Official: ACIO, Management; 

Corrective Action Monitoring Plan: We will monitor this corrective action as part of our internal management control system. We will enter accepted corrective actions into the Joint Audit Management Enterprise System (JAMES) and monitor them monthly until completion. 

[End of section] 

Appendix III GAO Contact and Staff Acknowledgments: 

GAO Contact: 

David A. Powner, (202) 512-9286, or p [Hyperlink, [email protected]] [email protected]: 

Staff Acknowledgments: 

In addition to the individual named above, Sabine R. Paul, Assistant Director; Neil Doherty; Nancy Glover; Sairah R. Ijaz; Rebecca LaPaze; and Paul B. Middleton made key contributions to this report. 

[End of section] 

Footnotes: 

[1] See the Financial Services and General Government Appropriations Act, 2008, contained in the Consolidated Appropriations Act, 2008, Pub. L. No. 110-161, div. D. title I, 121 Stat. 1844, 1972 (Dec. 26, 2007), which provides a new level of funding for BSM. (At the time of our briefing, IRS reported that it was updating its plans to reflect this new level of funding.) 

[2] BSM funds (except labor costs) are unavailable until IRS submits a modernization expenditure plan to the congressional appropriations committees and obtains their approval. This plan must (1) meet the Office of Management and Budget's (OMB) capital planning and investment control review requirements; (2) comply with IRS's enterprise architecture; (3) conform with IRS's enterprise life cycle methodology; (4) comply with federal acquisition rules, requirements, guidelines, and systems acquisition management practices; (5) be approved by IRS, the Department of the Treasury, and OMB; and (6) be reviewed by GAO. IRS's fiscal year 2008 funding is provided under the Consolidated Appropriations Act, 2008, div. D, title I, Pub. L. No. 110-161, 121 Stat. 1844, 1972 (Dec. 26, 2007). These conditions for BSM funding availability have been in effect for several years, including the immediately preceding fiscal year. 

[3] Milestones correspond to phases within IRS's enterprise life cycle (0--vision and strategy/enterprise architecture, 1--project initiation, 2--domain architecture, 3--preliminary design, 4a-- detailed design, 4b--system development, 5--system deployment). 

[4] Earned value management is a project management tool that integrates the investment scope of work with schedule and cost elements for investment planning and control. This method compares the value of work accomplished during a given period with that of the work expected in the period. Differences between accomplishments and expectations are measured in both cost and schedule variances. 

[5] GAO, Financial Audit: IRS's Fiscal Years 2007 and 2006 Financial Statements, GAO-08-166 (Washington, D.C.: Nov. 9, 2007). Since we briefed the congressional committees, GAO has issued a report focusing on IRS's information security program (GAO, Information Security: IRS Needs to Address Pervasive Weaknesses, GAO-08-211 (Washington, D.C.: Jan. 8, 2008). 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability.  

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "Subscribe to Updates."  

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:  

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548:  

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061:  

To Report Fraud, Waste, and Abuse in Federal Programs:  

Contact:  

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: [email protected]: 
Automated answering system: (800) 424-5454 or (202) 512-7470:  

Congressional Relations:  

Ralph Dawn, Managing Director, [email protected]: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548:  

Public Affairs: 

Chuck Young, Managing Director, [email protected]: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: 

*** End of document. ***