LegiStorm Pro

In August 2005, the Office of Management and Budget (OMB) issued a memorandum directing agencies to identify high risk information technology (IT) projects and provide quarterly reports on those with performance shortfalls--projects that did not meet criteria established by OMB. GAO was asked to (1) provide a summary identifying by agency the number of high risk projects, their proposed budget for fiscal year 2007, agency reasons for the high risk designation, and reported performance shortfalls; (2) determine how high risk projects were identified and updated and what processes and procedures have been established to effectively oversee them; and (3) determine the relationship between the high risk list and OMB's Management Watch List--those projects that OMB determines need improvements associated with key aspects of their budget justifications.

In response to OMB's August 2005 memorandum, the 24 major agencies identified 226 IT projects as high risk, totaling about $6.4 billion in funding requested for fiscal year 2007. Agencies identified most projects as high risk because their delay or failure would impact the essential business functions of the agency. In addition, agencies reported that about 35 percent of the high risk projects--or 79 investments--had a performance shortfall, meaning the project did not meet one or more of these four criteria: establishing clear baselines, maintaining cost and schedule variances within 10 percent, assigning a qualified project manager, and avoiding duplication with other investments. Although agencies, with OMB's assistance, generally evaluated their IT portfolio against the criteria specified by OMB to identify their high risk projects, the criteria were not always consistently applied. Accordingly, GAO identified several projects that appeared to meet OMB's definition for high risk but were not determined by agencies to be high risk. In addition, OMB does not define a process for updating high risk projects. As a result, agencies had inconsistent updating procedures. Regarding oversight of these projects, agencies either established special procedures or used their existing investment management processes. OMB staff stated that they review the projects' performance and corrective actions planned. However, OMB has not compiled the projects into a single aggregate list, which would serve as a tool to analyze and track the projects on a governmentwide basis. High risk projects and Management Watch List projects are identified using different criteria. The former is meant to track the management and performance of projects, while the latter focuses on an agency's project planning. Both sets of projects require attention because of their importance in supporting critical functions and the likelihood that their performance problems could potentially result in billions of taxpayers' dollars being wasted if the problems are not detected early.