The Office of Release Management Can Improve Controls for Modernization
Program Coordination
September 2004
Reference
Number: 2004-20-157
This report has cleared the Treasury
Inspector General for Tax Administration disclosure review process and
information determined to be restricted from public release has been redacted
from this document.
September
16, 2004
MEMORANDUM FOR
CHIEF INFORMATION OFFICER
FROM: Gordon C. Milbourn III /s/ Gordon C.
Milbourn III
Acting Deputy Inspector
General for Audit
SUBJECT: Final Audit Report - The Office of Release Management Can Improve
Controls for Modernization Program Coordination (Audit # 200420017)
This
report presents the results of our review of the effectiveness of the Business Systems Modernization Office’s (BSMO)
Release Management activities to ensure released projects are tested, minimize
crises and disruption to production processes, and deliver systems as described
in the project plans, fulfilling stated requirements. This review was part of our Fiscal Year 2004
audit plan for reviews of the Internal Revenue Service’s (IRS) Business Systems
Modernization (BSM) efforts.
In summary, the BSMO created the Office of Release Management in 2001 as part of the BSM program. The Office of Release Management obtains services from the PRIME contractor and other BSM program contractors, coordinates the delivery of those services, and resolves problems with and between the contractors and the IRS. We reviewed the activities of two subordinate offices of the Office of Release Management: the Release Scheduling Office, which ensures development of strategic/long-term and near-term BSM project release planning to move from the current information systems to the modernized architecture; and the Integration Test and Deployment Office, which provides an integrated testing and deployment program to verify that business and systems requirements will be met by the BSM projects. Generally, the Office of Release Management has served as an effective liaison between the IRS and the BSM contractors in facilitating BSM program activities.
In 1998, the PRIME
contractor was designated as the integrator of the BSM program. Since that time, the BSM program has gone
beyond the exclusive assignment of the PRIME contractor as its integrator. For example, the BSMO acted as the integrator
for the Modernized e-File Project, and the Northrop
Grumman Corporation is serving as the integrator for the Custodial
Accounting Project. The Office of
Release Management has helped facilitate the development, contracting, and
testing activities for these non-PRIME BSM projects. It has also performed integration
responsibilities for non-PRIME projects requiring the PRIME contractor’s
services for using the modernized infrastructure. Diversifying the development activities of
the overall BSM program will require the BSMO to consider how to assign
responsibility for integrating these projects. Without
clearly defining who is the integrator for non-PRIME projects and documenting
the related responsibilities and processes, the BSMO cannot assure the
successful integration of projects developed by multiple contractors.
The Release Scheduling
Office has evolved into what it is today by taking on responsibilities as part
of the overall BSM program development.
The Release Scheduling Office has performed its activities in response
to needs of the BSM program and has followed informal processes to accomplish
its responsibilities. This Office has
recognized the need for formal processes and procedures and has begun
documenting some of its activities.
However, further work is needed to develop and document its activities
to coordinate work and communicate project status among the BSMO, the
Information Technology Services organization, and the BSM contractors. Without procedures, the Release Scheduling
Office may not consistently perform the work or perform all of the work needed
to accomplish its mission.
The
Integration Test and Deployment Office uses the Enterprise Life Cycle (ELC) Systems Evaluation Process Description (SEPD) to ensure the products provided to the BSMO
satisfy the contractual requirements. However, the SEPD does not completely reflect this Office’s current
responsibilities. Without sufficient detailed guidance, the
Integration Test and Deployment Office staff cannot ensure the work is
performed effectively and consistently.
To help provide clear
direction in the development of the BSM program, we recommended that the Chief
Information Officer (CIO) determine whether and how the BSMO will fulfill the
BSM program integrator role and document the related responsibilities and
processes. Further, to help ensure the
mission of the Office of Release Management is accomplished, we recommended
that the CIO ensure procedures are developed and issued for the Release
Scheduling Office to review the accuracy of the Integrated Master Schedule,
manage Request for Information Services issues between the IRS and the BSM
contractors, facilitate use of PRIME contractor services for non-PRIME projects,
and provide BSM contractor staff access to IRS computer systems. Also, we
recommended that the CIO ensure the SEPD is updated to provide adequate
guidance for the activities to be performed by the Integration Test and
Deployment Office staff.
Management’s Response: IRS
management agreed with the report recommendations and stated that corrective
actions are underway to address them.
Some responsibility for implementing the recommendation to define the
BSMO’s role and processes as the BSM integrator will be addressed by the Office
of the Associate CIO (ACIO) for Enterprise Services. Steps are underway to restructure the Modernization
and Information Technology Services organization to include this new role. This ACIO will ultimately manage, direct, and
oversee crosscutting areas that involve highly complex, mission critical
information system initiatives. Further,
the CIO agreed with the recommendations to develop, complete, or update
guidance for managing the activities in the Office of Release Management, and
is considering the report’s proposed guidelines as presented in Appendix IV. Management’s complete response to the
draft report is included as Appendix VI.
Copies
of this report are also being sent to the IRS managers affected by the report
recommendations. Please contact me at
(202) 622-6510 if you have questions or Margaret E. Begg, Assistant Inspector
General for Audit (Information Systems Programs), at (202) 622-8510.
The Office of Release Management Is
Taking Positive Steps to Document Its Activities
The Integrator Role Is Not Clearly
Defined in the Modernization Program
The Release Scheduling Office Does Not Have Formally Documented Procedures to Direct Its Activities
Appendix
I – Detailed Objective, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix
IV – Operating
Procedures for the Office of Release Management
Appendix
V – Enterprise Life Cycle Overview
Appendix VI
– Management’s Response to the Draft Report
The Internal Revenue Service (IRS) Business Systems Modernization Office (BSMO) created the Office of Release Management in 2001 as part of the modernization acquisition organization. The Office of Release Management acquires services from the PRIME contractor and other Business Systems Modernization (BSM) program contractors, coordinates the delivery of those services, and resolves problems with and between the contractors and the IRS.
The mission of the Office of Release Management is to help facilitate BSM project development by ensuring projects are thoroughly planned and tested as described in the project plans. Additionally, it provides configuration management processes and procedures for all BSMO, PRIME contractor, and other contractor personnel supporting the BSM program.
To accomplish its mission, the Office of Release Management has established three subordinate offices assigned to perform the following activities:
· The Release Scheduling Office ensures development of strategic/long-term and near-term BSM project release planning to move from the current information systems to the modernized architecture.
· The Integration Test and Deployment Office provides an integrated testing and deployment program to verify that business and systems requirements will be met by the BSM projects.
· The Configuration Management Office defines and documents the BSM configuration management process and procedures.
This review was performed at the BSMO facilities in New Carrollton, Maryland, during the period March through June 2004. The scope of our work was limited to the activities of the Release Scheduling and Integration Test and Deployment Offices. We did not review the activities of the Configuration Management Office due to other recent audit work. The audit was conducted in accordance with Government Auditing Standards. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II. Appendix V presents an overview of the components of the Enterprise Life Cycle (ELC).
The Office of Release Management has generally served as an effective liaison between the IRS and the BSM contractors in facilitating BSM program activities. The Office has accomplished the liaison responsibilities by regularly hosting and attending meetings with the BSMO and PRIME contractor, such as the Delivery Integration Status conference call during which project testing and deployment status are monitored. Also, as the BSMO liaison, the Office of Release Management has generally acted as an effective contact point in communicating and elevating BSM issues to responsible IRS or PRIME contractor managers to address project development, testing, and deployment concerns. It has:
· Provided input to the Systems Evaluation Process Description (SEPD) guidance document that is used in managing the testing of BSM projects.
· Developed the monitoring plan and acquisition management plan for the Non-PRIME Projects Integration Office Task Order.
· Drafted procedures to assist non-PRIME projects interested in obtaining PRIME contractor services.
Although the Office of Release Management is taking steps to document its procedures, it needs to either complete or further enhance documentation for the activities it performs. This report addresses the activities performed by the Release Scheduling Office and the Integration Test and Deployment Office that need documented guidance.
During previous efforts in the 1990s to modernize its information systems, the IRS acted as the integrator of the Tax Systems Modernization (TSM) program. In July 1995, the Government Accountability Office (GAO) [formerly the General Accounting Office] expressed concerns with the TSM program performance and reported that the IRS’ system architecture, integration, testing and test planning were incomplete. The IRS subsequently disbanded the TSM effort.
When the modernization effort resumed in 1998, the PRIME contractor was designated as the integrator of the BSM program. However, the BSM program has gone beyond the exclusive assignment of the PRIME contractor as its integrator.
For example, the BSMO acted as the integrator for the
Modernized e-File Project, and the Northrop
Grumman Corporation is serving as the integrator for the Custodial
Accounting Project. The Office of
Release Management has helped facilitate the development, contracting, and
testing activities for these non-PRIME Modernization projects. It has also performed integration
responsibilities for non-PRIME projects requiring PRIME contractor services for
using the modernized infrastructure.
These activities are described in more detail in a later section of this
report.
Further, the IRS Commissioner recently decided to use a
contractor other than the PRIME contractor for the development of the BSM
Collection Contract Support (CCS) Project.
For the CCS Project, the BSMO will have to decide whether it will take
over the integration of the system into
the modernized infrastructure, contract with the PRIME contractor to perform
the integration activities, or use another contractor for the integration
activities.
Diversifying the development activities of the overall BSM program will require the BSMO to consider how to assign responsibility for integrating these projects. The Office of Release Management’s mission may evolve into the role of program integrator. Just as documenting the responsibilities mentioned in the previous section will help the Office of Release Management accomplish its mission, clearly defining who is the integrator for non-PRIME projects and documenting the related responsibilities and processes will be necessary to assure the successful integration of projects developed by multiple contractors.
1.
To help
provide clear direction in the development of the BSM program, the Chief Information Officer (CIO)
should determine whether and how the BSMO will fulfill the BSM program
integrator role and document the related responsibilities and processes.
Management’s Response: The CIO will assign some of the responsibility for the implementation of this recommendation to the Office of the Associate CIO (ACIO) for Enterprise Services. Steps are underway to restructure the Modernization and Information Technology Services organization to include this new role. This ACIO will ultimately manage, direct, and oversee crosscutting areas that involve highly complex, mission critical information system initiatives such as demand analysis, enterprise architecture, configuration management, project reporting, enterprise life cycle management, and systems engineering.
The Release Scheduling Office helps to ensure development of strategic/long-term and near-term release planning to implement the modernized architecture. To accomplish this mission, it:
· Obtains services from the PRIME contractor’s Release Management Office, including the Integrated Master Schedule (IMS), which provides a schedule for project development and integration of all BSM projects.
· Attends and hosts various meetings with the BSMO, IRS, and BSM contractors to assist in communicating project status and to facilitate problem resolution. These liaison activities help minimize project disruption and promote project delivery.
· Coordinates project hardware and software requirements and project development services between the BSM contractor staff and the IRS.
The Release Scheduling Office has evolved into what it is today by taking on responsibilities as part of the overall BSM program development. The Release Scheduling Office has performed its activities in response to needs of the BSM program and has followed informal processes to accomplish its responsibilities. It has recognized the need for formal processes and procedures and has begun documenting some of its activities.
Without procedures, the Release Scheduling Office may not consistently perform the work or perform all of the work needed to accomplish its mission. The GAO Standards for Internal Control in the Federal Government state that information should be recorded and communicated to management and others within the entity who need it and in a form and within a time period that enables them to carry out their responsibilities.
The IMS does not include a review to ensure its accuracy
The IMS provides a schedule for project development and integration of all BSM projects. The purposes of schedules are to provide information needed to monitor and control the work of the project or program and to identify dependencies between project offices and other projects or organizations, including IRS organizations.
Analysis of the IMS helps manage resources and focus attention on those areas of the BSM program that pose the most risk to a project’s schedule objectives. The IMS furnishes the ability to identify critical milestones and supporting activities, summarize detailed schedule data to total program levels, and evaluate the impact of current schedule performance on future activities and events.
The ELC includes a requirement that the BSMO perform quality reviews and validation of program and release schedules, review program revisions and redirection, and facilitate the dissemination and distribution of program schedules. The Release Scheduling Office receives the release schedules and the IMS from the PRIME contractor but has not been reviewing the content of the schedules. It has relied on the PRIME contractor to produce the schedules and on the BSM project staff members to identify and address any inaccuracies in the schedules.
In March 2004, the IRS received results from a review of the
IMS activities conducted by an independent consulting firm. The reported problems with the IMS included
observations that it has been consistently inaccurate and unreliable. The independent consulting firm provided recommendations that included
developing a formal review process to ensure IMS integrity.
The Release Scheduling Office is currently working with the BSMO Business Integration Program Control Office to develop guidance to effectively assess the reliability and accuracy of the IMS. Currently, the Business Integration Program Control Office performs analyses of portions of the IMS. However, this Office has not prepared and published guidance to perform these analyses.
Guidance is not in place for coordinating the completion of Request for Information Services (RIS) issues between the BSM contractors and the IRS
In the Release Scheduling Office’s role to provide support to the PRIME contractor’s Release Management Office, it becomes involved in resolving various types of issues requiring clarification of project development activity. One type of involvement is the Release Scheduling Office’s role in coordinating completion of RIS issues in weekly RIS meetings. The purpose of these meetings is to discuss the current RIS requirements and come to agreement on the RIS expectations.
The Release Scheduling Office is responsible for resolving RIS issues if a BSM contractor and the IRS have reached an impasse regarding the requested information technology service. The resolution of these issues becomes significant when the issues affect the work performance on a BSM project. If the Release Scheduling Office cannot negotiate a resolution, the unresolved RIS issue is forwarded to BSM executives. During the BSM executive meetings, the issues are discussed and a compromise is secured. Once a RIS issue has been resolved, the RIS is added to the IMS and the IRS proceeds to develop and deliver the required service.
The Release Scheduling Office currently has no guidance to manage the coordination of RIS issues between the IRS and BSM contractors. It did not consider its involvement in the resolution of RIS issues significant enough to require specific procedures.
Without a documented RIS process, Release Scheduling Office employees cannot ensure they provide adequate and consistent coordination to effectively resolve RIS issues between the IRS and the BSM contractors. If RIS issues are not resolved timely, they could delay the IRS from performing the required services for the BSM contractors, thus affecting the completion of a BSM project.
Guidance is not in place to assist non-PRIME projects in acquiring the PRIME contractor’s services to use the modernized infrastructure
The
Release Scheduling Office is responsible for assisting non-PRIME projects in
acquiring the PRIME contractor’s services to use the modernized
infrastructure. Non-PRIME projects
include BSM projects not being developed by the PRIME contractor and projects being developed by the IRS that require the
use of the modernized infrastructure.
The Release Scheduling Office assists non-PRIME projects’ staffs by
coordinating contracting activities with the PRIME contractor.
The
Release Scheduling Office has developed a listing that identifies and controls
the precontract award activities for non-PRIME projects interested in obtaining
the PRIME contractor’s services. It has
also developed a draft procedure with additional detail for some of the precontract
award activities included in the listing.
In addition, it has developed a monitoring plan that describes the
principal roles, responsibilities, and procedures for monitoring the
contractor’s performance under the task order.
While these documents provide the activities that need to be performed,
they do not include sufficient detail to guide all activities that the Release
Scheduling Office needs to perform to facilitate use of the PRIME contractor’s
services.
As
of March 30, 2004, there were four non-PRIME BSM projects (Modernized e-File,
Custodial Accounting Project, Internet Employer Identification Number, and
Internet Refund Fact of Filing) that had ongoing PRIME contract activities for
services to use the modernized infrastructure.
The Release Scheduling Office is coordinating and managing these PRIME
contract activities. In addition, it
coordinates preaward contract assessments that provide a project with a cost
estimate for the project to use the modernized infrastructure. As of March 30, 2004, there were two BSM
projects (Enterprise-wide Relationship Management and Individual Taxpayer
Identification Number) in the process of having preaward contract assessments
developed.
The
BSMO Acquisition Management Directives provide the policy for determining the
adequacy of contract performance. While
there is guidance for assessing contract performance activities, the guidance
does not provide the detail needed to conduct the non-PRIME contract assessment
activities that the Release Scheduling Office is responsible for
performing.
Without
detailed documented guidelines about facilitating the non-PRIME project
activities, the Release Scheduling Office staff cannot assure consistent and
effective assistance to non-PRIME projects seeking to use the modernized
infrastructure. If the Office of Release
Management assumes an expanded role as integrator with the number of non-PRIME
projects increasing, detailed procedures will become more important to ensure a
smooth process for using the modernized infrastructure.
Guidance is not in place to facilitate access to IRS systems for BSM contractors
The IRS developed an automated online system to control personnel requests and access to the IRS information systems. This online system replaced a manual process that used a paper form, Information System User Registration/Change Request (Form 5081), to control access. When developing the automated online system (known as the Online 5081), the IRS did not develop a process for contractor personnel to request access to the IRS’ information systems. The automated system was designed to compare requests for access against the IRS payroll system and verify that the personnel were actually IRS employees. Since contractor personnel are not in the payroll system, IRS personnel requesting access for them could not complete the requests using the automated system.
For example, during the development of the e-Services Project, work stoppage occurred because the PRIME contractor had difficulty gaining access to IRS systems. Since a process was not in place to request and gain access to IRS systems for contractor personnel, the BSMO Office of Release Management assumed responsibility for assisting the PRIME contractor personnel in obtaining access to the IRS systems.
The Release Scheduling Office began a weekly teleconference to resolve immediate work stoppages and to facilitate the resolution of issues that may become work stoppages. In addition, it assisted PRIME contractor personnel in obtaining access to IRS systems by manually entering them into the online system. The Release Scheduling Office has now assumed the role for controlling the nonautomated requests for system access for all BSM contractor personnel. It currently has no formal documented guidance for non-IRS personnel using the nonautomated process to obtain access to IRS systems.
Without a documented process, the Office of Release Management staff responsible for the nonautomated process cannot assure consistent and effective management of this process. If contractors are not able to obtain timely access to IRS systems, work stoppages may occur. The work stoppages could result in additional costs for those affected BSM projects, since the contractors would continue to charge the IRS for the time they are unable to perform work on the IRS systems. In addition, if system access is not properly managed and contractors’ access is not timely removed, there could be unauthorized access to IRS systems.
The
Modernization and Information Technology Services organization is currently implementing new network access
procedures as part of the IRS’ transition to a new operating system
infrastructure. Users, including most
contractors, will be required to use a Standard Employee Identifier (SEID) to
access the IRS computer information systems network. To obtain an SEID, the IRS must register the
contractors in the Online 5081 database.
This process is planned to begin implementation in July 2004. The Release Scheduling Office needs to
ensure compliance with the IRS-wide guidance.
2. To help ensure the mission of the Office of Release Management is accomplished, the CIO should ensure procedures are developed and issued for:
· Reviewing the accuracy of the IMS.
· Managing RIS issues between the IRS and the BSM contractors.
· Facilitating use of PRIME contractor services for non-PRIME projects.
For details of the specific procedures to consider, see Appendix IV.
Management’s Response: The CIO directed the Office of Release Management to develop and issue procedures to help ensure it accomplishes its mission. In developing these procedures, the Office of Release Management is considering this report’s proposed guidelines.
The Integration Test and Deployment Office coordinates and oversees
integration test and deployment activities from the end of project development
through deployment. It reviews
requirements for testability and assesses test environment readiness. It also ensures accomplishment of test and
deployment planning, execution, reporting, and monitoring.
The Integration Test and Deployment Office uses the ELC SEPD to ensure the
products provided to the BSMO satisfy the contractual requirements
(i.e., systems software and hardware requirements, contractual agreements,
conditions, and terms). The Integration Test and
Deployment Office provided
input to the SEPD about its role in testing activities.
However, the SEPD does not completely reflect its current responsibilities.
·
The SEPD requires the Integration Test and
Deployment Office to ensure rescheduling of tests previously
deferred. When a test is deferred, the project
team may prepare a change request. The
Integration Test and Deployment Office looks at all impending change requests once they are
approved. However, the SEPD does not require verification
that a change request has been completed for all deferred tests.
·
The SEPD requires the Integration Test and Deployment Office to coordinate reviewing
and approving or rejecting requests to waive or defer tests to allow testing to
proceed. However, current
guidance does not provide the attributes of test waivers or deferrals that
should be reviewed or verified.
·
The SEPD requires the Integration Test and
Deployment Office to resolve
problems that continue into the postdevelopment stage (after ELC Milestone 4)
of a project (see Appendix V for an overview of the ELC). The Integration Test and Deployment Office manager informed us
that this activity is the responsibility of the specific BSM project
office.
·
The SEPD does not include a requirement for
reviewing test folders documenting test results for completeness. However, the Integration Test and Deployment
Office manager
considered test folder reviews necessary, and his staff does review test
folders to ensure tests were properly performed.
·
The Integration
Test and Deployment
Office’s mission statement includes responsibility for reviewing whether
requirements can be tested. However, the SEPD does not include any
tasks or activities to accomplish this.
Without sufficient detailed guidance, the Integration Test and Deployment Office cannot ensure its work is performed effectively and consistently. In addition, with the SEPD incorrectly assigning the Integration Test and Deployment Office responsibility for an activity, it would be held accountable for completing an activity that is outside of its scope of responsibility.
3.
The CIO should ensure the SEPD is updated to
provide adequate guidance for the activities to be performed by the Integration
Test and Deployment Office staff. For
details of the specific procedures to consider, see Appendix IV.
Management’s Response: The CIO directed the Office of Release
Management to develop and issue
procedures under the SEPD to provide the specific guidance to address the
issues recommended.
Appendix I
Detailed
Objective, Scope, and Methodology
The overall objective of this review was to determine the effectiveness of the Business Systems Modernization Office’s (BSMO) Release Management activities to ensure released projects are tested, minimize crises and disruption to production processes, and deliver systems as described in the project plans, fulfilling stated requirements. This review was part of our Fiscal Year 2004 audit plan for reviews of the Internal Revenue Service’s (IRS) Business Systems Modernization (BSM) efforts. To accomplish our objective, we:
I.
Determined the purpose for establishing the BSMO
Office of Release Management and whether it provided effective direction for
the BSM program.
A.
Determined how the Office of Release Management
participated in the assessment of the BSMO’s progress.
B.
Determined how the Director, Release Management,
managed and assessed the effectiveness and efficiency of the Office of Release
Management.
II.
Determined whether the addition of program
guidance could improve the effectiveness of the Office of Release Management.
A.
Identified Enterprise Life Cycle (ELC) guidance
that could provide the Office of Release Management with procedures to direct
its activities.
B.
Determined how the Release Scheduling and
Integration Test and Deployment Offices within the Office of Release Management
conducted and documented their work.
C.
Determined what specific procedures were needed
to guide the Release Scheduling Office staff in overseeing the PRIME
contractor’s work, resolving problems that arise, and assisting non-PRIME
projects in acquiring the PRIME contractor’s services.
D.
Determined what specific procedures were needed
to guide the Integration Test and Deployment Office staff in coordinating
testing activities, overseeing the PRIME contractor’s work, and resolving
problems that arise during testing.
E. Determined whether the Office of Release Management coordination activities or recommendations have been adequately documented and controlled.
Appendix II
Major Contributors to This
Report
Margaret E. Begg, Assistant Inspector General for Audit
(Information Systems Programs)
Gary Hinkle, Director
Edward A.
Neuwirth, Audit Manager
Mark Carder, Senior
Auditor
Michael Garcia, Senior
Auditor
Beverly
Tamanaha, Senior Auditor
Appendix III
Commissioner C
Office of the
Commissioner – Attn: Chief of Staff C
Deputy Commissioner for Operations Support OS
Associate Chief Information Officer, Business Systems Modernization OS:CIO:B
Director, Stakeholder Management Division OS:CIO:SM
Deputy Associate Chief Information Officer, Systems Integration OS:CIO:B:SI
Director, Release Management OS:CIO:B:SI:RM
Chief Counsel CC
National Taxpayer Advocate TA
Director, Office of Legislative Affairs CL:LA
Director, Office of
Program Evaluation and Risk Analysis
RAS:O
Office of
Management Controls OS:CFO:AR:M
Audit Liaisons:
Associate Chief Information Officer, Business Systems Modernization OS:CIO:B
Manager, Program Oversight Office OS:CIO:SM:PO
Appendix IV
Operating Procedures for the Office of Release
Management
This appendix presents operating procedures for the Business Systems Modernization (BSM) Release Scheduling and the Integration Test and Deployment Offices within the Office of Release Management to consider in performing their work.
The Release Scheduling Office should consider
developing procedures to describe its roles and responsibilities in
facilitating the following BSM program efforts:
·
Reviewing the accuracy of the Integrated Master Schedule (IMS).
·
Coordinating completion of Request for Information Services (RIS) issues
between the BSM contractors (the PRIME and other contractors providing BSM
program services) and the Internal Revenue Service (IRS).
·
Developing and managing a process for non-PRIME projects to acquire the PRIME
contractor’s services.
·
Developing and managing a process for BSM contractor staff to gain access
to IRS information systems.
The following presents the possible elements for each of these activities:
Reviewing the accuracy of the IMS
The Release Scheduling Office, in coordination with
the Business Integration Program Control Office within the BSM Office, should
consider developing and publishing detailed guidance and assigning
responsibility for reviewing the accuracy of the IMS that includes:
·
Assessing the accuracy of the IMS and the release schedule information
received from the PRIME contractor, such as:
-
IRS project tasks.
-
Change requests.
-
Cross-project dependencies including RISs and memoranda of understanding.
-
Non-BSM project schedules.
-
Other non-PRIME modernization project schedules.
·
Time periods for the Release Scheduling Office and Business Integration
Program Control Office to perform IMS reviews.
·
A managerial approval process to assess the adequacy of the IMS review.
·
The IMS information used by BSM offices for assessing timelines,
slippages, and overall performance.
·
A process to verify that the IMS and release schedules agree with project
milestone completion dates. Steps need
to be developed to resolve any discrepancies or issues, and the process needs
to include procedures for escalating unresolved issues to executive
management.
·
A periodic report detailing the status of issues that need reconciliation
between the project status and the IMS status, along with a process to track
and monitor issues and discrepancies identified, to ensure the next IMS has the
corrected information.
Coordinating completion of RIS issues between the BSM contractors and the IRS
The Release Scheduling Office should consider
developing procedures that include:
·
A description of the Release Scheduling Office staff’s roles and
responsibilities in resolving differences in RIS requirements between the BSM
contractors and the IRS.
·
A process for documenting the actions taken by the Release Scheduling
Office to achieve resolution of differences in RIS requirements between the BSM
contractors and the IRS. The process
should include documentation to assess progress of the RIS resolution activity,
including:
-
RIS issue description.
-
IRS organizations involved in the issue.
-
Date the RIS issue was first considered by the Release Scheduling Office.
-
Date the Release Scheduling Office achieved resolution of the RIS issue.
-
If not resolved by the Release Scheduling Office, date the RIS issue was
submitted to the BSM executives.
-
Date the BSM executives achieved resolution of the RIS issue.
-
History of actions taken to achieve resolution of the RIS issue.
-
Date the RIS was placed on the IMS and verified by the Release Scheduling
Office.
-
Time period to achieve resolution of the RIS issue.
·
A managerial review to ensure RIS data accuracy.
·
Based on RIS data collected, a process to identify RIS issue trends to
determine if similar issues continue to arise.
·
A process for preparing biweekly RIS status reports for the BSM
executives’ meeting.
·
An outline for training Information Technology Services organization
staff on the Release Scheduling Office’s role in the RIS issue resolution
process.
Developing and managing a process for non-PRIME projects to acquire the PRIME contractor’s services
The Release Scheduling Office should consider:
·
Updating draft guidance for integrating non-PRIME project activities into
the modernized infrastructure to include:
-
References to specific guidance, law, or criteria relied upon in
performing non-PRIME project integration activities (e.g., providing input
about contract specifications for accessing the modernized infrastructure).
-
Detailed steps and templates for preparing proposed requisition and
specific contract actions (referred to as definitization) to use the modernized
infrastructure.
-
The process used to definitize task order proposal modifications.
-
The process and schedule for contract voucher reviews.
-
The steps to resolve significant issues arising in project development
before they need to be escalated to executive management.
-
A managerial approval process for the non-PRIME integration activities to
ensure the accuracy of the data and information being captured.
-
A process to track funding.
-
Any additional information templates/questionnaires/checklists to be
completed about projects.
-
Lessons learned from prior projects.
·
Updating the Office of Release Management web site to include information
about the processes for IRS business units to use in obtaining the PRIME
contractor’s services to integrate IRS information system development projects
into the modernized infrastructure. This
information should include the available PRIME contractor’s services,
information templates/questionnaires to be completed about the project, and
points of contact.
Developing and managing a process for BSM contractor staff to gain access to IRS information systems
The Release Scheduling Office
should consider developing guidance including:
·
A process to monitor BSM contractors with access to systems and their
need for continued access to the systems.
·
Certification of security/background investigation completion before
access is granted.
·
Verification that an IRS point of contact is listed.
·
A method to ensure managerial approval on the form is appropriate.
·
A process for tracking when the time period for the access has expired.
·
Steps to be followed, lessons learned, and points of contact to assist
Release Scheduling Office staff in obtaining access to IRS systems for
contractors and other non-IRS Federal Government employees.
The Integration Test and Deployment Office provided input about its testing role to the guidance document called the Systems Evaluation Process Description. Other items to consider include:
· A step to verify that a change request has been completed for all test deferrals to ensure tests have been rescheduled for later testing.
· A reference to standards or checklists for use in reviewing test waivers and deferrals.
· A requirement for conducting test folder reviews along with the references to any standards or checklists to be used in conducting the reviews.
· The specific steps to review requirements for testability.
· The lessons learned and best practices in assessing testing processes and procedures.
· The removal of requirements that the Integration Test and Deployment Office ensures disposition of deferrals and remaining product defects after testing is completed.
Appendix V
Enterprise Life
Cycle Overview
The
Enterprise Life Cycle (ELC) defines the processes, products, techniques, roles,
responsibilities, policies, procedures, and standards associated with planning,
executing, and managing business change.
It includes redesign of business processes; transformation of the
organization; and development, integration, deployment, and maintenance of the
related information technology applications and infrastructure. Its immediate focus is the Internal Revenue
Service (IRS) Business Systems Modernization (BSM) program. Both the IRS and the PRIME contractor must
follow the ELC in developing/acquiring business solutions for modernization
projects.
The
ELC framework is a flexible and adaptable structure within which one plans,
executes, and integrates business change.
The ELC process layer was created principally from the Computer Sciences
Corporation’s Catalyst®
methodology. It is intended to improve
the acquisition, use, and management of information technology within the IRS;
facilitate management of large-scale business change; and enhance the methods
of decision making and information sharing.
Other components and extensions were added as needed to meet the
specific needs of the IRS BSM program.
A
process is an ordered, interdependent set of activities established to
accomplish a specific purpose. Processes
help to define what work needs to be performed.
The ELC
methodology includes two major groups of processes:
·
Life-Cycle
Processes,
which are organized into phases and subphases and address all domains of
business change.
·
Management Processes, which are organized into
management areas and operate across the entire life cycle.
The chart was
removed due to its size. To see the
chart, please go to the Adobe PDF version of the report on the TIGTA Public Web
Page.
The life-cycle processes of the ELC are divided into
six phases, as described below:
·
Vision and Strategy - This phase establishes the
overall direction and priorities for business change for the enterprise. It also identifies and prioritizes the
business or system areas for further analysis.
·
Architecture - This phase establishes the
concept/vision, requirements, and design for a particular business area or
target system. It also defines the
releases for the business area or system.
·
Development - This phase includes the
analysis, design, acquisition, modification, construction, and testing of the
components of a business solution. This
phase also includes routine planned maintenance of applications.
·
Integration - This phase includes the
integration, testing, piloting, and acceptance of a release. In this phase, the integration team brings
together individual work packages of solution components developed or acquired
separately during the Development phase.
Application and technical infrastructure components are tested to
determine whether they interact properly.
If appropriate, the team conducts a pilot to ensure all elements of the business solution work
together.
·
Deployment - This phase includes
preparation of a release for deployment and actual deployment of the release to
the deployment sites. During this phase,
the deployment team puts the solution release into operation at target sites.
·
Operations and Support - This phase addresses the
ongoing operations and support of the system.
It begins after the business processes and system(s) have been installed
and have begun performing business functions.
It encompasses all of the operations and support processes necessary to
deliver the services associated with managing all or part of a computing
environment.
The Operations and Support phase includes the scheduled activities, such as planned maintenance, systems backup, and production output, as well as the nonscheduled activities, such as problem resolution and service request delivery, including emergency unplanned maintenance of applications. It also includes the support processes required to keep the system up and running at the contractually specified level.
Besides the life-cycle processes, the ELC also
addresses the various management areas at the process level. The management areas include:
·
IRS Governance and
Investment Decision Management - This area is responsible
for managing the overall direction of the IRS, determining where to invest, and
managing the investments over time.
·
Program Management and
Project Management - This area is responsible for organizing, planning,
directing, and controlling the activities within the program and its
subordinate projects to achieve the objectives of the program and deliver the
expected business results.
·
Architectural
Engineering/Development Coordination - This area is responsible for
managing the technical aspects of coordination across projects and disciplines,
such as managing interfaces, controlling architectural changes, ensuring
architectural compliance, maintaining standards, and resolving issues.
· Management Support Processes - This area includes common management processes, such as quality management and configuration management that operate across multiple levels of management.
The ELC establishes a set of repeatable processes and a system of milestones, checkpoints, and reviews that reduce the risks of system development, accelerate the delivery of business solutions, and ensure alignment with the overall business strategy. The ELC defines a series of milestones in the life-cycle processes. Milestones provide for “go/no-go” decision points in the project and are sometimes associated with funding approval to proceed. They occur at natural breaks in the process where there is new information regarding costs, benefits, and risks and where executive authority is necessary for next phase expenditures.
There are five milestones during the project life cycle:
·
Milestone 1 - Business
Vision and Case for Action.
In the activities leading up
to Milestone 1, executive leadership identifies the direction and priorities
for IRS business change. These guide
which business areas and system development projects are funded for further
analysis. The primary decision at
Milestone 1 is to select BSM projects based on both the enterprise-level Vision
and Strategy and the Enterprise Architecture.
·
Milestone 2 - Business Systems Concept and Preliminary Business Case. The activities leading up to Milestone 2
establish the project concept, including requirements and design elements, as a
solution for a specific business area or business system. A preliminary business case is also
produced. The primary decision at
Milestone 2 is to approve the solution/system concept and associated plans for
a modernization initiative and to authorize funding for that solution.
·
Milestone 3 - Business Systems
Design and Baseline Business Case. In the activities leading
up to Milestone 3, the major components of the business solution are analyzed
and designed. A baseline business case
is also produced. The primary decision
at Milestone 3 is to accept the logical system design and associated plans and
to authorize funding for development, test, and (if chosen) pilot of that
solution.
·
Milestone 4 - Business Systems
Development and Enterprise Deployment Decision.
In the activities leading up to Milestone 4,
the business solution is built. The
system is integrated with other business systems and tested, piloted (usually),
and prepared for deployment. The primary
decision at Milestone 4 is to authorize the release for enterprise-wide
deployment and commit the necessary resources.
·
Milestone 5 - Business Systems Deployment and Postdeployment Evaluation. In the activities leading up to Milestone 5,
the business solution is fully deployed, including delivery of training on use
and maintenance. The primary decision at
Milestone 5 is to authorize the release of performance-based compensation based
on actual, measured performance of the business system.
Appendix VI
Management’s
Response to the Draft Report
The response was removed due to its
size. To see the response, please go to
the Adobe PDF version of the report on the TIGTA Public Web Page.