TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

 

 

Lack of Proper IRS Oversight of the Department of the Treasury HSPD-12 Initiative Resulted in Misuse of Federal Government Resources

 

 

 

December 14, 2007

 

Reference Number:  2008-20-030

 

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

 Redaction Legend:

3(a) = Identifying Information - Name of an Individual or Individuals
3(d) = Identifying Information - Other Identifying Information of an Individual or Individuals

Phone Number   |  202-622-6500

Email Address   |  inquiries@tigta.treas.gov

Web Site           |  http://www.tigta.gov

 

December 14, 2007

 

 

MEMORANDUM FOR ACTING COMMISSIONER

 

FROM:                            Michael R. Phillips /s/ Michael R. Phillips

                                         Deputy Inspector General for Audit

 

SUBJECT:                    Final Audit Report – Lack of Proper IRS Oversight of the Department of the Treasury HSPD-12 Initiative Resulted in Misuse of Federal Government Resources (Audit # 200720034)

 

This report presents the results of our review to assess prior Homeland Security Presidential Directive-12 (HSPD-12)[1] program management activities and provide Internal Revenue Service (IRS) executives with an independent perspective to assist them in future implementation of the HSPD-12 program.[2]

This report presents the results of our second audit of HSPD-12.  The IRS has been designated as the lead bureau for ensuring the Department of the Treasury (the Treasury) complies with the Directive.  In our first review,[3] we reported that the IRS was at risk of wasting taxpayer funds because the Treasury was developing its own system for issuing the cards rather than joining other agencies that had already incurred much of the upfront costs associated with this effort.

Impact on the Taxpayer

The total estimated cost to build and maintain an HSPD-12 system for the Treasury is $421 million over 14 years.  As the lead bureau for the Treasury, the IRS is charged with ensuring the funds are spent prudently.  The IRS estimated it had obligated $30 million as of June 2007.  However, $3.5 million was spent on acquisitions that should have been avoided.  In addition, the IRS did not administer contracts effectively and could not provide documentation to support the actual costs charged to the HSPD-12 program.  Oversight of the program was hindered because the IRS, on advice from the Treasury, did not prepare a formal business case[4] for the program.  As a result, taxpayers could have little confidence their funds were being used effectively during the early stages of this initiative.

Synopsis

To implement HSPD-12, the IRS initially established an integrated project team to lead its efforts.  In September 2005, the IRS replaced the project team by formally establishing an HSPD-12 Program Management Office (PMO).  In January 2006, the IRS Commissioner volunteered the IRS to lead the Treasury HSPD-12 program efforts and to deliver a Departmentwide solution.  The Treasury agreed and, in March 2006, the IRS assumed leadership of the Treasury HSPD-12 PMO.

The integrated project team, and later the PMO, did not effectively manage the contracts for the HSPD-12 program.  Statements of work were too general to hold contractors accountable for work performed, and the IRS paid contractors without verifying work was performed.  The IRS could not provide supporting documentation for the actual costs spent on the program, and we found that at least $3.5 million was spent on unneeded hardware, software, and services.  The following specific costs could have been avoided:

·         $1,940,397 spent to purchase 350,000 Public Key Infrastructure[5] certificates in March and September 2005.

·         $837,616 spent to purchase 18 Public Key Infrastructure servers in September 2005 that were never used for the program.

·         $431,035 spent to establish an identification badge laboratory to create a test environment for issuing HSPD-12 identification badges.

·         $91,618 spent to reimburse the General Services Administration for preparing a Request for Procurement for acquiring another contractor’s services.

·         $188,160 paid to a contractor for 1 person to perform clerical duties over an 11-month period.

In addition, the IRS did not follow its established governance procedures for overseeing the HSPD-12 program because it did not prepare a formal business case for the program.  An internal business case was prepared by the PMO, but it did not comply with the IRS’ business case requirements and it was never provided to the Treasury HSPD-12 governance committees overseeing the program.  In addition, ****3(d)****

Many of the problems experienced by the HSPD-12 program are similar to those we have reported previously in the IRS Business Systems Modernization program.  In our Fiscal Year 2007 annual assessment of the Business Systems Modernization program,[6] we cited four specific challenges the IRS needs to overcome to deliver a successful modernization effort.  Three of these challenges (improving key management processes, managing the increasing complexity and risks of the Modernization program, and ensuring contractor performance and accountability are effectively managed) are related to the issues we identified in this review, indicating a need for the IRS to address these same challenges on information technology projects outside the Business Systems Modernization program.

Recommendations

We recommended the Chief, Agency-Wide Shared Services, require that future task orders prepared by the HSPD-12 PMO separate tasks by function to enable the IRS to better monitor contractor performance, ensure Contracting Officer’s Technical Representatives comply with procedures that require sufficient supporting documentation for hours worked and require the HSPD-12 Program Manager to provide written certification for labor hours worked on contracts before any payments are made to contractors, and ensure the Program Manager maintains documentation sufficient to support all HSPD-12 program costs and assigns costs to specific task orders.  We also recommended the Chief Information Officer coordinate with the Treasury to evaluate the possibility of combining its Public Key Infrastructure efforts with those of the General Services Administration and ensure executive steering committees responsible for providing oversight to information technology projects enforce use of IRS Enterprise Life Cycle requirements.[7]

Response

IRS management agreed with our recommendations.  The IRS has taken several steps to improve the management of the HSPD-12 PMO, including initiating a process to separate tasks by functional area to better monitor contractor performance; ensuring the Contracting Officer’s Technical Representatives are in compliance with existing IRS procedures for reviewing invoices before payments are made to contractors; and assigning planned costs, including labor hours, to project tasks to support all HSPD-12 program costs.  The IRS will coordinate with the Treasury to evaluate the possibility of combining Public Key Infrastructure efforts with those of the General Services Administration.  In addition, the IRS will strengthen the responsibilities of the executive steering committees and ensure project reporting templates, used by projects at the assigned governance board, are updated to reflect project status and compliance with the Enterprise Life Cycle.  Management’s complete response to the draft report is included as Appendix VII.

Copies of this report are also being sent to the IRS managers affected by the report recommendations.  Please contact me at (202) 622-6510 if you have questions or Margaret E. Begg, Assistant Inspector General for Audit (Information Systems Programs), at (202) 622-8510.

 

 Table of Contents

 

Background

Results of Review

The Program Management Office Did Not Adequately Safeguard the Financial Interests of the Federal Government

Recommendations 1 through 4:

The Internal Revenue Service Governance Process Over the HSPD-12 Program Was Ineffective

Recommendation 5:

Appendices

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Outcome Measure

Appendix V – Enterprise Life Cycle Overview

Appendix VI – Participants Involved in Oversight of the Department of the Treasury HSPD-12 Initiative

Appendix VII – Management’s Response to the Draft Report

 

 Abbreviations

 

GSA

General Services Administration

HSPD-12

Homeland Security Presidential Directive-12

IRS

Internal Revenue Service

PKI

Public Key Infrastructure

PMO

Program Management Office

  

Background

 

On August 27, 2004, President Bush signed Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors.  This Directive established a new standard for issuing and processing Federal Government identification badges for entering Federal Government facilities and accessing computer systems.  The Office of Management and Budget, which is responsible for overseeing implementation of the Directive, established the following deadlines for Federal Government agencies:

To implement HSPD-12, the Internal Revenue Service (IRS) initially established an integrated project team to lead its efforts.  However, the leadership and responsibilities of the program have changed significantly over the past 3 fiscal years.  Figure 1 provides a historical perspective on the designation of HSPD-12 program[8] management oversight responsibilities.

Figure 1:  Timeline of the HSPD-12 Program Management Office (PMO)

First Quarter of Fiscal Year 2005

The IRS established an integrated project team to lead the HSPD-12 project.  The Modernization and Information Technology Services organization managed the project during this period.

September 2005

The IRS established the HSPD-12 PMO and designated the Mission Assurance and Security Services organization to assume sole leadership of the program efforts.

January 2006

The IRS Commissioner volunteered the IRS to lead the Department of the Treasury (the Treasury) HSPD-12 program efforts and to deliver a Departmentwide solution.

March 2006

The Treasury designated the IRS to assume leadership of its HSPD-12 initiative.

March 2006

The Treasury HSPD-12 Executive Steering Committee was established to provide executive-level oversight and support of HSPD-12 implementation across the entire Department.

May 2006

The Treasury Bureau Advisory Board was created to serve as the primary coordination body for the Treasury and its bureaus on matters related to
HSPD-12 planning and implementation. 

May 2007

The IRS replaced the Program Manager and designated the Agency-Wide Shared Services organization as the lead organization for the Treasury
HSPD-12 initiative.

Source: Interviews with IRS officials.

The PMO must complete a significant amount of work to comply with the Directive and obtain identification cards for approximately 150,000 employees who work in the Treasury.  The PMO is led by a Program Manager and the scope of its work includes:

Our first audit of HSPD-12[9] determined the PMO was experiencing delays in meeting the Office of Management and Budget milestones.  The PMO was planning to produce its own identification cards instead of taking advantage of the General Service Administration’s (GSA) shared services provider, which was being offered to all Federal Government agencies at a low cost due to the economies of scale.  Despite assigning 68 employees to the Treasury HSPD-12 effort, the PMO had not yet purchased the hardware and software necessary to produce the identification cards and did not expect to complete the program until September 2010, 2 years after the Office of Management and Budget’s mandated deadline.  We recommended the IRS consider the benefits of using the GSA shared services provider, coordinate with the GSA to resolve concerns, and customize the GSA solution to meet the Treasury’s needs.  The IRS agreed with our recommendation and now intends to use the GSA shared services provider to the fullest extent possible.

We conducted this followup review to assess prior HSPD-12 program management activities and provide IRS executives with an independent perspective to assist them in future implementation of the program.  This review was performed at the IRS National Headquarters in New Carrollton, Maryland, in the Agency-Wide Shared Services organization during the period June through September 2007; it focused on activities occurring from the beginning of the program through May 2007.  We conducted this performance audit in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective.  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.  Detailed information on our audit objective, scope, and methodology is presented in Appendix I.  Major contributors to the report are listed in Appendix II.

 

Results of Review

 

The Program Management Office Did Not Adequately Safeguard the Financial Interests of the Federal Government

The total estimated cost to build and maintain an HSPD-12 system for the Treasury is $421 million over 14 years.  The IRS advised us that, as of June 2007, it had obligated approximately $30 million.  However, the IRS spent at least $3.5 million of these funds on acquisitions that should have been avoided.  In addition, it did not administer contracts effectively and could not provide documentation to support planned or actual costs attributable to the HSPD-12 program.

HSPD-12 program funds were used to purchase unneeded hardware, software, and services

The IRS HSPD-12 integrated project team made several unnecessary purchases in Fiscal Year 2005.  The following costs could have been avoided.

Both the GSA and the Treasury have been developing separate PKI strategies.  During our last review, the Program Manager stated that the need for the HSPD-12 program to comply with the Treasury PKI strategy was one of the reasons the IRS did not consider earlier use of the GSA shared services provider for the purchase of identification cards.  To ensure consistency throughout the Federal Government and reduce the duplication of effort in providing an effective PKI solution, we believe the Treasury should coordinate with the GSA and possibly other agencies to determine the feasibility of developing one PKI solution Governmentwide.  The GSA has recently endorsed the vendor used by the Treasury, which could make the transition easier than in prior years.

The Treasury HSPD-12 PMO also spent $710,813 that could have been avoided.  These expenditures included:

We attribute these unnecessary purchases to ineffective program management.  The PMO did not follow the IRS Enterprise Life Cycle and did not carry out its fiduciary responsibilities when making decisions to purchase hardware and software.  A key official from the Modernization and Information Technology Services organization informed us the IRS had worked hard to obtain funding ($15 million) for Fiscal Year 2005 and believed the IRS needed to spend the funds by the end of the fiscal year.  We reviewed procurement documentation and found approximately 90 percent of the program’s Fiscal Year 2005 budget was obligated to contractors during the last 2 months of Fiscal Year 2005.  We consider these purchases to be an inefficient use of resources.

Statements of work were incomplete, and the IRS paid contractors without verifying work was performed

According to the Federal Acquisition Regulation,[12] the Contracting Officer is responsible for ensuring performance of all necessary actions for effective contracting and ensuring compliance with the contract.  In addition, the Contracting Officer is to ensure the contractor(s) receives impartial, fair, and equitable treatment and request and consider the advice of specialists when appropriate.  The Contracting Officer’s Technical Representative is charged with (1) developing the specifications on each statement of work in such a manner as to promote competitive procurement actions and (2) monitoring the contractor’s technical performance to ensure the performance is strictly within the scope of the contract.  Statements of work should clearly define the scope of the work requested and list specific deliverables describing what is due and when it is due.  Additional duties include coordinating with the project’s program manager on issues related to funding and to changes in the scope of the work.

The PMO hired three contractors to assist in planning, developing, and implementing the requirements of the HSPD-12 program.  Each contractor was assigned responsibilities to meet program goals.  Specifically:

·         Booz Allen Hamilton was hired to address stakeholder management, communications, and program support.

·         MITRE was hired to coordinate the program management and business process engineering.

·         Presidio was hired to conduct the technical support work for implementation.

A separate Contracting Officer’s Technical Representative was assigned to each contract.  Statements of work for the MITRE contract were adequate; however, those for the other two contracts were not well defined.

To set aside or obligate funds for the three contracts, the IRS issued task orders to the contractors.  Task orders were issued to both Presidio and MITRE specifically for work on the HSPD-12 program.  However, the PMO used existing IRS contracts with Booz Allen Hamilton to perform work related to the program.  Instead of issuing a separate task order along with a statement of work to Booz Allen Hamilton, the PMO charged the HSPD-12 work to existing task orders that included many other assignments.  The HSPD-12 tasks included in the statements of work were not specific enough to identify the deliverables and were too general to track the program’s work requirements effectively.  For example, in one of the statements of work issued with a Booz Allen Hamilton task order, the subtask read, “. . . the Contractor shall support and assist the Treasury/IRS Program Management Office (PMO) in the implementation and maintenance of the IRS HSPD-12 program and related identity management project . . .”  The PMO paid Booz Allen Hamilton about $2.9 million dollars on these task orders.  An obligation of this magnitude should have its own task order and related statement of work with clearly defined deliverables.

We also identified weaknesses with the process used to pay contractors.  When a contractor provides an invoice to the IRS, prior to approving payment, the Contracting Officer’s Technical Representative is required to obtain sufficient supporting documentation from the contractor and a certification from the Program Manager that the work was performed.  ****3(d)****

****3(d)****  No written statements were obtained from the PMO stating the hours charged were appropriate for the tasks performed before payments were made.

At the time the statements of work were prepared, the HSPD-12 initiative was new and the IRS did not have knowledge of the specific technological requirements.  We believe this lack of technical knowledge contributed to the lack of specificity in the statements of work prepared by the Contracting Officer’s Technical Representatives.  ****3(d)****  Thus, the Federal Government has no assurance it received what it paid for, and additional funds could have been wasted.  The lack of specificity in the statements of work could have also contributed to delays in developing the program.

The PMO did not maintain documentation to support program costs and did not assign costs to planned tasks

The PMO should maintain adequate documentation to support program costs.  Through June 2007, the PMO had obligated $30 million.  Documentation was maintained to support approximately $15 million spent in Fiscal Year 2005.  Since then, adequate documentation has not been kept to support the remainder of the obligations.  Due to poor accounting controls, the PMO could not readily provide the amount spent on the MITRE and Presidio contracts without totaling the invoices.  Invoices from Booz Allen Hamilton were not available.

In an attempt to support the costs, we analyzed the invoices from MITRE and Presidio and requested that Booz Allen Hamilton provide copies of its invoices.  Booz Allen Hamilton supplied invoice numbers and amounts charged without providing the entire invoices.  Through that effort and with the documentation provided for the Fiscal Year 2005 costs, we have been able to locate support for approximately $21.6 million in expenditures.  We are continuing our efforts to determine the validity of the remainder of the program costs and obligations.  Without effective documentation to support costs, the PMO and oversight committees cannot ensure funds have been spent appropriately.

In addition, the program’s work breakdown structure did not include planned costs and resources needed to complete the program’s milestones and deliverables.  Preparing a work breakdown structure is a basic management technique for defining and organizing the total scope of a program and reporting progress.  It should identify what should be done, who will do it, how long it will take, and how much the program will cost.  The work breakdown structure should facilitate tracking of the program’s deliverables, milestones, and costs.

The Program Manager stated that costs were not assigned to specific tasks in the work breakdown structure due to poor contractor performance.  However, the work breakdown structure is ultimately the responsibility of the Program Manager.  Considering 68 employees and contractors were assigned to the PMO, we believe the PMO had sufficient staff with which to prepare and maintain a work breakdown structure that aligned planned costs and resources with the program’s milestones and deliverables.  By not assigning planned costs and resources to specific tasks, the Program Manager could not identify costly tasks that may be avoided and could not plan for staffing needs as the program progressed.

****3(d)****  Employees and contractors were not given sufficient direction and emphasis to carry out these responsibilities.

Recommendations

The Chief, Agency Wide-Shared Services, should:

Recommendation 1:  Require that future task orders prepared by the HSPD-12 PMO clearly separate tasks by function.  Doing so will help each contractor understand the tasks and propose its solution and will enable the IRS to monitor the contractor’s performance.

Management’s Response:  IRS management agreed with this recommendation.  The HSPD-12 PMO has initiated a process to establish clear delineation of tasks by functional area.

Recommendation 2:  Ensure Contracting Officer’s Technical Representatives comply with procedures that require sufficient supporting documentation for hours worked.  The HSPD-12 Program Manager should also be required to provide written certification for labor hours worked on contracts before any payments are made to contractors.

Management’s Response:  IRS management agreed with this recommendation.  The HSPD-12 project manager has implemented a process that will ensure the PMO and the Contracting Officer’s Technical Representatives are in compliance with existing IRS procedures for reviewing invoices prior to making payments to contractors.

Recommendation 3:  Ensure the HSPD-12 Program Manager maintains documentation sufficient to support all program costs and assigns costs to specific tasks in the work breakdown structure.

Management’s Response:  IRS management agreed with this recommendation.  The HSPD-12 PMO is now assigning planned costs, including labor hours, to project tasks.  The IRS will use software to track hours for Federal Government and contractor employees for projected earned value and schedule analysis.

The Chief Information Officer should:

Recommendation 4:  Coordinate with the Treasury to evaluate the possibility of combining its PKI efforts with those of the GSA.  Progress may be made for ensuring a consistent PKI approach throughout the Federal Government, and the duplication of effort could be reduced by taking advantage of the lessons learned from both efforts.

Management’s Response:  IRS management agreed with this recommendation.  The IRS will coordinate with the Treasury to evaluate the possibility of combining PKI efforts with those of the GSA.  The IRS is using the GSA-provided certificates for the HSPD-12 compliant Personal Identification Verification cards to be used by new and existing employees and contractors.

The Internal Revenue Service Governance Process Over the HSPD-12 Program Was Ineffective

The IRS requires executive steering committees to oversee major information technology projects.  The committees are comprised of key executives from organizations involved in the projects.  In March 2006, the Treasury HSPD-12 Executive Steering Committee was established to provide oversight and to support the Directive’s implementation across the Department and all its bureaus.  Because the HSPD-12 program involved all Treasury bureaus, a Bureau Advisory Board also was formed to serve as the primary coordination body for the Treasury and its bureaus on matters related to planning and implementation.  A list of participants for the Committee and Board is included in Appendix VI.

An information technology investment portfolio and a business case are required by the IRS Enterprise Life Cycle to assist governance committees in their monitoring of a program’s activities and progress.  However, these techniques were not effective in administering the HSPD-12 program.  ****3(d)****

Management over the HSPD-12 investment portfolio and business case was inadequate

The Clinger-Cohen Act of 1996[13] requires Federal Government agencies to improve the way they acquire and manage their information technology investments.  Agencies are required to put their technology investment decisions in a true business context and analyze investments for their return on investment.  The Office of Management and Budget published Circular A-11, Preparation, Submission and Execution of the Budget, to assist Federal Government agencies in complying with the Clinger-Cohen Act.  Specifically, Circular A-11, Section 300, Planning, Budgeting, Acquisition, and Management of Capital Assets, requires agencies to prepare and submit a business case for all major information technology investments.  The business case illuminates and clarifies details such as viable alternatives, budget and schedule performance variances, investment costs, and the reliability of the information, all of which are critical for accurate decision making.  Analysis of business cases helps instill discipline and rigor into an agency’s investment decision-making process.  In a prior report,[14] we noted the IRS used the business cases only to support funding requests.  We reported little effort had been given to using the business cases for decision making and for monitoring progress of information technology investments.

IRS procedures require preparation of a separate business case for any major information technology investment that:

The HSPD-12 program meets all of the above criteria; however, the PMO did not submit a separate business case for the program to the Bureau Advisory Board and the HSPD-12 Executive Steering Committee.  Information pertaining to the program was consolidated into another business case for Treasurywide infrastructure costs; therefore, the information could not be used by the HSPD-12 governance committees in making business decisions for the program.  The decision to consolidate the HSPD-12 business case into a Treasurywide security infrastructure business case was based on guidance received from the Treasury Capital Planning and Investment Control Office.  This decision is clearly in conflict with the stated requirement for preparation of a business case.

An internal business case for the program was prepared and submitted in October 2006 by the PMO but was never shared with the governance committees overseeing the program.  In addition, the internal business case did not include the information normally required by the Office of Management and Budget and the IRS.  Specifically:

The lack of information and analysis in the business case contributed to the Treasury continuing its costly implementation strategy.  An accurate, fully developed business case and regular analysis of variances between actual and budgeted costs and schedule would have provided IRS and Treasury executives with substantive information that could have prompted them to scale back the program at an earlier date and to minimize the costs incurred by the PMO.

****3(d)****  We also noted the HSPD-12 Executive Steering Committee did not request to see the internal business case.  Consequently, the business case was not subjected to the discipline and scrutiny normally required for an expensive information technology investment.  We were advised that the IRS is in the process of updating and improving the internal business case.  Thus, we have no recommendations at this time.

****3(d)****

On November 20, 2006, the Program Manager informed the HSPD-12 Executive Steering Committee that the Office of Management and Budget had approved the Treasury’s strategy for implementing the Directive.  T****3(d)****  On March 19, 2007, the Executive Steering Committee chairperson correctly apprised the Committee that the Office of Management and Budget had not approved the Treasury’s strategy.

****3(d)**** we had briefed the Program Manager on February 15, 2007, with the following recommendation:

To reduce costs and to improve the likelihood of meeting [the] OMB’s [Office of Management and Budget] milestones for developing identification cards compliant with HSPD-12 requirements, we recommend the Chief, Mission Assurance and Security Services, consider discontinuing the IRS pilot and contract with the GSA for developing identification cards.

If the PMO had provided accurate information to the governance committees, it is more likely that costs would have been minimized and funds could have been put to better use.  The Program Manager attributed the error to a misunderstanding.

Some of the unnecessary purchases and inappropriate decisions made by the HSPD-12 PMO could have been avoided if the PMO had followed the IRS Enterprise Life Cycle.  We believe stronger oversight by the HSPD-12 Executive Steering Committee was needed to ensure compliance with the Enterprise Life Cycle.

We also noted that many of the problems experienced by the HSPD-12 program are similar to those we have reported previously in the IRS Business Systems Modernization program.  In our Fiscal Year 2007 annual assessment of the Business Systems Modernization program,[16] we cited four specific challenges the IRS needs to overcome to deliver a successful modernization effort.  Three of these challenges are related to the issues presented above, indicating a need for the IRS to address these same challenges on information technology projects outside the Business Systems Modernization program.  These challenges include the need for the IRS to:

·         Implement planned improvements in key management processes and commit necessary resources to succeed.

·         Manage the increasing complexity and risks of the modernization program.

·         Ensure contractor performance and accountability are effectively managed.

Recommendation

Recommendation 5:  The Chief Information Officer should ensure executive steering committees responsible for providing oversight to information technology projects take an active role to address these challenges and, specifically, to enforce use of the IRS Enterprise Life Cycle requirements.

Management’s Response:  IRS management agreed with this recommendation.  The IRS will continue to implement planned improvements in key management processes through the continued rollout of program management initiatives.  To enforce the use of the Enterprise Life Cycle, the IRS will ensure project reporting templates, used by projects at the assigned governance board, are updated to reflect project status and compliance with the Enterprise Life Cycle.  In addition, the IRS Program Governance office will update executive steering committee charters to strengthen the committees’ responsibilities.

 

Appendix I

 

Detailed Objective, Scope, and Methodology

 

The overall objective of this review was to assess prior HSPD-12 program management activities and provide IRS executives with an independent perspective to assist them in future implementation of the program.  To accomplish this objective, we:

I.                   Identified and reviewed the requirements of HSPD-12 from the detailed guidance established by Office of Management and Budget Memorandum 05-24, Implementation of Homeland Security Presidential Directive–12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors (August 2005), and Federal Information Processing Standard 201, Personal Identity Verification (PIV) of Federal Employees and Contractors (February 2005).

II.                Evaluated the governance process over the HSPD-12 program to determine whether the funding decision was warranted and whether the executive steering committees provided adequate oversight.

A.    Reviewed the meeting minutes from the governance committees (the HSPD-12 Executive Steering Committee, Treasury Bureau Advisory Board, and Security and Privacy Executive Steering Committee) that were overseeing the program.

B.     Reviewed key program documents provided to the governance committees and verified the accuracy and completeness of the documentation.

C.     Determined whether procedures were followed in the approval of the program.

D.    Evaluated the decision to move responsibility for the program from the Modernization and Information Technology Services organization to the Mission Assurance and Security Services organization in September 2005.

E.     Reviewed the most current business case for the program.

III.             Determined whether the HSPD-12 PMO planned and carried out program tasks effectively.

A.    Reviewed the requirements matrix to determine whether key requirements in Federal Information Processing Standard 201 were identified.

B.     Reviewed the work breakdown structure[17] for the program.

C.     Determined whether staffing levels were appropriate for the work scheduled and performed and whether the program followed the IRS Enterprise Life Cycle[18] methodology.

D.    Determined whether the program met scheduled and budgeted goals and the experience and qualifications of employees in the PMO.

IV.             Determined whether the contracts used to deliver the HSPD-12 business solution were appropriate.

A.    Determined whether the appropriate types of contracts were used for the program.

B.     Evaluated the terms of the contracts, including the statements of work, task orders, and program deliverables such as status reports, and determined how much has been and is obligated to be paid to the contractors.

V.                Evaluated the process used by the HSPD-12 PMO to review and accept contract deliverables.

A.    Determined whether the PMO released funds based on accepted deliverables or based on hours worked.

B.     Interviewed the Contracting Officer’s Technical Representatives and identified their process for monitoring the contractors to ensure the contractors’ work meets the contracts’ terms and requirements.

VI.             Determined the total amount of funds possibly misspent on the HSPD-12 program.  The total funds should include all IRS and contractor labor costs and all hardware and software costs.

A.    Determined the total amount expended, committed, and obligated.

B.     Evaluated the timing of the PMO’s decision to scale back the program by adopting the GSA shared services provider.

C.     Compared the deliverables and work completed to the amounts spent and determined the amounts misspent.  We considered the possibility that the decision to forgo use of the GSA shared services provider may not have been the only area of mismanagement.[19]

 

Appendix II

 

Major Contributors to This Report

 

Margaret E. Begg, Assistant Inspector General for Audit (Information Systems Programs)

Stephen R. Mullins, Director

Thomas Polsfoot, Audit Manager

William A. Gray, Senior Auditor

Louis Lee, Senior Auditor

Thomas Nacinovich, Senior Auditor

Glenn Rhoades, Senior Auditor

Stasha Smith, Senior Auditor

 

Appendix III

 

Report Distribution List

 

Office of the Commissioner – Attn:  Acting Chief of Staff  C

Deputy Commissioner for Operations Support  OS

Chief, Agency-Wide Shared Services  OS:A

Chief Information Officer  OS:CIO

Chief Counsel  CC

National Taxpayer Advocate  TA

Director, Office of Legislative Affairs  CL:LA

Director, Office of Program Evaluation and Risk Analysis  RAS:O

Office of Internal Control  OS:CFO:CPIC:IC

Audit Liaisons:

Chief, Agency-Wide Shared Services  OS:A

Chief Information Officer  OS:CIO

 

Appendix IV

 

Outcome Measure

 

This appendix presents detailed information on the measurable impact that our recommended corrective actions will have on tax administration.  This benefit will be incorporated into our Semiannual Report to Congress.

Type and Value of Outcome Measure:

·         Inefficient Use of Resources – Actual; $3.5 million (see page 4).

Methodology Used to Measure the Reported Benefit:

The outcome measure is reported using actual contract amounts and support for arriving at the amounts listed.  The PMO made unnecessary purchases totaling approximately $3.5 million.  The following costs could have been avoided.

 

Appendix V

 

Enterprise Life Cycle Overview

 

The Enterprise Life Cycle defines the processes, products, techniques, roles, responsibilities, policies, procedures, and standards associated with planning, executing, and managing business change.  It includes redesign of business processes; transformation of the organization; and development, integration, deployment, and maintenance of the related information technology applications and infrastructure.  Its immediate focus is the IRS Business Systems Modernization program.  Both the IRS and its contractors must follow the Enterprise Life Cycle in developing/acquiring business solutions for modernization projects.

Life-Cycle Processes

The life-cycle processes of the Enterprise Life Cycle are divided into the following six phases:

The Operations and Support phase includes the scheduled activities (e.g., planned maintenance, systems backup, and production output) as well as the nonscheduled activities (e.g., problem resolution and service request delivery, including emergency unplanned maintenance of applications).  It also includes the support processes required to keep the system up and running at the contractually specified level.

Management Processes

In addition to the life-cycle processes, the Enterprise Life Cycle addresses the various management areas at the process level.  The management areas include:

Milestones

The Enterprise Life Cycle establishes a set of repeatable processes and a system of milestones, checkpoints, and reviews that reduce the risks of system development, accelerate the delivery of business solutions, and ensure alignment with the overall business strategy.  The Enterprise Life Cycle defines a series of milestones in the life-cycle processes.  Milestones provide for “go/no-go” decision points in the project and are sometimes associated with funding approval to proceed.  They occur at natural breaks in the process where there is new information regarding costs, benefits, and risks and where executive authority is necessary for next-phase expenditures.

There are five milestones during the project life cycle:

 

Appendix VI

 

Participants Involved in Oversight of the Department of the Treasury HSPD-12 Initiative

 

Department of the Treasury HSPD-12 Executive Steering Committee

John Dalrymple, IRS, Chairman ****3(d)****

Linda Stiff, Chairman, IRS (Replaced Mr. Dalrymple)

Bill Baity, Financial Crimes Enforcement Network

Larry Felix, Bureau of Engraving and Printing

Ira Hobbs, Department of the Treasury ****3(d)****

John Manfreda, Alcohol and Tobacco Tax and Trade Bureau

Ken Papaj, Financial Management Service

Mike Parker, Department of the Treasury

Van Zeck, Bureau of the Public Debt

Department of the Treasury HSPD-12 Bureau Advisory Board

Voting Members

Jim Dumais, IRS, Co-Chairman

John Kopec, Financial Management Service, Co-Chairman

Roger Adams, Bureau of the Public Debt

Ron Bell, Department of the Treasury, Departmental Offices

Pat Berbakos, Office of Thrift Supervision

Emile Beshai, Financial Crimes Enforcement Network

Bruce Crouch, Bureau of Engraving and Printing

Theresa Glasscock, Alcohol and Tobacco Tax and Trade Bureau

Tony Hunter, Financial Crimes Enforcement Network

Phil Perry, Department of the Treasury, Departmental Offices

Damon Plummer, Treasury Inspector General for Tax Administration

Fred Pyatt, Bureau of the Public Debt

Ron Sheiden, Office of the Comptroller of the Currency

Adam Silverman, Treasury Office of Inspector General

Rene Smeraglia, United States Mint

Nonvoting Members/Stakeholders

****3(a)**** IBM Corporation

****3(a)**** MITRE

****3(a)**** IRS

****3(a)**** IRS

****3(a)**** IRS

****3(a)**** Booz Allen Hamilton

****3(a)**** IRS

****3(a)**** Booz Allen Hamilton

****3(a)**** (Federally Funded Research and Development Center)

****3(a)**** Booz Allen Hamilton

****3(a)**** IRS

****3(a)**** IRS

****3(a)**** IRS

 

Appendix VII

 

Management’s Response to the Draft Report

 

The response was removed due to its size.  To see the response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.



[1] Policy for a Common Identification Standard for Federal Employees and Contractors (signed by President Bush on August 27, 2004).  This Directive requires all Federal Government agencies to meet standards for issuing identification badges that will be used for entering Federal Government facilities and accessing computer systems.

[2] Also referred to as “the program” in this report.

[3] Progress Has Been Slow in Meeting Homeland Security Presidential Directive-12 Requirements (Reference Number 2007-20-110, dated June 20, 2007).

[4] The IRS uses a business case as the primary tool for capital planning and investment control.  The business case provides a standard format for reporting key details about the investment.

[5] Public Key Infrastructure is an encryption system of digital certificates from authorities that verify and authenticate the validity of each party involved in an electronic transaction.

[6] Annual Assessment of the Business Systems Modernization Program (Reference Number 2007-20-121, dated August 24, 2007).

[7] See Appendix V for an overview of the Enterprise Life Cycle.

[8] Also referred to as “the program” in this report.

[9] Progress Has Been Slow in Meeting Homeland Security Presidential Directive-12 Requirements (Reference Number 2007-20-110, dated June 20, 2007).

[10] PKI is an encryption system of digital certificates and other authorities that verify and authenticate the validity of each party involved in an electronic transaction.

[11] The Enterprise Life Cycle establishes a set of repeatable processes and a system of reviews, checkpoints, and milestones that reduce the risks of system development and ensures alignment with the overall business strategy.  All IRS personnel and contractors involved in information technology efforts are required to follow the Enterprise Life Cycle.  See Appendix V for additional details.

[12] 48 C.F.R. ch. 1 (2006).

[13] (Federal Acquisition Reform Act of 1996) (Information Technology Management Reform Act of 1996), Pub. L. No. 104-106, 110 Stat. 642 (codified in scattered sections of 5 U.S.C., 5 U.S.C. app., 10 U.S.C., 15 U.S.C., 16 U.S.C., 18 U.S.C., 22 U.S.C., 28 U.S.C., 29 U.S.C., 31 U.S.C., 38 U.S.C., 40 U.S.C., 41 U.S.C., 42 U.S.C., 44 U.S.C., 49 U.S.C., 50 U.S.C.).

[14] Business Cases for Information Technology Projects Need Improvement (Reference Number 2005-20-074, dated April 2005).

[15] President Bush signed the E-Government Act (H.R. 2458/S. 803) on December 17, 2002, to make it easier for citizens and businesses to access Federal Government information, consolidate redundant computer systems, increase productivity, and save money.

[16] Annual Assessment of the Business Systems Modernization Program (Reference Number 2007-20-121, dated August 24, 2007).

[17] The work breakdown structure should identify what should be done, who will do it, how long it will take, and how much a program will cost.  It should facilitate tracking of the program’s deliverables, milestones, and costs.

[18] See Appendix V for an overview of the Enterprise Life Cycle.

[19] As identified in our prior report Progress Has Been Slow in Meeting Homeland Security Presidential Directive-12 Requirements (Reference Number 2007-20-110, dated June 20, 2007).

[20] PKI is an encryption system of digital certificates and other authorities that verify and authenticate the validity of each party involved in an electronic transaction.

[21] The Enterprise Life Cycle is a proven set of best practices that enhance the chances for successfully managing change in IRS business processes and systems.  See Appendix V for additional details.