Information Technology: Immigration and Customs Enforcement Needs to Fully Address Significant Infrastructure Modernization Program Management Weaknesses

In May 2007, ICE renewed the Atlas program's independent verification and validation (IV&V) contract, and in doing so, included a contract requirement that prohibited the the contractor from soliciting, proposing, or being awarded Atlas program work other than IV&V services. Specifically, the contract, which was signed on May 24, 2007, states that the contractor is prohibited from bidding, soliciting, proposing, or being awarded non-IV&V Atlas work.

ICE has taken multiple actions to improve its adherence to requirements development and management practices that are consistent with our recommendation. For example, ICE developed a process improvement plan that included, among other things, a goal of establishing requirements definition and validation processes that align with DHS/ICE policy and reported on agency progress in meeting these goals. In addition, ICE reported that it had assigned its project managers responsibility for rigorously adhering to the agency's System Lifecycle Handbook (SLH) requirements and holds the managers accountable by having periodic milestone reviews which are conducted by SLH subject matter experts. These experts assess Atlas projects against agency guidance and report the results (via a project management report system) to the ICE CIO, who uses this information in conducting monthly program management reviews.

Consistent with this recommendation, ICE has taken the following steps. First, it assigned a full-time contracting officer's technical representative (COTR) to the Atlas program, and it revised the Atlas Acquisition Plan to define the contract management and oversight roles and responsibilities of the COTR, contracting officer, and the Atlas program manager. The revised plan also includes the acquisition strategy and major milestones for each Atlas project. Second, in June 2007, ICE updated its System Lifecycle Handbook to incorporate key contract management and oversight activities. Specifically, the handbook now identifies the specific activities and steps that are to be followed and accompanying documentation that is to be submitted to ICE's Office of Acquisition for review. The update also required (1) the Atlas program manager to work with the COTR to ensure that contract management and oversight activities meet the requirements specified in the ICE handbook and (2) the COTR to conduct periodic reviews of contractor performance vis-a-vis the contract statement of work. Third, ICE issued a template in February 2007 that required statements of work for Atlas projects to include clearly defined requirements, deliverables, and related acceptance criteria. The template includes examples of how these requirements are to be met. Our analysis of a statement of work for one Atlas project (Common Computing Environment) that used this template showed that it contained detailed requirements for a variety of support activities, such as technical architecture planning, project management and coordination, and budget and financial analysis. It also defined specific deliverables and associated acceptance criteria.

Consistent with our recommendation, ICE recently updated its risk inventory to include risks for all Atlas projects. According to the inventory, risks extend to availability of funding, cost, schedule, and system reliability. In addition, in April 2007, ICE updated the Atlas program's risk management plan to include detailed processes for, among other things, reporting to management on the existence and status of risks and progress in implementing mitigation strategies. For example, the plan states that high risks are now to be disclosed and discussed at quarterly Program Management Review meetings. During program management review meetings that we attended (coupled with review of related documentation), high risks, including the status of mitigation efforts, were in fact disclosed to and discussed by management, including the Atlas program manager and ICE's Chief Information Officer.

ICE has taken several actions to improve program performance management that are consistent with the intent of our recommendation. In addition to developing goals for the two projects that were the basis for this recommendation, the Atlas program office is using several software tools (e.g. OCIO Project Activity Reporting tool) to help measure progress against program performance goals. These tools are used to report on, among other things, actual cost, schedule and performance relative to goals. In addition, the ICE CIO discusses the reports at monthly program management reviews to confirm that the reports and supporting information are reliable, complete, and accurate.