Information Technology: HUD Needs to Better Define Commitments and Disclose Risks for Modernization Projects in Future Expenditure Plans

Information technology (IT) is critical to the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission. By statutory mandate, HUD is to develop and submit to Congress an expenditure plan for its efforts to modernize the department's IT environment that satisfies certain conditions, including being reviewed by GAO. GAO's objectives were to determine the extent to which (1) HUD's expenditure plan meets statutory conditions and (2) HUD has in place key institutional IT modernization management capabilities. To accomplish this, GAO assessed the plan against the statutory conditions and assessed department documentation of efforts to institutionalize IT modernization management capabilities against open GAO recommendations.

The extent to which the fiscal year 2010 HUD expenditure plan met statutory conditions placed on the use of appropriated funds varied by IT modernization project. Specifically, the plan varied in the degree to which it described capabilities, expected mission benefits, estimated lifecycle costs, and key milestones for each of its eight modernization projects. Overall, however, it did not adequately satisfy all elements of the first of two conditions. For example, the plan described the expected mission benefits for three projects, but did not present specific and measurable benefits for the other five. Moreover, the plan, in combination with project management documentation, did not satisfy the second statutory condition that each project demonstrate that it is compliant with HUD's enterprise architecture, being managed in accordance with applicable lifecycle management policies, subject to HUD's capital planning and control requirements, and supported by an adequately staffed project office. Specifically, neither of the two projects assessed by GAO fully satisfied more than one of the elements of this condition. Officials attributed limitations in the plan's scope and content to the department's interpretation of the statutory requirements, as well as the unavailability of certain project documentation, and they stated that more detailed information would be included in future plans. Nevertheless, the plan is limited as a congressional oversight and decision-making mechanism. HUD has a range of actions under way to address GAO's prior recommendations and to evolve and strengthen its IT modernization management capabilities. However, it has yet to institutionalize these controls. Officials attributed the state of its controls largely to the fact that its new IT leadership team had only recently been established, and it is still in the process of introducing management improvements. Specifically, HUD (1) is redefining its enterprise architecture around core business functions, which is consistent with its modernization plans. However, the development of this new version has yet to commence, and HUD has not established a date for when it will be available. (2) has developed a conceptual construct for a new investment and lifecycle management framework, but is still developing the policies and process guidance needed to understand and consistently implement it. (3) is developing an approach to controlling investment portfolios and expects to begin implementing this approach by October 2010. (4) has begun developing a strategic IT human capital management plan, but it has not yet defined skill gap closure strategies and established milestones for completing and implementing the plan. The absence of institutionalized controls introduces risk to the success of HUD's modernization projects, and to the extent that future plans provide for expanded investment in the existing eight projects and additional ones, the risks associated with HUD's modernization efforts will increase. GAO is recommending that HUD ensure that future expenditure plans (1) fully satisfy all statutory conditions or disclose why any condition is not satisfied, along with any associated project risks and mitigation plans; and (2) describe the status of HUD's efforts to institutionalize key modernization management controls. GAO is also recommending that the number and scope of HUD's IT projects reflect the department's institutional capacity to manage them. In written comments on a draft of this report, HUD concurred with GAO's recommendations.