This is the accessible text file for GAO report number GAO-10-539 
entitled 'Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2010 Expenditure Plan' which was released on May 10, 2010. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

United States Government Accountability Office: 
GAO: 

May 2010: 

Business Systems Modernization: 

Internal Revenue Service's Fiscal Year 2010 Expenditure Plan: 

GAO-10-539: 

GAO Highlights: 

Highlights of GAO-10-539, a report to congressional committees. 

Why GAO Did This Study: 

The Internal Revenue Service’s (IRS) Business Systems Modernization 
(BSM) program is a multi-billion dollar, high risk, highly complex 
effort that involves the development and delivery of a number of 
modernized systems that are intended to replace the agency’s aging 
business and tax processing systems. As required, IRS submitted its 
fiscal year 2010 expenditure plan in November 2009 to the House and 
Senate appropriations committees, requesting approximately $254 
million from the BSM account. 

GAO’s objectives in reviewing the expenditure plan were to (1) 
determine whether it satisfies the applicable legislative conditions, 
(2) determine IRS’s progress in implementing prior expenditure plan 
review recommendations, and (3) provide additional observations about 
the plan and the BSM program. To accomplish the objectives, GAO 
analyzed the plan, reviewed related documentation, and interviewed IRS 
officials. 

What GAO Found: 

IRS’s expenditure plan satisfies five of the six legislative 
conditions, and partially satisfies the condition to comply with 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices used by the federal government. IRS has initiated 
an effort to improve its software acquisition and development 
practices, but does not expect to have changes in place until November 
2010, at the earliest. 

IRS has addressed two of GAO’s prior recommendations to improve its 
management capabilities and controls. Specifically, IRS has completed 
a plan with specific time frames for implementing the initiatives 
supporting its information technology human capital strategy and has 
defined procedures for determining when to grant conditional milestone 
exits. However, work remains in order to fully implement GAO 
recommendations to develop long-term plans for completing the BSM and 
developing a quantitative measure of scope. GAO made the following 
observations about the expenditure plan and the BSM program: 

* GAO’s analysis of reported project costs and completion dates shows 
that 6 of the 10 project milestones planned for fiscal year 2009 were 
completed early or within 10 percent of cost and schedule estimates 
and 3 milestones were completed on schedule but were more than 10 
percent over planned cost. IRS did not include underlying causes for 
these cost variances in its expenditure plan. Further, GAO was not 
able to determine cost and schedule variances for a milestone of the 
Modernized e-File-—the system intended to provide a single standard 
for filing electronic tax returns-—because IRS had not identified 
planned cost and schedule information for it in the fiscal year 2009 
expenditure plan. IRS also did not report completing this milestone in 
its expenditure plan, and Congress therefore was not provided with 
information on the system’s progress. 

* IRS began development of a new strategy for managing individual 
taxpayer accounts to address several challenges confronting the 
Customer Account Data Engine, which was intended to replace the 
antiquated Individual Master File containing the repository of 
individual taxpayer information. While much has been done to define 
the strategy’s transition states-—or key phases—-IRS has not 
identified time frames for completing key planning activities for 
fiscal year 2010 for the second transition state. 

* IRS has identified several risks associated with defining and 
implementing the new strategy (e.g., the ability to deliver 
capabilities could be jeopardized if the scope is not rigorously 
managed) and has classified these risks into five categories. IRS 
reported that it has developed mitigation strategies for the risks 
that it has identified. 

* Information security weaknesses continue to affect IRS’s 
modernization environment. As GAO recently reported, IRS continues to 
have weaknesses in its information security controls. Additionally, 
while IRS reported that it had corrected about 40 percent of 
previously reported weaknesses, GAO found that it had not fully 
implemented the remedial actions it had reported for at least a third 
of those that it considered corrected. 

What GAO Recommends: 

GAO is recommending that the Commissioner of Internal Revenue take 
several actions to improve program management capabilities and 
controls, including ensuring that underlying causes for project cost 
and schedule variances are consistently provided in the expenditure 
plan. In commenting on a draft of this report, IRS stated it would 
review the recommendations and provide a detailed corrective action 
plan to address them. 

View [hyperlink, http://www.gao.gov/products/GAO-10-539] or key 
components. For more information, contact David A. Powner at (202) 512-
9286 or pownerd@gao.gov. 

[End of section] 

Contents: 

Letter: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendix I: Briefing Slides from the March 9, 2010, Briefing to the 
Senate and House Appropriations Subcommittee Staffs: 

Appendix II: Comments from the Internal Revenue Service: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Abbreviations: 

AMS: Accounts Management Services: 

BSM: Business Systems Modernization: 

CADE: Customer Account Data Engine: 

CADE 2: Customer Account Data Engine 2: 

CIO: Chief Information Officer: 

CMMI: Capability Maturity Model Integration: 

CTO: Chief Technology Officer: 

EA: enterprise architecture: 

ELC: enterprise life cycle: 

IMF: Individual Master File: 

INF: infrastructure: 

IPM: integrated production model: 

IRS: Internal Revenue Service: 

LOE: level of effort: 

MCL: maintaining current levels: 

MeF: Modernized e-File: 

MER: Milestone Exit Review: 

MITS: Modernization and Information Technology Services: 

MV&S: Modernization Vision and Strategy: 

OMB: Office of Management and Budget: 

PMO: Program Management Office: 

SEI: Software Engineering Institute: 

TIGTA: Treasury Inspector General for Tax Administration: 

[End of section] 

United States Government Accountability Office:
Washington, DC 20548: 

May 10, 2010: 

The Honorable Richard J. Durbin: 
Chairman: 
The Honorable Susan Collins: 
Ranking Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations: 
United States Senate: 

The Honorable José E. Serrano: 
Chairman: 
The Honorable Jo Ann Emerson: 
Ranking Member: 
Subcommittee on Financial Services and General Government: 
Committee on Appropriations: 
House of Representatives: 

As required, the Internal Revenue Service (IRS) submitted its fiscal 
year 2010 expenditure plan in November 2009 to the House and Senate 
appropriations committees, requesting approximately $254 million from 
the Business Systems Modernization (BSM) account, which funds IRS's 
efforts to modernize its business and tax processing systems.[Footnote 
1] Our objectives in reviewing the plan were to (1) determine whether 
the plan satisfies the applicable legislative conditions,[Footnote 2] 
(2) determine IRS's progress in implementing our prior 
recommendations, and (3) provide any other observations about the plan 
and IRS's BSM program. 

This report transmits the information we provided to congressional 
appropriations subcommittee staffs during our March 9, 2010, briefing 
and provides the recommendations that we made to the Commissioner of 
Internal Revenue. The full briefing materials, including our scope and 
methodology, are included as appendix I. 

We conducted this performance audit from November 2009 to March 2010 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

In summary, we made the following major points: 

* IRS's fiscal year 2010 plan satisfies five of the six legislative 
conditions, and partially satisfies the condition to comply with 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices used by the federal government.[Footnote 3] IRS 
has not fully established disciplined practices for software 
acquisition.[Footnote 4] IRS has initiated an effort to improve its 
software acquisition and development practices, but does not expect to 
have disciplined processes in place until November 2010, at the 
earliest. 

* IRS has addressed two of our prior recommendations to improve its 
management capabilities and controls, including our recommendation to 
complete a plan with specific time frames for implementing the 
initiatives supporting IRS's information technology human capital 
strategy and define procedures for determining when to grant 
conditional milestone exits. However, work remains to fully implement 
our recommendations to develop long-term plans for completing BSM and 
develop a quantitative measure of scope. 

* Of 10 project milestones[Footnote 5] planned for fiscal year 2009, 6 
were completed early or within 10 percent of cost and schedule 
estimates and 3 were completed on schedule but were more than 10 
percent over cost. For 1 of the milestones, we could not determine 
cost or schedule variances because IRS had not identified planned cost 
and schedule information in the fiscal year 2009 expenditure plan. A 
release[Footnote 6] of the Customer Account Data Engine[Footnote 7] 
(CADE) intended to implement legislative changes for filing season 
2010 completed the detailed design phase on cost and schedule; by 
contrast, the release of the Accounts Management Services (AMS) system 
[Footnote 8] intended, among other things, to provide for the 
conversion of the Correspondence Imaging System (a legacy system) to a 
new platform for inventory management, completed the development phase 
127 percent over cost. In its expenditure plan, IRS attributed the 
variances for the milestones over planned cost to the need to fund the 
projects in excess of planned amounts. However, the agency did not 
include underlying causes for the variances in the plan. Finally, we 
were not able to determine cost or schedule variances of a milestone 
of Modernized e-File[Footnote 9] release 6.1, because IRS had not 
identified planned cost and schedule information for it in the fiscal 
year 2009 expenditure plan. IRS also did not report completing this 
milestone in its expenditure plan, and Congress therefore was not 
provided with information on progress in delivering functionality. 

* IRS began development of a new strategy for managing individual 
taxpayer accounts, but time frames for completing key planning 
activities scheduled to occur during fiscal year 2010 have not yet 
been defined. In August 2008, IRS began defining the strategy to 
address several challenges confronting CADE, including that the 
approach to develop the system was more complex and taking longer than 
initially anticipated, and also take advantage of the availability of 
new technologies. IRS expects the strategy, generally referred to as 
CADE 2, to deliver benefits, including faster refunds for all 
individual taxpayers, in two transition states--or key phases--
beginning in filing season 2012.[Footnote 10] While much has been done 
to define these transition states, IRS has not identified time frames 
for completing key planning activities during fiscal year 2010 for the 
second transition state.[Footnote 11] 

* IRS has identified several risks associated with defining and 
implementing CADE 2 (e.g., the ability to deliver capabilities could 
be jeopardized if the scope is not rigorously managed). IRS has 
classified these risks into five categories: delivery, program, 
people, technology and complexity, and management. The Department of 
the Treasury's Inspector General for Tax Administration (TIGTA) also 
recently identified several challenges that IRS needs to address to 
effectively manage identified risks including, among other things, 
developing contingency plans in the event that CADE 2 cannot be fully 
implemented. IRS reported that it has developed mitigation strategies 
for the risks it has identified and stated that it found TIGTA's 
assessment to be valid. 

* Information security weaknesses continue to affect IRS's 
modernization environment. In November 2009[Footnote 12] and March 
2010,[Footnote 13] we reported that, while IRS continued to make 
progress in correcting previously reported information security 
weaknesses, weaknesses in internal controls over information security 
continue to place IRS systems at risk. Additionally, while IRS had 
informed us that it corrected about 40 percent of the previously 
reported weaknesses, we found that it had not fully implemented the 
remedial actions it reported for at least a third of those that it 
considered corrected. Further, in August 2009,[Footnote 14] TIGTA 
reported that while IRS had taken steps to address several CADE system 
security vulnerabilities it had identified in a previous audit, some 
had been fully resolved and others could not be resolved until actions 
were completed to ensure controls are effectively in place or have 
been approved as deviations to IRS policy. IRS is taking steps to 
address recommendations from GAO and TIGTA and has stated that it 
expects CADE 2 to fully address the security weaknesses that are 
currently confronting CADE. While current and planned actions to 
improve its security posture are positive steps, IRS's modernization 
environment will continue to be at risk until the agency has fully 
addressed its information security weaknesses. 

Conclusions: 

During fiscal year 2009, IRS continued to deliver BSM projects, 
although work on planned releases of CADE and AMS was either modified 
or suspended pending completion of efforts to define the agency's new 
strategy to manage individual taxpayer accounts. IRS generally made 
progress in addressing outstanding recommendations from our prior 
expenditure plan reviews. However, the expenditure plan explanations 
for significant project cost variances did not always provide 
information on root causes, limiting Congress's insight into areas 
that need improvement. Further, because IRS did not report one 
completed project milestone for which it had not identified specific 
plans in the fiscal year 2009 expenditure plan, Congress did not 
receive information on progress in delivering key functionality. 
Finally, while much has been done to define the transition states of 
the CADE 2 strategy for managing individual taxpayer accounts, 
specific time frames for addressing key planning activities for the 
second transition state, including defining core requirements, have 
not been defined. Having these time frames would guide progress in 
completing activities that are foundational to the transition state. 

Recommendations for Executive Action: 

To improve the program management capabilities and controls that are 
critical to the effective management of the BSM program, we are 
recommending that the Commissioner of Internal Revenue direct the IRS 
Chief Technology Officer to take the following three actions: 

1. Ensure that explanations of project cost and schedule variances 
provided in the expenditure plan consistently include underlying 
causes. 

2. For individual milestones that have been combined, report available 
performance information in the expenditure plan to provide Congress 
with information on progress in delivering functionality. 

3. Define specific time frames for CADE 2 transition state 2 planning 
activities, including defining a core set of requirements, to guide 
progress. 

Agency Comments: 

IRS's Deputy Commissioner for Operations Support provided written 
comments on a draft of this report (reprinted in app. II). He stated 
that IRS appreciated that the report recognizes progress made to 
improve its program management capabilities and controls. He also 
stated that IRS would review the recommendations to ensue its actions 
include assuring that underlying causes for project cost and schedule 
variances are consistently provided in the expenditure plan. 
Additionally, IRS stated that it would provide the detailed corrective 
action plan addressing each of the recommendations. 

We are sending copies of this report to the Chairmen and Ranking 
Members of the Senate and House committees and subcommittees that have 
appropriations, authorization, and oversight responsibilities for IRS. 
We are also sending copies to the Commissioner of Internal Revenue, 
the Secretary of the Treasury, the Chairman of the IRS Oversight 
Board, and the Director of the OMB. In addition, the report will be 
available at no charge on the GAO Web site at [hyperlink, 
http://www.gao.gov]. 

Should you and your offices have questions on matters discussed in 
this report, please contact me at (202) 512-9286 or at 
pownerd@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. GAO staff who made key contributions to this report are listed 
in appendix III. 

Signed by: 

David. A. Powner: 
Director, Information Technology Management Issues: 

[End of section] 

Appendix I: Briefing Slides from the March 9, 2010, Briefing to the 
Senate and House Appropriations Subcommittee Staffs: 

Review of IRS's Fiscal Year 2010 Business Systems Modernization 
Expenditure Plan: 

Briefing for Staff Members of the: 

Subcommittee on Financial Services and General Government, Committee 
on Appropriations, U.S. Senate: 

and the: 

Subcommittee on Financial Services and General Government, Committee 
on Appropriations, House of Representatives: 

March 9, 2010: 

Contents: 
Introduction and Objectives; 
Scope and Methodology; 
Results in Brief; 
Background Results; 
Conclusions; 
Recommendations for Executive Action; 
Agency Comments and Our Evaluation; 
Appendixes: 
* I: Description of Business Systems Modernization Projects and 
Program-Level Initiatives; 
* II: Additional Detail on IRS's Fiscal Year 2010 BSM Expenditure Plan; 
* III: IRS-Reported Project Cost and Schedule for Projects Scheduled 
for Completion in Fiscal Year 2009. 

Introduction and Objectives: 

The Internal Revenue Service's (IRS) Business Systems Modernization 
(BSM) program is a multi-billion-dollar, high-risk, highly complex 
effort that involves the development and delivery of a number of 
modernized tax administration and internal management systems, as well 
as core infrastructure projects, that are intended to replace the 
agency's aging business and tax processing systems and provide 
improved and expanded service to taxpayers and internal business 
efficiencies for IRS. Initiated in fiscal year 1999, BSM is IRS's 
current effort to modernize its systems. IRS contracted with Computer 
Sciences Corporation as the prime systems integration support 
contractor to assist with designing, developing, and integrating the 
new set of information systems comprised by BSM. In fiscal year 2006, 
IRS developed a new Modernization Vision and Strategy (MV&S) in 
response to our recommendation to fully revisit the vision and 
strategy for the BSM program and develop a new set of long-term goals, 
strategies, and plans consistent with the budgetary outlook and IRS's 
management capabilities.[Footnote 15] The MV&S represented a new 
approach to modernizing IRS's information technology environment. For 
example, while at the outset the BSM program assumed complete 
replacement of existing systems, the MV&S among other things provides 
for leveraging existing systems where appropriate. Other principles of 
the MV&S include involving joint business and IT leadership throughout 
the process, and delivering smaller, incremental releases more 
frequently. 

Prompted by several challenges confronting the Customer Account Data 
Engine (CADE)—including that the approach to develop the system was 
more complex and taking longer than initially anticipated—the IRS 
Commissioner initiated a study of IRS's IT systems modernization 
efforts from an overall portfolio perspective, which included 
operations of existing systems, new system developments, and 
information security. The results of the study led to the decision to 
refocus modernization efforts on the accelerated completion of the 
modernized taxpayer account database that has been under development 
since 2002. The resulting strategy, generally referred to as CADE 2, 
is expected to deliver key benefits beginning in filing season 2012. 
IRS has reported that CADE 2 is central to its vision for ongoing 
improvements to its tax administration systems. Specifically, through 
CADE 2, IRS expects to (1) accelerate delivery of a relational 
taxpayer account database from at least 7 years under the initial 
approach to approximately 2 years and (2) more quickly move to a 
single tax processing environment (instead of the two environments 
that currently exist). It is expected that CADE 2 will result in 
faster refunds, improved customer service, elimination of notices 
based on out-of-date information, faster resolution of taxpayer 
account issues, and better online tools and services for taxpayers. 

The Consolidated Appropriations Act, 2010,[Footnote 16] provides 
appropriations for IRS for fiscal year 2010, including for BSM. The 
act prohibits IRS from obligating funds (excluding labor costs) for 
the BSM program until IRS submits a modernization expenditure plan to 
the relevant congressional appropriations committees.[Footnote 17] 

This plan must: 

* meet the capital planning and investment control review requirements 
established by the Office of Management and Budget (OMB);
* comply with IRS's enterprise architecture;[Footnote 18] 
* conform with IRS's enterprise life cycle methodology;[Footnote 19] 
* comply with federal acquisition rules, requirements, guidelines, and 
systems acquisition management practices;
* be approved by IRS, the Department of the Treasury, and OMB; and
* be reviewed by GAO. 

Since mid-1999, IRS has submitted a series of expenditure plans for 
BSM appropriations. To date, IRS has received about $2.8 billion for 
the BSM effort. 

On November 4, 2009, IRS submitted its fiscal year 2010 expenditure 
plan to the Subcommittees on Financial Services and General Government 
of the Senate and House of Representatives Committees on 
Appropriations, seeking release of approximately $254 million from the 
BSM account.[Footnote 20] 

As agreed with IRS's appropriations subcommittees, our objectives were 
to: 

* determine whether IRS's fiscal year 2010 expenditure plan satisfies 
the applicable legislative conditions; 

* provide an update on IRS's progress in implementing our prior 
expenditure plan review recommendations; and; 

* provide any other observations about the expenditure plan and IRS's 
BSM program. 

[End of section] 

Scope and Methodology: 

To accomplish our objectives, we: 

* reviewed the fiscal year 2010 expenditure plan submitted by IRS in 
November 2009; 

* analyzed the plan for compliance with the applicable legislative 
conditions; 

* interviewed IRS program and project management officials to 
corroborate our understanding of the plan and other BSM activities; 

* analyzed available evidence on recent agency efforts to implement 
our prior recommendations, including progress on improving its 
modernization management controls and capabilities; 

* reviewed and analyzed modernization program review and project 
management briefings and related documentation to assess program and 
project status and associated issues and risks; 

* reviewed program management reports to assess the progress IRS has 
made in completing actions and implementing program management 
improvements; and; 

* reviewed related reports by the Treasury Inspector General for Tax 
Administration (TIGTA). 

To assess the reliability of the cost and schedule information 
contained in this expenditure plan, we interviewed IRS officials in 
order to gain an understanding of the data and discussed our use of 
the data in this briefing. In addition, we confirmed that information 
in the plan was consistent with information contained in internal IRS 
briefings and other governance process artifacts. We did not, however, 
assess the accuracy and reliability of the information contained in 
these documents. 

We conducted this performance audit from November 2009 to March 2010 
in Washington, D.C., in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform 
the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

IRS's fiscal year 2010 expenditure plan satisfies five of the six 
legislative conditions, and partially satisfies the condition to 
comply with the acquisition rules, requirements, guidelines, and 
systems acquisition management practices used by the federal 
government. IRS has not fully established disciplined practices for 
software acquisition.[Footnote 21] While IRS has initiated an effort 
to improve its software acquisition and development practices, it 
stated that it does not expect to have these in place until November 
2010 at the earliest. 

IRS has implemented two of our four previous recommendations to 
improve its management capabilities and controls. Specifically, IRS 
has completed a plan with specific time frames for implementing the 
initiatives supporting its IT human capital strategy and has defined 
procedures for determining when to grant conditional milestone exits. 
However, steps remain to implement our recommendations to (1) develop 
long-term plans for completing BSM and consolidating and retiring 
legacy systems and (2) develop a quantitative measure of progress in 
delivering systems' planned functionality (scope). Regarding the long-
term plans for completing BSM, IRS began working on a new strategy in 
2008, and, at the conclusion of our review, provided us with key 
planning documents. Regarding the quantitative measure of progress for 
delivering planned functionality, IRS expects to have a measure 
developed by the end of this month. Fully developing long-term plans 
and developing a quantitative measure will help IRS in managing and 
controlling BSM. 

We have four observations related to the BSM program and fiscal year 
2010 expenditure plan: 

* Of 10 project milestones[Footnote 22] planned for fiscal year 2009, 
6 were completed within 10 percent of cost and schedule estimates or 
early, and 3 were completed on schedule but more than ten percent over 
cost. For 1 of the milestones, we could not determine cost or schedule 
variances because IRS had not identified planned cost and schedule 
information in the fiscal year 2009 expenditure plan. A release 
[Footnote 23] of CADE intended to implement legislative changes for 
filing season 2010 completed the detailed design phase on cost and 
schedule; by contrast, the release of the Account Management Services 
intended, among other things, to provide for the conversion of the 
Correspondence Imaging System to a new platform for inventory 
management, completed the development phase127 percent over cost. In 
its expenditure plan, IRS attributed the variances for the milestones 
over planned cost to the need to fund the projects in excess of 
planned amounts. However, the agency did not include underlying causes 
for the variances in the plan. Finally, we were not able to determine 
cost or schedule variances of a milestone of Modernized e-File, 
release 6.1, because IRS had not identified planned cost and schedule 
information for it in the fiscal year 2009 expenditure plan. IRS also 
did not report completing this milestone in its expenditure plan, and 
Congress therefore was not provided with information on progress in 
delivering functionality. 

* IRS began development of a new modernization strategy, but time 
frames for completing key planning activities to be completed during 
fiscal year 2010 have not yet been defined. In August 2008, IRS began 
to define a new strategy for managing individual taxpayer accounts 
that was to address several challenges confronting its Customer 
Account Data Engine and also take advantage of the availability of new 
technologies. IRS expects the strategy, generally referred to as CADE 
2, to deliver benefits, including faster refunds for all individual 
taxpayers, in two transition stages beginning in filing season 2012. 

While much has been done to define these stages, IRS has not 
identified time frames for completing key planning activities during 
fiscal year 2010 for the second transition stage. 

* CADE 2 faces several risks. IRS has identified several risks 
associated with defining and implementing CADE 2 (e.g., the ability to 
deliver capabilities could be jeopardized if the scope is not 
rigorously managed). IRS has classified these risks into five 
categories: delivery, program, people, technological and complexity, 
and management. Treasury's Inspector General for Tax Administration 
also recently identified several challenges that IRS needs to address 
to effectively manage identified risks, including, among other things, 
developing contingency plans in the event that CADE 2 cannot be fully 
implemented. IRS reported that it has developed mitigation strategies 
for the risks it has identified and stated that it found TIGTA's 
assessment to be valid. 

* Information security weaknesses continue to affect IRS's 
modernization environment. In November 2009, we reported that while 
IRS continued to make progress in correcting previously reported 
information security weaknesses, weaknesses in internal controls over 
information security continue to place IRS systems at risk. 
Additionally, while IRS had informed us that it corrected about 40 
percent of the previously reported weaknesses, we found that it had 
not fully implemented the remedial actions it reported for at least a 
third of those that it considered corrected. Further, in August 2009, 
TIGTA reported that while IRS had taken steps to address several CADE 
system security vulnerabilities it had identified in a previous audit, 
some had been fully resolved and others could not be resolved until 
actions are completed to ensure controls were effectively in place or 
had been approved as deviations to IRS policy. IRS is taking steps to 
address recommendations from GAO and TIGTA and has stated that it 
expects to fully address the security weaknesses that are currently 
confronting CADE in Transition State 2 of CADE 2. While current and 
planned actions to improve its security posture are positive steps, 
IRS's modernization environment will continue to be at risk until the 
agency has fully addressed its information security weaknesses. 

[End of section] 

Results in Brief: 

We are recommending that IRS: 

* consistently include underlying causes in the explanations of 
project cost and schedule variances provided in the expenditure plan; 

* for individual milestones that have been combined, report available 
performance information in the expenditure plan to provide Congress 
with information on progress in delivering functionality; and; 

* define time frames for completing key planning activities for a key 
transition stage of CADE 2. 

In e-mail comments and subsequent oral comments from the IRS's Chief 
Technology Officer (CTO) on a draft of these briefing slides, the CTO 
agreed with much of the information presented but disagreed with two 
of our findings and with two of our recommendations. Specifically, he 
disagreed with our finding that IRS partially complies with the 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices used by the government, stating that there is no 
requirement for federal agencies to use the cited practices. While not 
required, it is recognized that, without these practices, software 
acquisition processes are typically ad hoc and chaotic. The CTO also 
disagreed with our finding that IRS had not fully implemented our 
recommendation to develop a longterm plan for BSM, stating that it 
believed that it had addressed this by providing the Modernization 
Vision and Strategy (MV&S) in fiscal year 2006. We acknowledge IRS's 
recent update of the MV&S with the CADE 2 strategy and plan to review 
recently provided key planning documents to determine if IRS has now 
fully implemented this recommendation. 

Regarding our recommendation to ensure that the explanations of 
project cost and schedule variances provided in the expenditure plan 
include underlying causes, IRS stated that the expenditure plan 
consistently provides narrative explanations of all project segment 
cost and schedule variances, in addition to the attribution of those 
variances. Our point is that the underlying causes for the cost 
variances for three AMS milestones were not in the plan, in accordance 
with IRS's own guidance, although IRS subsequently provided us with 
these causes in response to our queries. Regarding our recommendation 
to report on project milestones delivered for which specific cost and 
schedule estimates were not identified in the previous year's 
expenditure plan (due to milestones being combined), the CTO commented 
that, when milestones are combined within a project segment, IRS 
generally does not develop or track specific cost and schedule 
estimates for the individual project milestones and that, given this, 
only the overall cost and schedule estimate for the combined milestone 
segment is reported in the expenditure plan. However, in the case of 
MeF, IRS developed and tracked some of this information but did not 
report it. Reporting this information would improve the transparency 
of IRS's progress in delivering functionality. IRS also provided 
technical comments which we have addressed as appropriate. 

Since 1999, we have reviewed and reported on numerous BSM expenditure 
plans. In particular, we have reported on program management 
capabilities and controls that are critical to the effective 
management of the BSM program. They include: 

* cost and schedule estimates: IRS did not have effective procedures 
for validating contractor-developed cost and schedule estimates; 
[Footnote 24] 

* requirements development and management: IRS did not have adequate 
policies and procedures in place to guide its system modernization 
projects in developing and managing requirements;[Footnote 25] 

* post-implementation reviews: post-implementation reviews conducted 
were incomplete and did not follow IRS procedures;[Footnote 26] 

* quantitative measures of progress in scope: IRS expenditure plans 
did not have a quantitative measure of progress in meeting project 
scope expectations;[Footnote 27] and; 

* conditional milestone exits: IRS did not have documented procedures 
for determining when projects were allowed to proceed to the next 
milestone with outstanding issues remaining to be addressed (i.e., 
conditional milestone exits).[Footnote 28] 

We have made recommendations aimed at strengthening IRS's program 
management controls and capabilities. Over the years, IRS has 
addressed several of these recommendations. However, more work remains 
for key capabilities and controls to be fully institutionalized or 
implemented. 

[End of section] 

Background: 

As previously noted, the BSM program is driven by IRS's Modernization 
Vision and Strategy (MV&S).[Footnote 29] However, the CADE 2 strategy 
that is currently being defined will redefine the approach for 
elements of the MV&S. 

IRS's Modernization and Information Technology Services (MITS) 
organization has primary responsibility for managing and delivering 
the BSM program. Headed by a Chief Technology Officer[Footnote 30] who 
is supported by, among others, the Deputy Chief Information Officer 
(CIO) for Strategy/Modernization and the Chief Information Officer, 
MITS is comprised of eight Associate CIO-level organizations, 
including: 

* Applications Development, which delivers applications for the MV&S 
and other applications to support the filing season and maintains 
legacy systems; 

* Enterprise Services, which sets enterprise technology and process 
standards to promote compatibility and common practices across the IT 
organization; 

* Strategy and Planning, which was established in August 2009 to 
facilitate the alignment of information technology and business 
through strategic planning and financial management practices that 
provide visibility into the overall demand for supply, and value of IT 
investments; and; 

* CADE 2 Program Management Office, which was established in July 2009 
to oversee the implementation of CADE 2. 

IRS's fiscal year 2010 expenditure plan describes the agency's efforts 
to develop modernized systems and supporting infrastructure.17 They 
include: 

* continuing ongoing program-level initiatives (e.g., architecture and 
integration and program management) and core infrastructure projects 
(e.g., infrastructure shared services), 

* continuing two tax administration project releases to their next 
milestones, and, 

* continuing to define and starting to implement the new strategy for 
managing individual taxpayer accounts. 

Key tax administration projects include: 

* Modernized e-File (MeF), which is to provide a single standard for 
filing electronic tax returns; 

* Customer Account Data Engine (CADE),18 which was intended to provide 
the modernized database foundation to replace the existing Individual 
Master File (IMF) processing system, containing the repository of 
individual taxpayer information. It will continue with daily 
processing of tax returns for approximately 40 million taxpayers and 
implementing new tax law changes; and; 

* CADE 2, which is IRS's new revised approach intended to provide the 
modernized database foundation and leverage applications, database 
structures, files, and business logic from both CADE and IMF19 to 
provide a daily processing capability for moving all individual 
taxpayer accounts to a faster refund cycle and address IRS's long-term 
modernization plans and goals. 

CADE 2 will also include projects such as: 

* Accounts Management Services (AMS),[Footnote 34] which is intended 
to enhance customer support by providing applications that enable IRS 
employees to access, validate, and update individual taxpayer accounts 
on demand; and; 

* Integrated Production Model (IPM), which is intended to serve as a 
central repository for corporate data and make those data available to 
several client systems. 

Details on these and other BSM projects and program-level initiatives 
identified in the fiscal year 2010 plan are provided in appendix 1. 

Table 1 shows a financial summary of the plan. 

Table 1: Summary of IRS's Fiscal Year 2010 BSM Expenditure Plan[A]: 

Tax administration projects: 

Modernized e-File; 
Amount (in thousands): $50,000. 

Current CADE; 
Amount (in thousands): $38,000. 

Customer Account Data Engine 2[B]: 
Amount (in thousands): $47,654. 

Subtotal—tax administration projects: 
Amount (in thousands): $135,654. 

Core infrastructure projects: 

Development, Integration, and Testing Environments: 
Amount (in thousands): $14,500. 

Infrastructure Shared Services: 
Amount (in thousands): $17,500. 

Subtotal—core infrastructure projects: 
Amount (in thousands): $32,000. 

Architecture, integration, and management: 

Architecture and Integration: 
Amount (in thousands): $13,745. 

Business Integration: 
Amount (in thousands): $4,206. 

Business Rules and Requirements Management: 
Amount (in thousands): $3,160. 

Management Processes: 
Amount (in thousands): $3,539. 

Federally Funded Research and Development Center: 
Amount (in thousands): $7,396. 

Project Management: 
Amount (in thousands): $2,954. 

Subtotal—architecture, integration, and management: 
Amount (in thousands): $35,000. 

Management Reserve: 
Amount (in thousands): $5,020. 

BSM Capital Total: 
Amount (in thousands): $207,674. 

BSM Labor Total: 
Amount (in thousands): $44,666. 

Maintaining Current Levels (MCL)[C]: 
Amount (in thousands): $1,334. 

Total: 
Amount (in thousands): $253,674. 

Source: GAO analysis of IRS data. 

[A] See appendix II for additional details on the plan. According to 
IRS's Chief Technology Officer, the agency is currently preparing an 
update to the expenditure plan to address the higher enacted level 
(about $264 million) for the BSM appropriation. 

[B] The amount for CADE 2 includes $2.6 million for the Integrated 
Production Model project. 

[C] Maintaining Current Levels (MCL) is the inflationary factor for 
the BSM labor cost. 

[End of table] 

[End of section] 

Results: Legislative Conditions: 

Objective 1: IRS's fiscal year 2010 BSM expenditure plan fully 
satisfies five of the six legislative conditions, and partially 
satisfies the condition that the plan comply with the acquisition 
rules, requirements, guidelines, and systems acquisition management 
practices used by the federal government. 

Table 2: Status of Fiscal Year 2010 Expenditure Plan Provisions for 
Satisfying Legislative Conditions[Footnote 35]: 

Legislative conditions: 

1. Meets OMB capital planning and investment control review 
requirements; 
Status: Satisfied. 

2. Complies with IRS's enterprise architecture (EA); 
Status: Satisfied. 

3. Conforms with IRS's enterprise life cycle (ELC) methodology; 
Status: Satisfied. 

4. Complies with the acquisition rules, requirements, guidelines, and 
systems acquisition management practices used by the federal 
government; 
Status: Partially satisfied. 

5. Approved by IRS, the Department of the Treasury, and OMB; 
Status: Satisfied. 

6. Reviewed by GAO; 
Status: Satisfied. 

Source: GAO analysis of IRS data. 

[End of table] 
		
1. Meets OMB capital planning and investment control review 
requirements: 

OMB requires agencies to develop capital planning and investment 
control review processes that help ensure that projects are being 
implemented at an acceptable cost and within reasonable and expected 
time frames, and that they are contributing to observable improvements 
in mission performance. The BSM expenditure plan met this condition. 
Specifically, as noted in the plan, IRS has established a structured 
governance and decision-making process framework that includes various 
levels of governing bodies to manage its projects under a standardized 
approach. The framework includes policies and procedures to select, 
control, and evaluate investments that are generally consistent with 
OMB capital planning and investment control review requirements. IRS 
also recently developed additional procedures to augment its 
governance and decision-making processes: 

* In November 2008, the agency developed an Enterprise Governance 
Authority and Operations Directive that describes a set of guiding 
principles and roles and responsibilities for IRS governance functions. 

* In April 2009, IRS issued an Enterprise Control Authority and 
Operations Directive that provides requirements, guiding principles, 
roles, and responsibilities for institutionalizing a comprehensive set 
of IRS enterprise control processes and a Tiered Program Management 
Escalation Guide that provides information for institutionalizing a 
comprehensive set of enterprise escalation guidelines. 

IRS has also conducted training of governance board coordinators and 
secretariats as well as ongoing work groups to provide a venue for 
sharing lessons learned and internal best practices. In addition, 
officials stated that IRS has established a single repository to house 
the data for its Governance IT portfolio. We recently initiated a 
review to assess IRS's capital planning and investment control 
practices against best practices identified in our IT Investment 
Management Framework.
		
2. Complies with IRS's enterprise architecture: 

IRS's BSM expenditure plan provides for compliance with the enterprise 
architecture (EA). Specifically, OMB requires that IRS document and 
submit an initial EA that is consistent with the principles identified 
within OMB Circular A-130. Additionally, IRS is required to submit 
updates to OMB when significant changes to the EA occur. Consistent 
with this requirement, IRS has developed a number of documents, 
including its Enterprise Transition Plan, which provides information 
about IRS's overall plan to evolve information technology and 
facilitate the investment decision-making process. In addition, IRS 
has outlined general processes that projects are to follow in order to 
ensure their compliance with the IRS EA. Specifically these processes 
discuss the activities and documentation required to ensure compliance 
with the EA. For example, at milestone 3—which is the phase where a 
project's preliminary design is developed—IRS requires projects to 
submit an EA compliance checklist which is used to help ensure that 
the project design has been checked for compliance. 

IRS's BSM expenditure plan also identifies funding for continued 
definition and implementation of the EA. For example, the plan 
identifies funding needed for: 

* performing architecture, engineering, and integration activities to 
ensure that the IRS EA provides the information and guidance necessary 
for modernization projects; 

* supporting the performance of EA compliance certification 
activities; and; 

* finalizing and publishing updates to the EA based on change requests. 
		
Additionally, in September 2009, IRS updated its Enterprise Transition 
Plan to include a number of enhancements. For example, the plan 
reflects the latest decisions made regarding the new strategy for 
managing individual taxpayer accounts and includes improvements for 
the integration of infrastructure and security services and privacy 
strategies. IRS has also developed a Preliminary Solution Architecture 
for the new strategy that discusses the current processes used to 
handle taxpayer accounts and the target architecture, such as 
requirements for accepting and validating taxpayer account 
information. Additionally, IRS's 2009 Enterprise Architecture provided 
information on the processes associated with creating taxpayer 
identification numbers, updating accounts and taxpayer information, 
posting tax returns, and providing account information to downstream 
processes. IRS has also developed a Customer Account Data Engine 
Preliminary Program Roadmap which defines the approach for delivering 
CADE 2. 

3. Conforms with IRS's enterprise life cycle methodology: 

The BSM expenditure plan conforms to IRS's enterprise life cycle 
methodology (ELC), which defines a set of processes that are to be 
used throughout the program's life cycle, including processes for 
managing system investments, configuration, and risks. Specifically, 
the plan calls for the following, as required by the ELC management 
program: 

* continuing to provide centralized guidance, administration, 
mitigation, and closure of risks and issues throughout the life cycle 
of each project; 

* maintaining and enhancing the ELC (consistent with this, IRS has 
developed a Milestone Exit Review procedure for inclusion in the ELC 
to more effectively determine whether projects have met the necessary 
conditions to exit a milestone and to prevent premature exit of 
milestones); and; 

* incorporating requirements for industry best practices into the ELC 
to help ensure consistent systems development processes. 

4. Complies with the acquisition rules, requirements, guidelines, and 
systems acquisition management practices used by the federal 
government[Footnote 36]: 

The plan partially complies with best practices for software 
development/acquisition because IRS does not yet have in place 
disciplined practices as called for by Carnegie Mellon University's 
Software Engineering Institute (SEI);[Footnote 37] however, IRS is 
taking steps to implement SEI's Capability Model Integration (CMMI®)
[Footnote 38] processes. The quality of software is governed largely 
by the quality of the processes involved in developing or acquiring it 
and maintaining it. SEI, recognized for its expertise in software 
processes, has developed models and methods that define and determine 
organizations' software process maturity, including the CMMI® model 
used to develop processes needed for software development and 
acquisition and specific practices that agencies should follow to 
mature these processes. IRS officials stated that, in June 2009, the 
agency initiated a CMMI® implementation project to improve its 
software acquisition and development practices by conducting a gap 
analysis—which compares actual performance with potential performance—
and performing benchmarking activities. As a result of these 
activities, IRS developed process improvement recommendations, 
including, among other things, updating the existing project 
management plan template, expanding performance monitoring, and 
establishing a communications management plan. Additionally, according 
to IRS officials, the agency developed a governance structure to 
oversee the implementation of these recommendations. IRS officials 
also stated that a sample of projects from across the Applications 
Development organization will be used to pilot the CMMI® changes, and 
mentoring teams will be established to coach and provide training to 
the pilot projects to ensure institutionalization of the newly created 
and modified process assets. 

IRS stated it has a number of reviews planned throughout calendar year 
2010 to assess progress in improving its practices and expects to have 
CMMI level 2[Footnote 39] practices, that is, disciplined processes, 
by November 2010 at the earliest. Until IRS has these processes in 
place, it will run the risk of encountering problems in meeting its 
performance, schedule, and cost objectives for the BSM program. 

5. Approved by IRS, the Department of the Treasury, and OMB: 

The expenditure plan was reviewed and approved by IRS on August 11, 
2009; Treasury on September 10, 2009; and OMB on October 8, 2009. 

6. Reviewed by GAO: 

We completed review of the plan in March 2010. 

Results: Prior Recommendation Status: 

Objective 2: IRS has implemented two of our previous recommendations 
to improve its modernization management controls and capabilities, but 
steps remain to fully implement the remaining recommendations.
IRS implemented our recommendations to complete a plan with specific 
time frames for implementing the initiatives supporting its human 
capital strategy and to define procedures for determining when to 
grant conditional milestone exits. However, steps remain to fully 
implement the remaining recommendations, including developing a 
quantitative measure of progress in meeting project scope expectations. 

Table 3: Status of IRS's Progress in Implementing Prior GAO 
Recommendations: 

Prior GAO recommendation: Human capital strategy: Complete a plan with 
specific time frames for implementing the initiatives supporting IRS's 
IT human capital strategy. 
Status: Implemented. 

Prior GAO recommendation: Conditional milestone exits: Define 
procedures for determining when to grant conditional milestone exits. 
Status: Implemented. 

Prior GAO recommendation: Modernization vision and strategy: Fully 
revisit the vision and strategy for the BSM program and develop a new 
set of long-term goals, strategies, and plans that are consistent with 
the budgetary outlook and IRS's management capabilities. 
Status: In progress. 

Prior GAO recommendation: Quantitative measures of progress in meeting 
scope expectations—Ensure that future expenditure plans include a 
quantitative measure of progress in meeting project scope expectations. 
Status: In progress. 

Source: GAO analysis of IRS data. 

[End of table] 

Human Capital Strategy: 

In March 2008, we reported that IRS had developed a human capital 
strategy for its Application Development organization that addressed 
hiring critical personnel, employee training, leadership development, 
and workforce retention and identified several initiatives it planned 
to undertake in these areas. However, the agency did not have a 
specific plan, including time frames, for addressing these 
initiatives. Accordingly, we recommended that the agency develop such 
a plan.[Footnote 40] IRS agreed with our recommendation, and, in 
response, identified a timeline for addressing these initiatives, 
including addressing the IT corporate hiring challenge, succession 
planning, and coaching and mentoring, in its Applications Development 
Strategic Plan for 2007-2011 and its 2008-2010 Modernization 
Information Technology Services Corporate Strategies document. IRS 
officials also noted that human capital initiatives are planned (and 
therefore updated) on an annual basis. Recently, IRS's Human Capital 
Management Branch developed the MITS Recruitment and Training 
Strategies and Projected Activity document for fiscal years 2010 
through 2013 to further address staffing issues within the MITS 
organization, including staffing associated with the new strategy for 
modernizing individual taxpayer accounts. Effectively performing these 
activities should allow IRS to acquire and retain the staff resources 
it needs to effectively support BSM. 

Results: Conditional Milestone Exits: 

In March 2009, we reported that IRS's use of conditional milestone 
exits (whereby projects are allowed to continue with outstanding 
issues needing to be addressed) was not supported by documented 
procedures and, as a result, the conditional exit process could 
potentially be used to mask cost and schedule overruns and result in 
projects exiting milestones prematurely. Accordingly, we recommended 
that such procedures be defined. IRS agreed with our recommendation 
and, in response, developed a Milestone Exit Review (MER) Procedure to 
emphasize the prevention of premature milestone exits with outstanding 
issues. The MER procedure describes the activities required for a 
project to enter and exit the MER process. It also requires that the 
governance board members review the project's cost, schedule, 
performance, risks, and conditions, in addition to the MER artifacts, 
to determine whether to (1) grant a conditional exit, (2) grant an 
unconditional exit, (3) disapprove the exit, (4) recommend suspending 
the project, or (5) terminate the project. By developing this 
procedure, IRS has reduced the likelihood that the conditional exit 
process will be used to mask cost and schedule overruns or result in 
projects exiting milestones prematurely. 

Results: Prior Recommendation Status: 
		
Modernization Vision and Strategy: 

In July 2005, we recommended that IRS fully revisit the vision and 
strategy for the BSM program and develop a new set of long-term goals, 
strategies, and plans consistent with the budgetary outlook and IRS's 
management capabilities.[Footnote 41] We also noted that the vision 
and strategy should include time frames for consolidating and retiring 
legacy systems. IRS agreed with our recommendation, and, in response, 
developed an initial cycle of its Modernization Vision and Strategy 
(MV&S) in fiscal year 2006[Footnote 42] to guide IT investment 
decisions during fiscal years 2007 through 2011. IRS also developed a 
high-level strategy and 5-year schedule for retiring and consolidating 
systems, which it began implementing.[Footnote 43] 

In 2008, IRS began working on a new strategy, referred to as CADE 2 
that, among other things, addresses the management of individual 
taxpayer accounts as well as several long-term goals to enhance IRS's 
systems. Specifically, the strategy's initial phase is to create a 
modernized taxpayer database and to move the processing of individual 
taxpayer accounts from a weekly processing cycle to a daily processing 
cycle by the January 2012 filing tax season. In support of this new 
strategy, in July 2009, IRS developed a Preliminary Solution 
Architecture document which describes the characteristics of the 
strategy in both business and technical terms. IRS also developed a 
Preliminary Program Roadmap which defines the approach for delivering 
the new strategy and provides general time frames for delivering key 
phases known as transition states. IRS also established a program 
management office and defined a program management framework that 
would guide the strategy from initiation to completion. IRS provided 
us with key planning documents for the new strategy, including cost 
and schedule estimates and final Solution Architecture and Program 
Roadmap documents, at the conclusion of our review. We plan to review 
these documents in a CADE 2 review we have underway and determine if 
IRS has implemented our recommendation. 

Quantitative Measure of Progress in Meeting Scope Expectations: 

In February 2007, we recommended that IRS ensure that future 
expenditure plans include a quantitative measure of progress in 
delivering systems' planned functionality (scope).[Footnote 44] We 
also recommended that, in developing this measure, IRS consider using 
earned value management[Footnote 45] since this is a proven technique 
required by OMB for measuring cost, schedule, and functional 
performance (i.e., scope of work) against plans. While IRS agreed with 
our recommendation to develop a quantitative measure of progress in 
meeting scope expectations, it stated at the time that it did not 
believe earned value management would provide this measure, given the 
manner in which the technique was being used at the agency. Instead 
IRS proposed a two-step approach to address our recommendation. 
[Footnote 46] As an initial step, IRS developed a qualitative measure 
that indicated the difference between a project release's planned and 
delivered capabilities and began using it in the fiscal year 2008 
expenditure plan. In March 2008, we reported that, as a second step, 
IRS planned to leverage its requirements management tools to assign 
quantitative values to the capabilities in order to develop a 
quantitative measure of scope in the fiscal year 2009 plan. IRS did 
not have the measurement of scope ready for the fiscal year 2009 
expenditure plan as planned but stated that it was continuing to 
develop the metric and that a schedule for implementation and 
inclusion into the annual expenditure plan would depend on the outcome 
of pilot efforts. IRS stated that it is still in the process of 
analyzing the results of pilots conducted in August 2008 and February 
2009 and plans to present a finalized process to its Application 
Development organization by March 31, 2010. Fully implementing a 
quantitative measure of progress in delivering systems' planned 
functionality will help IRS in managing and controlling BSM. 

Results: Observations: 		
		
Objective 3: Observations about IRS's BSM Program and Expenditure Plan: 

Observation 1: Of 10 project milestones[Footnote 47] planned for 
fiscal year 2009, 6 were completed within 10 percent of cost and 
schedule estimates or early, and 3 were completed on schedule but more 
than ten percent over cost. For 1 of the milestones, we could not 
determine cost or schedule variances because IRS had not identified 
planned cost and schedule information in the fiscal year 2009 
expenditure plan. 

Our analysis of IRS's reported planned and actual milestone costs and 
completion dates showed that six milestones were completed within 10 
percent of cost and schedule estimates or early and three were 
completed on schedule but more than ten percent over cost, although 
they were within ten percent of schedule estimates. Release 5 of CADE, 
intended to implement legislative changes associated with filing 
season 2010, completed detailed design (milestone 4a) at planned cost 
and on schedule; the release of AMS which is intended, among other 
things, to provide for the conversion of the Correspondence Imaging 
System to a new platform for inventory management, completed 
development 127 percent over planned cost. We were not able to 
determine cost or schedule variances of a milestone of MeF, release 
6.1, because IRS had not identified planned cost and schedule 
information for it.[Footnote 48] 

Figure 1 depicts the detailed cost and schedule variances of the 
project milestones that were completed during fiscal year 2009. 

Figure 1: Cost and Schedule Variances for Project Milestones Completed 
in Fiscal Year 2009: 

[Refer to PDF for image: vertical bar graph] 

Program: CADE; 
Release: 4.2; 
Milestone: 4; 
Cost variance: 2.1%; 
Schedule variance: -20.3%. 

Program: CADE; 
Release: 5; 
Milestone: 2-3; 
Cost variance: 0; 
Schedule variance: 0. 

Program: CADE; 
Release: 5; 
Milestone: 4a; 
Cost variance: 0; 
Schedule variance: 0. 

Program: AMS; 
Release: 1.2; 
Milestone: 5; 
Cost variance: 0; 
Schedule variance: 0.5%. 

Program: AMS; 
Release: 1.3; 
Milestone: 4b; 
Cost variance: 126.7%; 
Schedule variance: 8.5%. 

Program: AMS; 
Release: 1.3; 
Milestone: 5; 
Cost variance: 296.6%; 
Schedule variance: -0.7%. 

Program: AMS; 
Release: 2.1; 
Milestone: 4a; 
Cost variance: 29.2%; 
Schedule variance: 0. 

Program: AMS; 
Release: 2.1; 
Milestone: 4b; 
Cost variance: -10.4%; 
Schedule variance: 0. 

Program: IPM; 
Release: 4; 
Milestone: 4b; 
Cost variance: 0; 
Schedule variance: 0.9%. 

Source: GAO analysis of IRS data. 

[End of figure] 

The following provides details for the six milestones that were 
completed within ten percent of cost and schedule estimates or early: 

CADE: 

* Release 4.2, milestone 4: this release, intended to process decedent 
and surviving spouse returns, credit elect processing, receipt 
processing, criminal investigation refund hold, and last name changes, 
completed the development, test, and integration phase at a cost of 
$28,848,000—about 2 percent over the estimated cost—and about 10 weeks 
(or 20 percent) earlier than planned. It should be noted, however, 
that according to the fiscal year 2010 expenditure plan, some 
functionality--the credit election processing and criminal 
investigation refund hold--was not completed as planned and was 
deferred to a subsequent release. When we followed up with IRS 
officials, they stated that the functionality that was deferred 
represented only some final testing that needed to be completed; 
however, without a quantitative measure of the scope, both planned and 
delivered, at each milestone, it is difficult to assess the impact of 
these deferrals. As noted earlier, IRS is continuing to work toward 
developing such a metric in response to our previous recommendation. 

* Release 5, milestone 3: this release, intended to implement 
legislative changes associated with filing season 2010 and also 
complete the credit elect and refund hold capabilities that were 
deferred from the previous release, was reported to have completed 
preliminary design on March 17, 2009, within ten percent of cost and 
schedule estimates. (In our fiscal year 2009 BSM expenditure plan 
report, we noted that the initial plan for completing this milestone 
was September 30, 2008, and that, at that time, the milestone was 
already 10 percent over schedule. We also noted that IRS had reported 
stopping work on release 5 of CADE pending the results of its review 
of long-term plans for BSM. While IRS reported that the milestone was 
completed on March 17, 2009, 30 percent later than planned, the agency 
subsequently rebaselined the schedule for milestone 3 to show a March 
17, 2009, completion date in response to strategic changes being made 
for the program). IRS reported spending $6.025 million to complete 
this preliminary design phase, which represents a cost variance of 
zero. 

* Release 5, milestone 4a, completed the detailed design phase on 
April 30, 2009, and at a cost of $11.5 million as planned. 

AMS: 

* Release 1.2, milestone 5: this release, which was intended to 
include a new inventory and workflow that automates the assignment, 
research, resolution, and closure for entity and account transcripts, 
completed system deployment at planned cost and on schedule. 

* Release 2.1, milestone 4b: this release, intended to provide, among 
other things, enhanced views of tax return information and 
correspondence images for taxpayer accounts as well as the ability to 
view and edit taxpayer name and contact information, completed 
development on schedule and about 10 percent under the budgeted cost. 

IPM: 

* Release 4, milestone 4b: this release, intended to add new data 
sources (including data fields from the Individual Master File and the 
Information Returns Master File), completed development at planned 
cost and on schedule on December 16, 2008. 
		
The following provides details on the three AMS milestones that were 
significantly over cost but on schedule: 

* Release 1.3, milestone 4b: this release, which is intended, among 
other things, to provide for the conversion of the Correspondence 
Imaging System to a new platform for inventory management, completed 
development 127 percent over planned cost. 

* Release 1.3, milestone 5, completed deployment 297 percent over 
planned cost. 

* Release 2.1, milestone 4a: this release, which, as previously noted, 
is intended to provide, among other things, enhanced views of tax 
return information and correspondence images for taxpayer accounts as 
well as the ability to view/edit taxpayer name and contact 
information, completed detailed design 29 percent over planned cost.
IRS's explanation of the cost variances for these AMS milestones in 
the expenditure plan did not include the underlying cause for these 
variances, as called for in IRS's own guidance. In the plan, IRS 
attributed the variances to the need to fund the projects in excess of 
planned amounts. When we followed up with IRS, it attributed the cost 
increases for these milestones to the number of software and 
infrastructure activities required to migrate to the system's long-
term platform. IRS stated that, while these activities were initially 
estimated as part of the overall program, they had to be accomplished 
in this release in order to implement a usable solution that could 
then be used to implement the incremental changes in subsequent 
releases. Reporting on these underlying causes of variances in the 
expenditure plan in a consistent manner would provide Congress with 
insight into specific areas needing improvement. 

The following provides information on the milestone for which we could 
not calculate cost and schedule variances: 

* IRS completed detailed design (milestone 4a) for release 6.1 of MeF, 
intended to include the rollout of electronic versions of Form 1040 
and 22 other schedules, including Schedules A, B, and D, on December 
4, 2008. IRS, however, did not report this milestone in the 
expenditure plan because it had not identified specific cost and 
schedule estimates for it in the fiscal year 2009 expenditure plan. 
Rather, IRS had reported estimates for combined milestones 4a to 5. 
While IRS has stated that its ELC allows for combining milestones to 
provide flexibility, the ELC also cautions that such combinations 
should be used to a limited extent since it poses greater risk than 
having separate milestones. This is because a longer period of time 
elapses, more work is performed, and more expense is incurred before 
the project receives management scrutiny. While we agree, consistent 
with IRS's policy, that combined milestones should be used to a 
limited extent, not reporting on individual milestones in the 
expenditure plan reduces transparency by not disclosing information on 
progress in delivering functionality to Congress in a timely manner. 

It is important to note that the deployment of Release 6.1 of MeF 
represents a change in strategy whose net effect on the performance of 
the project is difficult to assess. Specifically, in response to 
schedule delays due to added complexities and requirements, IRS 
developed a new deployment strategy whereby the deployment of the 1040 
series of forms is expected to be completed up to 2 years later than 
planned under the initial strategy and at a cost of nearly $50 million 
more. However, a quantitative measure of progress in meeting scope 
expectations, which as previously noted, IRS expects to develop by the 
end of this month, would help more accurately assess the impact of 
this new strategy.
		
Observation 2: IRS has begun development of its new modernization 
strategy, but time frames for completing key planning activities for 
Transition State 2 have not yet been defined. 

IRS expects CADE 2, among other things, to: 

* establish a solid data foundation for the future by leveraging 
relational database processing capability; 

* address financial material weaknesses; 

* improve the agency's security and privacy posture by addressing 
identified weaknesses; 

* continue the focus on moving away from 1960s technology (i.e., aging 
infrastructure and applications and sequential flat-file processing); 
and; 

* demonstrate progress toward achieving long-term viability. 

In June 2009, IRS developed a CADE Program Management Office (PMO) 
Operating Model and Roadmap that identified high-level milestones for 
completing key activities associated with the development of the CADE 
2 PMO. IRS has completed activities associated with standing up the 
PMO and developing the PMO operating model. For example, IRS assigned 
key program leadership positions; defined PMO requirements, scope, and 
objectives; and defined the organizational structures and PMO staffing 
needs. In July 2009, IRS established the CADE 2 PMO to guide the 
implementation of the new strategy. 
		
IRS has identified two key phases, referred to as "transition states," 
for delivering the new strategy. The key objectives of these 
transition states are summarized below: 

Table 4: Summarization of CADE 2 Transition States: 

Transition State 1: 

1. Build an enterprise data model and establish the CADE 2 database 
that will house data on	individual taxpayers and their accounts. 

2. Enhance core IMF functionality, modify supporting systems and 
applications, and make required changes to upstream and downstream 
systems to support daily processing. 

3. Make progress toward addressing financial material weaknesses by 
establishing a plan to create a baseline and identifying changes 
needed for Federal Financial Management System Requirements 
compliance. 	 

Transition State 2: 

1. Core applications will directly access and update the CADE 2 
database. 

2. Address financial and security material weaknesses. 

3. Restructure core tax processing applications by either leveraging 
current tax applications or building new ones. 

4. Establish a single processing system - eliminating dual operating 
environments. 

Source: GAO Analysis of IRS data. 

[End of table] 

It is expected that CADE 2 will result in faster refunds, improved 
customer service, elimination of notices based on out-of-date 
information, faster resolution of taxpayer account issues, and better 
online tools and services for taxpayers. IRS currently estimates CADE 
2 costs for Transitions States 1 and 2 through fiscal year 2014 at 
about $700 million. 

IRS has made progress in defining the transition states. For example, 
in addition to the Preliminary Solution Architecture[Footnote 49] and 
Preliminary Program Roadmap[Footnote 50] mentioned earlier, IRS 
baselined the business and technical requirements for Transition State 
1 at the end of January 2010. Further, IRS has begun developing four 
different prototypes to test the feasibility of technologies and 
solution approach and gain confidence in system viability and 
performance. These prototypes, three of which are expected to be 
completed in fiscal year 2010 and the last one when the target state 
is reached, will test the following: (1) Java's performance, 
scalability, and ability to handle high-performance batch processing; 
(2) moving taxpayer information on IMF from weekly to daily 
processing; (3) the penalty and interest calculation's ability to meet 
performance requirements; and (4) end-to-end performance for each of 
the major transition states and the target state. 

IRS has taken several actions to increase the likelihood that CADE 2 
will be successfully defined and implemented. For example, key 
business stakeholders have been involved in defining the overall 
vision and specific requirements; a program management office has been 
established to manage the program; a governance framework involving 
MITS and business representatives at multiple levels has been 
developed to oversee the program; independent assessments have been 
performed to validate IRS's approach and make recommendations for 
improvements as appropriate; and, as previously noted, efforts to 
improve IRS's software development and acquisition practices have been 
initiated. 
		
For Transition State 2, IRS plans to set up a team to work on 
requirements, design principles, a framework for applications and 
infrastructure, engineering analysis, and prototypes during fiscal 
year 2010. However, it has yet to define associated time frames for 
completing these key planning activities. These time frames are 
critical to guiding progress in laying the groundwork for achieving 
the transition state's objectives of (1) using the CADE 2 database to 
feed downstream systems; (2) addressing financial and security 
material weaknesses; (3) restructuring core tax processing 
applications by either leveraging current or building new tax 
applications; and (4) eliminating dual operating environments. 

Observation 3: CADE 2 faces several risks. 

IRS has identified many risks associated with defining and 
implementing CADE 2. The agency has classified these risks into five 
categories: 

* Delivery (e.g., the ability to deliver capabilities could be 
jeopardized if the scope is not rigorously managed);
* Program (e.g., managing expectations in order to have adequate time 
for due diligence);
* People (e.g., staffing of the program management office to 
authorized staffing levels);
* Technology and complexity (e.g., successful processing of individual 
tax returns could be jeopardized if the target solution does not meet 
system performance requirements for peak volume and required 
throughput with reasonable capacity);
* Management (e.g., the ability to achieve Transition State 1 could be 
affected if the new collaborative operating model is not implemented 
successfully). 

IRS has defined and reports that it is implementing mitigation 
strategies for each risk identified.[Footnote 51] For example, IRS has 
stated that it will develop a knowledge transfer plan, a resource and 
staffing plan, and a training plan to update the skill set of current 
IRS employees to address the "critical skill constraints" risk, which 
it defines as having a limited number of people with the requisite 
knowledge and skills in current systems. 

In December 2009,[Footnote 52] TIGTA identified several challenges 
that IRS needs to address to effectively manage identified risks, 
including, among other things, implementing a governance structure for 
the Program Management Office to provide oversight and direction for 
the implementation of CADE 2, and developing contingency plans in the 
event that CADE 2 cannot be fully implemented. In its comments on 
TIGTA's report, IRS stated that it found the assessment to be valid. 

Observation 4: Information Security weaknesses continue to affect 
IRS's modernization environment. 

IRS continues to have information security weaknesses that affect its 
modernization environment. In November 2009,[Footnote 53] we reported 
that while IRS continued to make progress in correcting previously 
reported information security weaknesses, previously identified and 
newly identified weaknesses in internal controls over information 
security continue to place IRS systems at risk. For example, managers 
did not always provide timely review of employee access to sensitive 
data center areas as required to ensure that access is limited only to 
employees who need it to perform their jobs. Additionally, while IRS 
had informed us that it had corrected about 40 percent of the 
previously reported weaknesses, we found that it had not fully 
implemented the remedial actions it reported for at least a third of 
those weaknesses that it considered corrected. In written comments on 
our report, IRS stated that improving information security continues 
to be a priority and noted accomplishments it made in this area during 
fiscal year 2009. For example, IRS stated that it limited access to a 
reduced number of authorized staff and implemented controls to enforce 
the use of strong passwords in accordance with Internal Revenue Manual. 

Further, in August 2009,[Footnote 54] TIGTA reported that while IRS 
had taken steps to address 16 CADE system security vulnerabilities it 
had identified in a previous audit, only 10 had been fully resolved 
and the remaining 6 could not be resolved until controls were 
effectively in place or had been approved as deviations to IRS policy. 
These vulnerabilities increase the risks that (1) management will pay 
less attention to unresolved problems, (2) resources required to fix 
problems will not be allocated, (3) vulnerabilities will not be 
corrected in a timely fashion, and (4) the Office of Management and 
Budget will be unable to obtain an accurate status of IRS security 
weaknesses. As a result, TIGTA recommended that IRS take actions to 
ensure CADE and mainframe computer system owners (1) appropriately 
enter and track system vulnerabilities on control systems and (2) 
verify that corrective actions are fully implemented before they are 
considered and reported as resolved. IRS agreed with TIGTA's 
recommendations and stated that the cybersecurity organization will 
continue to improve the process to ensure that system owners comply 
with IRS policy to enter and track all system vulnerabilities in IRS 
control systems. 

In addition to the steps that IRS is taking to address security 
recommendations from GAO and TIGTA, IRS has stated that, in Transition 
State 2, CADE 2 will fully address the security weaknesses that are 
currently confronting CADE. While actions to address the identified 
report findings will help to improve its security posture, IRS's 
modernization environment will continue to be at risk until the agency 
fully implements its security programs. 

[End of section] 

Conclusions: 

During fiscal year 2009, IRS continued to deliver BSM projects, 
although work on planned releases of CADE and AMS was either modified 
or suspended pending completion of efforts to define the agency's new 
strategy to manage individual taxpayer accounts. IRS generally made 
progress in addressing outstanding recommendations from our prior 
expenditure plan reviews. However, the expenditure plan explanations 
for significant project cost variances did not always provide 
information on root causes, limiting Congress's insight into areas 
needing improvement. Further, because IRS did not report one completed 
project milestone for which it had not identified specific plans in 
the fiscal year 2009 expenditure plan, Congress did not receive 
information on progress in delivering key functionality. Finally, 
while much has been done to define the Transition States—or key phases—
of the CADE 2 strategy for managing individual taxpayer accounts, 
specific time frames for addressing key planning activities for 
Transition State 2, including defining core requirements, have not 
been defined. Having these time frames would guide progress in 
completing activities that are foundational to the transition state. 

[End of section] 

Recommendations for Executive Action: 

To improve the program management capabilities and controls that are 
critical to the effective management of the BSM program, we are 
recommending that the Commissioner of Internal Revenue direct the 
Chief Technology Officer to take the following three actions: 

* ensure that explanations of project cost and schedule variances 
provided in the expenditure plan consistently include underlying 
causes; 

* for individual milestones that have been combined, report available 
performance information in the expenditure plan to provide Congress 
with information on progress in delivering functionality; and; 

* define specific time frames for CADE 2 Transition State 2 planning 
activities, including defining a core set of requirements to guide 
progress. 

[End of section] 

Agency Comments and Our Evaluation: 

In e-mail comments and subsequent oral comments on a draft of these 
briefing slides, the IRS's Chief Technology Officer (CTO) generally 
agreed with much of the information presented but disagreed with two 
of our findings and with two of our recommendations. Specifically, he 
disagreed with our finding that IRS partially complies with the 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices used by the government, stating that there is no 
requirement for federal agencies to use the cited practices. We have 
previously reported that to effectively manage major IT programs, 
organizations must use sound acquisition and management processes to 
minimize risks and thereby maximize chances for success. Such 
processes have been identified by leading organizations such as the 
Software Engineering Institute, the Chief Information Officers 
Council, and in our prior work analyzing best practices in industry 
and government. In particular, the CMMI model defines a suite of key 
acquisition process control areas that are necessary to manage system 
acquisitions in a rigorous and disciplined fashion. We are focusing on 
level-2 practices because it is recognized that, without them, 
processes are typically ad hoc and chaotic. Since IRS is not yet level-
2 compliant, the agency partially complies with the acquisition rules, 
requirements, guidelines, and systems acquisition management practices 
used by the government. 

IRS also disagreed with our finding that it has not fully implemented 
our recommendation to develop a long-term plan for BSM, stating that 
it believed that it had addressed this by providing the Modernization 
Vision and Strategy (MV&S) in fiscal year 2006. We have previously 
reported that the MV&S did not fully address our recommendation. 
[Footnote 55] We acknowledge IRS's recent update of the MV&S with the 
CADE 2 strategy. As previously stated, we received the key planning 
documents associated with this strategy at the conclusion of our 
review and plan to review them as part of a review of CADE 2 that is 
currently underway. 

Regarding our recommendation to ensure the explanations of project 
cost and schedule variances provided in the expenditure plan include 
underlying causes, IRS stated that the expenditure plan consistently 
provides narrative explanations of all project segment cost and 
schedule variances, in addition to the attribution of those variances. 
While we agree with this statement, our point is that the underlying 
causes for the cost variances for three AMS milestones were not in the 
plan, in accordance with IRS's own guidance. IRS, however, provided us 
this information when we followed up with the agency. 

Regarding our recommendation to report on project milestones delivered 
for which specific cost and schedule estimates were not identified in 
fiscal year 2009 the expenditure plan (due to milestones being 
combined), the CTO commented that, when milestones are combined within 
a project segment, IRS generally does not develop or track specific 
cost and schedule estimates for the individual project milestones and 
that since milestone-specific information is not available, only the 
overall cost and schedule estimate for the combined milestone segment 
is reported in the expenditure plan. However, in the case of MeF, IRS 
developed and tracked schedule information for milestone 4a but did 
not report it. Reporting this information would improve the 
transparency of IRS's progress in delivering functionality. IRS also 
provided technical comments which we have addressed as appropriate. 

[End of section] 

Appendix I: Description of BSM Projects and Program-Level Initiatives: 
	
Tax administration projects: 

Proposed modernization initiative: Modernized e-File; 
Description: Is to provide a single standard for filing electronic tax 
returns. Initial releases will address large corporations, small 
business, and tax-exempt organizations. Its ultimate goal is the 
conversion of IRS's 1040 e-file program. 

Proposed modernization initiative: Current Customer Account Data 
Engine (CADE); 
Description: Is to build the modernized database foundation to replace 
the existing Individual Master File (IMF) processing system that 
contains the repository of individual taxpayer information. 

Proposed modernization initiative: Customer Account Data Engine 2 
(CADE 2): 
Description: Is intended to leverage Current CADE and the IMF, which 
contain the repository of individual taxpayer information, to provide 
timely access to authoritative individual taxpayer account information 
and enhance IRS's ability to address technology, security, financial 
material weaknesses, and long-term architectural planning and viability.
	
Core infrastructure projects: 

Proposed modernization initiative: Development, Integration, and 
Testing Environments; 
Description: Is to provide oversight for laboratory environments that 
support evaluation, development, and testing of components from 
multiple projects: (1) Virtual Development Environment provides a 
software development environment and a standardized set of tools, and 
(2) Enterprise Integration and Test Environment provides an 
integration and testing environment for all projects. 

Proposed modernization initiative: Infrastructure Shared Services; 
Description: Is to deliver, in incremental releases over multiple 
years, a fully integrated, shared IT infrastructure to include 
hardware, software, shared applications, data, telecommunications, 
security, and an enterprise approach to systems and operations 
management.
	
Architecture, integration, and management: 

Proposed modernization initiative: Architecture and integration; 
Description: Is to ensure that systems solutions meet IRS business 
needs and that the development projects are effectively integrated 
into the business environment.
	
Proposed modernization initiative: Business integration; 
Description: Is to ensure that IRS's BSM program is aligned with the 
business units' vision and delivers the desired business results. It 
provides support to key activities such as transition management, 
business rules enterprise management, and requirements development and 
management operations. 

Proposed modernization initiative: Business rules and requirements 
management; 
Description: Is to provide support to business process analysis and 
redesign by harvesting and managing an enterprise set of business 
rules and developing business requirements. 

Proposed modernization initiative: Management processes; 
Description: Is to provide sustaining support for program-level 
management processes, including quality assurance, risk management, 
program control and process management, and enterprise life cycle 
maintenance and enhancements. 

Proposed modernization initiative: Federally funded research and 
development center; 
Description: Is to provide program management and systems engineering 
support. 

Proposed modernization initiative: Program management; 
Description: Is to ensure programs achieve their objectives by 
providing the management information and IT infrastructure that 
supports risk management, project cost and schedule estimating, 
financial management, and procurement management for the prime 
contracts and associated task orders. 

Source: GAO analysis of IRS data. 

[End of table] 

[End of Appendix I] 

Appendix II: Additional Detail on IRS's Fiscal Year 2010 BSM 
Expenditure Plan: 

Tax administration projects: 

Proposed modernization initiative: Modernized e-File (MeF); 
Release[A]: 6.2; 
Milestone/type of activity[B]: 3-5; 
Amount Requested (In thousands): $17,000. 

Proposed modernization initiative: MeF; 
Release[A]: 7; 
Milestone/type of activity[B]: 3-4a; 
Amount Requested (In thousands): $33,000. 

Subtotal—MeF project: 
Amount Requested (In thousands): $50,000. 
			
Proposed modernization initiative: Current Customer Account Data 
Engine (CADE); 
Release[A]: 6.2; 
Milestone/type of activity[B]: 4b; 
Amount Requested (In thousands): $22,000. 

Proposed modernization initiative: Current CADE; 
Release[A]: operations and maintenance; 
Milestone/type of activity[B]: Level of Effort (LOE); 
Amount Requested (In thousands): $16,000. 

Subtotal—Current CADE project: 
Amount Requested (In thousands): $38,000. 
			
Proposed modernization initiative: CADE 2; 
Release[A]: Infrastructure; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $11,519. 

Proposed modernization initiative: CADE 2; 
Release[A]: Program Management Office; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $4,846. 

Proposed modernization initiative: CADE 2; 
Release[A]: Engineering and Analysis; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $9,100. 

Proposed modernization initiative: CADE 2; 
Release[A]: Transition State 1; 
Milestone/type of activity[B]: LOE. 
Amount Requested (In thousands): $17,594; 

Proposed modernization initiative: CADE 2; 
Release[A]: Transition State 2; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $1,941. 

Proposed modernization initiative: CADE 2; 
Release[A]: Integrated Production Model; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $2,654. 

Subtotal—CADE 2 project: 
Amount Requested (In thousands): $47,654. 

Subtotal—tax administration projects: 
Amount Requested (In thousands): $135,654. 
			
Core infrastructure projects: 

Proposed modernization initiative: Development, integration, and 
testing environment; 
Milestone/type of activity[B]: Infrastructure (INF); 
Amount Requested (In thousands): $14,500. 

Proposed modernization initiative: Infrastructure Shared Services; 
Milestone/type of activity[B]: INF; 
Amount Requested (In thousands): $17,500. 

Subtotal—core infrastructure projects: 
Amount Requested (In thousands): $32,000. 
			
Architecture, integration, and management: 

Proposed modernization initiative: Architecture and integration; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $13,745. 

Proposed modernization initiative: Business integration; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $4,206. 

Proposed modernization initiative: Business rules and Requirements 
Management; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $3,160. 

Proposed modernization initiative: Management processes; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $3,539. 

Proposed modernization initiative: Federally funded research and 
development center; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $7,396. 

Proposed modernization initiative: Program management; 
Milestone/type of activity[B]: LOE; 
Amount Requested (In thousands): $2,954. 

Subtotal—architecture, integration, and management: 
Amount Requested (In thousands): $35,000. 

Management reserve: 
Amount Requested (In thousands): $5,020. 

BSM Capital Total: 
Amount Requested (In thousands): $207,674. 

BSM Labor Total: 
Amount Requested (In thousands): $44,666. 

Maintaining Current Levels: 
Amount Requested (In thousands): $1,334 

Total fiscal year 2010 BSM program: 
Amount Requested (In thousands): $253,674. 

Source: GAO analysis of IRS data. 

[A] Releases are software versions that provide a subset of the total 
planned project functionality. 

[B] Milestones correspond to phases within IRS's enterprise life cycle 
(0 — vision and strategy/enterprise architecture, 1— project 
initiation, 2 — domain architecture, 3 — preliminary design, 4a —
detailed design, 4b — system development, 5 — system deployment). 
According to IRS, level of effort activities generally support the 
overall management of the program, such as contracting or risk 
management. They do not follow the ELC methodology nor do they 
directly create end user benefits. They do require the contractor to 
provide a specified level of effort, over a stated period, on work 
stated in general terms. Infrastructure projects follow many aspects 
of the ELC but differ from development projects in that they (1) do 
not have a separate business case, though they have definable costs 
and general broad benefits; (2) operate based on the support needs of 
the project, rather than end-user requirements; (3) cannot make 
changes that are independent from the projects they support, that is, 
the infrastructure projects must synchronize changes with the 
application projects and assess the impact; and (4) project teams have 
no direct control over external changes (e.g., a new requirement for 
an application project) that will drive cost fluctuations. 

[End of table] 

[End of Appendix II] 

Appendix III: Reported Cost and Schedule for Projects Scheduled for 
Completion in Fiscal Year 2009: 
				
This table shows the projects completed in fiscal year 2009. 

Project segment: AMS; Release 1.2; Milestone 5; 
Estimated completion date and funding (in thousands): 11/11/08; $1,060; 
Milestone exit and cost (in thousands):	11/13/08; $1,060; 
Change (%): 1 day (0.5%); $0 (0%); 
IRS explanation of change: Exit was completed one day later than 
planned due to the scheduling of a Customer Service Executive Steering 
Committee meeting. 

Project segment: AMS; Release 1.3; Milestone 4b; 
Estimated completion date and funding (in thousands): 11/11/08; $3,747; 
Milestone exit and cost (in thousands):	12/05/08; $8,494; 
Change (%): 16 days (8.5%); $4,747 (126.7%); 
IRS explanation of change: Technical complexity of the configurations 
and development of the environment resulted in approximately a 3-week 
delay in exiting this milestone. Additionally, cost variance was due 
to development costs significantly exceeding estimates and required 
realignment of AMS project funds to continue funding the development 
of this release. 

Project segment: AMS; Release 1.3; Milestone 5; 
Estimated completion date and funding (in thousands): 05/31/09; $1,006; 
Milestone exit and cost (in thousands):	05/28/09; $3,990; 
Change (%): -1 day (-0.7%); $2,984 (296.6%); 
IRS explanation of change: Completed one day earlier than planned. 
Additionally, cost variance was due to development costs significantly 
exceeding estimates and required realignment of AMS project funds to 
continue funding the development of this release. 

Project segment: AMS; Release 2.1; Milestone 4a; 
Estimated completion date and funding (in thousands): 12/09/08; $2,522; 
Milestone exit and cost (in thousands):	12/09/08; $3,258; 
Change (%): 0 days (0%); $736 (29.2%); 
IRS explanation of change: Variance is due to the need for additional 
funding to complete software and infrastructure design activities. 

Project segment: AMS; Release 2.1; Milestone 4b; 
Estimated completion date and funding (in thousands): 08/05/09; $4,402; 
Milestone exit and cost (in thousands):	08/05/09; $3,946; 
Change (%): 0 days (0%); -$456 (-10.4%); 
IRS explanation of change: Variance is due to slightly less funding 
needed for development activities than original planned amounts. 

Project segment: CADE; Release 4.2; Milestone 4; 
Estimated completion date and funding (in thousands): 03/31/09; 
$28,265; 
Milestone exit and cost (in thousands):	01/15/09; $28,848; 
Change (%): -51 days (-20.3%); $583 (2.1%); 
IRS explanation of change: Schedule variance resulted from exiting 
this milestone 10 weeks earlier than originally planned. However, some 
functionality deferred to subsequent release. Cost variance resulted 
from the need to fund development activities related to additional 
unplanned requirements and legislative changes associated with the 
filing season. 

Project segment: CADE; Release 5; Milestones 2-3; 
Estimated completion date and funding (in thousands): 03/17/09; $6,025; 
Milestone exit and cost (in thousands):	03/17/09; $6,025; 
Change (%): 0 days (0%); $0 (0%). 
IRS explanation of change: Note: This planned exit date represents a 
rebaseline of an earlier estimate of 9/30/08. 

Project segment: CADE; Release 5; Milestone 4a; 
Estimated completion date and funding (in thousands): 04/30/09; 
$11,500; 
Milestone exit and cost (in thousands):	04/30/09; $11,500; 
Change (%): 0 days (0%); $0 (0%). 
IRS explanation of change: Note: This planned exit date represents a 
rebaseline of an earlier estimate of 11/30/08. 

Project segment: IPM; Release 4; Milestone 4b; 
Estimated completion date and funding (in thousands): 12/15/08; $563; 
Milestone exit and cost (in thousands):	12/16/08; $563; 
Change (%): 1 day (0.9%); $0 (0%); 
IRS explanation of change: [Empty]. 

Source: GAO Analysis of IRS data. 

Note: Variances for projects through milestone 3 are based on rough 
order of magnitude estimates. Post-milestone-3 variances are based on 
more specific estimates. 

IRS also completed additional milestones for IPM. However, we are not 
reporting on these because funding for them was not requested in the 
fiscal year 2009 expenditure plan. 

[End of table] 

[End of Appendix III] 

[End of Briefing slides] 

[End of section] 

Appendix II: Comments from the Internal Revenue Service: 

Department Of The Treasury: 
Deputy Commissioner: 
Internal Revenue Service: 
Washington, D.C. 20224: 
	
April 27, 2010: 

Mr. David A. Powner: 
Director, Information Technology Management Issues: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, DC 20548: 

Dear Mr. Powner: 

I reviewed the Government Accountability Office draft report titled 
"Business Systems Modernization: Internal Revenue Service's Fiscal 
Year 2010 Expenditure Plan," (Government Accountability Office 10-
539). We appreciate that your draft report recognizes the progress 
that the Internal Revenue Service has made to improve our program 
management capabilities and controls. 

We will review the three new recommendations the Government 
Accountability Office reported to ensure our actions include assuring 
that underlying causes for project cost and schedule variances are 
consistently provided in the expenditure plan. We will provide the 
detailed corrective action plan addressing each of the recommendations 
with our response to the final report. 

We appreciate your continued support and the assistance and guidance 
from your staff. 

If you have any questions or would like to discuss our response in 
more detail, please contact Terence V. Milholland, Chief Technology 
Officer, at (202) 6226800. 

Sincerely, 

Signed by: 
Mark A. Ernst: 
Deputy Commissioner, Operations Support: 

[End of section] 

Appendix III: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

David A. Powner, (202) 512-9286 or pownerd@gao.gov: 

Staff Acknowledgments: 

In addition to the individual named above, Sabine R. Paul, Assistant 
Director; Neil Doherty; Mary D. Fike; Nancy Glover; Lee McCracken; 
Paul B. Middleton; and Krzysztof Pasternak made key contributions to 
this report. 

[End of section] 

Footnotes: 

[1] BSM funds (except labor costs) are unavailable until IRS submits a 
modernization expenditure plan to the congressional appropriations 
committees and obtains their approval. See the Consolidated 
Appropriations Act, 2010, Pub. L. No. 111-117, Division C, Title I, 
Dec. 16, 2009, 123 Stat. 3034, 3164. 

[2] This plan must (1) meet the Office of Management and Budget's 
(OMB) capital planning and investment control review requirements; (2) 
comply with IRS's enterprise architecture; (3) conform with IRS's 
enterprise life cycle methodology; (4) comply with federal acquisition 
rules, requirements, guidelines, and systems acquisition management 
practices; (5) be approved by IRS, the Department of the Treasury, and 
OMB; and (6) be reviewed by GAO. These conditions for BSM funding 
availability have been in effect for several years, including the 
immediately preceding fiscal year. At the time of this report, the 
latest appropriation was provided under the Consolidated 
Appropriations Act, 2010, Pub. L. No. 111-117, Division C, Title I, 
Dec. 16, 2009. 

[3] For this condition, we did not determine whether the expenditure 
plan comports with the Federal Acquisition Regulation or other federal 
requirements beyond those encompassed by the Software Engineering 
Institute's Capability Maturity Model Integration (CMMI). 

[4] We are referring to the practices defined in the CMMI model. CMMI 
is registered in the U.S. Patent and Trademark Office by Carnegie 
Mellon University's Software Engineering Institute. It is the process 
model that describes how to develop the processes needed for software 
development and specific practices that organizations should follow. 

[5] IRS's Enterprise Life Cycle Guidance defines seven milestones, 
each occurring at the end of one of the phases of the life cycle. 
Milestone 0-at the end of vision and strategy or enterprise 
architecture; 1-project initiation; 2-domain architecture; 3-
preliminary design; 4-development, test, and integration; and 5-system 
deployment. The development, test, and integration phase is sometimes 
split into two phases, each corresponding to a different milestone: 4a-
detailed design and 4b-system development. 

[6] Releases are software versions that provide a subset of the total 
planned project functionality. 

[7] CADE was intended to replace the antiquated Individual Master File 
containing the repository of individual taxpayer information. It is 
currently being used to provide for daily processing of tax returns 
for approximately 40 million taxpayers. 

[8] AMS is intended to enhance customer support by providing 
applications that enable IRS employees to access, validate, and update 
individual taxpayer accounts on demand. While IRS has stated that AMS 
will also be part of the new strategy for managing individual taxpayer 
accounts that is currently being implemented, it has not requested any 
funding for this project for fiscal year 2010. 

[9] Modernized e-file is the system intended to provide a single 
standard for filing electronic tax returns. 

[10] IRS has stated that it does not yet have any plans for 
modernizing the Business Master File, which stores tax data and 
related information on business taxpayers. IRS officials, however, 
have told us that they expect to be able to replicate the CADE 2 
approach to modernize the Business Master File. 

[11] We recently initiated a review of CADE 2. 

[12] GAO, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial 
Statements, [hyperlink, http://www.gao.gov/products/GAO-10-176] 
(Washington, D.C.: Nov. 10, 2009). 

[13] After we provided our expenditure plan review results to the 
subcommittees, we issued a report focusing on IRS's information 
security program: GAO, Information Security: IRS Needs to Continue to 
Address Significant Weaknesses, [hyperlink, 
http://www.gao.gov/products/GAO-10-355] (Washington, D.C.: Mar. 19, 
2010). 

[14] TIGTA, Customer Account Data Engine Release 4 Includes Most 
Planned Capabilities and Security Requirements for Processing 
Individual Tax Account Information, 2009-20-100 (Washington, D.C., 
Aug. 28, 2009). 

[15] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2005 Expenditure Plan, [hyperlink, 
http://www.gao.gov/products/GAO-05-774] (Washington, D.C.: July 22, 
2005). 

[16] Consolidated Appropriations Act, 2010, Pub. L No. 111-117, 
Division C, Title I, Dec. 16, 2009, 123 Stat. 3034, 3164. 

[17] These funds support IRS's efforts to modernize its business 
systems. Other systems efforts, including the maintenance of legacy 
applications, are supported by funding that is not subject to the BSM 
program legislative conditions. 

[18] An enterprise architecture is an institutional blueprint that 
defines how an enterprise operates today, in both business and 
technology terms, and how it intends to operate in the future. An 
enterprise architecture also includes a road map for transitioning 
between these environments. 

[19] IRS refers to its life cycle management program as the enterprise 
life cycle (ELC). 

[20] The amount appropriated for the BSM program for fiscal year 2010 
was approximately $264 million. 

[21] We are referring to the practices defined in the Capability 
Maturity Model Integration (CMMI®) model. CMMI is registered in the 
U.S. Patent and Trademark Office by Carnegie Mellon University's 
Software Engineering Institute. It is the process model that describes 
how to develop the processes needed for software development and 
specific practices that organizations should follow. 

[22] IRS's Enterprise Life Cycle Guidance defines seven milestones, 
each occurring at the end of one of the phases of the life cycle. 
Milestone 0--at the end of vision and strategy/enterprise 
architecture, 1--project initiation, 2--domain architecture, 3--
preliminary design, 4--development, test, and integration, 5--system 
deployment. The development, test, and integration phase is sometimes 
split into two phases, each corresponding to a different milestone: 
4a--detailed design and 4b--system development. 

[23] Releases are software versions that provide a subset of the total 
planned project functionality. 

[24] GAO, Business Systems Modernization: IRS Has Made Significant 
Progress in Improving Its Management Controls, but Risks Remain, 
[hyperlink, http://www.gao.gov/products/GA0-03-768] (Washington, D.C.: 
June 27, 2003). 

[25] GAO, Business Systems Modernization: IRS Needs to Complete Recent 
Efforts to Develop Polices and Procedures to Guide Requirements 
Development and Management, [hyperlink, 
http://www.gao.gov/products/GAO-06-310] (Washington, D.C.: Mar. 20, 
2006). 

[26] GAO, Business Systems Modernization: IRS's Fiscal Year 2004 
Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO-05-46] 
(Washington, D.C.: Nov. 17, 2004). 

[27] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2007 Expenditure Plan, [hyperlink, 
http://www.gao.gov/products/GAO-07-247] (Washington, D.C.: Feb. 15, 
2007). 

[28] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2009 Expenditure Plan, [hyperlink, 
http://www.gao.gov/products/GA0-09-281] (Washington, D.C.: Mar. 11, 
2009). 

[29] An initial cycle of the MV&S was completed in fiscal year 2006, 
and the strategy was updated a year later. IRS, Internal Revenue 
Service: IT Modernization Vision & Strategy (Washington, D.C: October 
2007). 

[30] IRS's Chief Technology Officer, who was appointed in November 
2008, reports to the Deputy Commissioner for Operations Support. 

[31] Efforts to maintain and enhance legacy applications are funded 
from a different source not subject to the BSM expenditure plan 
appropriations restriction. 

[32] CADE refers to the prime contract development efforts that began 
in 2002 to replace the legacy Master File and to date have resulted in 
a series of five CADE releases and sub-releases. IRS refers to the 
system as "Current CADE" in its expenditure plan. 

[33] IRS has stated that it does not yet have any plans for 
modernizing the Business Master File, which stores tax data and 
related information on business taxpayers. IRS officials, however, 
have told us that they expect to be able to replicate the CADE 2 
approach to modernize the Business Master File. 

[34] While IRS has stated that AMS will also be part of CADE 2, it has 
not requested any funding for this project for fiscal year 2010. 

[35] See Consolidated Appropriations Act, 2010, Pub. L. No. 111-117, 
Division C, Title I, Dec. 16, 2009, 123 Stat. 3034, 3164. 

[36] These key process areas are acquisition planning, solicitation, 
requirements development and management, project management, contract 
tracking and oversight, evaluation, and transition to support. For 
this condition, we did not determine whether the expenditure plan 
comports with the Federal Acquisition Regulation or other federal 
requirements beyond those encompassed by the Software Engineering 
Institute's Capability Maturity Model. 

[37] SEI is a federally funded research and development center 
operated by Carnegie Mellon University and sponsored by the Department 
of Defense. Its objective is to provide leadership in software 
engineering and in the transition of new software engineering 
technology into practice. 

[38] CMMI is registered in the U.S. Patent and Trademark Office by 
Carnegie Mellon University. The CMMI® is SEI's model that describes 
how to develop the processes needed for software development and 
specific practices that organizations should follow. 

[39] The CMMI® ranks organizational maturity according to five levels. 
Maturity levels 2 through 5 require verifiable existence and use of 
certain key process areas. CMMI level 2, known as the 'managed" level 
is characterized by processes that, among other things are planned and 
executed in accordance with policy; provide adequate resources; ensure 
the designated work products are under the appropriate levels of 
configuration management; involve relevant stakeholders; and are 
monitored, controlled, and reviewed. 

[40] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2008 Expenditure Plan, [hyperlink, 
http://www.gao.gov/products/GAO-08-420] (Washington, D.C.: Mar. 7, 
2008). 

[41] [hyperlink, http://www.gao.gov/products/GA0-05-774]. 

[42] IRS's MV&S initiative is intended to be an annual process through 
which the agency integrates the strategic plans, business concepts of 
operations, IT planning roadmaps, and proposed investments into a set 
of integrated strategies and investment proposals for each domain and 
ultimately into a proposed IT investment portfolio. 

[43] IRS, Applications Development: 5-Year Plan, "A systems view" 
Projects — Programs — Retirements & Consolidations. 

[44] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2007 Expenditure Plan, [hyperlink, 
http://www.gao.gov/products/GAO-07-247] (Washington, D.C.: Feb. 15, 
2007). 

[45] Earned value management is a project management tool that 
integrates the investment scope of work with schedule and cost 
elements for investment planning and control. This method compares the 
value of work accomplished during a given period with that of the work 
expected in the period. Differences between accomplishments and 
expectations are measured in both cost and schedule variances. 

[46] In December 2007, the Associate Chief Information Officer for 
Applications Development stated that IRS uses earned value management 
to measure progress in completing ELC deliverables, not in delivering 
functionality, and consequently the agency's application of earned 
value management does not provide a quantitative measure of progress 
in meeting scope expectations. 

[47] IRS's Enterprise Life Cycle Guidance defines seven milestones, 
each occurring at the end of one of the phases of the life cycle. 
Milestone 0--at the end of vision and strategy/enterprise 
architecture, 1--project initiation, 2--domain architecture, 3--
preliminary design, 4--development, test, and integration, 5--system 
deployment. The development, test, and integration phase is sometimes 
split into two phases, each corresponding to a different milestone: 
4a--detailed design and 4b--system development. 

[48] In the fiscal year 2009 expenditure plan, IRS requested funding 
for six milestones of AMS. IRS subsequently suspended these milestones 
pending completion of work to redefine its strategy for managing 
individual taxpayer accounts. 

[49] This document describes the characteristics of the new strategy 
in both business and technical terms. IRS provided us a final version 
at the conclusion of our review. 

[50] This document defines a high-level approach for delivering the 
new strategy and describes high-level milestones for delivering the 
transition states. IRS provided us a final version at the conclusion 
of our review. 

[51] We did not determine the effectiveness of IRS's methodology for 
identifying and mitigating risks but plan to do so in a review we have 
underway of IRS's CADE 2 strategy. 

[52] TIGTA, Reengineering Individual Tax Return Processing Requires 
Effective Risk Management, 2010-20-001 (Washington, D.C., Dec. 7, 
2009). 

[53] GAO, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial 
Statements, [hyperlink, http://www.gao.gov/products/GA0-10-176] 
(Washington, D.C.: Nov. 10, 2009). 

[54] TIGTA, Customer Account Data Engine Release 4 Includes Most 
Planned Capabilities and Security Requirements for Processing 
Individual Tax Account Information, 2009-20-100 (Washington, D.C., 
August 28, 2009). 

[55] [hyperlink, http://www.gao.gov/products/GAO-09-281]. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: