DOD Business Transformation: Air Force's Current Approach Increases Risk That Asset Visibility Goals and Transformation Priorities Will Not Be Achieved

In August 2008, we reported that neither the Defense Enterprise Accounting and Management System (DEAMS) nor the Expeditionary Combat Support System (ECSS) risk management programs used a comprehensive and fully integrated risk management process. Program risk was monitored, overseen, and managed independently by various groups or activities within the program without adequate visibility at the program management level. Without adequate visibility of risk management activities program wide, the program management office (PMO) has little assurance of the sufficiency of actions taken by its subordinate groups or activities to identify, analyze, and mitigate risk that may affect the programs. We recommended that the PMO for DEAMS and ECSS ensure that risk management activities at all levels of the program are identified and communicated to program management to facilitate oversight and monitoring. Key risks described at the appropriate level of detail should include risks associated with interfaces, data conversion, change management, and contractor oversight. The DEAMS Program Charter dated July 2009, provides that the risk management activities are to be managed by the Risk and Issue Management Integrated Product Team. The team offers a single program-level risk management component to ensure resolution of risks. In accordance with the charter, risk management activities at all levels of the program are to be identified and communicated to the DEAMS program management office and the functional management office to facilitate oversight and monitoring. Key risks to be considered include risks associated with interfaces, data conversion, change management, and contractor oversight. The charter further provided that the DEAMS PMO is responsible for articulating the requirements for an enterprise risk management capability to ensure risk data is accessible, integrated, and managed across multiple DEAMS stakeholder organizations and locations. In regard to ECSS, the Program Executive Officer and Director approved the ECSS Joint Manage Risk Process in August 2010. Subsequently, a revised risk management plan was issued in October 2010. Both documents provided that all identified risks are to be communicated to all affected stakeholders to include the Joint Risk Review Board and the Joint Risk Management Board. The Joint Risk Review Board is also the decision authority for closing/retiring all risks. The Boards are considered the senior program groups responsible for the oversight and monitoring of the ECSS program risks. These actions meet the intent of our recommendation.

In August 2008, we reported that the Defense Enterprise Accounting and Management System (DEAMS) program management office's (PMO) testing of DEAMS did not initially consider the impact that different computer desktop configurations would have on its ability to successfully deploy DEAMS, because they thought that there was a standard computer desktop configuration across the Air Force. As a result, the implementation of the system had to be delayed and system patches had to be developed to address software and connectivity issues before implementation of DEAMS could continue. The delay underscores how the importance of obtaining a comprehensive understanding of a location's current operating environment is essential to the successful implementation of a system. DEAMS's and ECSS's program management officials acknowledged that nonstandard computer desktop configurations will continue to represent a potential risk and indicated that they plan to test desk top configuration at each deployment location. We recommended that the Secretary of the Air Force direct the DEAMS and ECSS PMOs to test each system on relevant computer desktop configurations prior to deployment to a given location. The DEAMS PMO completed the initial desktop testing of the system in May 2010. Further, the DEAMS PMO worked with the Air Force Chief Information Officer to develop a schedule to allow for adequate testing of DEAMS at future deployment locations. The ECSS PMO reported completing the initial desktop configuration testing in March 2011. ECSS has also developed specific instructions for the testing of desktop compatibility that are to be followed as the system is released to the users at different locations. These actions meet the intent of our recommendation.

In March 2010 and March 2011 Air Force took actions to align the Office of Business Transformation and ensure that the Air Force's efforts are consistent with those outlined in the department's Strategic Management Plan and the Enterprise Transition Plan. Further, in March 2011, Air Force reported institutionalizing the use of metrics as part of regular performance reviews. With these actions, the Air Force has greater assurance that its business transformation plans are coordinated with overall DOD strategic plans.