document: Investments in IT can enrich people’s lives and improve organizational performance. During the last two decades the Internet has matured from being a means for academics and scientists to communicate with each other to a national resource where citizens can interact with their government in many ways, such as by receiving services, supplying and obtaining information, asking questions, and providing comments on proposed rules. However, while these investments have the potential to improve lives and organizations, some federally funded IT projects can—and have— become risky, costly, unproductive mistakes. We have previously testified that the federal government has spent billions of dollars on failed and troubled IT investments, such as the Office of Personnel Management’s Retirement Systems Modernization program, which was canceled in February 2011, after spending approximately $231 million on the agency’s third attempt to automate the processing of federal employee retirement claims; the tri-agency National Polar-orbiting Operational Environmental Satellite System, which was stopped in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion; the Department of Veterans Affairs’ Scheduling Replacement Project, which was terminated in September 2009 after spending an estimated $127 million over 9 years; and the Department of Health and Human Services’ (HHS) Healthcare.gov website and its supporting systems, which were to facilitate the establishment of a health insurance marketplace by January 2014, encountered significant cost increases, schedule slips, and delayed functionality. In a series of reports we identified numerous planning, oversight, security, and system development challenges faced by this program and made recommendations to address them. In light of these failures and other challenges, last year we introduced a new government-wide high-risk area, Improving the Management of IT Acquisitions and Operations. 18F and USDS were formed in 2014 to help address the federal government’s troubled IT efforts. Both programs have similar missions of improving public-facing federal digital services. 18F was created in March 2014 by GSA with the mission of transforming the way the federal government builds and buys digital services. Agencies across the federal government have access to 18F services. Work is largely initiated by agencies seeking assistance from 18F and then the program decides how and if it will provide assistance. According to GSA, 18F seeks to accomplish its mission by providing a team of expert designers, developers, technologists, researchers, and product specialists to help rapidly deploy tools and online services that are reusable, less costly, and easier for people and businesses to use. In addition, 18F has several guiding principles, to include the use of open source development, user-centered design, and agile software development. 18F is an office within the Technology Transformation Service within GSA that was recently formed in May 2016. 18F is led by the Deputy Commissioner for the Technology Transformation Service, who reports to the service’s Commissioner. Prior to May 2016, 18F was located within the Office of Citizen Services and Innovative Technologies and reported to the Associate Administrator for Citizen Services and Innovative Technologies. In March 2016 GSA created a new organizational structure for 18F that centers around five business units. Custom Partner Solutions. Provides agencies with custom application solutions. Products and Platforms. Provides agencies with access to tools that address common government-wide needs. Transformation Services. Aims to improve how agencies acquire and manage IT by providing them with consulting services, to include new management models, modern software development practices, and hiring processes. Acquisition Services. Provides acquisition services and solutions to support digital service delivery, including access to vendors specializing in agile software development, and request for proposal development consultation. Learn. Provides agencies with education, workshops, outreach, and communication tools on developing and managing digital services. To provide the products and services offered by each business unit, 18F relied on 173 staff to carry out its mission, as of March 2016. The staff are assigned to different projects that are managed by the business units. According to18F officials, the program used special hiring authorities for the vast majority of its staff: Schedule A excepted service authorities were used to hire 162 staff. These authorities permit the appointment of qualified personnel without the use of a competitive examination process. GSA has appointed its staff to terms that are not to exceed 2 years. According to the Director of the 18F Talent division, after the initial appointment has ended, GSA has the option of appointing staff to an additional term not to exceed 2 years. GSA funds 18F through the Acquisition Services Fund—a revolving fund, which operates on the revenue generated from its business units rather than an appropriation received from Congress. The Federal Acquisition Service is responsible for managing this fund and uses it to invest in the development of 18F products and services that will be used by other organizations. 18F is to recover costs through the Acquisition Services Fund reimbursement authority for work related to acquisitions and the Economy Act reimbursement authority for all other projects. According to the memorandum of agreement between 18F and the Federal Acquisition Service, 18F, like all programs funded by the Acquisition Services Fund, is required to have a plan to achieve full cost recovery. In order to recover its costs, 18F is to establish interagency agreements with partner agencies and charges them for actual time and material costs, as well as a fixed overhead amount. Table 1 describes 18F’s revenue, expenses, and net revenue for fiscal years 2014 and 2015. Table 2 describes 18F’s projected revenue, expenses, and net revenue for fiscal years 2016 through 2019. As shown in table 2, according to its projections, 18F plans to generate revenue that meets or exceeds operating expenses and cost of goods sold beginning in fiscal year 2019. In May 2016, the GSA Inspector General reported on an information security weakness pertaining to 18F. Specifically, according to the report, 18F misconfigured a messaging and collaboration application, which resulted in the potential exposure of personally identifiable information (PII). 18F officials told us that, based on the preliminary results of their ongoing review, information such as individual’s first names, last names, e-mail addresses, and phone numbers were made available on the messaging and collaboration platform’s databases, which are managed by that application’s vendor. Those officials also stated that based on the preliminary results of their ongoing review, more sensitive PII, such as Social Security numbers and protected health information, were not exposed. They added that they are continuing a detailed review, in coordination with the GSA IT organization, to confirm that more sensitive PII were not made available. According to the Administration, in 2013 it initiated an effort that brought together a group of digital and technology experts from the private sector that helped fix Healthcare.gov. In an effort to apply similar resources to additional projects, in August 2014 the Administration announced the launch of USDS, to be led by an Administrator and Deputy Federal CIO who reports to the Federal CIO. According to OMB, USDS’s mission is to transform the most important digital services for citizens. USDS selects which projects it will apply resources to and generally initiates its effort with agencies. To accomplish its mission, USDS aims to recruit private sector experts (e.g., IT engineers and designers) and partner them with government agencies. With the help of these experts, OMB states that USDS applies best practices in product design and engineering to improve the usefulness, user experience, and reliability of the most important public- facing federal digital services. As of November 2015, USDS staff totaled about 98 individuals. Similar to 18F, USDS assigns individuals directly to projects aimed at achieving its mission. USDS has used special hiring authorities for the vast majority of it staff. Specifically: Schedule A excepted service. According to USDS, as of November 2015, 52 USDS staff members were hired using the schedule A excepted service hiring authority. According to the USDS Administrator, appointments made using this authority are not to exceed 2 years. At the end of that period, staff can be appointed for an additional term of no more than 2 years. Intermittent consultants. According to USDS, as of November 2015, 39 USDS staff members were intermittent consultants—that is, individuals hired through a noncompetitive process to serve as consultants on an intermittent basis or without a regular tour of duty. The USDS Administrator explained that some of these staff are eventually converted to temporary appointments under the Schedule A authority. According to its Administrator, USDS does not generally make permanent appointments for its staff because it allows the program to continuously bring in new staff and ensure that its ideas are continually evolving. USDS reported spending $318,778 during fiscal year 2014 and approximately $4.7 million during fiscal year 2015. For fiscal year 2016, USDS plans to spend approximately $14 million, and the President’s fiscal year 2017 budget estimated obligations of $18 million for USDS. In an effort to make improvements to critical IT services throughout the federal government, the Presidents’ Budget for fiscal year 2016 proposed funding for the 24 Chief Financial Officers Act agencies, as well as the National Archives and Records Administration, to establish digital services teams. USDS policy calls for these agencies to, among other things, hire or designate an executive for managing their digital services teams. According to USDS policy, the digital service team leader is to report directly to the head of the agency or the deputy. Additionally, USDS has established a hiring pipeline for digital service experts—that is, a unified process managed by USDS for accepting and reviewing applications, performing initial interviews, and providing agencies with candidates for their digital service teams. According to OMB, before using this service, agencies must agree to a charter with the USDS Administrator. Over the last three decades, several laws have been enacted to assist federal agencies in managing IT investments. For example, the Paperwork Reduction Act of 1995 requires that OMB develop and oversee policies, principles, standards, and guidelines for federal agency IT functions, including periodic evaluations of major information systems. In addition, the Clinger-Cohen Act of 1996, among other things, requires agency heads to appoint CIOs and specifies many of their responsibilities. With regard to IT management, CIOs are responsible for implementing and enforcing applicable government-wide and agency IT management principles, standards, and guidelines; assuming responsibility and accountability for IT investments; and monitoring the performance of IT programs and advising the agency head whether to continue, modify, or terminate such programs. Most recently, in December 2014, IT reform legislation (commonly referred to as Federal Information Technology Acquisition Reform Act or FITARA) was enacted, which required most major executive branch agencies to ensure that the CIO had a significant role in the decision process for IT budgeting, as well as the management, governance, and oversight processes related to IT. The law also required that CIOs review and approve (1) all contracts for IT services prior to executing them and (2) the appointment of any other employee with the title of CIO, or who functions in the capacity of a CIO, for any component organization within the agency. OMB also released guidance in June 2015 that reinforces the importance of agency CIOs and describes how agencies are to implement the law. OMB plays a key role in helping federal agencies address these laws and manage their investments by working with them to better plan, justify, and determine how much they need to spend on projects and how to manage approved projects. Within OMB, the Office of E-Government and Information Technology, headed by the Federal CIO, directs the policy and strategic planning of federal IT investments and is responsible for oversight of federal technology spending. As part of our ongoing work, we determined that 18F and USDS have provided a variety of development and consulting services to agencies to support their technology efforts. Specifically, between March 2014 and August 2015, 18F staff helped 18 agencies with 32 projects and generally provided six types of services to the agencies, the majority of which related to development work. In addition, between August 2014 and August 2015, USDS provided assistance on 13 projects at 11 agencies and provided seven types of consulting services. Further, agencies were generally satisfied with the services they received from 18F and USDS. Specifically, of the 26 18F survey respondents, 23 were very satisfied or moderately satisfied and 3 were moderately dissatisfied. For USDS, all 9 survey respondents were very satisfied or moderately satisfied. Between March 2014 and August 2015, GSA’s 18F staff helped 18 agencies with 32 projects, and generally provided services relating to its five business units: Custom Partner Solutions, Products and Platforms, Transformation Services, Acquisition Services, and Learn. In addition, 18F also provided agency digital service team candidate qualification reviews in support of USDS. Custom Partner Solutions. 18F helped 11 agencies with a total of 19 projects relating to developing custom software solutions. Out of the 19 projects, 12 were related to website design and development. For example, regarding GSA’s Pulse project—a website that displays data about the extent to which federal websites are adopting best practices, such as hypertext transfer protocol over Secure Sockets Layer (SSL)/ Transport Layer Security (TLS) (HTTPS)—18F designed, developed, and delivered the first iteration of Pulse within 6 weeks of the project kick-off. According to the GSA office responsible for managing the project, the first iteration has led to positive outcomes for government-wide adoption of best practices; for example, between June 2015 and January 2016, the percentage of federal websites using https increased from 27 percent to 38 percent. As another example, officials from the Department of Education’s college choice project stated that 18F helped develop the College Scorecard website, which the public can use to search among colleges to find schools that meet their needs (e.g., degrees offered, location, size, graduation rate, average salary after graduation).44 18F also helped two agencies, HHS and the Department of Defense, on two projects to develop application programming interfaces—sets of routines, protocols, and tools for building software applications that specify how software components should interact. https://collegescorecard.ed.gov/. Acquisition Services. 18F helped seven agencies on seven projects relating to acquisition services consulting. For example, 18F provided the Department of State’s Bureau of International Information Programs with cloud computing services offered under a GSA blanket purchase agreement (BPA)—specifically, cloud management services (e.g., developers, testing and quality assurance, cloud architect) and infrastructure-as-a-service. According to the Department of State, the department was able to deploy its instance of the infrastructure service only 1 month after it executed an interagency agreement with 18F. According to Social Security Administration officials, 18F helped the agency to incorporate agile software development practices into their requests for proposals for their Disability Case Processing System. Learn. 18F provided services to four agencies on four projects regarding training, such as educating agency officials on agile software development. For example, 18F conducted training workshops on agile software development techniques with the Social Security Administration and Small Business Administration. In addition, according to the Department of Labor’s Wage and Hour Division officials, 18F conducted a 3-day workshop on IT modernization. Transformation Services. 18F assisted two agencies on two projects to help acquire the people, processes, and technology needed to successfully deliver digital services. For example, 18F assisted the Environmental Protection Agency on an agency-wide technology transformation. According to an official within the office of the CIO, 18F assisted the agency with e-Manifest—a system used to track toxic waste shipments. The official noted that 18F provided user-centered design, agile coaching, prototype development services, and agile and modular acquisition services. Further, the official stated that 18F helped turn around the project and significantly decreased the time of delivery for e-Manifest. Products and Platforms. 18F helped two agencies on two projects related to developing software solutions that can potentially be reused at other federal agencies. For example, according to GSA officials responsible for managing GSA’s Communicart project, 18F provided the agency with an e-mail-based tool for approving office supply purchases. Agency digital service team candidate qualification review. 18F worked with USDS to recruit and hire team members for agency digital service teams. According to 18F officials, it provided USDS with subject matter experts to review qualifications of candidates for agency digital service teams. Of the 32 projects, 6 are associated with major IT investments. Cumulatively, the federal government plans to spend $853 million on these investments in fiscal year 2016. Additionally, risk evaluations performed by CIOs that were obtained from the IT Dashboard showed that three of these investments were rated as low or moderately low risk and three investments were rated medium risk. Table 3 describes the associated investments, including their primary functional areas, planned fiscal year 2016 spending, and CIO rating as of May 2016. 18F is also developing products and services—including an agile delivery service blanket purchase agreement (BPA), cloud.gov, and a shared authentication platform: Agile delivery service BPA. 18F established this project in order to support its need for agile delivery services, including agile software development. In August and September 2015, GSA awarded BPAs to 17 vendors. The BPAs are for 5 years and allow GSA to place orders against them for up to 13 specific labor categories relating to agile software development (e.g., product manager, backend web developer, agile coach) at fixed unit prices. The BPAs do not obligate any funds; rather, they enable participating vendors to compete for follow-on task orders from GSA. In cases where 18F determines that it should use the agile BPA to provide services to partner agencies, GSA anticipates that 18F will work with that agency to develop a request for quotations and the other documents needed for a competition with agile BPA vendors. In March 2016 18F released its first request for quotations under the agile BPA for a task order relating to building a web-based dashboard that would describe the status of vendors in the certification process for FedRAMP—a government-wide program, managed by GSA, to provide joint authorizations and continuous security monitoring services for cloud computing services for all federal agencies. GSA anticipates that the time required to complete the process from releasing a request for quotations to task order issuance will typically take between 4 to 8 weeks. The initial BPAs were established under the first of three anticipated award pools—all of which are part of the “alpha” component of the Agile BPA project. 18F officials stated that they planned to establish BPAs for the other two pools in June 2016. They also anticipate a future beta version of the project that could potentially allow federal agencies beyond 18F to issue task orders directly to vendors. Officials stated that they expect to have a plan for the next steps of the beta version of this project by December of 2017. 18F officials have also expressed interest in creating additional marketplaces, such as those relating to data management, developer productivity tools, cybersecurity, and health IT. As of March 2016, 18F did not have time frames for when it planned to develop these additional marketplaces. Cloud.gov.18F also developed cloud.gov service, which is an open source platform-as-a-service that agencies can use to manage and deploy applications. 18F initially built cloud.gov in order to enable the group to use applications it developed for partner agencies. In creating the service, 18F decided to offer the service to other agencies because, according to 18F officials, cloud.gov offers a developer-friendly, secure platform, with tools that agencies can use to accelerate the process of assessing information security controls and authorizing systems to operate. According to 18F, the goal of cloud.gov is to provide government developers and their contractor partners the ability to easily deploy systems to a cloud infrastructure with better efficiency, effectiveness, and security than current alternatives. According to a roadmap for cloud.gov, 18F plans to receive full FedRAMP Joint Authorization Board approval for this service by August 2016. Once available, the group anticipates requiring agencies to pay for this service through an interagency agreement with 18F. Shared authentication platform. In May 2016, 18F announced that it was initiating an effort to create a platform for users who need to log into federal websites for government services. According to 18F, this system is designed to be each citizen’s “one account” with the government and allow the public to verify an identity, log into government websites, and if necessary, recover an account. As of May 2016, 18F plans to conduct prototyping activities through September 2016 and did not have plans beyond that time frame. In addition to developing future products and services, 18F created a variety of guides and standards for use internally as well by agency digital service teams. These guides address topics such as accessibility, application programming interfaces, and agile software development. From August 2014 through August 2015, USDS provided assistance on 13 projects across 11 agencies. The group generally provided seven types of consulting services: quality assurance, problem identification and recommendations, website consultation, system stabilization, information security assessment, software engineering, and data management. Quality assurance. Three of the 13 projects related to providing quality assurance services. For example, regarding the Social Security Administration’s Disability Case Processing System, USDS reviewed the quality of the software and made recommendations that, according to the agency, resulted in costs savings. Additionally, for the Departments of Veterans Affairs and Defense Service Treatment Record project, USDS provided engineers who identified and resolved errors in the process of exchanging records between the two departments, according to the Department of Veterans Affairs. Further, for the HHS Healthcare.gov system, the group performed services aimed at optimizing the reliability of the system, according to HHS. Problem identification and recommendations. USDS identified problems and made recommendations for three projects. For all three projects, it performed a discovery sprint—a quick (typically 2 week) review of an agency’s challenges, which is to culminate in a clear understanding of the problems and recommendations for how to address the issues. For example, it performed a discovery sprint for the Department of the Treasury Internal Revenue Service that focused on three areas: authentication of taxpayers, modernizing systems through event-driven architecture, and redesigning the agency’s website. USDS delivered a report to the Internal Revenue Service with recommendations and also suggested that work initially focus on taxpayer authentication. Consistent with these recommendations, the group and the agency decided to initially focus on authentication, to include re-opening of the online application GetTranscript. For the Department of Justice Federal Bureau of Investigation’s National Incident Based Reporting System, according to USDS, the program performed a discovery sprint and made several recommendations for accelerating deployment of the system. Website consultation. USDS provided consultation services for three agency website projects. For example, for the Office of the U.S. Trade Representative’s Trans-Pacific Partnership Trade Agreements website, USDS provided website design advice and confirmed that the agency had the necessary scalability to support the number of anticipated visitors. Additionally, it consulted with the Office of Personnel and Management (OPM) on the design, implementation, and development of a website for providing information on reported data breaches. System stabilization. For the Department of State’s Consular Consolidated Database, according to USDS, it helped stabilize the system and return it to operational service after a multi-week outage in June 2015. Information security assessment. USDS helped with an information security assessment regarding Electronic Questionnaires for Investigations Processing, which encompasses the electronic applications used to process federal background check investigations. Software engineering. For the Department of Homeland Security U.S. Citizenship and Immigration Services Transformation project, USDS’s software engineering advisors provided guidance on private sector best practices in delivering modern digital services. According to the department, the group’s work has supported accomplishments such as increasing the frequency of software releases and improving adoption of agile development best practices. Data management. For the Department of Homeland Security Office of Immigration Statistics, USDS helped to develop monthly reports on immigration enforcement priority statistics. According to the department, USDS supported the development of processes for obtaining data from other offices within the department and generating the monthly reports. According to the department, after 7 weeks of working with USDS, it was able to develop a proof of concept that reduced the report generating process from a month to 1 day. Seven of the 13 projects are associated with major IT investments. Cumulatively, the federal government plans to spend over $1.24 billion on these investments in fiscal year 2016. Three investments were rated by their CIOs as low or moderately low risk and four investments were rated as being medium risk. Table 4 describes the associated investments, including their primary functional areas planned fiscal year 2016 spending, and CIO rating as of May 2016. In addition to helping agencies improve IT services, USDS has developed guidance for agencies. For example, it developed the Digital Services Playbook to provide government-wide recommendations on practices for building digital services. The group also created the TechFAR Handbook to explain how agencies can use the Digital Services Playbook in ways that are consistent with the Federal Acquisition Regulation. Further, USDS, in collaboration with 18F, developed the draft version of U.S. Web Design Standards, which includes a visual style guide and a collection of common user interface components. With this guide, USDS aims to improve government website consistency and accessibility. In addition to developing guidance, USDS, in collaboration with OMB’s Office of Federal Procurement Policy, used challenge.gov to incentivize the public to create a digital service training program for federal contract professionals. The challenge winner received $250,000 to develop and pilot a training program. Additionally, the Deputy Administrator for USDS stated that 30 federal contract professionals from more than 10 agencies completed this pilot program in March 2016. According to OMB, the program is being revised and transitioned to the Federal Acquisition Institute, where it will be included as part of a certification for digital service contracting officers. In response to a satisfaction survey we administered to agency managers of selected 18F and USDS projects, a majority of managers were satisfied with the services they received from the groups. Specifically, the average score for services provided by 18F was 4.38 (on a 5-point satisfaction scale, where 1 is very dissatisfied and 5 is very satisfied) and the average score for the services provided by USDS was 4.67. Table 5 describes the survey results for 18F and USDS. In addition to providing scores, the survey respondents also provided written comments. Regarding 18F, five factors were cited by two or more respondents as contributing to their satisfaction with the services the program provided: delivering quality products and services, providing good customer service, completing tasks in a timely manner, employing staff with valuable knowledge and skills, and providing valuable education to agencies. For example, one respondent stated that 18F has an expert staff that helped the team understand agile software development and incorporate user-centered design into the agency’s development process. With respect to USDS, four factors were cited by two or more respondents as contributing to their satisfaction with its services: delivering quality services, providing good customer service, completing tasks in a timely manner, and employing staff with valuable knowledge and skills. For instance, one respondent stated that USDS responded to the agency’s request in a matter of hours, quickly developed an understanding of the agency’s IT system, and pushed to improve the system, even in areas beyond the scope of USDS’s responsibility. Although the majority of agencies were satisfied, a minority of respondents provided written comments describing their dissatisfaction with services provided by 18F. For example, six respondents cited poor customer service, four respondents cited higher than expected costs, and one respondent stated that 18F’s use of open source code may not meet the agency’s information security requirements. In a written response to these comments, 18F stated that it has received a variety of feedback from its partners and had modified and updated its processes continuously over the past 2 years. For example, with respect to higher than expected costs, 18F stated that project costs sometimes needed to be adjusted mid-project to address, among other things, higher than expected infrastructure usage or unexpected delays. To address this issue, 18F stated that it uses the assistance of subject matter experts to estimate project costs, and wrote a guide to assist with, among other things, better managing the budgets of ongoing projects. Regarding 18F’s use of open source code, it stated that it has worked with its partners to discuss the use of open source software and information security practices. To assess actual results, prioritize limited resources, and ensure that the most critical projects receive attention, entities that provide IT services, such as USDS and 18F, should establish and implement the following key practices. Define outcome-oriented goals and measure performance. Our previous work and federal law stress the importance of focusing on outcome-oriented goals and performance measures to assess the actual results, effects, or impact of a program or activity compared to its intended purpose. Goals should be used to elaborate on a program’s mission statement and should be aligned with performance measures. In turn, performance measures should be tied to program goals and demonstrate the degree to which the desired results were achieved. To do so, performance measures should have targets to help assess whether goals were achieved by comparing projected performance and actual results. Finally, goals and performance measures should be outcome-oriented—that is, they should address the results of products and services. Establish and implement procedures for prioritizing IT projects. We have reported that establishing and implementing procedures, to include criteria, for prioritizing projects can help organizations consistently select projects based on their contributions to the strategic goals of the organization. Doing so will better position agencies to effectively prioritize projects and use the best mix of limited resources to move toward its goals. In our draft report, we determined that 18F has developed several outcome-orientated goals, performance measures, and procedures for prioritizing projects, which it has largely implemented. However, not all of its goals are outcome-oriented and it has not yet measured program performance. Define Outcome-Oriented Goals and Measure Performance At the conclusion of our review in May 2016, 18F provided 5 goals and 17 associated performance measures that the organization aims to achieve by September 2016 (see table 6). To 18F’s credit, several of its goals and performance measures appear to be outcome-oriented. For example, the goal of delivering two government-wide platform services and the associated performance measures are outcome-oriented in that they address results—that is, delivering services to partner agencies. However, not all of the goals and performance measures appear to be outcome-oriented. For example, the goal of growing 18F to 215 staff while sustaining a healthy culture and its associated measure of hiring 47 staff do not focus on results of products or services. Further, not all of the performance measures have targets. For example, seven of the performance measures state that 18F will establish performance indicators, but 18F has yet to do so. Moreover, 18F does not have goals and associated measures that describe how it plans to achieve its mission after September 2016. In addition, although 18F is required to have a plan to achieve full cost recovery, it has yet to recover costs and its projections for when this will occur have slipped over time. Specifically, in June 2015, 18F projected that it would fully recover its costs for an entire fiscal year beginning in 2016; however, in May 2016, 18F provided revised projections indicating that it would recover costs beginning in fiscal year 2019. Those projections also indicated that, in the worst case, it would not do so through 2022, the final year of its projections. Establishing performance measures and targets that are tied to achieving full cost recovery would help management gauge whether the program is on track to meet its projections. However, 18F has not established such performance measures and targets. Finally, 18F has yet to fully assess the actual results of its activities. Specifically, the group has not assessed its performance in accordance with the 17 performance measures it developed. 18F’s then-parent organization assessed its own performance quarterly beginning in the 4th quarter of fiscal year 2015, including for measures that 18F was responsible for. However, this review process did not include or make reference to the 17 measures developed to gauge 18F’s performance, and thus do not provide insight into how well it is achieving its own mission. In a written response, GSA stated that 18F performance is measured as part of the Technology Transformation Service’s goals and measures and that these goals and measures should form the basis for our review. However, the Technology Transformation Service’s goals and measures do not describe how GSA aims to achieve the specific mission of 18F. Until it establishes goals and performance measures beyond September 2016, ensures that all of its goals and performance measures are outcome-oriented, and that its performance measures have targets, 18F will not have clear definition of what it wants to accomplish. Additionally, without developing performance measures and targets tied to achieving full cost recovery, GSA will lack a fully defined approach to begin recovering all costs in fiscal year 2019. Further, until 18F fully measures actual results, it will not be positioned to assess the status of its activities and determine the areas that need improvement. Establish and Implement Procedures for Prioritizing IT Projects 18F has developed procedures, including criteria, for prioritizing projects and largely implemented its procedures. Specifically, according to the Director of Business Strategy, potential projects are discussed during weekly intake meetings. As part of these meetings, 18F discusses project decision documents, which outline the business, technical and design elements, as well as the schedule, scope, and resources needed to fulfill the client’s needs. Using these documents, 18F determines whether proposed projects meet, among other things, the following criteria: (1) the project is aligned with the products and services offered by 18F, (2) it can be completed in a time frame that meets the agency’s needs and at a cost that fits the agency’s budget, and (3) the project’s government transformation potential (e.g., impact on the public, cost savings). These documents are used by the business unit leads to make a final decision about whether to accept the projects. 18F has largely implemented its procedures. To its credit, with respect to the 14 projects that 18F selected since establishing its prioritization and selection process, 18F developed a decision document for 12 of the 14 projects. However, 18F did not develop a decision document for the 2 remaining projects—the Nuclear Regulatory Commission Master Data Management project and GSA’s labs.usa.gov project. With respect to the Nuclear Regulatory Commission Master Data Management project, 18F officials explained that this project only required staff from one division; as such, that division was able to independently prioritize and select this project. Additionally, regarding the GSA labs.usa.gov project, 18F officials said the Associate Administrator for Office of Citizen Services and Innovative Technologies directed 18F to provide assistance. If 18F consistently follows its process for prioritizing projects, it will be better positioned to apply resources to IT projects with the greatest need of improvement. As part of our ongoing work, we determined that while USDS has developed a process for prioritizing projects and program goals, it has not fully implemented important program management practices. Define Outcome-Oriented Goals and Measure Performance In response to our inquiry, in November 2015 USDS developed four goals to be achieved by December 2017: (1) recruit and place over 200 digital service experts in strategic roles at agencies and cultivate a continually growing pipeline of quality technical talent through USDS, (2) measurably improve five to eight of the government’s most important services, (3) begin the implementation of at least one outstanding common platform, and (4) increase the quality and quantity of technical vendors working with government and cultivate better buyers within government. Additionally, USDS established a performance measure with a target for one of its goals. Specifically, it has a measure for its first goal as it plans to measure the extent to which it will hire 200 digital service experts by December 2017. To its credit, several of the goals appear to be outcome-oriented. For example, improving five to eight services is outcome-oriented in that it addresses results. However, USDS has not established performance measures or targets for its other goals. In addition, the program’s first goal—recruit and place over 200 digital service experts in strategic roles at agencies and cultivate a continually growing pipeline of quality technical talent through USDS—does not appear to be outcome-oriented. Further, USDS has only measured actual results for one of its goals. Specifically, for the goal of placing digital service experts at agencies, as of May 2016, USDS officials stated that they had 152 digital service experts. However, USDS has not measured actual results for the other three goals. USDS officials provided examples of how they informally measure performance for the other three goals. For example, for the goal of measurably improving five to eight of the government’s most important services, the USDS Administrator stated that approximately 1 million visitors viewed the Department of Education’s College Scorecard website in the initial days after it was deployed. However, USDS has not documented these measures or the associated results to date. Until USDS ensures that all of its goals are outcome- oriented and establishes performance measures and targets for each goal, it will be difficult to hold the program accountable for results. Additionally, without an assessment of actual results, it is unclear what impact USDS’s actions are having relative to its mission and whether investments in agency digital service teams are justified. Establish and Implement Procedures for Prioritizing Projects USDS has developed procedures and criteria for prioritizing projects. To identify projects to be considered, USDS is to use, among other sources, a June 2015 OMB report to Congress that identifies the 10 highest-priority federal IT projects in development. To prioritize projects USDS has the following three criteria, which are listed in their order of importance (1) What will do the greatest good for the greatest number of people in the greatest need? (2) How cost-efficient will the USDS investment be? and (3) What potential exists to use or reuse a technological solution across the government? Using these criteria, USDS intends to create a list of all potential projects, to include their descriptions and information on resources needs. This list is to be used by USDS leadership to make decisions about which projects to pursue. To its credit, USDS created a list of all potential, ongoing, and completed projects, which included project descriptions and resource needs. Additionally, USDS has engaged with 6 of the 10 priority IT projects identified in the June 2015 report, including the Department of Health and Human Services’ healthcare.gov project and the Department of Homeland Security’s U.S. Citizenship and Immigration Services Transformation. Additionally, according to a USDS staff member, USDS considered the remaining 4 projects and decided not to engage with them to date. However, USDS has yet to develop a quarterly report on the 10 high priority programs, which it was directed by Congress to develop. Specifically, in December 2015, Congress modified its direction for the Executive Office of the President to develop the reports regarding the top 10 high priority programs and specifically called for USDS to do so on a quarterly basis. According to a USDS staff member, a second top 10 high priority investment report has been drafted and will be finalized prior to the issuance of our report. However, the second top 10 report will address the former congressional direction for the Executive Office of the President to develop reports and OMB did not have a time frame for when USDS would begin to develop reports that address the modified congressional direction. Until USDS develops a time frame for the report on the top 10 programs, develops the report within that time frame and on a quarterly basis thereafter, and considers the programs identified in these reports as part of its prioritization process, USDS has less assurance that it will apply resources to the IT projects with the greatest need of improvement. To help agencies effectively deliver digital services, the President’s Budget for fiscal year 2016 proposed funding for digital service teams at 25 agencies—the 24 Chief Financial Officers Act agencies, as well as the National Archives and Records Administration. According to USDS policy, agencies are to, among other things, hire or designate an executive for managing their digital services teams. In addition, USDS has called for the deputy head of these agencies (or equivalent) to, among other things, agree to a charter with the USDS Administrator. After agreeing to a charter, according to USDS, agencies can use USDS’s hiring pipeline for digital service experts. Of the 25 agencies that requested funding to establish teams, OMB has established charters with 6 agencies for their digital service teams—the Departments of Defense, Health and Human Services, Homeland Security, the Treasury, State, and Veterans Affairs. The charters establish the executives for managing digital service teams and describe the reporting relationships between the team leaders and agency leadership. In addition, according to the Deputy USDS Administrator, USDS plans to establish charters with an additional 3 agencies by the end of the fiscal year—the Department of Education, the Social Security Administration, and Small Business Administration. For the remaining 16 agencies, as of April 2016, 8 agencies reported that they plan to establish digital service teams but have yet to establish charters with USDS—the Department of Housing and Urban Development, Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, National Archives and Records Administration, National Science Foundation, Nuclear Regulatory Commission, and Office of Personnel Management. The other 8 agencies reported that they do not plan to establish digital service teams by September 2016 because they did not receive requested funding—the Departments of Agriculture, Commerce, Energy, the Interior, Justice, Labor, and Transportation; and the U.S. Agency for International Development. Table 7 summarizes agency and OMB efforts to establish digital service teams. Congress has recognized the importance of having a strong agency CIO. In 1996, the Clinger-Cohen Act established the position of agency CIO and, among other things, gave these officials responsibility for IT investments, including IT acquisitions, monitoring the performance of IT programs, and advising the agency head whether to continue, modify, or terminate such programs. More recently, in December 2014, FITARA was enacted into law. It required most major executive branch agencies to ensure that the CIO has a significant role in the decision process for IT budgeting, as well as the management, governance, and oversight processes related to IT. The law also required that CIOs review and approve (1) all contracts for IT services associated with major IT investments prior to executing them and (2) the appointment of CIOs for any component within the agency. OMB also released guidance in June 2015 that reinforces the importance of agency CIOs and describes how agencies are to implement FITARA. Further, according to our prior work, leading organizations clearly define responsibilities and authorities governing the relationships between the CIO and other agency components that use IT. Only one of the four agencies we selected for review—the Department of Homeland Security—defined the relationship between the executive for managing the digital services team and the agency CIO. Specifically, the Department of Homeland Security established a charter for its digital services team, signed by both the Administrator of USDS and the Deputy Secretary, which outlines the reporting structure and authorities for the digital services executive, including the relationship with the CIO. For example, according to the charter, the digital services executive will report on a day-to-day basis to the CIO, but will also report directly to the Deputy Secretary. However, the other three agencies we reviewed—the Departments of Defense, State, and Veterans Affairs—have not defined the role of agency CIOs with regard to these teams. Although they have established charters for these teams, which describe the reporting structure between the digital services executive and senior agency leadership, the charters do not describe the role of the agencies’ CIOs and they have not documented this information elsewhere. The Department of Defense CIO and the Department of Veterans Affairs Principal Deputy Assistant Secretary for the Office of Information and Technology told us that they work closely with their agency digital service team. However, while these officials have coordinated with the agency digital service teams, the roles and responsibilities governing these relationships should be described to ensure that CIOs can carry out their statutory responsibilities. In contrast to the Departments of Defense and Veterans Affairs, the State CIO told us that he has had limited involvement in the department’s digital services team. He added that he believes it will be important for CIOs to be involved in agency digital services teams in order to sustain their efforts. In written comments, OMB acknowledged that the Department of State’s charter does not describe the role of the CIO, but stated that the Departments of Defense and Veterans Affairs digital service team charters at least partially address the relationship between digital service teams and agency CIOs. Specifically, with respect to the Department of Defense, OMB stated that the charter calls for senior leadership, including the department’s CIO, to ensure that digital service team projects proceed without delay. Additionally, according to OMB, the charter for the Veterans Affairs digital service team calls for the team to be located in and supported by VA’s CIO organization. However, these requirements do not address the specific responsibilities or authorities of the Veterans Affairs’ CIO with regard to the digital service team. The lack of defined relationships is due, in large part, to the fact that USDS policy on digital service teams does not describe the expected relationship between agency CIOs and these teams. As previously mentioned, USDS policy calls for the digital service team leader to report directly to the head of the agency or its deputy; however, it does not describe the expected responsibilities and authorities governing the relationship of the CIO. Until OMB updates the USDS policy to clearly define the responsibilities and authorities governing the relationships between CIOs and digital services teams and ensures that existing agency digital service team charters or other documentation reflect this policy, agency CIOs may not be effectively involved in the digital service teams. This is inconsistent with long-standing law, as well as the recently enacted FITARA, and OMB’s guidance on CIO responsibilities, and may hinder the ability for CIOs to carry out their responsibilities for IT management of the projects undertaken by the digital service teams. In summary, by hiring technology and software development experts and using leading software development practices, both 18F and USDS have provided a variety of useful services to federal agencies. Most surveyed agency project managers that partnered with 18F and USDS were satisfied with the services provided. It is important for USDS and 18F to establish outcome-oriented goals, measure performance, and prioritize projects, particularly since these are valuable management tools that could aid in the transfer of knowledge when critical temporary staff leave these organizations and are replaced. To their credit, both 18F and USDS have developed several outcome- orientated goals and procedures for prioritizing projects. However, the goals and associated performance measures and targets were not always outcome-oriented. Additionally, they have not fully measured program performance. As a result, it will be difficult to hold the programs accountable for results. Moreover, without documented measures and results for USDS, it is unclear whether investments in agency digital service teams are justified. Further, by delaying the date for when it projects to fully recover its costs and not having associated performance measures, 18F is at risk of not having the information necessary for GSA leadership to determine whether to continue using the Acquisition Services Fund for 18F operations. Finally, USDS has yet to develop a quarterly report on the 10 high priority programs, meaning that it may be applying resources to investments that are not in the most need of their assistance. Although OMB has called for agencies to establish digital service teams, USDS policy does not require agencies to define the expected responsibilities and authorities governing the relationships between CIOs and digital service teams. To fulfill their statutory responsibilities, including as most recently enacted in FITARA and reinforced in OMB guidance, and ensure that CIOs have a significant role in the decision making process for projects undertaken by the digital service teams, such defined relationships are essential. Accordingly, our draft report contains two planned recommendations to GSA and four to OMB. Specifically, the report recommends that GSA: ensure that goals and associated performance measures are outcome-oriented and that performance measures have targets, including performance measures and targets tied to fully recovering goals, performance measures, and targets for how the program will achieve its mission after September 2016; and assess actual results for each performance measure. The draft report also includes recommendations for OMB to: ensure that all goals and associated performance measures are outcome-oriented and that performance measures have targets; assess actual results for each performance measure; establish a time frame for developing the report identifying the highest priority projects, develop the report within that established time frame and on a quarterly basis thereafter, and consider the highest priority IT projects as part of the established process for prioritizing projects; and update USDS policy to clearly define the responsibilities and authorities governing the relationships between CIOs and the digital services teams and require existing agency digital service teams to address this policy. In doing so, the Federal Chief Information Officer should ensure that this policy is aligned with relevant federal law and OMB guidance on CIO responsibilities and authorities. If GSA implements our recommendations, it will be better positioned to effectively measure performance. Additionally, OMB’s implementation of our recommendations will position it to effectively measure performance, prioritize USDS resources, and ensure that CIOs play an integral role in agency digital service teams. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Committees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you have any questions on matters discussed in this testimony, please contact David A. Powner at (202) 512-9286 or at pownerd@gao.gov. Other key contributors include Nick Marinos (Assistant Director), Kavita Daitnarayan, Rebecca Eyler, Kaelin Kuhn, Jamelyn Payan, and Tina Torabi. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.
summary: In an effort to improve IT across the federal government, in March 2014 GSA established a team, known as 18F that provides IT services to agencies. In addition, in August 2014 the Administration established USDS, which aims to improve the federal IT services provided to citizens. OMB also required agencies to establish their own digital service teams. GAO was asked to summarize its draft report that (1) describes 18F and USDS efforts to address problems with IT projects and agencies' views of services provided, (2) assesses these programs' efforts against practices for performance measurement and project prioritization, and (3) assesses agency plans to establish their own digital service teams. In preparing the draft report on which this testimony is based, GAO reviewed 32 18F projects and 13 USDS projects that were underway or completed as of August 2015 and surveyed agencies about these projects; reviewed 18F and USDS in key performance measurement and project prioritization practices; reviewed 25 agencies' efforts to establish digital service teams; and reviewed documentation from four agencies, which were chosen based on their progress made in establishing digital service teams. In a draft report, GAO determined that the General Service Administration's (GSA) 18F and Office of Management and Budget's (OMB) U.S. Digital Service (USDS) have provided a variety of services to agencies supporting their information technology (IT) efforts. Specifically, 18F staff helped 18 agencies with 32 projects and generally provided development and consulting services, including software development solutions and acquisition consulting. In addition, USDS provided assistance on 13 projects across 11 agencies and generally provided consulting services, including quality assurance, problem identification and recommendations, and software engineering. Further, according to GAO's survey, managers were generally satisfied with the services they received from 18F and USDS on these projects (see table). Both 18F and USDS have partially implemented practices to identify and help agencies address problems with IT projects. Specifically, 18F has developed several outcome-oriented goals and related performance measures, as well as procedures for prioritizing projects; however, not all of its goals are outcome-oriented and it has not yet fully measured program performance. Similarly, USDS has developed goals, but they are not all outcome-oriented and it has established performance measures for only one of its goals. USDS has also measured progress for just one goal. Further, it has not fully implemented its procedures for prioritizing projects. Until 18F and USDS fully implement these practices, it will be difficult to hold the programs accountable for results. Agencies are beginning to establish digital service teams. Of the 25 agencies that requested funding for these teams, OMB has established charters with 6 agencies for their digital service teams. In addition, according to the USDS Deputy Administrator, USDS plans to establish charters with an additional 3 agencies by the end of the fiscal year—the Department of Education, as well as the Social Security Administration and Small Business Administration. For the remaining 16 agencies, as of April 2016, 8 agencies reported that they plan to establish digital service teams but have yet to establish charters with USDS. The other 8 agencies reported that they do not plan to establish digital service teams by September 2016 because they did not receive requested funding. Further, of the four agencies GAO selected to review, only one has defined the relationship between its digital service team and the agency Chief Information Officer (CIO). This is due, in part, to the fact that USDS policy does not describe the expected relationship between CIOs and these teams. Until OMB updates its policy and ensures that the responsibilities between the CIOs and digital services teams are clearly defined, it is unclear whether CIOs will be able to fulfill their statutory responsibilities with respect to IT management of the projects undertaken by the digital service teams. GAO's draft report includes two recommendations to GSA and three recommendations to OMB to improve goals and performance measurement. In addition, GAO's draft report is recommending that OMB update USDS policy to define the relationships between CIOs and digital services teams.