Federal Bureau of Investigation's Management of Information Technology Investments

Report No. 03-09
December 2002
Office of the Inspector General

In its response to the draft report, the FBI requested that this report be classified For Official Use Only or Limited Official Use.  However, in a sensitivity review conducted prior to issuance of the final report, the FBI did not request classification of the report or limitation of its distribution.  Consequently, this report is unclassified and not restricted in its distribution.

Recommendation Number:

1. Resolved.  This recommendation is resolved based on the FBI’s agreement to plan for and take more timely action to allow board members and other ITIM users to execute assigned responsibilities competently.  This recommendation can be closed when we receive documentation demonstrating that: (a) the ITIM Program Office has established regularly scheduled meetings for the investment boards with standing agendas of items to be discussed, and (b) the ITIM Program Office maintains an up-to-date list of items requiring board member action and the status of those items.
2. Resolved.  This recommendation is resolved based on the FBI’s agreement to ensure that all members of the IT investment boards receive sufficient education and training to execute assigned responsibilities effectively.  The FBI’s response states that additional training will be held in the second and third quarters of FY 2003; however, it does not explicitly state that education and training plans will be developed.  This recommendation can be closed when we receive:  (a) the ratified Roles and Responsibilities documents dated June 2002 that specifically identify the roles and responsibilities for each investment board member, and (b) education and training plans to ensure board members acquire the required core competencies.
3. Resolved.  This recommendation is resolved based on the FBI’s agreement to ensure FBI IT project mangers consistently follow official project management guidance.  However, the FBI’s response does not indicate a date when such a process will be established.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation that official project management guidance has been implemented and consistently followed.
4. Resolved.  This recommendation is resolved based on the FBI’s agreement to develop written policies and procedures for management oversight of IT projects for use by the investment review boards.  The FBI’s response indicates that detailed written policies will be completed in the third quarter of FY 2003.  This recommendation can be closed when we receive a copy of the written policies and procedures.
5. Resolved.  This recommendation is resolved based on the FBI’s agreement to support the IT investment review boards with a centralized project management office that operates in accordance with ITIM policies and procedures.  The FBI’s response indicates that a centralized project management office has been established and will be supporting the investment review boards during the Control phase of the ITIM pilot test.⁶⁷  This recommendation can be closed when we receive documentation such as organization charts, charters, and policy guidance demonstrating that the centralized project management office has been established and operates in accordance with ITIM policies and procedures.
6. Resolved.  This recommendation is resolved based on the FBI’s agreement to develop a project management plan for each IT project, approved by the Project Oversight Committee, that includes cost and schedule controls.  While the FBI’s response indicates that the centralized project management office will develop project management plans, it is not clear when these actions will be initiated.    We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that each IT project has a project management plan approved by the Program Oversight Committee.
7. Resolved.  This recommendation is resolved based on the FBI’s agreement to ensure that information in the IT asset inventory is made available to, and used by, the boards.  The FBI’s response indicates that an assessment of the IT asset inventory will initially be shared with the boards in the third quarter of FY 2003.  This recommendation can be closed when we receive documentation demonstrating that the IT asset inventory is used by the boards as an investment decision-making tool.
8. Resolved.  This recommendation is resolved based on the FBI’s agreement to execute, by the fourth quarter of FY 2003, the key practice activities necessary for the investment review boards to maintain effective oversight of IT projects. These key practices are:

   • providing each project’s up-to-date cost and schedule data to the appropriate IT investment board;
   • establishing criteria for the boards to review each IT project’s performance by comparing actual cost and schedule data to expectations;
   • performing special reviews of projects that have not met predetermined performance standards;
   • defining, documenting, and agreeing to corrective actions for each under-performing project by the appropriate IT investment board and project manager; and
   • tracking and implementing corrective actions until the desired outcome is achieved.

   This recommendation can be closed when we receive documentation demonstrating that the five key practice activities listed above have been executed.

9. Resolved. This recommendation is resolved based on the FBI’s agreement to ensure progress toward completing the IT asset inventory is monitored.  The FBI’s response states that the established deadline for completing and validating the IT inventory is end of the second quarter of FY 2003.  This recommendation can be closed when we receive documentation demonstrating that progress toward completion is evaluated.
10. Resolved.  This recommendation is resolved based on the FBI’s agreement to implement processes that ensure:  (a) subsequent changes to IT projects and systems are identified and documented in the inventory, (b) information from the inventory is available on demand to decision-makers and other affected parties, and (c) the IT project and system inventory and its information records are maintained to contribute to future investment selections and assessments.  This recommendation can be closed when we receive documentation demonstrating that the processes have been implemented.  The FBI’s response indicates that periodic updates to the IT inventory are planned for the fourth quarter of FY 2003.
11. Resolved.  This recommendation is resolved based on the FBI’s agreement to develop written policies and procedures for identifying the business needs (and the associated users) for each IT project.  The FBI’s response states that since March 2002, the Concept Paper and Exhibit 300 have been used to standardize the documentation of the business case.  While we agree that these forms can be used to document the business needs and users of IT projects, we do not agree that these forms are sufficient evidence that a policy or procedure exists.  This recommendation can be closed when we receive a copy of the written policies and procedures for identifying the business needs and users of IT projects.
12. Resolved.  This recommendation is resolved based on the FBI’s agreement to train ITIM users in identifying business needs and associated users.  While the FBI’s response states that training for the Select phase was completed in March 2002, and that additional training will be held when the Control and Evaluate phases are rolled out (second and third quarters of FY 2003, respectively), it does not specify that the training encompasses business needs identification.  This recommendation can be closed we receive documentation demonstrating that such training is taking place.
13. Resolved.  This recommendation is resolved based on the FBI’s agreement to ensure identified users participate in project management throughout a project’s life-cycle.  The FBI’s response states that the project management office will institute procedures to ensure user involvement throughout a project’s life-cycle, but does not specify when these procedures will be instituted.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that the FBI instituted procedures requiring participation of end users throughout the project’s life-cycle.
14. Resolved.  This recommendation is resolved based on the FBI’s agreement to ensure the ITIM process applies to all proposals, including those funded through the FBI’s base funding.  The FBI’s response states that base funding requests are planned to be included in the FY 2003 Select phase.  This recommendation can be closed when we receive documentation demonstrating that the ITIM process has been applied to all proposals.
15. Resolved.  This recommendation is resolved based on the FBI’s agreement to provide sufficient staffing to the ITIM Program Office, as recommended in the Post-Implementation Review.  Although the FBI’s response states that six additional full-time staff have been requested for the ITIM Program Office, it did not specify when such positions are expected to be filled.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that the staffing requests have been fulfilled.
16. Resolved.  This recommendation is resolved based on the FBI’s response stating that all recommendations set forth in the Post-Implementation Review relating to expanding policies and procedures were implemented by September 2002.  This recommendation can be closed when we receive documentation demonstrating that the policies and procedures have been implemented.
17. Resolved.  This recommendation is resolved based on the FBI’s response that input from various ITIM users was incorporated into the design of the Control and Evaluate phases through interviews and working group sessions completed in September 2002.  This recommendation can be closed when we receive documentation demonstrating that such working group sessions were conducted and that input was incorporated.
18. Resolved.  This recommendation is resolved based on the FBI’s agreement to modify the ITIM process so that the Technical Review Board and Enterprise Architecture Technical Committee perform a business architecture compliance review of IT proposals to ensure these proposals support the missions of the FBI.  The FBI’s response states that this modification will be completed by the third quarter of FY 2003.  This recommendation can be closed when we receive a copy of the modified ITIM process.
19. Resolved.  This recommendation is resolved based on the FBI’s agreement to prepare a plan that specifically details how the project management office will support the ITIM process.  However, the FBI’s response did not specify when this plan will be completed.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive a copy of the completed plan.
20. Resolved.  This recommendation is resolved based on the FBI’s agreement to develop and implement a plan detailing how and when it will integrate the ITIM process with a system development life-cycle methodology.  Although the FBI’s response indicates that the project management office will integrate the ITIM process with a system development life-cycle methodology, it does not specify when this will be accomplished.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that this integration has been completed.
21. Resolved.  This recommendation is resolved based on the FBI’s agreement to continue its efforts to establish a comprehensive enterprise architecture.  The FBI’s response states that it has a target to implement the first phase of a world-class enterprise architecture framework by April 2003.  This recommendation can be closed when we receive a documentation demonstrating that the first phase of the enterprise architecture has been developed and a maturation plan is in place.
22. Resolved.  This recommendation is resolved based on the FBI’s agreement to establish cost, schedule, technical, and performance baselines for Trilogy and track significant deviations from these baselines.  The FBI’s response states that baselines will be established once the current Engineering Change Proposals are negotiated, although no target dates were provided.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that the baselines have been established and are being monitored.
23. Resolved.  This recommendation is resolved based on the FBI’s agreement to adequately define, document, and share technical requirements for Trilogy.  The FBI’s response states that functional  requirements have been defined for Trilogy’s User Application Component.  This recommendation can be closed when we receive documentation demonstrating that the technical requirements for the User Application Component have been adequately defined, documented, and shared with appropriate users.
24. Resolved.  This recommendation is resolved based on the FBI’s agreement to prepare an action plan to address the risks identified by the three internal reports on Trilogy by December 31, 2002.  This recommendation can be closed when we receive a copy of the approved action plans and documentation demonstrating that the plans are being monitored for implementation.
25. Resolved.  This recommendation is resolved based on the FBI’s agreement with our recommendation.  The FBI’s response states that a successful process was used for the site installation schedule for the Trilogy project.  However, we do not believe that the initial site survey utilized in the Trilogy deployment is an adequate process to submit input and receive feedback from FBI field offices.  Our position is that a more comprehensive process could have mitigated the lack of clear communication between FBI Headquarters and field offices that caused confusion over the number of desktop computers to be delivered and shortages of fiber optic cable.  This recommendation can be closed when we receive documentation demonstrating that such a process has been established for future IT deployments.
26. Resolved.  This recommendation is resolved based on the FBI’s agreement to remedy contractor deficiencies associated with (a) operation of the service support center, and (b) maintenance support for Trilogy architecture.  This recommendation can be closed when we receive documentation regarding the new maintenance contract and reductions in outstanding trouble tickets.
27. Resolved.  This recommendation is resolved based on the FBI’s agreement to enhance employee training by:  (a) remedying problems associated with the FBI’s on-line training system, and (b) developing a training plan specifically tailored to information technology specialists and electronic technicians.  This recommendation can be closed when we receive:  (a) documentation demonstrating that the outstanding issues with the on-line training system have been resolved, and (b) documentation of the Trilogy training received by the information technology specialists and electronic technicians regarding Trilogy software and hardware.
28. Resolved.  This recommendation is resolved based on the FBI’s agreement to:  (a) deliver the remaining Extended Fast Track desktop computers to all sites except New York City by December 31, 2002, and New York City by February 2002, and (b) obtain sufficient fiber optic cable from other FBI funding.  This recommendation can be closed when we receive documentation demonstrating that:  (a) the remaining Extended Fast Track desktop computers have been deployed, and (b) sufficient fiber optic cable has been obtained.
29. Resolved.  This recommendation is resolved based on the FBI’s agreement to:  (a) procure adequate trouble-shooting equipment for Trilogy architecture when the Enterprise Operations Center is operational, and (b) choose a web-based approach for submissions previously supported by Word Perfect macros.  While the FBI disagreed with the original part (b) of this recommendation (that it “complete timely development of FBI unique macros for Microsoft Word”), it offered the acceptable alternative action of web-based submissions.  However, the FBI did not provide estimated completion dates for these planned actions.  We request that in its next corrective action correspondence the FBI provide a timeframe for implementation of this recommendation.  This recommendation can be closed when we receive documentation demonstrating that: (a) adequate trouble-shooting equipment for Trilogy equipment has been procured, and (b) a web-based approach has been established to replace Word Perfect macros.
30. Resolved. This recommendation is resolved based on the FBI’s agreement to update the IT strategic and performance plans so that the plans:  (a) are fully integrated with the FBI’s ITIM process, and (b) include those performance goals and indicators included in the DOJ’s IT Strategic Plan.  The FBI’s response states that its IT Strategic Planning process will be updated and integrated with the ITIM framework by the fourth quarter of FY 2003.  However, the response does not state that the FBI’s IT Strategic Planning process will incorporate performance goals and indicators included in the DOJ’s IT Strategic Plan.  This recommendation can be closed we receive a copy of the updated Strategic Planning process that includes the above requirements.

67. The FBI's response states that the roll-out of the Control phase is expected to be completed by the fourth quarter of FY 2003.