TESTIMONY OF GENE L. DODARO,1 ASSISTANT COMPTROLLER GENERAL, ACCOUNTING AND INFORMATION MANAGEMENT DIVISION, U.S. GENERAL ACCOUNTING OFFICE, ACCOMPANIED BY RONA B. STILLMAN,2 CHIEF SCIENTIST, OFFICE OF COMPUTERS AND TELECOMMUNICATIONS, ACCOUNTING AND INFORMATION MANAGEMENT DIVISION, U.S. GENERAL ACCOUNTING OFFICE, AND LYNDA WILLIS, ASSOCIATE DIRECTOR FOR TAX POLICY AND ADMINISTRATION, U.S. GENERAL ACCOUNTING OFFICE

Mr. DODARO. Yes, Mr. Chairman, and good morning, Senator Glenn.

As you indicated, in the series of hearings that we have had, the underlying theme has been the critical need to continue improving IRS' business operations. Since we were before this Committee in May, we have issued two major additional reports at this Committee's request-one on the Cyberfile project, and also our assessment of Treasury and IRS' responses to our recommendations in the tax system modernization area.3

I am going to ask Rona to give you a quick summary of both of those reports, and then I will come back. You asked me, Mr. Chairman, in March to come back at the end of this series of hearings and give you our assessment of what needs to be done, moving forward, both in the short-term and in the long-term, and I will do that.

Chairman STEVENS. Good. Dr. Stillman?

Ms. STILLMAN. Mr. Chairman, Senator Glenn, we are pleased to be here to discuss IRS efforts to modernizing tax processing via TSM. Since 1986, IRS has spent more than $3 billion on TSM and expects to spend billions more on TSM.

By any measure, this is a world-class information system development investment. In a July 1995 report, we identified pervasive management and technical weaknesses in TSM. These weaknesses included not having a business strategy to reach its goal of getting at least 80 million returns submitted electronically by 2001; not having the data architecture and security architecture needed to build TSM systems; not using sound data, such as life-cycle cost, mission-related benefit, technical risk, and systems performance when deciding which projects to fund in TSM; and having immature, ad hoc and sometimes chaotic systems development processes, that is, Level 1 process on the Carnegie Mellon University Software Engineering Institute's (SEI) Capability/Maturity Scale of 1 through 5.

We said these problems were so serious that if they were not corrected, TSM would not succeed. We also made over a dozen specific recommendations for correcting the problems.

Since that time, both IRS and Treasury have acknowledged the problems and their criticality and have stressed their commitment to correcting them. For example, IRS has begun using contractors

1 The prepared statement of Mr. Dodaro appears on page 286.

2 The prepared statement of Ms. Stillman appears on page 300.

3 GAO reports entitled "Tax Systems Modernization: Cyberfile Project Was Poorly Planned and Managed" (GAO/AMID-96-140, August 1996) and "Internal Revenue Service: Business Operations Need Continued Improvement" (GAO/AIMD/GGD-96-152, September 1996) appears on page 422 and 454.

to define its data and security architectures and has created an Investment Review Board to oversee its huge information systems investment, and Treasury has created a Modernization Management Board that shows promise of providing effective leadership.

However, the bottom line is this: None of these actions, individually or in the aggregate, fully corrects any of the problems we identified or fully implements any of the recommendations we made. As a result, today, IRS still has no strategy showing year by year, from 1996 through 2001, how it will reach its electronic filing goals. IRS continues to build systems without blueprints defining how IRS employees will be provided ready and secure access to complete taxpayer data. IRS continues to invest hundreds of millions of dollars each year, without a disciplined, data-driven investment process, and IRS continues to build software using undisciplined, poorly controlled and inconsistent software development processes.

We also assessed IRS plans to expand its use of contractors in managing and developing TSM. Specifically, IRS plans to increase use of its current contractors and to transition overall authority and responsibility for the development, delivery and deployment of TSM to what they have called a "prime contractor." IRS believes that it can award the contract for the prime in about 2 years.

At this point, IRS plans to use a prime contractor are insufficiently defined to understand or assess. We do not understand exactly what they plan to do, how and when they plan to do it, or how it will work.

For example, IRS has not specified which development activities it will transfer to contractors or to what extent contractors could be held responsible for existing problems in these government-initiated systems. This is critical, because if IRS continues as planned, the principal TSM systems will all be in development and/or deployed before IRS awards a prime contract.

What is even more important, however, is that these plans appear to assume that IRS will get better results if it uses contractors to develop TSM than it has gotten developing TSM in-house. This is not the case. Cyberfile, a system to allow taxpayers to file returns from home PCs, is evidence that just contracting out, even using what IRS calls a prime contractor, is not the answer.

In August 1995, IRS agreed to use Commerce Department's NTIS as its prime contractor in developing Cyberfile. However, Cyberfile fared no better than IRS in-house developments. It was developed using undisciplined, SEI Level 1 software development processes, could not be delivered as planned for the 1996 tax filing season, and has been suspended after advancing $17.1 million.

In a report recently completed for the Committee, we found that IRS did not manage the Cyberfile acquisition effectively. IRS contracted with NTIS without convincing evidence that NTIS could deliver what it promised. IRS did not conduct the requirements and alternatives analyses mandated by applicable procurement regulations and by IRS' own policies. IRS abdicated its responsibility to oversee NTIS development and acquisition efforts. IRS did not properly account for Cyberfile obligations and costs. And IRS did not take steps to avoid unnecessary Cyberfile costs, including hundreds of thousands of dollars in NTIS management fees for placing

orders with other Federal agencies that IRS could have placed itself and $89,000 in NTIS management fees for placing orders against IRS' own contract, an existing Treasury contract that IRS administers.

The bottom line, then, is this. Until IRS institutionalizes discipline in its contract management and systems acquisition practices, it will do no better contracting out for TSM than it has done trying to build TSM in-house.

In considering alternatives for bringing IRS modernization back on track, it is important to discard three myths that have distorted the discussion in the past. The first myth is that criticizing TSM is tantamount to opposing modernization. It is not. Every reasonable person recognizes that IRS must modernize its operations. The only issue is how to do that effectively.

The second myth is that TSM is a single, integrated system that will achieve IRS' vision. It is not. TSM is a set of projects and activities of uncertain business value which is missing key elements needed to modernize IRS operations. TSM is missing a business plan to maximize electronic filings. It is also missing the data and security architectures needed to define how ready and secure access to taxpayer data would be provided.

The third myth is that cutting funding from TSM means endangering current operations. This is not true. The operations and maintenance of the Legacy systems are not funded by TSM appropriations. Further, by IRS' own accounting, only a fraction of TSM goes to supporting operational systems-about 22 percent of the original $850 million requested for 1997 and about 26 percent of the revised $664 million request.

In formulating corrective strategies, then, there is latitude to adjust both the content of TSM and its budget. The key is to focus on the heart of the problem and to act to correct it. The heart of the problem with TSM is that IRS is doing things-expensive things-without the management and technical discipline needed to ensure success.

Therefore, in a June 1996 report to the Appropriations Committee, we recommended that the Congress consider permitting IRS to continue only those things that it is capable of doing, like the operations and maintenance of current systems or the development of small, low-cost, low-risk systems, but that IRS be required to institutionalize disciplined processes and develop detailed plans before proceeding with more difficult things like developing major systems or contracting out for major systems.

The details of our recommendations are in the written testimony, Mr. Chairman. This concludes my statement.

Chairman STEVENS. Thank you very much.

Mr. Dodaro, what do you want to do now?

Mr. DODARO. As you requested in March, Mr. Chairman, I will give you an overall assessment of IRS' responsiveness to our recommendations in the series of reports and testimonies that we have been issuing and highlight for this Committee's attention some short-term recommendations that we have made, and then talk about a couple of longer-term issues.

First, on the recommendations we have made in the tax system modernization effort, in our financial audits, and in our reviews of

IRS' efforts to provide customer service, IRS has basically agreed with all the recommendations that we have made. They have many activities underway to address some of the problems, but the bottom line is that none of the major recommendations that we have made so far have been fully implemented by the IRS.

I will note, however, that the IRS is beginning to develop a much better appreciation for the depth of its problems, particularly those in the technical areas of developing tax system modernization. IRS still needs to do much more to implement the recommendations that we have made before they are fully able to report, and we would be able to tell to this Committee, that their serious management problems are fully corrected.

In the short term, I would recommend three major categories of items. One would be, as we have reported, to limit funding to the Tax Systems Modernization effort only to critical priorities. These are priorities that would sustain current operations and maintenance of their existing systems. This would be also funding to help them fix some of their serious management and technical problems and also to develop small, manageable projects that are low technical risk and would fit their current capabilities to implement them much more successfully.

Both of the Appropriations Committees are moving in this direction; the markups for IRS in the Committees begin to restrict the funding and put some checks and balances on further funding in TSM, making it contingent upon IRS improving its capabilities.

IRS and Treasury themselves are beginning to recognize this as well, which I think is a good development. They have scaled back their budget requests and plans and are looking at some of the projects and only undertaking ones they can handle.

So the first category is to limit the funding on Tax Systems Modernization until IRS develops better capabilities.

Second is building those capabilities themselves, and this is in two major areas.

One is in making good investment decisions. IRS is putting in place a process, both at the IRS level and at the Treasury level, to scrutinize what projects they are selecting, how they are evaluating them and deciding upon making funding decisions. And while the rudiments of this process are in place, there is still not good information that IRS has in order to develop the business cases. They are working to develop this, but they need better data on what the costs of these projects are going to be, what the expected benefits are, and then to measure whether or not the projects they put in place are actually receiving the benefits.

Two, they need to work on the technical foundation to improve their processes to both build software themselves, but more importantly, to manage contractors that they use. The problems with Cyberfile and other areas show that IRS needs to develop the capability to manage contractors effectively, and they also need their overall architecture and blueprint. They have activities underway to do this, and we are going to continue to monitor their efforts and provide progress reports. But building this technical foundation is paramount.

The third major short-term issue is to continue working on the problems that are undermining IRS' ability to accurately account

for the $1.3 trillion in revenue and its $8 billion in operating funds. These problems are ones we reported for the past 4 years in our financial audits. Since the May hearing before this Committee, we have been working with IRS on a much more detailed action plan to implement those recommendations. They have engaged some outside parties to help them. We are closely watching that and plan to provide continued progress reports to this Committee. But it is paramount that they get on top of those accounting problems. In the longer term, there are two major issues. First, a fundamental underlying problem here is that there is yet to be a general agreement between IRS and the Congress on what its priorities are, what its business strategy should be, how it is going to implement those business strategies and how the Congress is going to measure their performance and hold them accountable. And there are two tools that are available to the Congress to assist it. One is the Government Performance and Results Act, and IRS will be presenting its strategic plan and performance measure next year, but the Congress must engage with them and reach agreement on what that basic business framework is going to be and how they are going to hold IRS accountable and measure their progress.

Two, next summer, the Congress will have the results from the National Commission on Restructuring the IRS, which has just begun its deliberations-in fact, as we are meeting here, they are having their second meeting. That Committee, which was created last year by the Congress, has a broad charter to review IRS' operations, including its organizational structure and technical capabilities.

Finally, the Congress needs to settle on making sure there is effective oversight over IRS' operations. The Treasury Department has become much more active recently in their Modernization Management Board. That is a good development. Treasury should have been engaged earlier, and they were not. Now they are beginning to get more assertive. OMB also needs to exercise its leadership in terms of reviewing these investments before sending budget requests to the Congress to make sure that IRS can deliver on those results.

The Congress now has available a number of management tools. You have mentioned many of them this morning-the CFO Act, in order to assess progress in accounting; also, the Information Technology Management Reform Act, which this Congress passed and was signed into law, has now become effective in August. This act is designed to help ensure much more rigor and discipline in making technology investments and making sure the American public gets a return on its investment, which has not been the case in the past.

All of these activities are necessary to make sure IRS fixes its problems. It is going to take discipline, it is going to take time, and it is going to take a lot of oversight from this Committee. This series of hearings has been a good start, and I would encourage the Committee to continue this in the future.

Thank you. We would be happy to respond to any questions.

Chairman STEVENS. Ms. Willis, do you have any comments at this time?