Input:
	Background

The mission of IRS, a bureau within the Department of the Treasury, is to  provide America’s taxpayers top quality service by helping them  understand and meet their tax responsibilities and by applying the federal  tax laws with integrity and fairness to all. In carrying out its mission, IRS  annually collects over $2 trillion in taxes from millions of individual  taxpayers and numerous other types of taxpayers and manages the  distribution of over $300 billion in refunds. To guide its future direction,  the agency has two strategic goals: (1) deliver high quality and timely  service to reduce taxpayer burden and encourage voluntary compliance;  and (2) effectively enforce the law to ensure compliance with tax  responsibilities and combat fraud.
IRS has established seven overarching priorities to accomplish its  mission:  facilitate voluntary compliance by empowering taxpayers with secure  and innovative services, tools, and support; understand non-compliant taxpayer behavior, and develop  approaches to deter and change it;  leverage and collaborate with external stakeholders;  cultivate a well-equipped, diverse, skilled, and flexible workforce;  select highest value work using data analytics and a robust feedback  loop; drive more agility, efficiency, and effectiveness in IRS operations; and strengthen cyber defense and prevent identity theft.
The mission of IRS’s Information Technology organization is to deliver IT  services and solutions that drive effective tax administration to ensure  public confidence. It is led by the Chief Technology Officer, who reports to  the Deputy Commissioner for Operations Support of the IRS. Several  subordinate offices report to the Chief Technology Officer. Figure 1 shows  the structure of IRS’s Information Technology organization.

		IRS Relies on IT to Carry Out Its Mission

IT plays a critical role in enabling IRS to carry out its mission and  responsibilities. For example, the agency relies on information systems to  process tax returns, account for tax revenues collected, send bills for  taxes owed, issue refunds, assist in the selection of tax returns for audit,  and provide telecommunications services for all business activities,  including the public’s toll-free access to tax information.
For fiscal year 2016, IRS is pursuing 23 major and 114 non-major IT  investments to carry out its mission. These investments generally support  (1) day-to-day operations (which include operations and maintenance, as  well as development, modernization, and enhancements to existing  systems), and (2) modernization efforts in support of IRS’s future goals.  The day-to-day operations are primarily funded via the operations support  appropriation account, user fees and other supplemental funding. The  modernization efforts are funded via the business systems modernization  appropriation account. IRS expects to spend about $2.7 billion for IT,  including $2.2 billion in appropriated funds, $391.9 million in user fees,  and $108.2 million in other supplemental funding.
Approximately $1.4 billion of IRS’s IT funding for fiscal year 2016  supports the two operational investments (TSS and MSSS), and four  development investments (FATCA, ACA, CADE 2, and RRP) that we  selected for review.
TSS supports IRS’s network infrastructure services such as network  equipment, video conference service, enterprise fax service, and  voice service for over 85,000 IRS employees at about 1,000 IRS  locations. According to IRS, the investment continues delivery of  services and products to employees which translates into service to  taxpayers. IRS allocated approximately $366.6 million to activities  supporting the TSS investment. Table 1 identifies the fiscal year 2016  funding allocation for the TSS investment, as well as the types of  activities being funded.
MSSS provides for the design, development, and deployment of  server, middleware, and large systems as well as enterprise storage  infrastructures, including systems software products, databases, and  operating systems for these platforms. For fiscal year 2016, IRS  allocated approximately $454.2 million for activities supporting the  MSSS investment. Table 2 identifies the fiscal year 2016 funding  allocation for the MSSS investment, as well as the types of activities  being funded.
FATCA is intended to improve tax compliance by identifying U.S.  taxpayers that attempt to shield or divert assets by depositing funds in  foreign accounts. A law enacted in 2010 requires foreign financial  institutions to report to the IRS information regarding financial  accounts held by U.S. taxpayers or foreign entities in which U.S.  taxpayers have a substantial ownership interest. IRS allocated $89.1  million to FATCA for fiscal year 2016.
ACA encompasses the planning, development, and implementation of  IT systems needed to support IRS’s tax administration responsibilities  associated with parts of the Patient Protection and Affordable Care  Act. IRS allocated $311.2 million to ACA for fiscal year 2016.
CADE 2 is intended to provide daily processing of taxpayer accounts.
A major component of the program is a modernized database for all  individual taxpayers that is intended to provide the foundation for  more efficient and effective tax administration. In Transition State 2 of  the initiative, the modernized database will become IRS’s authoritative  source for taxpayer account data, as it begins to address core  financial material weakness requirements for individual taxpayer  accounts. Existing financial reports will be modified to take into  account the increased level of detail and accuracy of data in the  database. CADE 2 data will also be made available for access by  downstream systems such as the Integrated Data Retrieval System  for online transaction processing by IRS customer service  representatives. IRS allocated $129.9 million to CADE 2 for fiscal year  2016.
RRP is intended to deliver an integrated and unified system that  enhances IRS’s capabilities to detect, resolve, and prevent criminal  and civil tax noncompliance. In addition, it is intended to allow  analysis and support of complex case processing requirements for  compliance and criminal investigation programs during prosecution,  revenue protection, accounts management, and taxpayer  communications processes. IRS allocated $91.7 million to RRP for  fiscal year 2016.

		GAO Has Reported on IRS’s Major IT Investments and Identified Needed Improvements

Over the past several years, we have issued a series of reports which  have identified opportunities for IRS to improve the management of its  major IT investments.
We reported in June 2012 that while IRS reported on the cost and  schedule of its major IT investments and provided chief information  officer ratings for them, the agency did not have a quantitative  measure of scope–a measure that shows functionality delivered. We  noted that having such a measure is a good practice as it provides  information about whether an investment has delivered the  functionality that was paid for.
We recommended that IRS develop a quantitative measure of scope,  at a minimum for its major IT investments, to have more complete  information on the performance of these investments. In December  2015, IRS officials told us that they were exploring options to report  scope and proposed an option in a December 2015 quarterly report  on IT to Congress. We examined the suitability of proposed solutions  for a quantitative measure of scope as part of this review.
Further, in April 2013 we reported that the majority of IRS’s major IT  investments were reportedly within 10 percent of cost and schedule  estimates and eight major IT investments reported significant cost  and/or schedule variances. We also reported that weaknesses  existed, to varying degrees, in the reliability of reported cost and  schedule variances, and key risks and mitigation strategies were  identified. As a result, we made recommendations for IRS to improve  the reliability of reported cost and schedule information by addressing  the identified weaknesses in future updates of estimates. We also  recommended that IRS ensure projects consistently follow guidance  for updating performance information 60 days after completion of an  activity and develop and implement guidance that specifies best  practices to consider when determining projected amounts.
IRS agreed with three of our four recommendations and partially  disagreed with the fourth recommendation. The agency specifically  disagreed with the use of earned value management data as a best  practice to determine projected cost and schedule amounts, stating  that the technique was not part of IRS’s current program management  processes and the cost and burden to use it outweighed the value  added. While we disagreed with IRS’s view of earned value  management because best practices have found that the value  generally outweighs the cost and burden of implementing it, we  provided it as one of several examples of practices that could be used  to determine projected amounts. We also noted that implementing our  recommendation would help improve the reliability of reported cost  and schedule variance information, and that IRS had flexibility in  determining which best practices to use to calculate projected  amounts.
Finally, our February 2015 report found that most of IRS’s major IT  investments reported meeting cost and schedule goals; however,  selected investments experienced variances from initial cost,  schedule, and scope plans that were not transparent in reports to  Congress because IRS had yet to address our prior  recommendations. Specifically, IRS had not addressed our  recommendation to report on how delivered scope compares to what  was planned, and also did not address guidance for determining  projected cost and schedule amounts, or the reporting of cumulative  cost and schedule performance information.

	IRS Has Identified IT Priorities for Fiscal Year 2016, but Does Not Have a Process for Prioritizing Modernization Efforts

IRS has identified priorities for operations and modernization but does not  have a structured process for prioritizing among modernization efforts.  Specifically, IRS has developed eight priority groups for operations, such  as the delivering essential tax administration and taxpayer services  group, and identified eight priority projects for modernization, including  CADE 2 and RRP, to help reach IRS’s future state vision. In addition, IRS  has developed a structured process for allocating funding to its operations  support activities which is consistent with best practices. However, IRS  has not fully documented this process. In addition, IRS does not have a  similar structured process for prioritizing funding among its modernization  activities, stating it does not have such a process because there are  fewer competing activities than for operations support. A documented  process for both operations support and modernization activities that is  consistent with best practices would provide transparency into the  process and provide greater assurance it is consistently applied.

		IRS Has Identified Priorities for Operations Support and Modernization

IRS has identified eight priorities—referred to as repeatable priority  groupings—for its operations support activities. Officials told us that these  priorities evolved from lessons learned in using priorities established the  prior year and noted that they will continue to be refined over time. For  example, in fiscal year 2015, activities associated with the tax filing  season were identified as IRS’s top priority; however, in fiscal year 2016,  IRS decided that infrastructure (i.e., telephones and computer servers)  was essential in supporting tax processing and should thus be classified  as IRS’s top priority. Each of the priority groupings includes several  supporting business activities associated with major and non-major  investments that IRS allocates funding to. Examples of such business  activities include enterprise video conferencing service, and print support  for taxpayer notices. These priorities and information related to these  priorities are identified in order of importance, as determined by IRS, in  table 3.
IRS has also identified eight priority projects for modernization. These  projects, as well as their descriptions and associated funding allocations  are identified in table 4.

		IRS Has a Structured Process for Prioritizing Funding for Its Operations Support Activities, but Lacks a Similar Process for Modernization Activities

According to GAO’s Information Technology Investment Management  Framework, an organization should document policies and procedures for  selecting new and reselecting ongoing IT investments. These policies  and procedures should include criteria for making selection and  prioritization decisions. A policy-driven, structured method for reselecting  ongoing projects provides the organization’s investment board with a  common understanding of how ongoing projects will be reselected for  continued funding. In addition, executives funding decisions should be  aligned with the selection decision. Specifically, the organization’s  executives have discretion in making the final funding decisions on IT  proposals. However, their decisions should be based upon the analysis  that has taken place in the previous activities.
Further, the Office of Management and Budget’s (OMB) Capital  Programming Guide requires, among other things, that agencies have a  disciplined capital programming process that addresses project  prioritization and comparison of assets against one another to create a  prioritized portfolio.
In 2015, IRS developed and implemented a process known as the  Portfolio Investment Planning process to prioritize its operations support  activities. This process addresses (1) prioritization and comparison of IT  assets against each other and (2) criteria for making selection and  prioritization decisions. Further, senior IRS executives stated that the final  funding decisions on IT proposals are based on IRS’s prioritization  process.
IRS uses priority groupings it has defined as criteria for making  prioritized selections. Specifically, a consideration in determining if an  activity (i.e., request for funding) will be selected is to determine the  extent to which it supports any of eight priority groupings. If the activity  is found to support one of the eight priorities, it is further assigned one  of four priority levels: must do, high, medium, or low. IRS has defined  the criteria that must be met in order to classify a funding activity at a  particular priority level. Table 5 provides an example of the criteria  used to make these decisions for the legislative provisions for the  FATCA and ACA priority group.
IRS prioritizes and compares IT assets against each other.  Specifically, IRS business units identify line item activities for which  they are requesting funding. For each activity, business units address,  among other things, placement within IRS’s established priorities;  proposed high-level capabilities and a cost estimate; a 1-year usable  segment; and the date funding is needed and subsequent mitigation  strategy if funding is not received by the specified date. Further,  several meetings are held to review requested funding activities.  According to IRS, the purpose of these meetings is to provide a cross- organization review and evaluation of IT-related demands.  Stakeholders include Associate Chief Information Officers, business  unit representatives, and staff from IRS’s IT Financial Management  Service.
Finally, IRS senior executives stated that its final funding decisions on  IT proposals are based on IRS’s prioritization process. According to  these officials, when the agency receives its appropriation, it  evaluates prioritized activities—starting with the highest priority  demands—until the total estimate of appropriated funding is allocated.  Officials have discussions relative to the items that will not be funded  and then engage the Office of the Chief Financial Officer to determine  the extent to which user fees and other sources of funding are  available to support priorities that exceed the appropriated amount.  Prioritized activities, which have been allocated funding for the  upcoming fiscal year, are presented to the Chief Technology Officer  for approval. IRS’s Senior Executive Team approves the Chief  Technology Officer’s funding recommendations and submits the  recommendations to the Commissioner and Deputy Commissioners  for final funding approval.
Despite these strengths, IRS has not fully documented its process for  prioritizing operations support activities. Specifically, while several  documents describe aspects of the operations support prioritization  process, including the criteria used and the meetings to review and  evaluate IT related demands, none fully describe the procedures  associated with the process. IRS officials stated this is because it is  relatively new and not yet stabilized. IRS officials who are stakeholders in  this process stated that documentation would have reduced the  uncertainty they faced during implementation and would have helped  them to better prepare the required data for the process. IRS senior  executives stated they plan to fully document this process; however, they  did not identify a time frame for when this would be done. Fully  documenting IRS’s portfolio investment process for operational activities  would help ensure consistent implementation of the process by all  stakeholders and provide transparency regarding how such prioritization  decisions are made.
In contrast with operations support, IRS does not have a structured  process for prioritizing funding among its modernization investments.  Specifically, IRS officials stated that discussions are held to determine the  modernization efforts that are the highest priority to meet IRS’s future  state vision and technology roadmap. Officials reported that staffing  resources and lifecycle stage are considered but there are no formal  criteria for making final determinations.
Senior IRS officials stated that they do not have a structured process for  selection and prioritization of business systems modernization activities  because the projects are set and there are fewer competing activities  than for operations support. While there may be fewer competing  activities, a structured, albeit simpler, process that is documented and  consistent with best practices would provide transparency into IRS’s  needs and priorities for appropriated funds. Such a process would better  assist Congress and other decision makers in carrying out their oversight  responsibilities.

	Performance Varied for Selected Investments

Of the six selected investments in our review, two development  investments—FATCA and RRP—performed under cost, with varying  schedule performance, and delivered most of the scope that was  planned; however, performance information for these investments could  be improved by implementing best practices for determining actual work  performed. For portions of the two other development investments (CADE  2 and ACA) for which performance information was available, IRS  reported completing work under planned cost and on time. However,  neither investment reported information on planned versus actual delivery  of scope, in accordance with best practices. Further, ACA did not report  timely information on planned versus actual costs. Finally, one of the two  investments in operations and maintenance (MSSS) met all operational  performance goals, while the other investment in operations and  maintenance (TSS) met six out of eight goals.

		Four Investments in Development Experienced Variances and Performance Reporting for These Investments Could Be Improved

Best practices highlight the importance of timely reporting on performance  relative to cost, schedule, and scope (both planned and actual).  According to these practices, one way to measure benefits of  development work is to approximate by measuring a project’s actual cost  and schedule progression (i.e., evaluating earned value), which is a  measure of the amount of planned work that is actually performed in  relation to the funds expended. IRS reported metrics for FATCA and  RRP, which allowed us to determine these investments’ performance.  The agency did not use such metrics or consistently develop planned and  actual cost, schedule, and scope information for all CADE 2 and ACA  projects and activities that were completed or ongoing during fiscal year  2015 and the first quarter of fiscal year 2016. As a result, we could only  determine the performance of portions of these investments.
FATCA and RRP: During fiscal year 2015 and the first quarter of fiscal  year 2016, IRS reported quarterly cost, schedule, and scope performance  information for each of the FATCA and RRP projects it was working on.  Specifically, it reported metrics for these investments via its Investment  Performance Tool. Table 6 summarizes the performance of the FATCA  and RRP investments (see appendix II for detailed analyses).
As shown in table 6, FATCA and RRP performed under cost, with varying  schedule performance, and delivered most of the scope that was  planned. Specifically,  IRS was developing 10 projects to support the FATCA investment  during fiscal year 2015 and the first quarter of 2016. IRS reported  completing work at $12.4 million less than budgeted and delivering  91.7 percent of planned scope with an 8 percent schedule overrun for  these projects. IRS stated that the reasons for these variances  include, among other things, issues with the requirements  management process; an overestimation of costs; and a reduction in  the amount of work completed versus what was planned.
IRS was developing three projects to support the RRP investment  during fiscal year 2015 and the first quarter of 2016. IRS reported  completing work at $24.5 million less than budgeted and delivering  99.9 percent of planned scope with a minor schedule overrun for  these projects. IRS stated that the reasons for these variances  include, among other things, overestimation of costs (including IRS  labor) and unplanned work that needed to be completed.
While the scope metric used for FATCA and RRP provides an indication  of performance, this metric would be more reliable if it incorporated best  practices for determining the amount of work completed for all activities.  Specifically, IRS uses a level of effort method beyond the amount  generally accepted by best practices to determine the amount of work  completed by its own staff. Our Cost Estimating and Assessment  Guide states that the level of effort method should be used sparingly (15  percent of the budget or less); however, the work performed by IRS staff  ranged from 22 to 100 percent of the work completed for the FATCA and  RRP projects that were ongoing during the time frame of our review. IRS  officials stated that measuring value for government work is a vague  concept to pursue. Nevertheless, revising the method for determining the  amount of work completed by IRS staff for these investments would  improve the reliability of the performance information.
CADE 2 and ACA: For the CADE 2 projects that were completed during  fiscal year 2015 and the first quarter of fiscal year 2016, IRS reported that  CADE 2 performed on time and $1.7 million under planned cost.  According to IRS, the positive cost variance for the CADE 2 investment is  the result of overestimation of costs and the ability to reuse existing code.  For the ACA activities that reported actual costs during fiscal year 2015  and the first quarter of 2016, IRS reported that ACA performed on time  and $10.3 million under planned costs. IRS stated that this variance was  primarily due to an overestimation of the labor needed to complete the  planned work. Table 7 shows the reported cost and schedule  performance for CADE 2 and ACA.
With respect to CADE 2, IRS does not report timely information on  planned versus actual delivery of scope. Specifically, a senior CADE 2  program official stated that, due to the nature of the methodology  being used to implement the projects, progress in delivering planned  scope cannot be determined until the end—after the testing phase.  For CADE 2, projects can be 16 to 60 months long. We requested  information from IRS regarding delivery of planned scope for those  projects that completed during the time frame of our review; however,  IRS was unable to provide this information.
Regarding ACA, IRS does not report timely cost or scope information.
A senior IRS official stated that the investment is being developed  using an iterative approach, the goal of which is to deliver  functionality in short increments. However, the agency does not report  actual costs for the activities comprising the projects until the activities  are completed; this delay in reporting could be as long as 9 months.  Instead, ACA calculates a cost projection, which provides an estimate  of cost to complete rather than cost of work completed, with which we  have previously identified weaknesses. In addition, IRS only  provided information on delivery of planned scope for one of the ACA  projects it was developing during the timeframe of our review.
Reporting of performance for the CADE 2 and ACA investments could  be improved by incorporating best practices for timely reporting of  cost, schedule, and scope performance information. As a result of the  lack of timely and complete performance information, Congress and  other external parties do not have pertinent information about CADE 2  and ACA with which to make oversight decisions.

		One Investment in Operations and Maintenance Met All Operational Performance Goals, the Other Met the Majority of Goals

According to OMB’s Fiscal Year 2016 Capital Planning Guidance,  ongoing performance of operational investments is monitored to ensure  the investments are meeting the needs of the agency, delivering expected  value, and/or modernized and replaced consistent with the agency’s  enterprise architecture. To this end, OMB requires agencies to report on  at least five operational metrics for major IT investments and agencies  are specifically required to report on planned and actual operational  performance.
The two operations and maintenance investments in our review reported  on operational performance metrics, as required. MSSS met its five  operational performance goals during fiscal year 2015; however, TSS  consistently underperformed on two of its eight metrics.
Table 9 identifies the MSSS operational performance metrics, their  descriptions, and the performance against these metrics during fiscal year  2015.
IRS reported planned and actual performance for eight operational  performance metrics for TSS during fiscal year 2015. However, as  previously mentioned, TSS consistently missed operational performance  goals for two of the eight metrics. The two TSS metrics that were not met  illustrate pervasive challenges meeting its goals in deploying new  telecommunications capabilities. Specifically, IRS missed every monthly  target in fiscal year 2015 for deploying voice, video, and data  technologies. As a result, TSS did not deploy such technologies to  approximately 4,300 users that were originally included in the planned  deployment.
According to IRS officials, the operational performance goals for the two  metrics that were not met should have been updated to better reflect the  limited funding the agency intended to allocate to these activities.
Table 10 identifies the TSS operational performance metrics, their  descriptions, and the performance against these metrics during fiscal year  2015.

	Conclusions

While IRS has developed a process for prioritizing funding for operations  support activities that adheres to best practices, it is not fully documented.  Further, IRS has not developed a priority setting process for  modernization activities for which the agency allocated nearly $300  million to for fiscal year 2016. Until IRS documents its process for  operations support activities and develops a process for modernization  activities, the agency will lack the transparency needed by Congress and  others to assist in carrying out their oversight responsibilities.
IRS has developed performance metrics for two investments—FATCA  and RRP—which include a measure of progress in delivering scope, a  measure we have been reporting on and recommending IRS address  since 2012. While these metrics represent an important step, their  reliability could be improved by incorporating best practices for measuring  the work performed by IRS staff by using the level of effort measure  sparingly. In addition, only partial performance information was available  for CADE 2 and ACA because IRS did not use the metrics it is positioned  to develop for these investments or consistently have cost, schedule, and  scope information for these investments. Continued efforts in this area  would substantially improve the performance reporting for the CADE 2  and ACA investments, and potentially for all major development efforts.

	Recommendations for Executive Action

To help IRS improve its process for determining IT funding priorities and  to provide timely information on the progress of its investments, we  recommend that the Commissioner of IRS direct the Chief Technology  Officer to take the following four actions: document IRS’s process for selecting and prioritizing operations establish, document, and implement policies and procedures for  selecting new and reselecting ongoing business systems  modernization activities, consistent with IRS’s process for prioritizing  operations support priorities, which addresses (1) prioritization and  comparison of IT assets against each other, (2) criteria for making  selection and prioritization decisions, and (3) ensuring IRS executives’  final funding decisions on IT proposals are based on IRS’s  prioritization process; modify existing processes for FATCA and RRP for measuring work  performed by IRS staff to incorporate best practices, including  accounting for actual work performed and using the level of effort  measure sparingly; and  report on actual costs and scope delivery at least quarterly for CADE  2 and ACA. For these investments, IRS should develop metrics  similar to FATCA and RRP.

	Agency Comments and Our Evaluation

We provided a draft of this product to IRS for comment. In its written  comments, reproduced in appendix III, IRS agreed with two  recommendations, did not agree nor disagree with one, and disagreed  with one. Specifically,  IRS agreed with our recommendations to better document its  prioritization process for operations support activities and extend that  process to its business systems modernization activities.
With respect to our recommendation to report on actual costs and  scope delivery at least quarterly for CADE 2 and ACA, IRS did not  agree nor disagree, but noted that IRS is continuing to try to improve  its processes in reporting investment performance.
Regarding our recommendation to modify existing processes for  FATCA and RRP for measuring work performed by IRS staff to  incorporate best practices, including accounting for actual work  performed and using the level of effort measure sparingly, IRS  disagreed and stated that modifying the use of the level of effort  measure would equate to a certified earned value management  system, which would add immense burden on IRS’s programs on  various fronts and would outweigh the value it provides. However, we  did not specify the use of an earned value management system in our  report and believe other methods could be used to more reliably  measure work performed. As noted in our report, 22 to 100 percent of  the work for selected projects was performed by IRS staff. As a result,  we believe that it is a reasonable expectation for IRS to reliably  determine the actual work completed, as opposed to assuming that  work is always completed as planned. Accordingly, we maintain our  recommendation is still warranted.
We are sending copies of this report to interested congressional  committees, the Commissioner of IRS, and other interested parties. This  report will also be available at no charge on our website at  http://www.gao.gov.
If you or your staffs have any questions on matters discussed in this  report, please contact me at (202) 512-9286 or pownerd@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the Internal Revenue Service’s (IRS)  current information technology (IT) investment priorities and assess IRS’s  process for determining these priorities, and (2) determine IRS’s progress  in implementing key IT investments.
To address our first objective, we reviewed documentation, such as IRS’s  fiscal year 2016 Business Systems Modernization Operating Plan, as well  as financial reports to determine IRS’s IT funding priorities and funding  allocations.
In addition, we reviewed artifacts from IRS’s Portfolio Investment  Planning process, such as slide decks describing key stages of the  process, memorandums distributed to stakeholders, prioritized listings of  investment activities, and criteria for establishing priorities, to identify and  describe IRS’s process for determining its IT investment priorities.  Further, we interviewed officials in IRS’s Office of Strategy and Planning,  as well as stakeholders of the Portfolio Investment Planning process from  IRS business units. We then analyzed IRS’s processes against best  practices in our IT Investment Management Framework and the Office of  Management and Budget’s Capital Programming Guide to determine the  extent to which the processes met best practices and requirements.  Lastly, we met with officials at the Department of the Treasury who are  responsible for IT capital planning, including the Treasury Chief  Information Officer, to determine the department’s role in IRS’s process  for prioritizing IT funding.
For our second objective, we analyzed the performance of four key  development investments—Customer Account Data Engine 2 (CADE 2),  Return Review Program (RRP), Foreign Account Tax Compliance Act  (FATCA), and the Affordable Care Act Administration (ACA). Further, we  analyzed two key operational investments —Telecommunications  Systems and Support (TSS) and Mainframes and Servers Services and  Support (MSSS). We chose these investments because they represented  IRS’s most significant expenditures on development and operations for  fiscal year 2015 ($496.5 million and $777.8 million, respectively).
A tailored approach was necessary for analyzing the development  investments given the varying types and extent to which performance  information was available for these investments. To determine the  progress in implementing FATCA and RRP, we compiled and  analyzed quarterly output from IRS’s Investment Performance Tool for  the period of fiscal year 2015 through the first quarter of 2016. IRS  does not consider this tool to be a formal Earned Value Management  System. As a result, we did not evaluate the extent to which the tool  was compliant with the American National Standards Institute’s  guidelines for an Earned Value Management System. For CADE 2,  we analyzed IRS’s quarterly reporting of planned and actual costs, as  well as requirements reports and schedule reporting. For ACA, we  analyzed IRS’s financial reporting via the ACA business case  submissions, as well as performance reporting to management and  schedule reporting. In addition, we held multiple meetings with IRS  officials, including officials in the CADE 2, FATCA, ACA, and RRP  program offices.
To determine the progress in implementing TSS and MSSS, we  reviewed operational performance information reported for the  selected investments from October 2014 to September 2015; this  information included, where reported, the performance target and  actual results for each metric. In addition, we reviewed documentation  describing the performance metrics and interviewed IRS officials  regarding the process for reporting such metrics.
To determine the reliability of data used for our review, we obtained and  reviewed IRS’s guidance for its Investment Performance Tool, which  identifies, among other things, how data are to be entered within this tool,  sources of such data, and explanations of the methods used to calculate  performance metrics generated from the tool. Further, we held meetings  with officials responsible for overseeing the use of IRS’s Investment  Performance Tool. In addition, we relied on extensive work we previously  completed on IRS’s financial management system for relevant data used  for this review. In determining the reliability of the data supporting this  review, we determined that data regarding the delivery of planned scope  for the FATCA and RRP investments could be more reliable by  incorporating best practices. While these data were sufficiently reliable for  our purposes, we made recommendations to improve their reliability.
We conducted this performance audit from September 2015 to June 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Performance Evaluation for Selected Investments in Development

This appendix illustrates the potential for reporting complete performance  information via IRS’s Investment Performance Tool. Specifically, the  following tables provide a detailed evaluation of cost, schedule, and  scope performance for Return Review Program and Foreign Account Tax  Compliance Act projects that were being developed by IRS during fiscal  year 2015 and the first quarter of fiscal year 2016.

	Return Review Program

IRS reported working on three projects in support of Return Review  Program during fiscal year 2015 and the first quarter of fiscal year 2016.  The following tables identify the performance information reported via  IRS’s Investment Performance Tool; positive cost variances indicate that  the project was performing under planned cost and positive schedule  variances indicate that the project was performing ahead of schedule.

	Foreign Account Tax Compliance Act

IRS reported working on 10 projects in support of Foreign Account Tax  Compliance Act during fiscal year 2015 and the first quarter of fiscal year  2016. The following tables identify the performance information reported  via IRS’s Investment Performance Tool; positive cost variances indicate  that the project was performing under planned cost, and positive schedule  variances indicate that the project was performing ahead of schedule.

Appendix III: Comments from the Internal Revenue Service

Appendix IV: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the individual named above, the following staff made key  contributions to this report: Sabine Paul (Assistant Director), Bradley  Roach (Analyst in Charge), Rebecca Eyler, Charles Hubbard III, Paul  Middleton, Karl Seifert, and Marshall Williams, Jr.

Output:
Why GAO Did This Study

IRS relies extensively on IT systems to annually collect more than $2 trillion in taxes, distribute more than $300 billion in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. For fiscal year 2016, IRS planned to spend approximately $2.7 billion for IT investments. Given the size and significance of these expenditures, it is important that Congress be provided information on agency funding priorities, the process for determining these priorities, and progress in completing key IT investments.
Accordingly, GAO's objectives were to (1) describe IRS's current IT investment priorities and assess IRS's process for determining these priorities, and (2) determine IRS's progress in implementing key IT investments.
To do so, GAO analyzed IRS's process for determining its fiscal year 2016 funding priorities, interviewed program officials, and analyzed performance information for six selected investments for fiscal year 2015 and the first quarter of 2016.

What GAO Found

The Internal Revenue Service (IRS) has developed information technology (IT) investment priorities for fiscal year 2016, which support two types of activities—operations and modernization. For example, it has developed priority groups for operations such as: (1) critical business operations, infrastructure operations, and maintenance; and (2) delivery of essential tax administration/taxpayer services. It has identified priorities for modernization, such as web applications, to help reach IRS's future state vision. However, while IRS has developed a structured process for allocating funding to its operations activities consistent with best practices, it has not fully documented this process. IRS officials stated this is because the process is relatively new and not yet stabilized. In addition, IRS does not have a structured process for its modernization activities, because, according to officials, there are fewer competing activities than for operations activities. Fully documenting a process for both operations support and modernization activities that is consistent with best practices would provide transparency and greater assurance it is consistently applied.
Of the six investments GAO reviewed, two investments—Foreign Account Tax Compliance Act and Return Review Program—provided complete and timely performance information for GAO's analyses. These investments performed under cost, with varying schedule performance, and delivered most planned scope (see table). However, IRS did not always use best practices for determining scope delivered. Specifically, IRS used a method inconsistent with best practices for determining the amount of work completed by its own staff.
Two other investments reported completing portions of their work on time and $1.7 million under planned costs (for the Customer Account Data Engine 2), and on time and $10.3 million under planned costs (for Affordable Care Act Administration). However, neither investment reported information on planned versus actual delivery of scope in accordance with best practices. The remaining two investments—Mainframes and Servers Services and Support and Telecommunications Systems and Support—generally met performance goals.

What GAO Recommends

GAO is recommending that IRS develop and document its processes for prioritizing IT funding and improve the calculation and reporting of investment performance information. IRS agreed with two recommendations regarding its prioritization processes, disagreed with one related to the calculation of performance information, and did not comment on one recommendation. GAO maintains all of the recommendations are warranted.


Input:
	Background

		Future Operational Environment Includes Increasing A2/AD Challenges

Future A2/AD challenges are part of a security environment that will be  characterized by increasing complexity, uncertainty, and rapid change,  according to DOD. Further, national security challenges will continue to  arise from ongoing concerns such as violent extremism, the proliferation  of weapons of mass destruction, resource competition, and the rise of  modern competitor states, among others. These concerns, according to  DOD, combined with the proliferation of advanced technologies; the  increasing importance of space and cyberspace; and the ubiquity of  digital networks, including social media, will make the future security  environment less predictable, more complex, and potentially more  dangerous than it is today.
The JOAC notes that challenges to operational access are not new but  that three trends promise to significantly complicate DOD’s ability to  establish operational access.are   According to the JOAC, the three trends
Technology Improvement and Proliferation: The first important trend is  the dramatic improvement and proliferation of weapons and other  technologies capable of denying access or freedom of action within an  operational area. Specifically, an increasing number of state and  nonstate actors are developing or obtaining weapons of increasing  range and accuracy.
Space and Cyberspace Emergence: The second and related trend is  the emergence of space and cyberspace as increasingly important  and contested domains. According to the JOAC, the U.S. military will  continue to derive great benefit from its space and cyberspace  capabilities, but potential adversaries understand that and are  increasingly targeting those capabilities. Operating in the space and  cyberspace domains is also attractive to potential adversaries  because actions in those domains are often difficult to attribute.
Posture Changes: The third trend is that the change in U.S. overseas  defense posture complicates the U.S. ability to obtain operational  access. Specifically, DOD has reduced the number of overseas  facilities and number of deployed forces, meaning that future  operations will likely require it to deploy over longer distances.
According to the JOAC, the effect of these three trends is that potential  adversaries who may have once perceived that they could not stop U.S.  forces from deploying into an operational area are now adopting A2/AD  strategies. Figure 1 provides examples of anti-access and area denial  capabilities.
The JOAC describes A2/AD challenges in the context of an adversary’s  strategy rather than a list of technical capabilities that need to be  overcome. In general, the intent of an adversary that adopts an A2/AD  strategy is to convince and, if necessary and possible, compel the United  States to keep out of its affairs. At the most sophisticated level, an A2/AD  strategy is not a sequential series of actions using specific military  capabilities but rather an integrated and adaptive campaign using all  levers of national power and influence before, during, and after any actual  military conflict. Critical elements of an A2/AD strategy include keeping  U.S. forces as far away as possible and imposing steeper costs on the  United States than it is willing to bear.
Militarily, an A2/AD environment is characterized by sophisticated  adversaries using asymmetric capabilities, such as electronic and cyber  warfare, space capabilities, advanced air defenses, missiles, and mines,  according to DOD. The advanced weapons and technologies are  characterized by their increasing precision and range, and are often  affordable and increasingly proliferated. Adversaries could range from a  high-end peer state that has integrated a wide range of domestically  produced advanced capabilities to states, including failed or failing states,  adopting a hybrid strategy that includes regular and irregular forces and a  number of sophisticated weapons and technology developed at home or  acquired abroad. Even nonstate actors could obtain some A2/AD  capabilities, such as guided anti-ship missiles and cyber attack tools,  according to DOD. Figure 2 depicts the range of A2/AD challenges.

		DOD Strategic Guidance and Recent Joint Concepts Focus on Operational Access

DOD has increasingly focused over the past few years on the operational  access challenges it may face in the future, although it has recognized  A2/AD challenges for well over a decade. For example, projecting and  sustaining U.S. forces in distant A2/AD environments and defeating  A2/AD threats was one of six operational goals identified in the 2001  Quadrennial Defense Review (QDR). However, DOD’s focus over the  subsequent decade was on operations in Afghanistan and Iraq. As those  operations began to wind down, DOD began to reemphasize the need to  be able to overcome challenges to operational access.
The 2012 Defense Strategic Guidance was intended to transition the  department from an emphasis on current operations to preparing for  future challenges, including helping guide decisions regarding the size  and shape of the future force in a more fiscally constrained environment.  In the guidance, the Secretary of Defense established projecting power  despite A2/AD challenges as 1 of 10 primary DOD missions, noting that  countries such as Iran and China will continue to pursue capabilities such  as electronic and cyber warfare and ballistic and cruise missiles to  counter U.S. power projection capabilities and limit the operational access  of U.S. forces. Other primary missions, such as operating effectively in  cyberspace and space, deterring and defeating aggression, and providing  a stabilizing presence, are also relevant to overcoming A2/AD challenges.
The 2014 QDR maintains the emphasis on overcoming A2/AD  challenges. It builds on the 2012 Defense Strategic Guidance and  continues DOD’s transition to focusing on future challenges during a time  of fiscal uncertainty. The QDR states that DOD must be prepared for a full  range of conflicts, including against state powers with advanced A2/AD  capabilities. Further, two of the QDR’s three strategic pillars—build  security globally and project power and win decisively—emphasize the  importance of being able to project power and overcome challenges to  access. The 2014 QDR also stresses that innovation will be paramount  across all of DOD’s activities in order to best address the increasingly  complex operational environment.
The Chairman of the Joint Chiefs of Staff has also issued guidance in the  past 2 years that emphasizes the importance of overcoming access  challenges. The Capstone Concept for Joint Operations: Joint Force 2020  is the foundational concept document that describes the Chairman’s  vision for how the joint force will defend the nation against a wide range of  security challenges and helps establish force development priorities.
Among these priorities is developing capabilities to defeat A2/AD threats,  which as noted above is the specific focus of the JOAC.
The JOAC includes a list of 30 required capabilities that are essential to  the implementation of the concept (see app. I). It further states that this  list is neither complete nor prioritized but provides a baseline for further  analysis and concept development. DOD also has a number of supporting  concepts to the JOAC that provide further detail on specific aspects of  operations in A2/AD environments. The first of these supporting concepts  is the Air-Sea Battle Concept, which is focused on overcoming the longer- range and advanced anti-access challenges. At the direction of the  Secretary of Defense, the Departments of the Navy and Air Force  developed this multiservice concept focused on gaining and maintaining  freedom of action in the global commons, that is, the areas of air, sea,   In April 2014, the  space, and cyberspace that belong to no one state.Chairman of the Joint Chiefs of Staff issued the Joint Concept for Entry  Operations, a supporting concept to JOAC focused on how forces will  enter onto foreign territory and immediately conduct operations in the face  of adversaries with increasingly effective area-denial strategies and  capabilities. There are a number of other existing concepts, as well as  concepts that are being developed, that support the JOAC (see fig. 3).

	Army and Marine Corps Are Undertaking Efforts to Prepare for Operational Access Challenges

The Army and Marine Corps are undertaking multiple efforts to address  operational access challenges, which impact a broad range of their  existing missions. In light of the rapidly changing operational environment,  the Army and Marine Corps are reviewing how they will need to carry out  their roles and functions in part by revising their service concepts and by  conducting wargames that incorporate such challenges. Further, the  Army and Marine Corps have identified several areas where they have  important roles in overcoming access challenges, including engagement  activities and entry operations, as well as logistics and missile defense for  the Army. The services are beginning to take steps to change how they  carry out these roles.

		Army and Marine Corps Are Incorporating Operational Access Challenges into Service Concepts and Wargames

The Army and the Marine Corps have begun examining the impact of  operational access challenges on existing missions by revising their  concepts and incorporating such challenges into their wargames. For  example, the Army is revising the Army Operating Concept, which  generally describes how an Army commander will operate in future  environments that include A2/AD challenges, and identifies required  capabilities in land operations. Given future operational challenges, the  draft concept states that Army forces need to be agile, responsive,  adaptive, and regionally engaged across the globe, and be able to  conduct distributed operations. These distributed operations would  involve Army elements arriving from numerous directions and domains to  distributed locations in a joint operations area. According to the draft  concept, this operational approach, also discussed in the JOAC, could  help to overcome A2/AD challenges because the Army forces would be  more spread out and thus more difficult to target and defend against.  Once completed, the Army Operating Concept is to provide guidance for  the Army’s development of supporting functional concepts, which  eventually inform Army assessments of capability needs, gaps, and  solutions.
The Marine Corps has also incorporated consideration of A2/AD  challenges into Expeditionary Force 21, its capstone concept, which  provides guidance for how the Marine Corps will be organized, trained,  and equipped to fulfill its assigned responsibilities over the next 10  years. Published in March 2014, the concept identifies the JOAC as an  input and is consistent with many of its themes, including the importance  of distributed operations. Expeditionary Force 21 identifies a number of  challenges to Marine Corps operations caused by A2/AD threats and  proposes a number of potential solutions for how the service will  overcome them, including operating from amphibious ships farther from  shore and using dispersed formations. According to Marine Corps  officials, the service is also developing a number of supporting concepts,  including some with the Navy that will further explore proposed  approaches for overcoming A2/AD challenges. These officials stated that  eventually this will inform Marine Corps assessments of capability needs,  gaps, and solutions. The officials added that while the capstone concept  has been issued and the associated analysis and innovation is under  way, developing the full range of capabilities envisioned will be a long- term endeavor.
In addition, the Army and Marine Corps are incorporating operational  access challenges into their wargames. Services conduct wargames for  multiple reasons, including mission rehearsal, concept analysis, and  doctrine validation. The Army’s Unified Quest wargames explore a broad  range of future conflicts and have included A2/AD scenarios. For  example, the scenario for Unified Quest 2013 was set in the 2030-2040  time frame with fictional adversaries adopting hybrid warfighting  approaches that used a mix of A2/AD capabilities, including integrated air  defenses, cyber warfare, and anti-ship cruise missiles. The wargame  explored new operating concepts, including how to effectively fight with  dispersed forces. The Marine Corps’ Expeditionary Warrior wargames  have also included A2/AD challenges. For example, Expeditionary  Warrior 2012 was set in 2024 in a fictional country where state and  nonstate adversaries were armed with A2/AD capabilities, including cyber  warfare, ballistic missiles, anti-ship cruise missiles, integrated air defense  systems, mines, and submarines. The Marine Corps used this wargame,  in part, to explore integration with special operations, cyber, and other  joint forces.
Although they have functions important to overcoming the range of A2/AD  challenges, the Army and Marine Corps have focused their wargames on  A2/AD challenges from states and failed or failing states with less- advanced A2/AD capabilities. A primary reason for this approach,  according to Army and Marine Corps officials, is that ground forces are  likely to have a larger role in failed and failing state scenarios as  compared with their roles in scenarios involving a peer or near-peer  competitor. Further, such conflicts are more likely than a conflict with a  peer competitor (see fig. 4). The officials added that the Army and Marine  Corps participate in Navy and Air Force wargames that examine the  A2/AD challenges posed by peer competitors.

		Army and Marine Corps Have Identified Important Roles in Overcoming Operational Access Challenges and Are Beginning to Take Steps to Change How They Carry Out These Roles

The Army and the Marine Corps have identified several areas where they  have important roles in overcoming operational access challenges.  According to Army and Marine Corps officials, A2/AD challenges impact a   While  broad range of their existing missions but do not create new ones.A2/AD challenges impact many missions, primary missions include the  engagement activities and entry operations of both services, as well as  logistics and missile defense for the Army. The services are beginning to  take steps to change how they carry out these missions. Some of these  efforts are expected to stretch well into the next decade and beyond.

			Engagement Activities

The Army and the Marine Corps play a primary role in establishing  access through their engagement activities and are using these  opportunities to help address A2/AD challenges, according to DOD  officials. The JOAC emphasizes that success in overcoming A2/AD  challenges in combat often depends on activities prior to conflict that help  gain and maintain access and identifies three required capabilities for  such activities. According to the JOAC, such activities include  multinational exercises, basing and support agreements, improving  overseas facilities, prepositioning supplies, and forward-deploying forces.  These types of activities help shape favorable access conditions. For  example, engagement activities such as combined training or exercises,  or improving a host-nation’s infrastructure, help maintain and develop  good relationships with and improve the capabilities of allies and partners  that then may be called upon in the event of a crisis. Also, officials from  the U.S. Pacific Command (PACOM) and the U.S. Central Command  (CENTCOM) emphasized the importance of engagement activities in  gaining and maintaining access and stated that continued forward  presence of U.S. forces in their regions may help deter potential  adversaries and reassure allies and partners by signaling U.S.  commitment to that region. Moreover, DOD officials stated that having  Army and Marine Corps forces forward deployed conducting engagement  activities helps with access challenges because these forces are already  in theater and can respond more quickly if a crisis occurs than they could  if they had to deploy from the United States.
Both the Army and Marine Corps are developing new approaches to their  engagement activities to help shape favorable access conditions. For  example, the Army is testing a new operational approach in 2014, called  Pacific Pathways, that changes the way the Army supplies forces for  engagement activities. Rather than sending a number of small units that  each conduct a single activity for a short period of time, under Pacific  Pathways the Army will send a fully-equipped, combat-trained, 700- soldier battalion-sized force to participate in two or three regional  exercises over the course of 90 days. Soldiers and their equipment would  travel by air and sea between engagements. Similarly, the Marine Corps  is also taking steps to enhance engagement activities and provide  forward presence. The Marine Corps is planning on having one-third of its  forces forward deployed. As part of this effort, the Marine Corps is  returning to the practice of rotational deployments, where units based in  the United States deploy to Japan or Australia for 6 months to train,  engage allies and partners in the region, and provide forward presence.  According to DOD officials, these approaches allow the forces to better  fulfill their respective missions while providing the combatant  commanders with more options for their employment.
In addition, officials from CENTCOM, PACOM, and U.S. Special  Operations Command told us they are increasingly incorporating  engagement activities into their planning efforts. Moreover, the JOAC  states that combatant commanders will need to coordinate these efforts  with other U.S. agencies that are also conducting engagement activities.  In February 2013, we testified that as DOD continues to emphasize  engagement activities, to include building partner capacity, the need for  efficient and effective coordination with foreign partners and within the  U.S. government has become more important, in part because of fiscal  challenges, which can be exacerbated by overlapping or ineffective  efforts.

			Entry Operations

The Army and the Marine Corps both play a primary role in conducting  entry operations in an A2/AD environment, according to DOD. Entry  operations are the projection and immediate employment of military  forces from the sea or through the air onto foreign territory to accomplish  assigned missions. The JOAC states that maintaining or expanding  operational access may require entry of Army or Marine Corps forces into  hostile territory to accomplish missions, such as eliminating land-based  threats or initiating sustained land operations, and identifies the ability to  conduct forcible entry operations as a required capability.
The Army has conducted several studies, exercises, and wargames that  examine entry operations in an A2/AD environment and concluded,  among other things, that it must be able to deploy decisive force much  more rapidly. The Army identified a number of areas requiring  improvement, including enhancing engagement with friends and allies,  increasing the ability to deploy small units, reducing logistics demands,  and greatly advancing technologies such as vertical lift, lighter yet  survivable vehicles, missile defenses, and command and control.  Moreover, for Army airborne units, the Army has identified the need for  capabilities such as weapon systems and vehicles that can be air- dropped in a location and provide forces with long-range, precision  firepower; mobility across a range of terrain; and protection, among other  things.improvements by 2025 and to have significantly improved forces in the  2040 time frame.
It has further outlined an approach intended to achieve some  The Marine Corps is also examining how to conduct entry operations in  an A2/AD environment. According to the Marine Corps, the joint force has  become brittle and risk averse because of its reliance on a small number  of very advanced and expensive weapons systems that are increasingly  vulnerable to A2/AD capabilities. A key force priority for overcoming  A2/AD challenges is resilience, according to PACOM officials. To  increase resilience, the Marine Corps is developing the idea of using a  greater number of highly mobile capabilities on expeditionary advanced  bases—small, temporary, austere, and distributed bases that can be  established for a variety of purposes. For example, the Marine Corps  could use land-based anti-ship missiles on small mobile platforms to  control sea-lanes. However, according to the Marine Corps, pursuing this  idea would require it to obtain new missile capabilities as well as more  flexible supply and command and control systems than are currently in  place. Additionally, the Marine Corps is examining operating short- takeoff/vertical-landing-capable joint strike fighters from small distributed  bases; however, according to the Marine Corps, it has not yet determined  the supportability requirements for this aircraft in austere environments.  The Marine Corps is aware of such challenges and is in the early stages  of addressing them. It has not yet completed the concepts and follow-on  analyses needed to support the implementation of these ideas, according  to Marine Corps officials.

			Logistics

The Army has a fundamental role in providing logistics support in an  A2/AD environment, according to DOD, and the JOAC states that  increased threats and operational demands of future operations in such  environments may present challenges for logistics. Specifically, the  JOAC states that logistics hubs and networks may be increasingly  vulnerable to attack by adversaries with A2/AD capabilities, such as  cyber, counterspace, and ballistic missiles. Further, one of DOD’s and the  Army’s approaches to conducting operations in an A2/AD environment is  to use multiple smaller units operating independently, but supporting such  units is more logistically demanding. The JOAC identifies three required  capabilities for logistics, but also notes that new logistics concepts are  needed to explore the challenges to logistics in an A2/AD environment  and to help define required capabilities. Also, a study examining the  impacts of the JOAC on joint logistics echoed this need.
According to  officials from the Joint Staff and the Army, they have begun revising the  Joint Concept for Logistics, in part, to include A2/AD challenges.
In addition, the Army is examining how it might address A2/AD challenges  related to logistics. One way that the Army is proposing to mitigate the  problem of increased demands on logistics is to focus efforts on  decreasing the Army’s and the joint force’s demand for items such as  fuel, water, and ammunition. For example, the Army’s Functional Concept  for Sustainment, issued in October 2010, states that during operations in  Iraq, 22 percent of all convoys into the theater per year were for fuel. The  concept states that technological advances are needed to reduce the fuel  demand for vehicles and energy production, among other things. In  addition, the Army is exploring unmanned distribution of supplies in  theater to help provide timely sustainment and reduce the exposure of  soldiers to potential threats. A 2013 Army Unified Quest wargame report  stated that while this technology could provide benefits, additional study is  needed to understand how and when automated systems should be  used, as well as the costs, such as those for maintenance, that would be  involved.

			Missile Defense

Another primary Army contribution to overcoming A2/AD challenges is  providing active missile defenses, according to DOD. The JOAC notes  that the increasing accuracy, lethality, and proliferation of ballistic and  cruise missiles are a key A2/AD challenge. Further, such capabilities are  attractive to potential adversaries because they are cost imposing: that is,  defenses against ballistic and cruise missiles tend to be more costly than  the missiles themselves. According to DOD, adversaries will use ballistic  and cruise missiles to counter U.S. power projection capabilities by  attacking forward bases, naval forces, and logistics support and  command and control capabilities. The JOAC therefore identifies  expeditionary missile defense as a required capability for overcoming  access challenges.
Land-based missile defense is a core Army function and a main element  of DOD’s force structure, according to DOD. Although the JOAC does not  provide a clear definition of what constitutes expeditionary missile  defense, several characteristics of the Army’s missile defense force  structure indicate that they do not meet this required capability, including  the following:
Mobility/supportability—The JOAC emphasizes the need for smaller  and highly mobile systems requiring little support. Current Army  missile defenses are transportable but lack strategic and tactical  mobility, according to the Army. They also have large logistical  requirements.
Capacity—According to DOD, demand for missile defenses, including  those provided by the Army, exceeds capacity. Missiles are the core  of adversary A2/AD capabilities, and growing adversary missile  inventories and improving capabilities will exacerbate capacity  issues.
Cost—According to DOD, current missile defenses are very  expensive. By pursuing increasingly advanced missiles, adversaries  are able to impose costs on the United States.
Army and Army-sponsored reviews recognize some of these difficulties  and have recommended that more attention be paid to other, less costly  technologies that can protect against large numbers of missiles, such as  directed energy weapons and railguns.Office is working with the Navy and others to develop a railgun that can  provide cost-effective land-based ballistic and cruise missile defense   DOD’s Strategic Capabilities  capability.projectiles with sensors and existing guns, including Army artillery, to  shoot down cruise missiles. These alternatives could provide high- capacity, cost-effective missile defense capabilities, but they have not yet  matured into programs, according to the Strategic Capabilities Office.  According to the Army, power generation, storage, and mobility issues  associated with directed energy weapons and railguns will be resolved in  the 2040 time frame.

	DOD Is in the Early Stages of Developing the JOAC Implementation Plan, but Has Not Fully Established Specific Measures and Milestones to Assess Progress

DOD is developing an implementation plan for the JOAC in order to bring  coherence to the department’s many simultaneous efforts to overcome  A2/AD challenges but has not fully established measures and milestones  to gauge progress.effort to coordinate, oversee, and assess the department’s  implementation of the JOAC. DOD is planning to issue the first iteration of  the plan in 2014 and intends to assess and update the plan annually.  However, the draft 2014 JOAC Implementation Plan is limited in scope  and does not fully establish the specific measures and milestones DOD  needs to allow decision makers to assess the progress the department is  making, including the contributions of the Army and the Marine Corps.

		DOD Is in the Early Stages of Developing the Joint Operational Access Concept Implementation Plan

The Joint Staff is leading a multiyear DOD-wide effort, initiated in June  2013, to coordinate, oversee, and assess the department’s  implementation of the JOAC. In order for DOD to fulfill its mission to  project power despite A2/AD challenges, the 2012 Defense Strategic  Guidance requires DOD to implement the JOAC. In addition, DOD  guidance on concept development requires DOD to develop and execute  implementation plans for joint concepts and to assess their  implementation.JOAC is the first joint concept to be implemented under the new  guidance, according to DOD officials. They further stated that the  emphasis on implementation is a significant and positive change to the  guidance but will be challenging to execute.
The guidance was issued in November 2013 and the  In accordance with this guidance, DOD is planning to issue the first  iteration of the JOAC Implementation Plan in August 2014 and intends to  assess and update the plan annually. single place where it was tracking and coordinating its efforts to address  A2/AD challenges, including those of the Army and Marine Corps, even  though the JOAC notes that addressing A2/AD challenges requires closer  integration between services than ever before. The draft 2014 JOAC  Implementation Plan states that it is intended to provide coherence by  integrating, overseeing, communicating, and assessing the various efforts  being taken across DOD to create the capabilities required to overcome  A2/AD challenges.
The first iteration of the implementation plan—the 2014 plan—remains in draft as of July  2014. officials.force development processes to gather information about current and  planned activities that contributed to the implementation of the JOAC.  They further noted that the JOAC implementation process may eventually  address not only capability issues but also capacity issues, which officials  from the Army, Marine Corps, and the combatant commands we spoke  with noted were critical in terms of overcoming A2/AD challenges.
These officials stated that the intent was to leverage existing  Because of the large scope of the JOAC and to help familiarize  stakeholders with a new process, Joint Staff officials stated that the  working group decided to focus the first iteration of the plan on 10  required capabilities that it determined to be the highest priority rather  than including all 30 JOAC-required capabilities.  Once those capabilities  were identified, officials said that working group members, including those  from the Army and Marine Corps, reviewed ongoing and planned  activities from their respective organizations that they believed would  align with the implementation of 1 or more of the 10 prioritized  capabilities.
The JOAC identifies 30 required capabilities as essential to the implementation of the  concept (see app. I). While the 30 capabilities are unclassified, when they are ordered in  terms of priority, they become classified. Thus, the 10 capabilities that were considered  the highest priority for the department are classified. The working group identified the 10  priorities by comparing DOD’s current list of prioritized gaps in the Chairman’s Capability  Gap Assessment with the list of JOAC capabilities. The working group also included a  special topic in the annual Chairman’s Joint Assessment that asked the services,  combatant commanders, and other DOD organizations to identify the highest-priority  JOAC-required capabilities. for completion determined by the organization responsible for the action  that could span several years. Thus, for each capability, multiple  organizations are simultaneously undertaking implementation actions with  various timelines for completion. Joint Staff officials stated that the  execution matrix revealed that DOD was already taking many actions  addressing the 10 prioritized capabilities.
Officials noted that the 165 implementation actions do not constitute the  full effort required to complete implementation of these 10 required  capabilities, and future iterations of the execution matrix will be updated  as required based on analyses to identify additional discrete  implementation actions. In addition, future iterations of the JOAC  Implementation Plan will also include the other JOAC-required  capabilities as well as required capabilities from other joint concepts that  support the JOAC, according to Joint Staff officials.

		Draft Implementation Plan Does Not Have Fully Established Specific Measures and Milestones to Assess Progress

The draft 2014 JOAC Implementation Plan does not fully establish the  specific measures and milestones DOD needs to allow decision makers  to assess the progress the department is making, including the  contributions of the Army and the Marine Corps. DOD guidance requires  that all joint concepts have an implementation plan that includes  measures and milestones that allow decision makers to gauge  implementation progress. Further, a stated purpose of the plan is to  measure progress toward the development of a joint force able to project  power despite A2/AD challenges. Internal control standards in the federal  government also call for agencies to provide reasonable assurance to  decision makers that their objectives are being achieved and that decision  makers have reliable data to determine whether they are meeting goals  and using resources effectively and efficiently.
Moreover, GAO’s  Schedule Assessment Guide states that milestones and measures are  essential for tracking an organization’s progress toward achieving  intermediate and long-term goals, and helping to identify critical phases of  the project and the essential activities needed to be completed within  given time frames.
The draft JOAC Implementation Plan identifies four stages at which the  working group is to assess implementation.
Implementation Actions. The working group is to assess the progress  made in implementing the discrete materiel and nonmateriel actions in  the execution matrix.
Required Capabilities. The working group is to assess progress in  implementing each JOAC-required capability based on the progress  made on completing the implementation actions relevant to that  capability.
Operational Objectives. The Implementation Plan organizes the  required capabilities into four operational objectives—the broad goals  a commander must achieve in order to project power despite A2/AD  challenges. The working group is to assess progress in  implementing each operational objective based on the progress of the  required capabilities aligned under each objective.
End State. The working group is to assess progress in reaching the  JOAC end state based on the implementation progress of the four  operational objectives.
The draft 2014 JOAC Implementation Plan includes measures and  milestones for the 165 identified implementation actions but not for the  other three implementation stages. Specifically, the 165 actions will be  assessed as being either complete or not yet complete, according to Joint  Staff officials. However, Joint Staff officials stated the working group has  not yet developed the necessary measures to gauge the extent to which  required capabilities, operational objectives, or the end state have been  implemented. For example, the working group has not yet developed  measures for how the completion of an implementation action affects the  completion of the required capability to which it is tied. In other words, the  aggregate of the implementation actions will show how much work has  been completed—i.e., the number of actions—but it will not show how  much work remains to be completed to fully implement the required  capability. Thus, even if DOD completed all 165 implementation actions  identified in the first plan, it currently would not be able to determine the  progress in implementing the 10 required capabilities. Figure 5 shows the  stages at which the draft 2014 JOAC Implementation Plan has measures  and milestones.
Similarly, the draft 2014 JOAC Implementation Plan does not fully identify  milestones for all four implementation stages. Specifically, the plan  identifies milestones for the 165 implementation actions, but not for  required capabilities, operational objectives, and the end state. Moreover,  the 2014 plan does not indicate if or when milestones will be established.  For example, the implementation plan does not identify when the required  capability for expeditionary missile defense should be completed, and  Army officials told us that plans for developing this high-priority capability  may take decades. Additionally, the plan does not identify milestones for  implementing the operational objective related to engagement activities,  which, as noted previously, is an area in which the Army and Marine  Corps play primary roles.
Joint Staff officials emphasized that the 2014 JOAC Implementation Plan  is the first of many iterations and was intended only to provide visibility of  ongoing activities relevant to the top 10 JOAC-required capabilities. Joint  Staff officials stated that they intend to include ways to assess overall  implementation progress in future iterations of the plan. Specifically, the  draft 2014 Implementation Plan states that the working group will  establish a process to aggregate implementation actions in such a way as  to allow it to gauge progress at the required capability, operational  objective, and end state stages. However, the draft plan provides no  detail about how or when this will be accomplished.
While DOD has stated its intent to assess progress in the future, its  current planning lacks specifics about the measures it will employ and  how it will set milestones to gauge that progress. Consequently, the draft  2014 plan is not fully consistent with DOD guidance, as well as federal  internal control standards and GAO’s Schedule Assessment Guide, that  emphasize the importance of tracking an organization’s progress toward  achieving its goals. Without establishing specific measures and  milestones in future iterations of the JOAC Implementation Plan, DOD will  not be able to gauge JOAC implementation progress and assess whether  efforts by the joint force, to include the Army and the Marine Corps, will  achieve DOD’s goals in desired time frames in the near and long terms.  Specifically, if DOD does not have a means to assess implementation  progress, it may lack assurance that Army and Marine Corps efforts to  address areas such as engagement activities, entry operations, logistics  support, and expeditionary missile defense fully align with the JOAC.  Moreover, without an effective implementation plan that allows decision  makers to track progress over time, DOD will not have the assurance that  it will be able to provide commanders with the forces they need to  overcome A2/AD challenges envisioned to be faced by the joint force of  2020.

	Conclusions

The proliferation of relatively low-cost advanced technologies and the  emergence of space and cyberspace as contested domains, along with  the change in U.S. overseas defense posture, present DOD with a future  operational environment that no longer includes the unimpeded  operational access DOD has enjoyed for decades. As potential  adversaries develop strategies aimed at preventing the U.S. military from  arriving at the fight and complicating its freedom of action once there,  DOD’s planning has shifted to focus on how to maintain its ability to  project power into operational areas. While DOD may have initially  emphasized the role of the Air Force and Navy in overcoming A2/AD  challenges, the Army and the Marine Corps also have primary roles to  play and are beginning to address these challenges.
DOD’s effort to develop an implementation plan is a significant step and  provides the foundation for a roadmap to move the JOAC from concept to  implementation. However, since it does not yet include specific measures  and milestones that would allow DOD to gauge JOAC implementation  progress, it is not yet clear the extent to which efforts across the  department to address A2/AD challenges, including those of the Army  and Marine Corps, support JOAC implementation, or whether current  efforts align with JOAC implementation time frames. Given that some of  the department’s efforts to address JOAC-required capabilities, such as  the Army’s work on missile defense, may take many years, a means to  assess progress is essential. Specifically, fully establishing measures and  milestones would clarify what additional steps the Army and Marine Corps  may need to take to align their current efforts to address A2/AD  challenges—including with respect to their key roles in engagement  activities, entry operations, logistics support, and missile defense—with  the required capabilities in the JOAC. Until future iterations of the JOAC  Implementation Plan contain specific measures and milestones to gauge  progress, DOD may find it difficult to judge whether it is on target to meet  its overall goal of ensuring the joint force of 2020 can operate effectively  in an A2/AD environment.

	Recommendation for Executive Action

To improve DOD’s ability to assess Joint Operational Access Concept  implementation, including the contribution of the Army and the Marine  Corps, we recommend that the Secretary of Defense direct the Joint  Staff, in coordination with the Army, the Marine Corps, and other  members of the working group, to establish specific measures and  milestones in future iterations of the JOAC Implementation Plan to gauge  how individual implementation actions contribute in the near and long  terms to achieving the required capabilities, operational objectives, and  end state envisioned by the department.

	Agency Comments and Our Evaluation

We provided a draft of this report to DOD for review and comment. DOD  provided written comments, which are summarized below and reprinted in  appendix II. In its written comments, DOD partially concurred with the  report’s recommendation to establish specific measures and milestones  in future iterations of the JOAC Implementation Plan to gauge how  individual implementation actions contribute in the near and long term to  achieving the required capabilities, operational objectives, and end state  envisioned by the department.
In its comments, the department stated that it had previously recognized  the need to assess JOAC implementation progress and that it had  already begun to develop specific measures and milestones and would  incorporate them into annual updates of the JOAC Implementation Plan.  We noted in the report that DOD intended to include ways to assess  overall implementation progress in future iterations of the implementation  plan but that the draft 2014 plan did not fully establish specific measures  and milestones to assess progress or provide detail for how progress  would be assessed or when this would be accomplished. As also noted in  the report, it is important that specific measures and milestones move  beyond being able to assess progress of individual implementation  actions and expand to allow the department to gauge JOAC  implementation progress and assess whether efforts by the joint force, to  include the Army and the Marine Corps, will achieve DOD’s goals in  desired time frames in the near and long terms. In doing so, DOD will be  better positioned to judge whether it is on target to meet its overall goal of  ensuring the joint force of 2020 can operate effectively in an A2/AD  environment.
DOD also provided technical comments, which we have incorporated as  appropriate.
We are sending copies of this report to appropriate congressional  committees, the Secretary of Defense, the Chairman of the Joint Chiefs of  Staff, the Secretary of the Army, and the Commandant of the Marine  Corps. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-3489 or pendletonj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Joint Operational Access Concept Required Capabilities

The Joint Operational Access Concept (JOAC) identifies 30 capabilities  considered essential to the implementation of the concept and what the  future joint force will need to gain operational access in an opposed  environment. According to the JOAC, the list of required capabilities is  neither complete nor prioritized but provides a baseline for further  analysis and concept development. The JOAC organizes the required  capabilities in eight categories as described below.

	Command and Control

1.  The ability to maintain reliable connectivity and interoperability among  major warfighting headquarters and supported/supporting forces while  en route.  2.  The ability to perform effective command and control in a degraded  and/or austere communications environment.  3.  The ability to create sharable, user-defined operating pictures from a  common database to provide situational awareness (including  friendly, enemy, and neutral situations) across the domains.  4.  The ability to integrate cross-domain operations, to include at lower  echelons, with the full integration of space and cyberspace  operations.  5.  The ability to employ mission command to enable subordinate  commanders to act independently in consonance with the higher  commander’s intent and effect the necessary cross-domain  integration laterally at the required echelon.

	Intelligence

6.  The ability of operational forces to detect and respond to hostile  computer network attack in an opposed access situation.  7.  The ability to conduct timely and accurate cross-domain all-source  intelligence fusion in an opposed access situation.  8.  The ability to develop all categories of intelligence in any necessary  domain in the context of opposed access.

	Fires

9.  The ability to locate, target, and suppress or neutralize hostile anti- access and area denial capabilities in complex terrain with the  necessary range, precision, responsiveness, and reversible and  permanent effects while limiting collateral damage.  10. The ability to leverage cross-domain cueing to detect and engage in- depth to delay, disrupt, or destroy enemy systems.  11. The ability to conduct electronic attack and computer network attack  against hostile anti-access/area denial capabilities.  12. The ability to interdict enemy forces and materiel deploying to an  operational area.

	Movement and Maneuver

13. The ability to conduct and support operational maneuver over  strategic distances along multiple axes of advance by air and sea.  14. The ability to “maneuver” in cyberspace to gain entry into hostile  digital networks.  15. The ability to conduct en route command and control, mission  planning and rehearsal, and assembly of deploying forces, to include  linking up of personnel and prepositioned equipment.  16. The ability to conduct forcible entry operations, from raids and other  limited-objective operations to the initiation of sustained land  operations.  17. The ability to mask the approach of joint maneuver elements to  enable those forces to penetrate sophisticated anti-access systems  and close within striking range with acceptable risk.

	Protection

18. The ability to defeat enemy targeting systems, including their  precision firing capabilities.  19. The ability to provide expeditionary missile defense to counter the  increased precision, lethality, and range of enemy anti-access/area  denial systems.  20. The ability to protect and, if necessary, reconstitute bases and other  infrastructure required to project military force, to include points of  origin, ports of embarkation and debarkation, and intermediate staging  bases.  21. The ability to protect forces and supplies deploying by sea and air.  22. The ability to protect friendly space forces while disrupting enemy  space operations.  23. The ability to conduct cyber defense in the context of opposed  access.

	Sustainment

24. The ability to deploy, employ, and sustain forces via a global network  of fixed and mobile bases, to include seabasing.  25. The ability to quickly and flexibly establish nonstandard support  mechanisms, such as the use of commercial providers and facilities.  26. The ability to plan, manage, and integrate contractor support in the  context of operations to gain operational access in the face of armed  resistance.

	Information

27. The ability to inform and influence selected audiences to facilitate  operational access before, during, and after hostilities.

	Engagement

28. The ability to develop relationships and partnership goals and to share  capabilities and capacities to ensure access and advance long-term  regional stability.  29. The ability to secure basing, navigation, and overflight rights and  support agreements from regional partners.  30. The ability to provide training, supplies, equipment, and other  assistance to regional partners to improve their access capabilities.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, Patricia Lentini, Assistant  Director; Margaret Morgan, Assistant Director; Carolynn Cavanaugh;  Colin Chambers; Nicolaas Cornelisse; Amie Steele; and Erik Wilkins- McKee made key contributions to this report.

Output:
Why GAO Did This Study

According to DOD, its ability to deploy military forces from the United States to a conflict area is being increasingly challenged as potential adversaries pursue capabilities designed to deny access. Access can be denied by either preventing an opposing force from entering an operational area or limiting an opposing force's freedom of action within an operational area. DOD has a joint concept that broadly describes how DOD will operate effectively in such access-denied environments. DOD's initial efforts have emphasized the roles of the Air Force and Navy.
GAO was mandated to review the role of the Army and Marine Corps in access-denied areas. This report (1) describes Army and Marine Corps efforts to address operational access challenges and (2) analyzes the extent to which DOD is able to gauge how its efforts support implementation of its concept for future operations in access-denied environments. GAO analyzed DOD, Army, and Marine Corps concepts; reports on service-level exercises; DOD policy and guidance on concept implementation; and documents specifically related to the joint concept. GAO also interviewed cognizant DOD officials.

What GAO Found

The Army and Marine Corps are undertaking multiple efforts to address operational access challenges—challenges that impede a military force's ability to enter and conduct operations in an area—that impact a broad range of their existing missions. For example, they are incorporating operational access challenges into their wargames and revising their service concepts, which inform their assessments of capability needs, gaps, and solutions. In addition, the Army and the Marine Corps have identified important roles they play in overcoming operational access challenges and are examining ways to carry them out in access-denied environments, including
engagement activities—improving access conditions through such activities as multinational exercises, prepositioning supplies, and forward presence, and
entry operations—deploying forces onto foreign territory to conduct missions such as eliminating land-based threats to access.
In addition, the Army has identified areas specific to its role, including
logistics—sustaining forces despite increased vulnerabilities from access threats and challenges associated with new operational approaches, and
missile defense—providing defense against increasingly accurate, lethal, and available ballistic and cruise missiles.
The Department of Defense (DOD) is unable to gauge the extent to which its efforts to overcome operational access challenges support the implementation of the 2012 Joint Operational Access Concept (JOAC). The JOAC describes how the department will operate effectively in future operating environments with access challenges and is intended to guide the development of capabilities for the joint force of 2020. The Joint Staff is leading a multiyear DOD-wide effort, initiated in June 2013, to coordinate, oversee, and assess the department's implementation of the JOAC. DOD plans to issue the first iteration of the JOAC Implementation Plan in 2014 and to assess and update the plan annually. The draft plan focuses on the highest-priority JOAC-required capabilities and identifies related actions, but does not fully establish specific measures and milestones to gauge progress. While DOD has stated its intent to assess progress in the future, its current planning lacks specific details about the measures it will employ and the milestones it will use to gauge that progress. Until DOD establishes specific measures and milestones in future iterations of its implementation plan, the department will not be able to gauge implementation progress and assess whether efforts by the joint force, to include the Army and the Marine Corps, will achieve DOD's goals in desired time frames. As a result, DOD may lack assurance that efforts, including those currently being undertaken by the Army and the Marine Corps to address areas such as engagement activities, entry operations, logistics, and expeditionary missile defense, will fully align with the JOAC.

What GAO Recommends

GAO recommends that DOD establish specific measures and milestones in future iterations of the JOAC Implementation Plan to improve DOD's ability to gauge implementation progress. DOD agreed with the importance of assessing the plan and said it is developing measures and milestones and will continue to refine these tracking tools in the future.