While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
For agencies, an Exhibit 300Âthe business justification for any major federal capital information technology expenditureÂis a fact of life, required for approval by the Office of Management and Budget before any large systems project.
Most agencies have the expertise to assemble business cases good enough for OMB to give them passing gradesÂless than a third of the 1,087 business cases submitted during the past year failed, according to Karen Evans, OMB's administrator for e-government and IT. But few have developed methodologies that result in outstanding business cases, Evans and others in OMB contend.
OMB wants to make sure that agencies are crafting cases specifically for each individual program and not glomming on to a case that OMB has rated highly and then using it almost verbatim for other or all IT projects. Additionally, OMB Deputy Director for Management Clay Johnson III and Evans have repeatedly encouraged agencies to follow through on their business cases. The case is just the beginning of a process that requires agencies to ultimately craft metrics to track progress and measure if and how well projects are meeting performance objectives.
A truly effective IT business case is one that goes beyond merely gaining OMB's approval. Instead of just scoring well, it should represent the project's goals and the agency's mission, identify performance gaps and explain how technology is working to close those gaps. In essence, a successful business case should represent a holistic view of what a program should be addressing while serving as a tool for encouraging good management principles. The final crucial factor to achieving and maintaining solid management practices is the development and use of the performance metrics.
"If you get it right, you may get a good score from the OMB, but what you've really got is a project that runs smoothly and works well," says Stuart Simon, team leader for IT capital planning in the Commerce Department's IT Policy and Planning Section. With the right staff, the right attitude, the right buy-in and the right methodology, it's eminently achievable, Simon says.
The initial step requires the project team to define the mission and the goals to achieve it. This phase creates the foundation for the case and also shows how a project fits into the broader systems scheme, the agency's enterprise architecture.
"It should be reflective of all of the different things you should be doing, like how effective you are in instituting project management and program management," says Darren Ash, associate CIO for IT investment management at the Transportation Department.
And though it may seem obvious, make sure each team that works on a case is familiar with OMB's guidance documents for Exhibit 300 preparation and the accompanying Capital Planning and Investment Control process, says Jim Kendrick, a certified management consultant with P2C2 Group Inc., a public-sector consultancy in Kensington, Md. Kendrick also advises agencies to begin work early on the business cases, which agencies submit each fall with their budget proposals.
The submission of the finished version of an "Exhibit 300 is like the final exam for a major course. You need to follow good practices all year and do your homework to get an 'A,' " he says. "You can't get there simply by cramming for a few days before the deadline."
Once the mission and goals are set, the next step is figuring out where the gaps lie. Agencies must assemble teams of knowledgeable stakeholders to clearly describe performance gaps, detail how a program will close those gaps, explain how the project will help the agency support its target architecture and mission and establish strong program management to get the job done, Ash says. Meanwhile, each team must also keep on top of changing OMB rules and internal business requirements.
"If an acquisition strategy doesn't make sense, that says to me that your contracting officer or procurement executive may not have looked at it," Ash says. At Transportation, "we make sure that all of the right people are tied into it so we know that everyoneÂthe procurement, the budget official, the security and privacy [team] and everybody else who needs toÂhas reviewed it."
Strong participation from agency experts also helps ensure that any errors or omissions to a business case are caught and corrected early on. Agency experts can be particularly helpful in areas such as security, acquisition, enterprise architecture and earned-value management, Kendrick says.
But even with experts involved, agencies need formal review processes for all business cases. The reviews mean each case gets valuable feedback before submission to OMB, and they create a solid project management environmentÂone where projects are expected to achieve defined milestones and approval before moving to their next phase, Commerce's Simon says.
At Commerce, Simon's organization reviews all of the department's business casesÂ60 last yearÂand provides feedback to the stakeholders. Simon says catching potential problems before they become bigger problems is his specialty, and in some cases, doing so has significantly affected the outcome of both the OMB review and the overall success of projects.
He recalled, for instance, a review of a business systems project that prompted the team to ask whether it was on schedule because the information was not in the case. In fact, the project was a year off track, so ultimately, Commerce put a hold on the project, revised its plan, put a new project manager in place and set clearer lines of authority.
Because of the business case review, the team strengthened the requirements for the system and added precise explanations about how the department would meet the new requirements, Simon says.
In another review of an enterprisewide system, Simon's group turned up a budget variance that was wreaking havoc with a project: The business case included figures for what Commerce wanted to spend on the project rather than what Congress appropriatedÂa difference of millions of dollars.
"Due to the huge funding gap, the de-tailed project plan had become meaningless in place of ad hoc planning relying on scrounged up resources," Simon says. The review resulted in a complete overhaul of the plans and the business case that meshed with the funding realities, he says.
Finally, in making the process part of an overall effort to improve program management, the business case teams must make sure to enlist agency leaders. Without full buy-in from higher-ups, all of the effort put into creating an effective business case may render it ineffective, Ash points out.
At the Federal Aviation Administration, for example, the administrator has taken a personal interest in making sure that business cases are done correctly. In fact, for the past two years, the administrator kicked off the business case season by stressing to all program and project managers that business cases are important to FAA and the department, Ash says.
"Our strongest lesson learned is that the level of attentionÂbe it from the CIO, the administrator or the deputy secretaryÂplaces a level of importance on the business case that everybody understands," he says.
One of the chief reasons for OMB's interest in the business cases has always been what happens after they are approved. Deputy Director Johnson regularly points out that the creation of metrics to measure performance is crucial and the only true test of whether the premise of any given Exhibit 300 is sound.
To measure results, Johnson advocates the use of the Program Assessment Rating Tool. OMB has directed agencies to use PART to assess performance and track costs as well as to measure results against original goals.
"Programs are not only improving their performance, they are doing more with less," Johnson told Senate lawmakers during a hearing on the White House management initiatives. "Program managers are isolating the cost factors that drive performance and working to reduce those costs."
But there's room for improvement. OMB figures show that 67 percent of the 607 programs that agencies have assessed using PART so far have received effective, moderately effective or adequate ratings. That leaves 33 percent that are below average. Additionally, for 71 percent of the rated programs, agencies have defined clear goals for measuring results. These numbers are improving since last year, but Johnson says agencies can still do better.
Over time, more and more agencies are getting it right, according to OMB. Evans points to examples of how three agencies are going above and beyond the requirements of the Exhibit 300: the Food and Drug Administration's efforts to incorporate best practices into its process agencywide, the Labor Department's standardization of a process for creating the cases (see column, Page 14) and the Veterans Affairs Department's linking of its systems functions and investment management.
Simon likes to note that there's also a bonus benefit from creating effective business cases: the ability to use them as advertising vehicles for the agency and its programs.
"Some people use the Exhibit 300 to obfuscate what they are doing, but a much more successful approach is to use it to advertise what you're doing," he says. "Put your best foot forward in explaining what you're doing, why you're doing it and what the benefits are from doing it. If you have to do it anyway, you might as well turn it to your advantage."