*&j\ Office of Inspector General
Report of Review
Special Review of EPA's Information
Systems Program
Volume I
E1SKG3-15-0098-4400038
March 24, 1994
at toast 50% recycled fib*r
-------
Inspector General Division
Conducting the Audit:
Region Covered:
Program Offices Involved:
Technical Assistance Division
Washington, D.C.
Agencywide
Agencywide
-------
\
8 UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON. D.C. 20460
MM? 24 (991 THE INSPECTOR GENERAL
MEMORANDUM
SUBJECT: Special Review of EPA's Information Systems Program
Special Report No. E1SKG3-15-0098-4400038
TO: Carol M. Browifer
Administrato
Attached is our final report entitled "Special Review of
EPA's Information Systems Program." The purpose of this review
was to respond to a September 27, 1993, request by the Chairman,
Subcommittee on Superfund, Recycling, and Solid Waste Management
of the Committee on Environment and Public Works, U.S. Senate.
In his request letter, the Subcommittee Chairman asked that we
perform a comprehensive management review of EPA's information
systems program, with as much specific attention on the Superfund
area as possible.
Because of the high-level focus of the request and the time
constraints involved, we approached this review very differently
from past special reviews. The most important difference was the
participation of staff members from EPA program offices jointly
with Office of Inspector General (OIG) employees in a team effort
to identify the root causes of EPA's information resources
management (IRM) problems and to develop cost-effective
solutions.
The single most important theme we identified was that
historically, EPA has not treated information as a valuable,
strategic resource. The review found that EPA's IRM problems are
the result of systemic deficiencies in the following areas: IRM
management and organizational structure; resource planning and
performance measurement; information system development; and data
management. This report makes recommendations to address these
concerns .
This special review report describes problems that the joint
review team identified and corrective actions the OIG recommends.
The report represents the opinion of the OIG. Final
determinations on matters in this report will be made by EPA
managers in accordance with established EPA audit resolution
procedures. Accordingly, the recommendations in this report do
not necessarily represent the final EPA position.
-------
This report is addressed to you because of the Agencywide
impact of the IRM program and the need for you to be involved in
seeing to it that necessary corrective actions are properly
implemented. We would recommend that you designate the Assistant
Administrator for Administration and Resources Management as the
action official to oversee the corrective actions being taken to
resolve the issues presented in this report. He is required to
provide us, within 90 days, a written response describing the
actions the Agency has taken as a result of our recommendations.
If these actions will not be complete by that time, we ask that
the actions that are ongoing be described and a timetable
provided for their completion. We have no objections to the
release of this report to the public.
Should your staff have any questions or need additional
information regarding this report, please have them contact
Kenneth A. Konz, Assistant Inspector General for Audit, on
(202) 260-1106.
Martin
Attachment
John C. Marl
-------
Special Review of EPA's Information Systems Program
EXECUTIVE SUMMARY
PURPOSE. OBJECTIVES AMD METHODOLOGY
This comprehensive management review of the Environmental
Protection Agency's (EPA) information resources management
(IRM) program was undertaken in response to a request from
the Subcommittee on Superfund, Recycling, and Solid Waste
Management of the Committee on Environment and Public Works,
U.S. Senate. This request expressed concern about the "...
apparent lack of credible basic management information about
where Agency funds, including Superfund money, are being
spent and how, and the questions raised about what the
resulting accomplishments may be . . ."
Because of the strong base of prior audit work and studies in
this area, one objective of the review was to examine,
validate, and synthesize issues raised in relevant prior
Office of Inspector General (OIG) and General Accounting
Office (GAO) audit reports and Agency studies. The second
objective was to identify any additional mission-related IRM
problems, their root causes, and their solutions from an
Agencywide perspective, with specific attention on the
Superfund program.
This management-oriented review focused on "big picture,"
whole program issues. Working cooperatively, a joint
OIG/Agency review team1 relied heavily on interviews and
focus groups to most fully leverage both review team and
Agency resources within the allotted time. The groups
responded to previously identified problem statements from
their perspectives, and then discussed the IRM problems they
encounter directly in their jobs, as well as the problems'
root causes and solutions. These discussions brought forth a
mixture of facts and opinions. The review team also used
recently issued audit reports and current audit work to
identify or confirm IRM problems and root causes. Finally,
the review team followed up on a number of significant
recommendations made in OIG audit reports issued since fiscal
1990 to determine the status of EPA's corrective actions.
1 The review team consisted of representatives from the Office of Inspector General, the Office of Information Resources Management
(OIRM), and the Office of Solid Waste and Emergency Response (OSWER), which is responsible for the Superfund program.
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Syatens Program
The review embodied three central assumptions: that the team
would obtain the best root cause statements and solutions
from front-line program office and IRM representatives in the
Regions; that balance would be obtained by interviewing
members of the Headquarters IRM community; and that the joint
review team approach would help mitigate the review's time
constraints.
BACKGROUND
A sound IRM infrastructure and efficient, responsive
information systems are critical to EPA's ability to provide
objective, reliable, and understandable information to help
achieve its environmental mission. For instance, EPA's
information systems provide data:
• on management and oversight of the Superfund program;
• on nationwide air pollution and water quality;
• to track and report on Agency financial management; and
• on the effects of pesticides and toxic substances on
humans and the environment.
The IRM program at EPA has both centralized and decentralized
components. The central components in the Office of
Administration and Resources Management (OARM) and the Office
of Policy, Planning and Evaluation (OPPE) provide certain
Agencywide IRM services, as well as IRM policy, planning, and
oversight. The decentralized components (i.e.)" the program
and Regional offices) implement and operate systems to meet
their needs. While the responsibility to lead the use of
information and information technology to best meet the
Agency mission may be centralized, most resources to
implement and manage information systems are decentralized.
The IRM program has recently faced significant challenges,
and is working to overcome them. IRM planning and security
have been declared to the President as material weaknesses
for the Agency. Corrective actions are underway in both
areas, are progressing well, and present the promise of
fundamental improvements in the Agency's management of
information.
Nevertheless, significant problems remain. A number of
recent reports and studies present recommendations for these
problems, although the recommendations tend to focus on
specific systems and selected components of the IRM program.
The intent of this review, however, was to discover root
it
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'3 Information Systems Program
causes of the most fundamental, cross-cutting IRM problems,
and to craft program-wide solutions affecting the entire
Agency.
RESULTS IN BRIEF
In recent years, EPA has been criticized for information
systems problems, many of which the Agency is in the process
of addressing. These problems may be categorized as:
• concerns about the quality, integrity, and completeness
of data, i.e., a lack of credible basic.management
information about where and how Agency funds, including
Superfund money, are being spent, and the
accomplishments resulting from those expenditures;
• difficulties,in addressing cross-media pollution
problems;
• significant cost overruns and delays in developing and
implementing information systems;
• development of duplicate systems; and
• exposure of EPA's financial payment systems to
unnecessary risks.
Our review has concluded that these problems are the result
of systemic deficiencies in the following areas: IRM
management and organizational structure; resource planning
and performance measurement; information system development;
and data management, in our view, the Subcommittee's concern
stated in the request letter to the Inspector General cannot
be attributed to any one of these systemic deficiencies
alone, but results from all of them in combination.
The single most important theme identified by our review was
that the culture of information management at EPA does not
treat information as a valuable, strategic resource. Well-
managed corporate assets are rigorously inventoried, tracked,
and maintained. More importantly, they are used to leverage
a corporation's productivity. But at EPA, information -
resources are rarely seen as being of strategic importance in
accomplishing the Agency's environmental mission. The
transforming power of information is not being harnessed, and
the opportunity to use information to leverage the Agency's
other resources is being missed.
In response to previously identified IRM problems, EPA has
initiated a number of actions. For example, the Office of
Information Resources Management (OIRM) has drafted a revised
iii
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
charter which would establish the "Executive Steering
Committee for IRM" as the decision-making vehicle for top
management in IRM planning and oversight; the first meeting
of the committee is planned for the second quarter of fiscal
1994. A new IRM Planning Group has developed a proposed IRM
strategic planning process; a high level portion of an IRM
Strategic Plan2 is expected to be completed by October 1994.
Further, OARM plans to pilot test a working capital fund in
fiscal 1995, which is intended to provide stable, .raulti-year
funding for selected Agency activities, including major IRM
initiatives; implementation is scheduled for fiscal 1996. In
addition, the Agency has begun a number of initiatives to
help its information systems better assist the environmental
risk assessment process and to promote data sharing.
Finally, EPA is converting hundreds of contractor positions
to Federal employee positions, and many of these are.
tentatively planned to be automated data processing (ADP)-
related. This will help reduce the Agency's vulnerability to
the loss of IRM expertise.
Although in many respects we believe the Agency is proceeding
in the right direction, we still have concerns about EPA's
ability and commitment to address its long-standing IRM
problems.
PRINCIPAL ISSUES
IRM Management and Organizational Structure
Virtually all of the interview and focus group participants
believed that EPA's upper management does not understand how
critical IRM is to environmental protection. Because of
this, information is not treated as a strategic resource, IRM
is not treated as a core function, and information is not
viewed as a valuable tool to empower the public. One reason
is that top management is not perceived to be accountable for
IRM, but instead is focused primarily on programmatic
accomplishments. Another factor is that EPA's IRM Steering
Committee has not fulfilled an important role as a decision-
2 We define the term, IRM Strategic Plan, as a detailed document which includes an overall IRM vision for the Agency, links
information technology to anticipated-program and mission needs-and reflects-budget constraints. In addition, the Plan should provide
detailed descriptions and costs of all major IRM initiatives—for example, major system development and modernization activities and
significant ADP acquisitions and contracts—in order to form the basis for budget requests. Hie Plan should be a 5-year plan, updated
annually, and includes functional requirements, current architecture, target architecture, and annual tactical plans with estimated budgets and
major milestone dates to achieve the target architecture. As such, this definition includes two documents the Agency separately calls its
IRM Strategic Plan and its Multi-year Implementation Plan.
iv
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
making body, due to its infrequent meetings and lower level
participation.
Lines of authority and communication for IRM matters are
confused at EPA. Formal lines of authority are fragmented
between four offices under two Assistant Administrators.
Interview and focus group participants consistently expressed
concerns about an inadequate communication infrastructure.
Of particular concern was the perception that the Office of
Information Resources Management and the National Data
Processing Division (NDPD) make important unilateral
decisions without consulting their "customers," such as the
service cutbacks announced by NDPD for fiscal 1993 and 1994
which some focus group participants said were developed
without any input from those Agency components using these
services.
The organizational placement, numbers, and apparent
qualifications of the EPA employees with significant IRM
responsibilities are inconsistent among Headquarters program
offices. For example, two Assistant Administrators had no
in-house data processing staff, while one Assistant
Administrator had 45. And these employees occupied 18
different job series positions, with over 42 percent in non-
computer specialist positions. This problem, combined with
EPA's dependence on support contractors, has left the Agency
vulnerable, to a loss of expertise.
Resource Pla.r>ninq and Performance Measurement
Interview and focus group participants consistently cited the
lack of an Agencywide IRM Strategic Plan as a major
impediment to the success of IRM at EPA. To maximize the
effectiveness of such a plan, however, EPA as a whole needs
to have an Agency Business Plan3 which aligns resources,
skills, and strategies (including information technology)
with EPA's mission. Such a Business Plan is now in
development, and is expected to be completed in the Spring of
1994. Concurrent with this, a draft portion of EPA's IRM
Strategic Plan--a high level IRM vision statement--is being
developed, with issuance expected around the same time.
Another aspect of this problem is that the IRM planning that
does exist is not integrated with EPA's budgeting process.
3An Agency Business Plan is considered the same as an Agency Strategic Plan.
V
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA7 a Information Sy at <•""." Program
This contributes to funding shortages for systems development
projects and to incremental, independent systems design and
development .
Unstable funding from one year to the next also was viewed as
contributing to systems development problems, due the lack of
a mechanism to ensure long-term financial support. The
current 1-year budget cycle was viewed as the major reason
for this, along with the fact that system development
projects are not line budget items. Longer-term budgeting
for these projects would establish more accountability for
managers in the development, implementation, and maintenance
of major information systems, and force managers to look at
the entire life cycle of a system. For example, different
decisions may have been made during the development of EPA' s
Integrated Financial Management System (IFMS) if management
had initially been aware of the total IFMS life cycle costs.
The initial estimate for IFMS was almost $8 million, but this
was only for the design, development, and implementation of
the system. Our current audit has estimated that the costs
of the entire life cycle of IFMS over a 12 -year period, which
include maintenance and operations costs not included in the
original estimate, are actually over $200 million.
IRM planning is greatly complicated by EPA' s unbalanced
emphasis on short-term vs. long-term results. While all
organizations have emergencies which must be addressed, it
was the perception of interview and focus group participants
that this occurs excessively at EPA. Continually changing
Congressional information needs, new and changing
environmental regulations, and poor communications with
Congressional staff were viewed as keeping EPA in a generally
reactive mode .
EPA does not have adequate mechanisms in place to measure the
performance of the IRM program. For example, EPA has not yet
built into its information systems sufficient measures of
environmental successes, accomplishments, and economic
benefits, which Congress and the public want. Further, EPA
cannot totally account for its IRM expenditures on a system-
by- system basis; preliminary information developed in a
separate ongoing OIG audit shows that for 10 major
information systems, EPA had not reported correctly, by
system, fiscal 1993 costs to the Office of Management and
Budget totaling almost $29 million. Nor can EPA measure the
success or failure of some critical information system
activities, such as software maintenance.
Report Ho. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
Information Systems Development
Carefully defining the needs of all users and customers of an
information system is critical to its success. But in our
interviews and focus groups, managers and staff frequently
stated that EPA's systems developers* do not always work
effectively with users and customers (i.e., EPA program
officials, Congress, and the States) to define needs and
design good systems.
Systems developers were specifically criticized for not
really understanding how EPA's programs work or what program
officials' needs were; some focus group members attributed
this to EPA's heavy use of contractors to develop systems.
EPA's national systems were also criticized for: meeting
Headquarters needs but not Regional needs; having low levels
of utility; not being "friendly" to Regional users; and being
overly complex. A manager gave one example, saying that they
could not do something as simple as go into IFMS and find out
what their available travel balance was; the data was
unavailable and unaccessible in a user-friendly fashion, so
they had to ask an intermediary staff person to generate a
report to find out the answer.
Inadequate consideration of customers' needs also applies to
Congress and the States. Focus group members believed that
not working with Congress to anticipate their questions led
to situations in which Congress asked good, straightforward
questions about an environmental program's accomplishments,
yet EPA's systems could not answer them. Likewise, not
involving the States in the systems design process creates
problems when the States must then input data to, or use data
from, EPA's systems.
On the other hand, even when needs are fully defined during
systems design, new questions or needs can arise years later
which the systems were not designed to address. This was
perceived to lead to unfair criticism.
The vast majority of Headquarters program and Regional
offices do not use a standard approach to manage software
development and maintenance. The primary reason appears to
be the use of contractors for the majority of EPA's systems
4 In this report, we use the term "system developers" to include contractor and Federal personnel from OIRM, program offices, and the
Regions who perform system development activities.
vii
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
development projects; these contractors are allowed to use
their own methodologies, which vary widely and do not always
meet Federal requirements. Further, some of the steps in
this standard approach are perceived to add time to the
development of a system, so some organizations tend to
perform them cursorily or not at all . Participants in one
focus group summed it up by stating that "management often
will not let us do it right, but there is always time to do
it again." Part of this process involves assessing whether
older systems are obsolete, something EPA does not
consistently do.
Data sharing is crucial to the Administrator' s four top
priorities, which cut across all environmental media. Yet
the link between data sharing and these priorities has not
been widely recognized.
EPA does not have the "structure" (i.e., an information/data
architecture, data standards, and a Data Administration
function) to really share data Agencywide. Interview and
focus group participants attributed this to: insufficient
resources; an EPA culture which does not value
information/data as a strategic resource; EPA programs and
States which want flexibility in defining some types of data;
EPA' s media -based organizational structure; program offices'
reluctance to relinquish the control of resources to another
office; and technical risks.
Data quality problems exist in many EPA information systems,
such as Superfund's main system5, for which the OIG has
reported significant inaccuracies for a number of years.
Another example was provided by focus group participants, who
said that EPA's geographic information systems (GIS) showed
certain facilities in the middle of the Atlantic Ocean and at
the North Pole. These inaccuracies adversely affect both
"business" and environmental decision-making, and are caused
by such things as frequently changing definitions of data,
lack of "ownership" of the data by those who have to input
it, lack of a "data audit process" in the program offices,
and EPA's inability to force the States to provide quality
data .
3 The Comprehensive Environmental Response, Compensation, and Liability Information System (CERCLJS) is Superfund's official
source of planning and accomplishment data and serves as the primary basis for strategic decision-making and site-by-site tracking of
cleanup activities.
viii
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
The OIG is making a number of recommendations affecting root
causes which cut across most, if not all, of the major IRM
problem categories. By implementing certain recommendations,
the OIG believes the Agency can start to solve more than one
major problem. More specifically, these recommendations
should go a long way in improving EPA's basic management
information about where Agency funds, including Superfund
money, are being spent and how, and what the resulting
accomplishments are. The OIG has not prioritized these
recommendations, believing all to be so significant that they
must be addressed as soon -as possible.
A culture change is dramatically needed at EPA to view
information as a strategic resource and IRM as a core
function central to accomplishing the Agency's mission. A
cornerstone of this change would be establishing a Chief
Information Officer (CIO) with authority and responsibility
for the entire IRM program. Other recommendations include
strengthening: the Senior IRM Official (SIRMO) positions in
Headquarters and the Regions; the IRM organizations in the
program and Regional offices; and the Executive Steering
Committee for IRM.
The OIG is making recommendations which will substantially
improve IRM planning. The IRM planning process should be
closely linked with the development of EPA's Business Plan,
and be integrated with the Agency's budget process. Further,
the performance of information systems needs to be measured,
to quantify their support of the Agency's mission and goals.
EPA's management framework for building information systems
and increasing user involvement during the development
process needs to be strengthened. Training mechanisms should
be established to close the expertise gap between those who
are knowledgeable about EPA programs and those who are
knowledgeable about IRM.
EPA needs an Agencywide information/data architecture and
data standards. To help in this, a centralized Data
Administration function should be established with
appropriate authorities and responsibilities. Finally, the
public should be given greater access to view EPA's non-
sensitive data.
IX
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
(This page intentionally left blank)
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information systems program
TABLE OF CONTENTS
VOLUME I
Page
EXECUTIVE SUMMARY i
CHAPTER
1 INTRODUCTION * 1
PURPOSE AND OBJECTIVES 1
SCOPE, METHODOLOGY, AND ASSUMPTIONS 1
BACKGROUND 2
Structure Of IRM At EPA 3
Previously Identified Problems And
Recommendations 4
Status Of Implementing Prior Recommendations 5
2 INFORMATION RESOURCES MANAGEMENT PROBLEMS AND
UNDERLYING CAUSES 6
IRM MANAGEMENT AND ORGANIZATIONAL STRUCTURE 8
Upper Management Does Not Adequately Understand
And Participate In Information Resources
Management 9
Confusion Exists About Lines Of Authority And
Communication Regarding IRM Issues 13
IRM Organizational Placement, Qualifications, And
Responsibilities Are Inconsistent Throughout
The Agency 15
IRM Policies Are Not Effectively Implemented 16
RESOURCE PLANNING AND PERFORMANCE MEASUREMENT 17
EPA Needs An IRM Strategic Plan Driven By An
Agencywide Business Plan 17
Report NO. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems program
page
The Agency Has Not Integrated The Planning
and Budgeting Processes 18
Too Much Emphasis Exists On Short-Term Results.... 20
EPA Has No Performance Measurement Criteria For
The IRM Program 22
INFORMATION SYSTEMS DEVELOPMENT 24
Information Systems Are Designed Without Up-Front
Agreement On Necessary Components 24
EPA Does Not Follow A Standard Approach To
Managing The System Development Life Cycle
Of Information Systems 28
DATA MANAGEMENT 30
The Agency Has Neither A Standard, Defined
Information Architecture Nor A Centralized
Data Administration Function To Facilitate
Data Sharing 31
EPA Needs To Improve Its Quality Assurance
Program 36
3 RECOMMENDATIONS 40
IRM Management and Organizational Structure 41
Resource Planning and Performance Measurement 43
Information Systems Development 45
Data Management 46
Report NO. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
APPENDIXES
APPENDIX I:
APPENDIX II:
APPENDIX III;
APPENDIX IV:
APPENDIX V:
APPENDIX VI:
APPENDIX VII;
TABLE OF CONTENTS
VOLUME II
Page
SENATE SUBCOMMITTEE ON SUPERFUND,
RECYCLING, AND SOLID WASTE MANAGEMENT
REQUEST TO INSPECTOR GENERAL
FOR A SPECIAL IRM REVIEW 1-1
SENATE SUBCOMMITTEE ON SUPERFUND,
RECYCLING, AND SOLID WASTE MANAGEMENT
REQUEST TO EPA ADMINISTRATOR
FOR A SPECIAL IRM REVIEW II-l
JOINT AGENCY AND OFFICE OF
INSPECTOR GENERAL TEAM MEMBERS III-l
FOCUS GROUP SUMMARIES IV-1
INTERVIEW SUMMARIES V-l
AGENCY PARTICIPANTS IN FOCUS
GROUPS AND INTERVIEWS VI-1
DIG REPORTS, GAO REPORTS, EPA
MANAGEMENT REPORTS, AND
CONGRESSIONAL TESTIMONY. VII-1
APPENDIX VIII: APPROACH AND METHODOLOGY VIII-1
APPENDIX IX: IMPLEMENTATION STATUS OF PRIOR
HIGH-PRIORITY RECOMMENDATIONS IX-1
CHART: EPA OFFICES WITH MAJOR
IRM RESPONSIBILITIES X-l
APPENDIX X:
APPENDIX XI:
APPENDIX XII:
APPENDIX XIII: REPORT DISTRIBUTION XIII-1
OIRM ISSUE PAPER: STRENGTHENING
IRM AT EPA XI-1
GLOSSARY OF ACRONYMS AND
ABBREVIATIONS XII-1
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
(This page intentionally left blank)
Report NO. E1SKG3-15-0098-4400038
-------
Special Review of EPA*a Information Systems Program
CHAPTER 1
INTRODUCTION
PURPOSE AND OBJECTIVES
This comprehensive management review of EPA's IRM program was
undertaken in response to a request from the Subcommittee on
Superfund, Recycling, and Solid Waste Management of the
Senate Committee on Environment and Public Works (see
Appendix I)6. The Subcommittee's request expressed concern
'about the "... apparent lack of credible basic management
information about where Agency funds, including Superfund
money, are being spent and how, and the questions raised
about what the resulting accomplishments may be ..." In
addition, the Subcommittee sent a letter to the EPA
Administrator (see Appendix II), requesting "... full
cooperation and participation from fiscal and information
system as well as program officials ..." during the course
of the review.
Because of the strong base of prior audit work and studies in
this area, one objective of the review was to examine,
validate, and synthesize issues raised in prior 016 and 6AO
audit reports and Agency studies that relate to the
Subcommittee's interest. The second objective was to
identify any additional mission-related IRM problems, their
root causes, and their solutions from an Agencywide
perspective, with specific attention on the Superfund
program.
SCOPE, METHODOLOGY. AND ASSUMPTIONS
The scope of the review was extremely comprehensive. It was
a management-oriented review that looked at "big picture,"
whole program issues, rather than specific details or
systems. Because of the nature of the Subcommittee's request
and the time constraints for the project, the methodology and
approach reflected a special review, rather than a formal
audit, of EPA's IRM program. This review relied heavily upon
group interviews and focus groups to most fully leverage both
review team and Agency resources within the allotted time.
'All appendices are included in Volume n of the report, which is available upon request.
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
The methodology, in brief, began with creation of a joint
OIG/Agency review team, consisting of representatives from
the OIG, OIRM, and the Office of Solid Waste and Emergency
Response (OSWER), which is responsible for the Superfund
program (see Appendix III). Working cooperatively, the team
developed an agreed-upon project plan, and then extracted
relevant problem statements from audits issued from fiscal
1990 through fiscal 1993. The team used these problem
statements to begin discussions with interviewees and focus
groups. The groups responded to the problem statements from
their perspectives, and then discussed the IRM problems they
encounter directly in their jobs, as well as the problems'
root causes and solutions. These discussions brought forth a
mixture of facts and opinions; it should be noted that OIRM
officials may not necessarily agree with all the expressed
opinions. After concluding and summarizing the interviews
and focus groups (see Appendices IV, V, and VI), the review
team followed up where needed, and synthesized the results.
The review team also used recently issued audit reports,
studies, and other documents (see Appendix VII), and current
audit work to identify or confirm IRM problems and root
causes. Finally, the review team followed up on a number of
significant recommendations made in audit reports issued
since fiscal 1990 to determine the status of EPA's corrective
actions. Complete details of the review team's methodology
are provided in Appendix VIII.
The review embodied several assumptions. One assumption of
the methodology was that the team would obtain the best root
cause statements and draft solutions from front-line program
office and IRM representatives in the Regions. The
methodology also assumed that balance would be obtained by
interviewing members of the Headquarters IRM community. A
final assumption was that the joint review team approach
would help mitigate the review's time constraints.
Due to its limited scope, this review does not represent an
audit in accordance with the Government Auditing Standards
(1988 revision) issued by the Comptroller General of the
United States. Our review was performed in accordance with
the procedures set forth in OIG Manual Chapter 150, "Reports
of Review."
BACKGROUND
A sound IRM infrastructure and efficient, responsive
information systems are' critical to EPA's ability to provide
Z~
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
objective, reliable, and understandable information to help
achieve its environmental mission. EPA is an information-
intensive organization, and its information resources are
critical to the success of all program activities. EPA has
over 500 information systems as well as computer models which
support its mission. For instance, major information systems
provide data:
• on management and oversight of the Super fund program;
• on nationwide air pollution and water quality;
• to track and report on Agency financial management;
• for computerized models designed to evaluate acid rain
and emissions; and
• on the effects of pesticides and toxic substances on
humans and the environment.
The Federal government has been making major investments in
IRM activities over the last decade. Annual expenditures now
exceed $20 billion government-wide. EPA also is making
significant investments, totaling an estimated $265 million
in fiscal 1993. This figure is about five times what the
Agency spent ten years ago for IRM resources, although EPA's
IRM budget has suffered cutbacks for several years.
Structure Of IRM At EPA
The IRM program at EPA has both centralized and decentralized
components. The central components in OARM and OPPE provide
certain Agencywide information management and information
technology services, as well as IRM policy, planning, and
oversight. The decentralized components (i.e., the program
and Regional offices) implement and operate systems to meet
their needs. While the responsibility to lead the use of
information and information technology to best meet the
Agency mission may be centralized, most resources to
implement and manage information systems are decentralized,
residing in the program offices and Regions.
EPA's recent budgets have greatly constrained the centralized
components of EPA's IRM program.. This has increased
pressures on the decentralized components to cover any
shortfalls in centralized IRM programs and services. Yet
these decentralized components are simultaneously receiving
their own budget cutbacks, essentially yielding a two-fold
cutback in IRM technology and services. This is especially
noticeable in the contracting area, because EPA's IRM program
3
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
relies heavily on contractors for essential technical
expertise.
Certain pressures on the IRM program over the past few years
have increased the trend towards decentralization. For
example, prior problems with administration of Agencywide IRM
contracts have led program offices to proceed rapidly to
establish their own contracts for essential IRM services. As
another example, because of advances in local area- network
(LAN) technology, Headquarters and Regional off ices now
operate and maintain their own basic desktop computing
platforms. Technology is promoting decentralization of IRM,
and is changing the role of the centrally-managed computing
resources .
The IRM program has recently faced significant challenges,
and is working to overcome them. IRM planning and security
have been declared to the President as material weaknesses
for the Agency. Corrective actions are underway in both
areas, are progressing well, and present the promise of
fundamental improvements in the Agency's management of
information.
Nevertheless, significant problems remain. For example, the
Agency often manages information and information systems
reactively. Congress asks questions of EPA that EPA' s
systems cannot easily answer. In part, this stems from IRM
considerations not being addressed early enough during
development of laws and regulations. Some reactivity derives
from strict Congressional mandates, which are then followed
by broad questions. For example, the Clean Water Act's best
practicable technology approach did not lead EPA to create
information systems whose primary purpose was to track
nationwide improvement in ambient water quality. It led EPA
to create information systems to track permitting and
compliance activities. Legislation that guides EPA towards
strategic use of information, such as Title III of the
Superfund Amendments and Reauthorization Act of 1986, is
rare. This issue, and many others, are discussed in this
report .
Previousl Identified Problems A*>d mTnndai
Appendix VII provides a comprehensive list of reports,
studies, correspondence, and Congressional testimony from
fiscal 1990 through fiscal 1993 that are relevant to the
scope of the review. These establish a solid foundation for
4
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
the review and identify numerous problems and
recommendations.
The review team categorized the previously identified
problems into five major areas of concern:
• organizational accountability;
• planning and resources;
• data integration and data management;
• quality assurance and protection of data; and
• communications throughout the IRM community.
The prior reports and studies present recommendations for all
of these areas, although the recommendations tend to focus on
specific systems and selected components of the Agency IRM
program. The review team identified the most important of
these recommendations, and followed up to see how fully the
Agency had implemented them.
Status Of Implementing Prior Recommendations
Appendix IX presents details of the Agency's efforts to
implement these high-priority prior recommendations. In
general, the Agency shows good progress in implementing
certain recommendations (e.g., those dealing with the
Resource Access Control Facility [RACF] and mainframe access
security). However, in some instances, resource constraints
appeared to be slowing progress somewhat (e.g., in
establishing centralized data administration). In addition,
some recommendations were very long-term by nature, and are
not yet expected to be completed. The recommendations for
improving aspects of IRM planning are a good example of this.
All the specific recommendations were designed to correct
particular previously identified problems. The results show
that progress is occurring on numerous individual fronts.
The intent of this review, however, was to discover root
causes of the most fundamental, cross-cutting IRM problems,
and to craft program-wide solutions affecting the entire
Agency. The remainder of the report looks at these broader
issues.
5
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
CHAPTER 2
INFORMATION RESOURCES MRNAgEMPMT PROBLEMS
AND UNDERLYING CAUSES
The purpose of this chapter is not to simply list IRM
problems, because they have already been well identified in
various audit reports, studies, and testimonies. Problems
are briefly discussed here only to provide a context for the
analysis of root causes. This, in turn, will serve to
document the need for the solutions and recommendations
presented in the next chapter.
Since fiscal 1990, 75 DIG and GAO reports, internal EPA and
contractor studies, and Congressional correspondence and
testimonies have criticized EPA for information systems
management problems, most of which the Agency is in the
process of addressing. These problems may be categorized as
follows: (1) concerns about the quality, integrity, and
completeness of data (i.e., a lack of credible basic
management information about where and how Agency funds,
including Superfund money, are being spent, and the
accomplishments resulting from those expenditures);
(2) difficulties in addressing cross-media pollution
problems; (3) significant cost overruns and delays in
developing and implementing information systems; (4)
development of duplicate systems; and (5) exposure of the
Agency's financial payment systems to unnecessary access
risks.
For example, data quality and integrity problems have been
particularly noticeable in EPA's Comprehensive Environmental
Response, Compensation and Liability Information System
(CERCLIS). CERCLIS is the official source of planning and
accomplishment data and serves as the primary basis for
strategic decision-making and site-by-site tracking of
cleanup activities for the multi-billion dollar Superfund
program. Yet, in spite of its importance, the DIG has
repeatedly found major problems with CERCLIS, raising serious
questions about the credibility of its financial and
accomplishments data. For example:
6-
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
• The last four Superfund annual reports to Congress7
have shown substantial error rates on many crucial
reported program accomplishments, such as removal
actions.
• A March 1990 OIG report8 concluded that inadequate
controls existed over system documentation, software
changes, and testing. The report pointed out that the
lack of these program quality assurance procedures led
to unreliable reports which, in turn, caused users to
abandon use of CERCLIS.
• A March 1992 OIG followup review9 of the 1990 report
identified significant financial data errors, as well as
missing outlay data and audit trail information in
CERCLIS.
On March 29, 1993, GAO officials summarized EPA's Agencywide
IRM problems in a testimony before the Subcommittee on
Legislation and National Security and the Subcommittee on
Environment, Energy, and Natural Resources, Committee on
Government Operations, House of Representatives. One
official stated that
EPA is an agency with hundreds of information
systems that are mostly separate and distinct, with •
their own structures and purposes. This plethora
of systems impairs EPA's ability to easily share
mutually beneficial information across program
boundaries, fosters data duplication, and precludes
more comprehensive, cross-media assessments of
environmental risk and solutions. EPA's managers
and analysts find many of the agency's automated
systems too difficult to use or ill-designed to
measure and assess environmental results, because
few were designed for this purpose. Instead, the
7 "Review of the Fiscal Year 1988 Superfund Report to Congress" (OIG Report No. E1SFF9-11-0015-0100227, issued March 28,
1990); "Review of the Fiscal Year 1989 Superfund Report, to Congress" (OIG Report No. E1SFFO-11-0018-1100026, issued October 18,
1990); 'Annual Superfund Report to the Congress for Fiscal 1990" (OIG Report No. PlSFFQ-11-0032-1100385, issued September 16,
1991); "Annual Superfund Report to the Congress for Fiscal 1991" (OIG Report No. PlSFFl-11-0026-2100660, issued September 30,
1992).
' "Report on CERCLIS Reporting" (OIG Report No. E1SFF9-15-0023-010087, issued March 12, 1990).
9 "C
"Special Review On Follow-up Of CERCLIS Reporting And Post-Implementation" (OIG Report No. E1SFG1-15-5001-2400027,
issued March 27, 1992).
7~
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
information systems with the bulk of the agency's
data contain activity-related data--chiefly
designed to record, count, track, and report on
such items as the number of permits issued, levels
of pollutants discovered, or types of enforcement
actions taken. Additionally, data quality and
integrity remain a chief concern because of
inattention to strong quality assurance and data
administration practices. These problems, I might -
add, are not necessarily unique to EPA, but are
common across many federal agencies.
Our current review has concluded that the problems set forth
above are the result of systemic deficiencies in the
following four general areas (which combined and expanded on
the five previously identified major areas of concern
identified on page 8) : (1) IRM management and organizational
structure; (2) resource planning and performance measurement;
(3) information system development; and (4) data management.
These underlying causes are discussed in more detail in the
following sections. The causes are not addressed in any
priority order. Instead, these deficiencies are all
considered to be significant barriers to an efficient and
effective IRM program and should be addressed concurrently.
The OIG's recommendations for correcting these deficiencies
are set forth in Chapter 3 of this report.
IRM MANAGEMENT AND ORGANIZATIONAL STRUCTURE
EPA has taken some steps recently to address this area of
concern. For example, the Assistant Administrator for
Administration and Resources Management met with the other
Assistant Administrators in January 1994 to discuss their
leadership role in IRM and to solicit their ideas. Further,
OIRM has drafted a revised IRM Steering Committee charter
which would establish the "Executive Steering Committee for
IRM" as the decision-making vehicle for top management in IRM
planning and oversight. The committee has already met twice
since the beginning of the year. Additionally, the Agency is
planning to take action to address some other organizational
and communications issues as a result of OIRM's "Model IRM
Study" to be completed in May 1994. Further, the Agency is
working toward converting hundreds of contractor positions to
Federal employee positions, and many of these are tentatively
planned to be ADP-related positions. This will contribute to
reducing the Agency's vulnerability to the loss of IRM
expertise.
8
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
We agree with these actions and believe that they should go a
long way in solving the Agency's IRM problems and in
achieving. Agencywide IRM goals. Although we believe the
Agency is generally proceeding in the right direction, we
still have concerns about EPA's long-term ability and
commitment to address these issues, which will take years of
continuing effort to solve. Our specific concerns are
discussed below.
Participate In Information Resources Management
During our interviews and focus group meetings, we repeatedly
heard, from virtually all levels of Agency management and
staff, that upper management10 does not understand how
critical IRM is to environmental protection. This was a
strong belief of the Headquarters focus group participants,
who felt that senior management understands neither the
linkage between information systems and mission
accomplishment, nor the role of data in framing options in
the decision-making process. While this may not be the case
with every top manager and executive at EPA, we nevertheless
believe it is a very pervasive problem.
Because of this, IRM is not treated as a core function,
information/data is not treated as a strategic resource, and
information/data is not viewed as a valuable tool to empower
the public (i.e., environmental groups, labor, industry,
etc.) to deal with environmental problems beyond what
government can do. Other Federal agencies--such as the
Federal Aviation Administration, Social Security
Administration, Internal Revenue Service, Patent and
Trademark Office, National Weather Service, and Securities
and Exchange Commission--have recognized the strategic value
of information and treat IRM as a core business line.
However, until EPA treats information as a key element of its
business, it is losing the opportunity to use information to
leverage its other resources.
This is just one manifestation of a "culture" prpblem at EPA,
which has relegated to secondary importance a number of
crucial management activities because they are not perceived
to be sufficiently related-to EPA's environmental mission.
10 When asked to define 'upper management," focus group members decided it was Headquarters Office Directors and above, and
Regional Branch Chiefs and above.
9
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
As the Inspector General testified on March 29, 1993, before
the Subcommittee on Legislation and National Security, and
the Subcommittee on Environment, Energy and Natural
Resources, Committee on Government Operations, House of
Representatives,
Just as contract management at SPA has been viewed
as secondary to the Agency's environmental mission,
information resources management has also been
pushed into the background and not given the
attention it deserves. These are both problems in
the "culture" at EPA which must be changed.
EPA's culture lias limited top management's central direction
and control of IRM. This is exemplified by things like an
ineffective IRM Steering Committee which was not mandated to
make substantive decisions, inadequate IRM policies and
procedures, and insufficient communications within EPA's IRM
community, all of which we discuss later in this chapter.
Overall, the lack of central direction and control-of IRM has
significantly contributed to EPA's many long-standing IRM
problems.
Part of this problem is that top management officials are not
perceived to be accountable for IRM. Instead, focus group
members stated that upper management is accountable for
things other than IRM, primarily programmatic
accomplishments, and as a result pays insufficient attention
to IRM. One SIRMO stated that IRM is buried with other
resources management issues, helping to make management less
directly accountable for it. Even the SIRMOs are affected,
because almost all of them have many other major duties which
seem to take precedence over IRM.
Another factor pertains to EPA's IRM Steering Committee.
Such a committee is the accepted method for top management to
provide leadership and direction to ensure effective and
efficient use of information resources. Yet, historically,
EPA rarely held any IRM Steering.Committee meetings (an
average of 1 to 2 meetings a year were held between fiscal
1985 and 1992, and only l meeting in fiscal 1993), and when
they were held the Assistant Administrators or their Deputies
did not attend. During these meetings, very few decisions
were made because the committee acted almost exclusively as
an information-exchange body: As a result, EPA's IRM
Steering Committee has not effectively fulfilled what should
have been an important role as a decision-making body.
10
Report Ho. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
We are convinced that a culture change is needed at EPA to
recognize the crucial role that IRM and information/data play
in accomplishing the Agency's mission. But changing EPA's
current IRM culture will require long-term commitment from
top management. For example, in 1992 GAO conducted a
study11 on changing organizational cultures, with the
assistance of five academics who had researched the subject
and of officials of nine large private industry companies.
The study reported that
The experts generally agreed that a culture change
is a long-term effort that takes at least 5 to 10
years to complete. Company officials believe that
two key techniques are of prime importance to a
successful culture change:
Top management must be totally committed to
the change in both words and actions.
Organizations must provide training that
promotes and develops skills related to their
desired values and beliefs.
One critical demonstration of such a culture change would be
the appointment of a CIO for the Agency. On May 6, 1993, in
testimony before the Legislation and National Security
Subcommittee, and the Environment, Energy, and. Natural
Resources Subcommittee, Committee on Government Operations,
House of Representatives, GAO officials stated that
Department of Environmental Protection12 clearly
needs strong, competent leadership and direction to
tackle its information management problems. The
appointment of a Chief Information Officer who is
familiar with the uses of information technology in
simplifying and streamlining organizational
practices and who can devote full-time attention to
these issues offers real advantages.
11 'Techniques Companies Use to Perpetuate or Change Beliefs and Values' (GAO Report No. GAO/NSIAD-92-105, issued February
27, 1992).
12 GAO uses this term in discussing possible EPA elevation to cabinet level.
11
Report NO. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
Further, a September 1993 GAO report13 stated
Currently, the agency's designated official for IRM
has many other responsibilities ... We have
previously testified that information management
should not be viewed as a subset of facilities
management or administration; it needs to be
recognized and dealt with at a strategic level. We
further testified that having a Chief Information
Officer at EPA who reports to the Administrator and
can devote full-time attention to IRM issues,
combined with the adoption of proven, disciplined
practices for managing information resources, is a
sound investment and can provide major benefits.
The Assistant Administrator for Administration and Resources
Management does not agree with appointing a separate CIO. In
response to the September 1993 GAO report, he stated that as
the Designated Senior Official for IRM (DSO) and Assistant
Administrator for Administration and Resources Management, he
reports directly to the Administrator. In this capacity, and
because of his unique position of managing the Agency's
budget and finances as well as IRM, he believes he can
effectively influence IRM investments at all levels to meet
Agency goals.
However, we agree with GAO that EPA needs a separate CIO with
full-time IRM responsibilities, because running an effective
IRM program is substantially more than just having
"influence" over IRM investments. Program officials we met
with throughout Headquarters and in the Regions cited the
lack of knowledgeable, experienced, forceful leadership in
the IRM arena as a significant problem, and strongly
supported the creation of a separate CIO. Considering the
hundreds of millions of dollars of annual IRM expenditures
and the extent of IRM deficiencies identified in all the
reports, studies, and testimonies over many years, creation
of a separate CIO who can devote his/her undivided attention
to IRM is imperative. We believe it is unrealistic to expect
the Assistant Administrator for Administration and Resources
Management, who is burdened with major responsibilities in
other areas (i.e., Chief Financial Officer (CFO) duties,
human resources .management., acquisition ..management, grants
" "EPA's Plans to Improve Longstanding Information Resources Management Problems" (GAO Report No. GAO/AIMD-93-8, issued
September 16, 1993).
12
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
and debarment administration, facilities management and
services, and other Agency management and administration
functions) to devote the attention necessary to solving one
of the Agency's most significant and oldest problems.
Furthermore, even though the current Assistant Administrator
for Administration and Resources Management has taken an
active interest in IRM, solving the Agency's IRM problems is
a long-term activity and will undoubtedly transcend this
administration and, therefore, deserves continuous and long-
term top management attention and involvement. Finally, the
House bill on EPA cabinet-level elevation, H.R. 3425
sponsored by Congressman Conyers, specifically calls for a
separate CIO..
Confusion Exists About Lines Of Authority And
Regarding IRM Issues
Although offices with IRM responsibilities generally
cooperate with one another on primary IRM matters, formal
lines of authority for IRM matters are fragmented between
four offices under two Assistant Administrators (see Appendix
X) which are not in the direct chain of command with one
another. For example:
• OIRM reports directly to the Assistant Administrator for
Administration and Resources Management and has the
primary functional responsibility for IRM..policy
development and overall management of the Agency's IRM
program. (Note: Appendix XI contains a detailed
description of EPA's IRM program, provided by OIRM
officials.)
• The Office of Regulatory Management and Evaluation
(ORME) , which reports directly to the Assistant
Administrator for Policy, Planning, and Evaluation,
evaluates and reviews all Agency information collection
requests and activities, evaluates Agency management and
uses of data for decision-making, and is piloting
increased use of Electronic Data Interchange (EDI) .
• NDPD, which reports to the Director, OARM-Research
Triangle Park, NC, is responsible within the authority
of OIRM for: (1) planning, oversight, management,
operation, and acquisition of all ADP resources in the
Agency; and (2) computing and telecommunications
services .
13
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
• The Information Resources Management Division (IRMD)-
Cincinnati reports to the Director, OARM-Cincinnati, OH,
and is responsible for operating the Agency's disaster
recovery facility for highly sensitive systems under the
technical direction of NDPD.
This fragmented organizational structure has been previously
criticized by program officials and in recent audit reports
and studies. For example, a .1992 DIG audit report14 stated
that
The current fragmented structure does not lend
itself to a centralized consistent approach to
accomplishing Agencywide IRM support. This has
resulted in duplication of efforts, failure to
address key IRM areas, and confusion from the
program offices as to who is providing IRM
leadership and direction ... In our view, a
direct chain of command between OIRM and NDPD is
needed in order to establish strong centralized IRM
leadership . . .
Additionally, a 1991 General Services Administration
report15 predicted that the organizational separation of IRM
activities in EPA could create problems in the future.
The lack of an adequate communication infrastructure was
consistently identified during our review as a"root cause for
many of the IRM problems. Agency employees do not always
know in what directions OIRM and NDPD are headed, and these
two components do not always solicit the input of users to
their decisions and directions. The perception of some
program officials is that NDPD and OIRM make unilateral
decisions without consulting their "customers" or assessing
the impacts. For example,
• Some focus group members stated that in fiscal 1993 NDPD
made unilateral decisions about its budget cuts
affecting service to program offices, which resulted in
considerable criticism. Headquarters OARM officials had
to spend a great deal of time listening to the reactions
of the program offices and, after the fact, learning
" "COMPUTER SYSTEMS INTEGRITY: EPA Must Fully Address Longstanding Information Resources Management Problems"
(DIG Report No. E1NMF1-15-0032-2100641, issued September 28, 1992).
13 "Information Resources Procurement and Management Review, Environmental Protection Agency" (issued 1991).
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
what their most important needs were. As a result, NDPD
restructured its service cutbacks. Nevertheless, some
focus group members stated that NDPD repeated this
process for fiscal 1994, making additional budget cuts
without consulting customers again.
Some focus group stated that the NDPD officials making
architectural decisions do not understand how computers
are used in the Agency or by the States/local
governments.
Many Agency officials also complained that they were not
consulted about the drastic cutbacks in IRM training
which will adversely impact their ability to implement
new technologies.
IRM functions are not treated consistently throughout the
Agency (i.e., organizational placement, and qualifications
and responsibilities of staff). For example, an April 1993
OIG survey found the following.
• The responsibility for IRM within major Headquarters
offices belongs to individual sub-offices in five cases,
a SIRMO in one case, a LAN administrator in one office,
an information management office in one case, and a
program operations office in another.
• The number of in-house ADP staff in Headquarters program
offices16 varies from no staff in two offices to 45
staff in another office. The number of in-house ADP
staff in the Regions varies from no staff in two regions
to 50 staff in another region.
• ADP functions are normally performed by "computer
specialists" (job series "334"), which is accepted
government-wide as the job series qualified for
performing these types of duties. However, based on
their job series, the qualifications of EPA's in-house
ADP staff vary greatly. For example, the staff in the
Headquarters program offices occupy 18 different job
series positions with over 42 percent in non-computer
" "Program offices" do not include OARM or OPPE.
15
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA.'s Information Systems Program
specialist positions. Regional ADP staff occupy 11
different job series positions, with over 37 percent in
non-computer specialist positions. While we realize
that some of these positions provide other types of IRM
support, our concern is that the job series positions
are inconsistent throughout the Agency and, in many
cases, are completely unrelated to IRM (e.g.,
Environmental Protection Specialists, Hydrologists,
Scientists, Contract Specialists, Clerks,..and
Secretaries).
.17
According to a recent GAO study
Neither the senior-level IRM executive nor the
organization can be effective without adequate
staff resources imbued with disciplined approaches
for both managing the current technology base and
carrying out strategic planning for new technology.
Providing these resources is difficult for agencies
in lean budget times. But this is a good place to
make an investment since the effective use of
information technology can leverage major benefits
in operational efficiency and service to the
public.
A September 1992 OIG report18 identified that OIRM: (1) had
directives that were incomplete and outdated; (2) had not
developed certain key IRM standards; and (3) had not always
distinguished between formal or mandatory policies,
standards, and procedures, and informal or optional guidance
when issuing IRM documents. In response to that report, EPA
officials inventoried all their IRM policies, standards,
procedures, and guidance, created a prioritized listing of
additional policies needed, and formally issued a number of
key IRM documents as temporary directives through the
Agency's directives system. They are currently developing a
number of policies, including revised systems life cycle
guidance and information security-related policies.
17 "Information Management and Technology Issues' (GAO Report No. GAO/OCG-93-5TR, issued December 1992).
" "COMPUTER SYSTEMS INTEGRITY: EPA Must Fully Address Longstanding Information Resources Management Problems"
(OIG Report No. E1NMF1-15-0032-2100641, issued September 28, 1992).
If
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
While EPA is making progress in developing and updating IRM
policy and guidance documents, IRM directives are not being
adequately enforced and Agency officials are not always aware
of these directives. Agency officials attribute this
primarily to insufficient top management involvement and
oversight over IRM and to the lack of adequate training. In
the decentralized environment within EPA, the IRM community
requires an effective policy structure, complete with
adequate enforcement measures, to direct Agency IRM efforts
in the pursuit of Agency goals.
RESOURCE PLANNING AMP PERFORMANCE
In response to prior OIG and GAO report recommendations, OIRM
created an IRM Planning Group (IRMPG) responsible for
implementing a corrective action plan. This group prepared a
proposed IRM strategic planning process which was discussed
with the top Agency managers at a meeting in January 1994.
The proposed planning process includes a structured
methodology and involves input from a wide range of internal
and external groups. A high level IRM strategic planning
document is scheduled to be completed by October 1994 . This
document will contain a high level mission statement, vision
statements, operating principles, and key implementation
strategies. The key implementation strategies will define
overall Agency steps to be taken to implement the vision
statements, with scope, timing, and cost implications
discussed. The vision section of the document is planned to
be substantially complete in March 1994. In addition, OARM
plans to pilot test a working capital fund in fiscal 1995 and
implement it beginning in the fiscal 1996 budget cycle. The
fund is intended to provide stable, multi-year funding for
selected Agency resources and initiatives, including IRM
initiatives. However, our review identified a number of
serious concerns which need to be addressed in this IRM
planning and budgeting process.
EPA Needs An IRM Strategic Plan Driven Bv An Aoencvwide
Business Plan
The need -for a comprehensive, integrated IRM strategic
planning process which is tied to the mission needs of the
Agency has-been a long- standing concern at EPA. Part of the
problem in the past has been that EPA has not analyzed its
"business" processes and developed an Agencywide Business, or
Strategic, Plan. Prior to completing an IRM Strategic Plan,
EPA needs to develop an Agencywide Business Plan which aligns
17
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
resources, skills, and strategies with mission objectives.
Where the strategies include information technology, they
should be reflected in the Business Plan. Without such a
Business Plan, the effectiveness and efficiency of
information technology cannot be maximized. The subsequent,
more detailed IRM Strategic Plan should then be tied to and
support this Business Plan.
According to a GAO government-wide study19,
Successful modernization is based on a strategic
analysis of what the agency needs to accomplish,
where it is now, and where it must be at future
points in order to meet its goals. While most
agencies have mission statements that define
general goals, many agency leaders do not follow
through on the next step: analyzing current
business processes to learn where they are breaking
down and how they should be restructured to achieve
fundamental, long-term improvements in business
practices and service to the public. Such analysis
is exactly what many successful private sector
organizations are doing . . . When an agency does
not first analyze its business processes and
determine where improvements should be focused, it
short-circuits technology's potential to
dramatically increase productivity and reduce
costs.
According to our discussions with officials in OPPE and in
OIRM, EPA plans to complete an Agency Business Plan by March
1994, and a draft of a portion (i.e., a high level IRM vision
statement for the Agency) of the IRM Strategic Plan at the
same time. These officials also told us that they are
coordinating with each other to ensure that both plans are
linked.
The Agrencv Has Not Integrated The Planning And Budgeting
Processes
EPA has not established an integrated strategic IRM planning
and budgeting process which is updated on an annual basis to
help acquire, manage, and use its computer resources. As a
result, the Agency and its components lack a sufficient
"Information Management and Technology Issues" (GAO Report No. GAO/OCG-93-STR, issued December 1992).
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'a Information Systems Program
mechanism to make information system funding decisions, thus
subjecting system development projects to funding shortages
and to incremental, independent design and development.
A 1992 OIG report20 criticized the Agency for not
integrating these two processes. In addition, a recent
Office of Management and Budget (OMB) report21 criticized
the Agency for not using strategic plans to drive the budget
process. According to that report,
Several [EPA] managers thought that planned
integration efforts of financial and related
systems .could not be supported by current funding
levels. However, there appears to be no intention
to request special funding for future efforts that
may be under-supported. This also relates to the
findings in strategic planning. An effective
strategic plan with resources identified, should
drive the budget process and result in the
proactive efforts to secure necessary resources,
where warranted.
Agency officials agree that this linkage of IRM planning and
budgeting is an important issue. IRMPG is performing a study
to determine the methodology for integrating the IRM planning
and budgeting processes.
One of the more significant barriers to the successful
development and implementation of major information systems
is unstable funding from one year to the next, due to the
lack of a mechanism to ensure long-term financial support.
The major reason for this is that the current 1-year budget
cycle is not consistent with multi-year technology
development activities. For example, the Integrated Contract
Management System and IFMS are long-term system development
efforts which are highly dependent upon multi-year funding.
In addition, system development projects are not line budget
items--funding is hidden in program budgets. When program
budgets get cut, the system development projects usually
suffer.
20 'Computer Systems Integrity: EPA Must Fully Address Longstanding Information Resources Management Problems" (OIG Report
No. E1NMFM 5-0032-2100641, issued September 28, 1992).
21 'Report on the Financial Systems Planning Process: The Environmental Protection Agency' (issued September 20, 1993).
19
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
Another benefit of long-term budgeting and accounting for
information systems would be to establish accountability for
managers in the development, implementation, and maintenance
of major information systems. It would provide a valuable
tool for decision-making and force managers to look at the
entire life cycle (i.e., initiation, design, development,
implementation, operations, maintenance, and retirement) of a
system. If top management was aware of the life cycle costs
when making decisions for initiating long-term system
development projects, different decisions might be made. For
example, for IFMS, the initial estimate was almost $8
million, but this was only for the design, development, and
implementation of the system. Our current IFMS audit has
estimated that the costs of the entire life cycle of IFMS
over a 12-year period, which include maintenance and
operations costs (such as timesharing and telecommunication
costs) not included in the original estimate, are actually
over $200 million.
A more balanced emphasis between long-term and short-term
results is needed. At present, the emergency of the moment
is frequently the driving factor in much of EPA's operations.
Participants in one of the focus groups, commenting on the
rapid coming and going of "major" initiatives, jokingly
referred to them as the "initiative du jour." While all
organizations have crises that must be addressed, it is the
perception that this occurs excessively at EPA, and has
helped create an enormous short-term focus very detrimental
to long-range planning, especially for information systems.
Continually changing Congressional information needs, new and
changing environmental regulations affecting changes in
information systems, and poor communications with
Congressional staff generally keep EPA in a reactive mode.
For example, EPA reports to at least 110 Congressional
committees and subcommittees; this level of oversight is
second only to the Department of Defense. In addition, EPA
is currently tracking 576 bills introduced in Congress that
have environmental aspects. In both of these areas,
oversight and pending legislation, EPA is frequently asked
for quick turnaround information and immediate answers to
20
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
complex problems. According to the GAO study mentioned
above22,
Pressure for quick solutions to complex problems
works against strategic planning--the heart of
effective IRM. The political process pushes both
the Congress and executive agencies to focus
strongly on achieving near-term results at the
expense of the long term.
The frequent issuance of new regulations, and regular
revisions of existing ones, adversely impact .Agency
information systems. For example, the Agency's Permit
Compliance System (PCS) is increasingly cumbersome to use
because it requires detailed understanding of over 2,500
parameters for issuing permits; many of these parameters have
been introduced due to revised regulations. Another example
is the Agency's Toxic Release Inventory System (TRIS), which
cost only $300,000 to develop, but now costs $1.2 million
each year for maintenance due to frequent regulatory changes.
EPA's IRM Strategic Plan will also be subject to changing
programmatic needs. For example, EPA's information systems
reflect its media-specific legislative and regulatory
framework. Yet during the tenure of the prior Administrator,
EPA began to put increased emphasis on a cross-media approach
to pollution problems; the new Administrator has continued
this approach. But according to a 1992 GAO report23,
EPA cannot readily bring together and correlate
data from its various programs--such as air, water,
hazardous waste, and pesticides--in order to assess
environmental risks comprehensively or identify and
target the most important enforcement priorities.
This deficiency demonstrates the need to better integrate
program offices' data and systems. Therefore, the IRM
Strategic Plan must be flexible enough to deal with these
changing programmatic needs. As. long-term needs change, the
changes need to be reflected in the Plan, and annually
0 "Information Management and Technology Issues' (GAO Report No. GAO/OCG-93-5TR, issued December 1992).
" "EPA Needs a Better Strategy to Manage Its Cross-Media Information" (GAO Report No. GAO/IMTEC-92-14, issued April 2,
1992).
21
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA'3 Information Systems Program
reviewing and updating the Plan would facilitate this
process.
EPA Has No Performance Measu**«*"*»"<: Criteria For The IRM
Program
EPA does not have adequate mechanisms in place to measure the
overall performance of the IRM program. One critical aspect
of performance measurement related to information-systems
pertains to the information/data they contain. The Agency
does not currently build into its information systems
sufficient measures of environmental successes,
accomplishments, and economic benefits. Yet this is exactly
the kind of information that Congress and the public want.
In 1993 GAO testified to Congress24 that
EPA lacks not only performance measures but also
the information necessary to establish these
measures and to assess the effectiveness of its
programs in improving or protecting environmental
quality. Although environmental programs are meant
to clean up or prevent unacceptable levels of
pollution, EPA has not had the information with
which to judge the success of its programs.
EPA's Strategic Targeted Activities for Results System
(STARS) is the Agency's official accomplishments reporting
system. However, this system accumulates activity or "bean
counting" measures (e.g., compliance rates, permits issued,
inspections completed, penalties collected, etc.) rather than
trends/outcomes (e.g., how much have we improved the quality
of water or reduced air pollution?). An OPPE official told
us that STARS II is currently being planned and will get
closer to identifying outcome-related information. The
system will link resources to accomplishments and will
represent all program offices. Information systems can place
this information/data at a user's fingertips. However, this
system is still in the conceptual stage.
Another aspect of program performance involves accounting for
expenditures and the accomplishments resulting from them. In
the first place, EPA cannot adequately account for IRM
expenditures ,on a system by system .basis. In our current
24 "Creation Of A Department of Environmental Protection", GAO Testimony before the Subcommittee on Legislation and National
Security and the Subcommittee on Environment, Energy, and Natural Resources, Committee on Government Operations, House of
Representative on May 6, 1993.
22
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
audit of EPA's software maintenance activities, preliminary
information is showing that EPA program officials and
information system managers do not consider, by system, the
life cycle costs of major information systems which support
the mission of the Agency. When asked for cost information,
most system managers were only able to provide information on
contract dollars spent by their program office in support of
the system. For 10 major information systems reviewed in
that audit, preliminary information shows that EPA did not
correctly report almost $29 million in fiscal 1993 system
costs to OMB. Instead of reporting these costs by individual
system, EPA reported them in the aggregate.
Nor can EPA measure the success or failure of some critical
information system activities. For example, for the 10
systems mentioned above, which account for approximately $18
million of reported annual EPA IRM maintenance expenditures,
five Assistant Administrators reported that their offices do
not measure the success or failure of software maintenance.
The other four Assistant Administrators reported that they
have success factors for software maintenance. However, our
preliminary evaluation of the factors is that the measures of
success are not quantifiable.
The importance of performance measures is gaining long-
deserved recognition. For example, the "Government
Performance and Results Act of 1993" requires that over the
next few years EPA set program goals, measure program
performance against those goals, and report publicly on their
progress. Also, the report of Vice President Gore's National
Performance Review stated that
We must hold every organization and individual
accountable for clearly understood, feasible
outcomes. Accountability for results will replace
"command and control" as the way we manage
government . . . Agencies will start measuring and
reporting on their past goals and performance as
part of their 1996 budget requests.
Finally, the Administrator's March 10, 1993, memorandum to
all employees stated that
To address resource management problems I am taking
three courses of action: (1) construction of a
rigorous system of accountability; (2) establish-
ment of clear standards of discipline with serious
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
consequences for failure to meet the standards; and
(3) development of an overall management scheme
based on clear goals, work plans and milestones for
measuring success.
Without performance measures, EPA does not have an adequate
mechanism for providing credible basic management information
about where Agency funds are being spent on system
development activities and the resulting accomplishments.
EPA has made some progress in recent years in the information
systems development area. For example, the Agency has
implemented the Systems Development Center, which is a
contractor-run operation using formal, disciplined
development methods to improve EPA systems25. As previously
discussed, in response to a recent audit report, EPA
officials have improved many of their IRM policies,
standards, procedures, and guidance, and are working on
others, including their systems life cycle policies.
Although we believe the Agency is generally proceeding in the
right direction, we have identified a number of barriers that
EPA must address when developing and implementing these
policies.
Information Svp+-«»™g &re Designed Without Up-Front
Agreement On Necessary Components
A critical factor in the long-term success of an information
system is the careful definition of all users' and customers'
needs early in its design. This involves understanding who
all the users and customers will be, and communicating
effectively with them to identify what they will need from
the system. These needs must then be addressed by the system
builders. Otherwise, a number of adverse effects can occur,
such as the system not being used by many of its intended
beneficiaries, users who are responsible for entering data
into the system not being motivated to ensure data quality,
and significant criticisms being leveled at the system by
users or customers who were not consulted during the design
process.
" The Agency has recognized the value of the Center and the process, and intends to continue them after expiration of the current
contracts.
24
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
In both our Headquarters and Regional focus groups and
interviews, managers and staff frequently stated that EPA's
systems developers do not always work effectively with users
and customers to design useful systems. These users and
customers include EPA program officials, Congress, and the
States.
EPA Program Officials
Overall, systems developers were criticized for not really
understanding how EPA's programs work and what their needs
are. Some focus group members attributed this to EPA's heavy
use of outside contractors for system development work.
Focus group members were also concerned that Agencywide (or
"national") systems are usually designed to meet only EPA
Headquarters needs, so they frequently do not meet Regional
needs. This is especially burdensome to the Regions when
they are required to devote the resources to input much, or
all, of the data to these systems, and yet cannot'effectively
use them to help manage their programs. This impairs the
Regions' motivation to ensure the quality of the data in
these systems, since the Regions do not have a sense of
"ownership" of the data. Some Regional focus group members
added that these systems need to be designed to do more than
just generate answers to questions for Headquarters
personnel; they also need to be useful tools for Regional
managers and staff.
Other specific criticisms of many of the national systems
also appear to be due to inadequate consideration of users'
and customers' needs. For example, members of one Regional
focus group discussed what they termed the national systems'
"low levels of utility and friendliness to Regional users."
A good example of this was given by a SIRMO, who said that
they could not do something as simple as go into IFMS and
find out what their available travel balance was. IFMS
contains lots of data, but it is not available and accessible
in a user-friendly fashion. So the typical EPA manager must
ask an intermediary staff person to generate a report to find
the basic data needed. Some of the reasons Agency officials
gave for this include the following.
• Better identification is needed of "who the system must
be friendly/useful for."
25
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA.1 a Information Systems Program
• The universe of potential system users has expanded over
time to include everyone with a personal computer on
their desk.
• It costs more money to make systems really user-
friendly.
• Program staff and systems developers do not work
together on what is needed and what use is to be made of
the data input to the system.
• Headquarters, or Agencywide, needs are different from
individual Regional needs.
On the other hand, this same SIRMO cited TRIS as a success
story, in which the developers gave more consideration to
users' needs and user-friendliness. Another example is the
development of the Public Water Supply System.
Some Regional focus group members also expressed concerns
about the complexity of the national systems, saying they
were overly complicated and too difficult for managers and
staff to use. They stated that the Regions frequently have
to develop their own systems because the national systems
cannot produce the reports the Regions need, changes to the
systems are difficult and take too long due to the process of
obtaining nationwide consensus, and, as previously mentioned,
the systems developers often have insufficient program
knowledge.
Congress
Many focus group participants believed that EPA does not do a
good enough job of working with Congress to define their
needs and anticipate their questions. Clearly, this
parallels the concerns expressed about understanding the
needs of the program offices. Focus group members felt this
often led to situations in which Congress asked good, •
straightforward questions about an environmental program's
progress or accomplishments, yet EPA's systems simply could
not answer them.
The States
This criticism is valid for the States, as well. Focus group
members, especially in the Regions, stated that the States
were too often not involved in the design of EPA's systems.
2-6
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
One SIRMO stated that they frequently hear from the States,
local governments, and even the public, that EPA data is not
easy to access arid that, when accessed, does not serve their
needs. The SIRMO attributed this to the fact that users and
customers like these groups were not involved in the design
of the particular systems. This can be especially
troublesome when the States are expected to input data to
certain systems; as with the EPA Regions, when they feel a
lack of ownership, yet must devote resources to entering
data, the motivation to ensure data quality is adversely
affected.
Overall, information needs analyses and cost/benefit studies
are not being adequately conducted. As a result, systems are
being delivered to users that do not meet their needs, and no
mechanisms are in place to adequately identify costs and
benefits for managers to make informed decisions about
information systems. For example, a recent GAO report2* on
the Office of Prevention, Pesticides, and Toxic Substances
(OPPTS) stated that
OPPTS' officewide systems do not meet users' needs
for screening large numbers of existing chemicals
and setting review priorities. Instead, these
systems largely serve either as an index to
available chemical studies or to track the progress
of chemicals through OPPTS' review process. These
systems do not meet users' needs because OPPTS
never (1) assessed and validated users' needs for
chemical data--such as the type of data needed or
how quickly such data should be retrieved, or
(2) developed information systems to satisfy these
data requirements. Without such analysis of user
needs, OPPTS scientists and contractors must follow
cumbersome and time-consuming manual steps when
screening large numbers of chemicals.
It was clear in all our focus groups and discussions that
developers of national systems need to better recognize the
roles and needs of the Regions, Congress, and the States in
implementing and maintaining information systems.
* "EPA TOXIC SUBSTANCES PROGRAM: Long-standing Information Planning Problems Must Be Addressed" (GAO Report No.
GAO/AIMD-94-25, issued November 1993).
27
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
On the other hand, it was also clear that even when needs are
fully defined during the systems design process, completely
new questions or needs can be raised years later which the
systems were legitimately not designed to address. This,
too, has led to criticisms of EPA's systems, but these
criticisms were generally viewed as unfair. For example,
members of one Regional focus group cited the Resource
Conservation and Recovery Information System (RCRIS) as a
system on which the developers spent a great deal of money to
thoroughly identify all likely needs during its design. They
believed it was an excellent example of a collaborative
effort between EPA, the States, and other users to define
requirements. Nevertheless, with the passage of time, new
requirements arose which have been difficult to implement,
resulting in complaints that the system does not meet users'
needs.
The Federal government and the private sector generally use
standard, internally consistent approaches to developing and
maintaining information systems. A critical part of the
standard system development life cycle (SDLC) process is an
adequate requirements analysis, discussed in the preceding
section. The SDLC process also addresses other key
components of systems development and maintenance, such as
risk analyses, system decision papers, test plans, user
manuals, and operations and maintenance manuals. In fact, a
standard approach to the entire life of information systems
is so important that OMB Circular A-130 specifically requires
compliance with Federal SDLC standards, unless an agency can
show it is cost-beneficial to use an alternative approach.
However, a recent OIG survey conducted as part of our audit
of EPA's software maintenance practices showed that the vast
majority of Headquarters program and Regional offices do not
28
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
use a standard approach to manage software development and
maintenance. The responses to the survey indicated:
• 88 percent of Headquarters program offices and 60
percent of Regional offices do not utilize a standard
SDLC methodology27 when designing, developing, and
modifying information systems.
• 77 percent of Headquarters program offices and 70
percent of Regional offices do not utilize a mandatory
SDLC approach28 in managing information systems.
The primary reason for this appears to be that the majority
of EPA's system development projects are contracted out, and
contractors are allowed to use their own system development
methodologies which vary widely and do not necessarily meet
minimum Federal requirements. In addition, contracting and
project officers responsible for monitoring these contractors
do not always have the knowledge and ability to effectively
determine whether the contractors are meeting minimum Federal
standards.
Another important reason is that EPA's IRM policy, standards,
and guidance documents relating to the SDLC are not being •
adequately enforced, and Agency officials are not always
aware of these directives. As previously mentioned, focus
group and interview participants attributed this primarily to
insufficient top management involvement and oversight over
IRM and to the lack of adequate training.
Some of the steps in the standard SDLC process are perceived
to add time to the development of a system. Consequently,
some organizations tend to perform them only cursorily,
shortcut them, or avoid them entirely. This can lead to
system problems which must then be corrected later in the
process. Participants in one focus group summed it up by
stating that "management often will not let us (i.e., give us
the time to) do it right, but there is always time to do it
again." This sometimes hasty approach to systems development
can also lead to duplicate systems. An example of this was
given by a Headquarters focus group participant, who said
" Includes feasibility studies;cost/benefit analyses; requirements and conversion studies; decision papers; accepted programming
techniques; test plans; program, system, and acceptance testing; etc.
a A management approach which continuously manages and evaluates an information system over the entire life cycle (i.e., design,
development, implementation, operations, maintenance, and extinction).
29
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA*a Information Systems Program
that a Congressional mandate to report on contaminant
sediments by a certain date led to the creation of an
"emergency data base," despite the fact that a system was
already in development which could have provided the data but
would have taken longer than the mandated date to complete.
Information systems need to be periodically evaluated as part
of the SDLC process to assess whether they are obsolete. EPA
does not, however, consistently do this. For example, in our
audit of software maintenance activities, we found that 4 of
the 10 systems we reviewed are over 7 years old, which is one
of the Federal criteria29 for making a system a candidate
for redesign. Although EPA's IRM Policy Manual requires
program officials to periodically review all software
resources to identify obsolete software and evaluate what to
do about it, we found no evidence that EPA had assessed the
obsolescence of these four systems.
Obsolescence can make software maintenance more difficult and
costly. For example, CERCLIS is almost seven years old and
is maintained on an archaic data base management system,
System 2000. We conducted an informal survey of five
technical recruiting and consulting firms to determine the
availability of programmers with System 2000 skills and
industry demand for such skills. None of the firms has had a
request for such skills in the last five years. These firms
characterized System 2000 as archaic and obsolete, and said
it is difficult to find programmers with current System 2000
experience. As a result, maintaining CERCLIS is very costly.
For example, fiscal 1993 maintenance costs for CERCLIS were
estimated at $3.9 million.
DATA MANAGEMENT
EPA has begun a number of initiatives in recent years to help
its information systems better address issues such as
environmental monitoring and environmental risk assessment.
These initiatives include the creation of an Information
Management/Data Administration (IM/DA) group in May 1992.
The IM/DA group is beginning to develop an IM/DA discipline
and infrastructure at EPA. This will serve as the backbone
for coordination of integrated development and/or use of
shared data and, information systerns.-aligned.with EPA goals
29 Federal Information Processing Standards Publication 106 defines programming code over seven years old as one of the characteristics
which makes systems candidates for redesign.
30
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
and strategies. As such, it should enable integration of
data and information systems across environmental programs.
Also, EPA has initiated projects to promote data sharing.
For example, the Agency developed and enhanced the Facility
Index System (FINDS) , which provides a central index to the
facilities tracked by various EPA databases--RCRIS, CERCLIS
PCS, THIS, and others. In 1990, EPA initiated a project
known as Gateway/Envirofacts that is expected to apply GIS
technology.30 The Gateway project was initiated primarily
to research technical aspects of cross-media data
integration, and is still a developmental system. A new
database, Envirofacts, was developed under the Gateway
project and contains excerpts of individual program systems
databases--PCS, TRIS, CERCLIS, and FINDS. EPA plans to use
GIS mapping capabilities with the Gateway/Envirofacts user
interface to display information geographically. Another
project, the Integrated Data for Enforcement Analysis .(IDEA),
was initiated in 1990 to integrate data across programs to do
analysis by industry, by corporation, and by facility31.
These efforts are producing valuable integration tools.
However, the Agency still needs to address certain barriers
to efficiently share mutually beneficial information across
program boundaries, eliminate data duplication, and allow for
more comprehensive, cross-media assessments of environmental
and health risks and solutions.
The Agency Has Neither A Standard, Defined Information
Function To Facilitate Data Sharing
Data sharing is crucial to the Administrator's four top
priorities: ecosystem protection; pollution prevention;
environmental justice/equity; and, less directly, partnership
building. These priorities cut across all environmental
media, but the link between data sharing and these priorities
has not been widely recognized.
To successfully share or integrate data on a large scale, a
standard, defined "information architecture," along with
, * A GB is a computer system that captures, stores, displays, analyzes, and models natural and artificial environments using data
referenced to locations on the earth's surface.
31 Certafn aspects of IDEA (i.e., documentation and testing of the system software, and training users) have been reported to the
President as material weaknesses for the last two years. However, this should not detract from the intent of the system.
31
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
organization-wide data standards, are necessary. An
information architecture models the data and processes of the
organization, and presents a stable basis for developing the
processes and information used by the organization to
accomplish its mission. The data architecture, a major
component of an information architecture, is a key, but
expensive, ingredient in determining the data and application
software needed to manage the organization's programs. Part
of developing the data architecture involves establishing
data standards, which means setting out official,
organization-wide definitions of what terms mean and how they
are to be entered into information systems. A final key
factor is having a strong, centralized Data Administration
function to oversee the development and implementation of the
data architecture and data standards.
However, EPA has not established such an Agencywide
information architecture, sufficient data standards -, or Data
Administration function. Although the formation of the IM/DA
group is a step in the right direction, this OIRM group has
no representation from EPA program offices. Furthermore,
this group has not been established as a permanent
organization and does not have adequate funding, staffing
(five staff members), and authority needed to centralize
control over the Agency's decentralized systems development
activities.
As a result, EPA systems continue to be independently
designed and managed and lack both EPA and government-wide
data standards (e.g., standard definitions, common user
interfaces, core data sets, and analytical tools). A recent
GAO report32 stated
EPA's lack of sound data management practices has
resulted in difficulties in accessing and sharing
data. Supporting EPA's new strategies calling for
cross-media assessments of environmental and health
problems requires data management practices that
will allow users to easily access data from
multiple existing systems. This will require the
development of standard definitions, common user
interfaces, core data sets, and analytical
tools . . .
32 "EPA's Plans to Improve Longstanding Information Resources Management Problems" (GAO Report No. GAO/AIMD-93-8, issued
September 16, 1993).
32
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
Despite the activities we have outlined above, focus group
and interview participants generally believed that limited
national initiatives exist to support data sharing and data
management. As a result, some Regions are embarking on their
own integration initiatives. For example, members of one
focus group told us that two States in their Region are
moving away from a single-medium approach to pollution
prevention, and one of these States is integrating its
information regarding air, water, and permit activities for
its top 400 facilities.
Focus group and interview participants identified a number of
important reasons why data sharing has not yet been pervasive
at EPA, and why these critical elements of successful data
sharing are not present.
Resource Constraints
Lack of resources has contributed heavily to EPA's
inattention to building a good information architecture with
shared/integrated data. In fact, participants in focus
groups and interviews commented that budget items for
implementing data standards are the first ones cut when IRM
cutbacks occur, severely harming data integration efforts.
One example given of harmful budget cuts was the State/EPA
Data Management Program, which some officials called
excellent. They said that State and EPA people had worked
together on small multi-media types of projects, and the
participants were very enthusiastic. The project apparently
facilitated very good State-EPA communications. However, it
was suspended due to budget cutbacks in fiscal 1993.
Differing Views of Data
The other major cause, discussed at length earlier in this
chapter, is that the Agency culture does not value data. Its
strategic importance to the Agency is minimized, so large-
scale efforts to maximize its usefulness have not been deemed
warranted.
Also, some Agency components view the current management of
data as working against data standards and, therefore, data
sharing. For example, members of one focus group described
how some definitions of programmatic outputs continually
change. OIG audits have seen this first-hand, particularly
in the Superfund program, where official definitions of some
programmatic accomplishments, such as the completion of a
33
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
removal action or a preliminary assessment, can change each
year.
Superfund officials in one focus group further stated that
the premise that all Superfund sites have common traits is a
false assumption. Instead, they said that each site has
unique characteristics that make nationwide definitions, or
standardization, difficult.
In addition, some program officials view their data very
parochially. Some are only interested in their own
information needs, and so are reluctant to spend their
resources on behalf of secondary users or customers.
Finally, participants in one focus group also mentioned that
even the States want flexibility in how some terms are
defined. This is due, at least in part, to the fact that the
States may already have their own definitions of data and do
not want to change them just to satisfy EPA's individual,
compartmentalized systems. This creates inconsistencies and
makes data aggregation very difficult. The large number of
users (e.g., EPA officials, Congress, the States, the public,
industry, even foreign governments, groups and individuals,
etc.) for many of EPA's systems and/or data greatly
complicates EPA's ability to establish and enforce data
standards.
Media-based Approach
The media-based organizational structure of the Agency does
not encourage information system designs which use data
integration to address risk-based environmental problems.
Furthermore, systems tend to lack common data elements (e.g.,
facility identifier numbers) which would facilitate use
across organizational lines. Instead, systems are developed
for .single media concerns.
Focus group participants mentioned a number of causes for
this, such as the needs from media to media are different,
and the separate media-based programs do not encourage cross-
media communications. However, the fundamental cause is that
these systems are based on Federal statutes that are
themselves compartmentalized with distinct budget
authorizations, allocations, and oversight, and so drive the
Agency in that direction.
34
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
On the other hand, one group noted that while the statutes
are, indeed, partly to blame, EPA also must share the blame.
EPA has not been very aggressive in pursuing data
integration, yet there is nothing in these statutes which
prohibits this.
Program Offices' Desire For Contro?
EPA managers and staff told us that program offices are
reluctant to relinquish resources and the control of those
resources to another office. This creates risks (i.e., the
potential loss of those resources) . Other risks are also
involved, such as the technical risks to a program office of
having its systems development efforts combined with those of
another office.
At the heart of this is the issue of trust. Participants in
one interview group told us that even when data integration
efforts do take place, such as FINDS, they are inadequately
supported by the Agency, and the program offices become
reluctant to participate.
For example, the Office of Enforcement (OE) is aware of the
Agency's data integration activities and met with IM/DA over
a year ago. But because of concerns about the speed of the
data integration group's progress and about the size and
capability of the group, OE has taken the initiative to begin
development of its own data dictionary and data standards.
Yet, some OE systems (e.g., IDEA and the Enforcement Docket
System) are national systems that depend on information from
other Agency systems, and would benefit greatly from an
Agencywide data dictionary and common data standards.
Without an Agencywide information architecture and data
standards, the ability of Agency components to access and
share information needed to accomplish EPA's mission will
continue to be inhibited. Further, it is doubtful that
Agencywide data sharing, which will require the enforcement
of common data standards throughout EPA, will ever be
realized unless the enforcement becomes centralized under one
group. A strong data administration office is critical to
the success of the Agencywide data integration goals. The
director of this office (i.e., the Data Administrator) needs
to be a strong leader with knowledge, experience, and
authority, and should report, preferably, directly to the
Agency's CIO.
35
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
EPA is an information/data-intensive agency, and accurate,
complete, and timely data are critical. Agency managers must
use an enormous amount of data for both "business" (i.e.,
financial, contracting, etc.) and scientific decision-making.
Other interested parties, such as Congress, other Federal
agencies, and the States, also make decisions based on EPA's
data. Much of this data comes from EPA's information.
systems. However, problems have been previously reported
with the quality of both the data in these information
systems, and the processes used to build them.
It should be noted that some of the participants in our
review felt that the data in EPA systems were sometimes
unfairly criticized. They pointed out that EPA systems have
generally been designed for a specific purpose and usually do
not support secondary users (e.g., Congress and the general
public) adequately. When secondary users query EPA systems,
the desired information is very seldom available. This
creates the perception that the data is bad, even when the
data may be fine for the primary users.
Regardless of whether the data truly is good or bad, we
learned that EPA employees and Congress have, over time,
stopped asking many important questions because EPA simply
does not have the data to answer them or cannot get the
needed information out of its systems. As a result, we were
told that making decisions based on limited amounts of
information has become a general course of business. For
example, some focus group members stated that
• The lack of an interface between CERCLIS and IFMS has
made it difficult to match cost data in IFMS with
obligations and planning data in Superfund. As a
result, EPA may be missing opportunities to recover
Federal money spent in the Superfund program.
• PCS provides information on wastewater permit limits
versus discharges to assess compliance. It does not
bring in wetlands, population impacts, ecosystems, and
the proximity of discharges to well supplies.
Therefore, permit and enforcement decisions may be based
on limited available information.
36-
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
• The Storage and Retrieval of Water Quality System
cannot show how much contamination is coming into a body
of water.
In addition to not having some information available, the
data accuracy of EPA's current information systems has been
criticized. For example, a recent GAO report" stated that
After more than 3 years of effort and systems
investments costing more than $14 million, EPA
cannot easily assemble accurate, reliable, and
complete information on chemicals in the
reregistration process. This has compounded the
already difficult task facing the agency in meeting
pesticide reregistration deadlines imposed by the
Congress . . . EPA's information management
problems are traceable to inadequate systems
planning and poor data management . . . the
consistency, accuracy, and completeness of
information within the new systems is also
jeopardized because EPA has not implemented data
management procedures to ensure data consistency
and quality.
Another example was presented in a 1993 DIG report34, which
questioned 30 percent of a sample of 650 Superfund
accomplishments claimed in CERCLIS. The entire gamut of
cleanup achievements was involved, in each of the four
Regions audited. The report attributed the problem to:
(1) official definitions of accomplishments were not met;
(2) source documents could not be located to support the
claimed accomplishments; (3) the accomplishments were
duplicatively claimed; (4) the accomplishments were claimed
in the wrong fiscal year; and (5) there were data entry
errors.
Finally, participants in our focus groups and interviews
cited examples of data quality problems in other systems,
such as:
» -PESTICIDES: Information Systems Improvements Essential For EPA's Reregistration Efforts" (GAO Report No. GAO/IMTEC-93-
5, issued November 23, 1992).
« 'Consolidated Report Regarding Fiscal 1992 CERCLIS Data' (DIG Audit Report No. E1SFF3-11-0016-3100392, issued September
29, 1993).
37
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
• GIS showed the locations of certain facilities in the
middle of the Atlantic Ocean and at the North Pole.
• 25 FINDS numbers were assigned to the same facility
under the air program.
These officials attributed the data inaccuracies to a number
of causes.
• Data definitions cause inaccuracies because of frequent
changes and misinterpretation.
• The lack of consistent data dictionaries (e.g., multiple
data dictionaries exist for common data elements with
different data definitions) contribute to inaccuracies.
• As discussed earlier, for some national systems little
or no motivation exists to ensure data quality. No
clear ownership of data exists--data is input by non-
stakeholders (i.e., Regions and States).
• Data quality is less accurate for "environmental" data
and is subject to many qualifiers (season, age, sex,
species, etc.) which must be interpreted.. Environmental
data is expensive to collect and limited in amount,
geography, year, etc.
• Some focus group participants stated that~no "data audit
process" exists in the EPA program offices to ensure
data elements and definitions within individual systems
are consistent and adhered to.
• The States sometimes input questionable data to the
systems due to unclear input instructions and lack of
resources. This is complicated by EPA's inability to
force the States to provide good quality data. One
example of the last point concerned the Aerometric
Information Retrieval System (AIRS), in which we were
told that one major State refused to input zip codes
into the system, and EPA was powerless to force them to
do so.
Agency officials involved in data integration projects
believe that the need for data integration will become more
apparent and the data quality of current and future infor-
mation systems will improve dramatically as EPA increases
public access to more of its information resources. Some
38
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
interview participants believed EPA should facilitate this
access by embracing the "information highway" concept and
making available to the public all information that is of
interest to the public and is not officially declared to be
sensitive. These officials believed the Agency will eventu-
ally be forced in this direction. For example, the Vice-
President's National Performance Review strongly encourages
agencies to provide information to the customer (i.e.,
general public) on what they have paid for. Additionally,
the proposed House bill on EPA cabinet-level elevation (H.R.
3425 sponsored by Congressman Conyers) specifically calls for
enhancing and promoting public access to EPA information.
39
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
CHAPTER 3
RECOMMENDATIONS
Our review identified problems in many areas of EPA's IRM
program. These problems exist for many reasons, and involve
all facets of the Agency's operation. Consequently,
recommendations have been developed which will affect all
aspects of EPA's IRM program, and which take the Agency's
streamlining initiatives into consideration.
Many of these recommendations address root causes which cut
across the problem categories in Chapter 2. So by
implementing 'certain recommendations, the Agency can impact
more than one category. However, the recommendations are
presented consistent with the categories' order of
presentation in Chapter 2. The recommendations are not in
any priority order of importance, and many should be
implemented concurrently.
The first group of recommendations addresses weaknesses in
IRM management and necessary changes to the Agency's
organizational structure. Recommended improvements focus on
establishing a separate CIO function, strengthening the SIRMO
position and IRM organizations in the program and Regional
offices, and strengthening the Executive Steering Committee
for IRM.
The second group of recommendations addresses weaknesses in
the way in which the Agency plans for and measures the uses
of information resources. Recommendations address
development of an IRM Strategic Plan, linking the IRM
Strategic Plan with the Agency Business Plan, integration of
the planning and budget processes, and the establishment of
performance measurement criteria for the IRM program.
The third group of recommendations addresses specific
concerns related to the development of information systems.
Key areas of recommendations include development of policies
and procedures to strengthen EPA's management framework for
developing information systems and for increasing user
involvement during development activities, and establishment
of training.mechanisms to.close.the gap in.expertise between
those who are knowledgeable about EPA programs and those who
are knowledgeable about IRM:
40
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
The final group of recommendations addresses the management
of information/data. Recommended improvements focus on
developing an Agencywide information/data architecture,
establishing a centralized data administration function, and
increasing public access to EPA's non-sensitive
information/data.
The DIG recommends that the Administrator take the following
actions to correct the most significant problems in EPA's IRM
program, and to facilitate the program's long-term success.
IRM Management and Organizational Structure
1. Establish a separate senior level position, the CIO, at
the Assistant Administrator level. Consolidate all IRM
. functions under this position and do not encumber it
with any other responsibilities outside of IRM. The
CIO's responsibilities should include, but not be
limited to, the following: (a) establishing what IRM
capabilities are necessary to support programs for
accomplishing the mission of the Agency, including IRM
policies, architectures, and standards; (b) coordinating
with EPA's CFO to help ensure that financial and other
information systems used in preparing EPA's financial
statements are effectively designed, developed, and
implemented; (c) developing policies, standards, and
mechanisms to communicate information management goals,
priorities, and practices effectively throughout the
Agency; (d) working to enhance top management's
knowledge and understanding of IRM, particularly that it
is a core Agency function and that data is a strategic
EPA resource; and (e) designing and implementing a
process by which the Agency initiates, approves, and
evaluates major automated information systems at key
milestones.
2. Establish clear lines of authority under the CIO,
especially between OIRM and NDPD-
3 Approve and support the proposed new charter for the
Executive Steering Committee for IRM and require the
active participation of the permanent members of the
Committee.
4 Direct the CIO to conduct a study of the SIRMO function
' to evaluate the success of its current operation in
terms of the requirements and responsibilities of the
41
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
function, and the differences in responsibilities and
organizational placement between the various
Headquarters program offices and Regional offices. The
study should articulate what is expected of and needed
from the function by establishing a baseline of
requirements, responsibilities, qualifications, and
organizational placement of the function. To make the
SIRMO function truly effective, the study should then
assess the time required to implement the functional
responsibilities and recommend any additional staff
required to support the function.
5. Direct the CIO to develop, in coordination with the
Office of Human Resources Management and the Agency
streamlining efforts, a generic position description
outlining the duties and responsibilities of program and
Regional office SIRMOs based upon the study. The
position description should establish minimum
qualifications for staffing this position.
6. Direct the CIO to develop, in coordination with the
Office of Human Resources Management, generic
performance standards for program and Regional SIRMOs
based upon the study. These standards should reflect
the responsibilities outlined in the position
description.
7. Direct the Assistant Administrators, Regional
Administrators, and equivalent office heads to ensure
that the SIRMOs in their organizations meet and maintain
the qualifications of the position as defined in the
position description and are evaluated using the
standards developed by the CIO.
8. Direct the Assistant Administrators, Regional
Administrators, and equivalent office heads to establish
an IRM advisory committee in each Headquarters program
office and Region to: (a) provide a forum for sharing
information about the following types of IRM issues--
program, State, Regional, and national initiatives;
budget issues; information technology issues; training;
planning; policy formulation,- etc.; and (b) support
senior, management .participation. on..the Executive
Steering Committee for IRM. The CIO should develop a
generic charter for these advisory committees,
identifying purpose, mission, membership (should include
representation from each major division/office and
42
Report No. E1SKG3-15-0098-4400038
-------
^ — J — —' i '• • <•• >»3J<» VMM*
States), and a meeting schedule. The SIRMOs would serve
as the Chair of these advisory committees.
9. Direct the CIO to: (a) provide and/or identify training
vehicles for enhancing the IRM knowledge of Agency
employees, such as the ADP exchange program offered by
OARM-RTP; (b) develop a comprehensive IRM component
within the Agency's core training curriculum for both
managers and staff; (c) encourage OARM's IRM personnel
to take training in Agency programmatic activities/ and
(d) provide basic training in proper procedures for
developing information systems.
10. Direct the Assistant Administrators, Regional
Administrators, and equivalent office heads to ensure
that their employees are appropriately trained in
information management and information technology
disciplines.
Resource Planning and Performance Measmr^ingnt,
11. Ensure that general IRM goals and objectives in relation
to the Agency mission are addressed in the Business
Plan.
12. Give the CIO overall responsibility for developing,
maintaining, and overseeing the implementation of EPA's
IRM Strategic Plan, which should: (a) be "based on the
Agency Business Plan; (b) include implementation plans
for all major IRM initiatives (e.g., major system
development and modernization activities and significant
ADP acquisitions and contracts) with detailed
descriptions, significant milestones and target dates,
life cycle costs, and explanations of how the
initiatives support the Agency mission; and (c) incor-
porate component plans from the program and Regional
offices, the responsibility for which resides with the
Assistant Administrators and Regional Administrators.
13 Direct the CIO to ensure that the IRM Strategic Plan:
(a) continues .to support efforts to integrate the
budgetary and resource allocation process; (b) has a
planning horizon of a minimum of five years; (c) is
updated at least annually with associated changes based
on accomplishments, budget authorizations and
allocations, revisions of life cycle cost estimates, and
actual expenditures; (d) is flexible enough to deal with
43
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
changing program and technology needs; (e) anticipates
and projects future potential IRM needs (data,
information, and technology) and the future direction of
technology, distinguishes these from known needs, and
establishes an appropriate priority level;
(f) accommodates OMB, GAO, Congressional, and internal
budgetary reporting requirements; and (g) takes into
account legislative, regulatory, and guidance
development and changes which affect IRM.
14. Direct the CIO to include the "stakeholders" (program,
Regional, and State officials associated with both IRM
and programmatic activities) in the information
resources planning and implementation processes.
15. Require that the Agency's IRM Strategic Plan be reviewed
and approved by the Executive Steering Committee for IRM
and the CIO.
16. Direct the Assistant Administrators, Regional
Administrators, and equivalent office heads to reduce,
where possible, reliance on contractors in order to
reduce EPA's vulnerability to loss of IRM expertise.
17. Direct the CIO, in coordination with the CFO, to examine
whether the Agency can fund IRM on a multi-year basis.
The examination should evaluate funding of: (a) IRM
initiatives; (b) implementation of Agency policies and
standards; (c) ADP technology; and (d) systems
development, operations and maintenance. The Agency
survey of resources expended for IRM activities should
be modified as necessary to facilitate this examination.
18. Direct the CFO to establish direct line items in the
Agency budget process for IRM activities as a necessary
component of meeting the mission of the Agency. The
line budget items should reflect the IRM budgets for
both Headquarters and Regional components, and should be
tied to implementation plans for all significant IRM
initiatives.
19. Direct all Agency components to ensure that their:
(a) major systems' development, operations, and
maintenance costs are addressed explicitly in their
individual organizations' IRM plans and; (b) systems are
built, enhanced, and operated only in accordance with
those plans,- and
-------
Special Review of EPA's Information Systems Program
in response to the Agency's survey of resources expended
for IRM (i.e., "Exhibit 43" data call) is certified for
accuracy.
20. Establish an ongoing system to measure and report on
specific IRM program performance from policy,
operational, and economic standpoints. This system
should include performance measurement criteria for
information systems and other IRM activities, which
will: (a) measure operational results against mission-
related goals for which the information systems were
developed; (b) evaluate and compare actual life cycle
costs to budgeted life cycle costs; and (c) compare
planned benefits to actual benefits. The initial
measurement criteria and goals should be based on
established plans and budgets. Subsequent changes in
performance criteria based on implementation should be
reflected in plan revisions.
Information Svpfc**"1" Development
21. Direct the CIO to establish controls to ensure that EPA
employees and contractors follow established Federal
SDLC standards throughout the life cycle of information
systems.
22. Direct the CIO to continue efforts to develop and revise
clear IRM policies, procedures, and standards. In those
instances in which Agencywide policies and standards
cannot be resolved within the context of the green
border review process, expeditiously bring those
policies and standards before the Executive Steering
Committee for IRM for resolution.
23. Direct the CIO to ensure that the new IRM policies
require that on all major system development/enhancement
projects: (a) primary and secondary users be identified
and involved throughout the system life cycle process,-
(b) detailed needs analyses be conducted and updated
periodically, and include the needs of primary and
secondary users; (c) cost-benefit analyses be conducted
and updated periodically; and (d) system decision papers
be prepared at significant decision points in the life
cycle of the system for approval by the Executive
Steering Committee for IRM.
45
Report No. E1SKG3-15-0098-4400038
-------
_ Special Review of EPA's Information Systems Program
24. Direct the Assistant Administrators, Regional
Administrators, and equivalent office heads to establish
a system life for each major system. These systems
should be reviewed periodically prior to the end of
their identified life to: (a) assess relationships among
the systems; (b) identify areas of excessive overlap;
and (c) determine which systems need to be retired or
enhanced .
D anagoinort t
25. Establish a formal Information/Data Administration
Program under the CIO. This program should be
responsible for: (a) developing, overseeing, and
enforcing a centralized repository of mission-related
standardized data elements for every EPA program in
Headquarters and the Regions; (b) developing and
implementing a standard, defined information/data
architecture; and (c) working with other Agency
components to implement data integration throughout the
Agency to reduce unnecessary duplicate data in
information systems developed for individual programs.
26. Appoint a Data Administrator with the knowledge,
experience, and authority to effectively manage the
Information/Data Administration Program. The Data
Administrator should report directly to the CIO.
27. Direct the Data Administrator to: (a) develop and
promulgate Agencywide standards and management controls
for data resources,- (b) develop, oversee, and enforce
centralized coordination of mission-related data
standardization efforts for every EPA program,-
(c) develop and manage an Agencywide information
architecture; and (d) coordinate and control
information/data integration efforts throughout the
Agency .
28. Direct the Data Administrator to work with the National
Institute of Standards and Technology, other Federal
agencies, and non- Federal organizations, as appropriate,
in the development of data standards.
29. Direct the Data Administrator to create a central
repository to manage and control logical data models,
architectures, and standard data element documentation,
46
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
and to make this information easily accessible within
and outside the Agency.
30. Ensure that the Data Administrator participates in the
IRM strategic planning and budgeting process, develops
an Agencywide strategic information/data plan, works to
see that sufficient funds are allocated for
information/data management activities through the
budget process, and participates in the information
collection process.
31. Require that every proposed new information/data
collection and modification activity be submitted by the
SIRMOs to the Data Administrator for comparison to
existing data models, consistency with data standards,
.assurance of data quality plans, and reasonableness of
cost versus benefits and impacts analysis.
32. Require that all significant information system
development activity be accompanied by the development
of data collection plans, data quality assurance plans,
data cost and impact analyses, and survey designs.
Ensure that these plans, analyses, and designs are
reviewed and approved by the Data Administrator prior to
the initiation of development activity.
33. Direct the CIO to work with Agency components to:
(a) identify, to the maximum extent practicable, EPA
information/data that is of interest to the public and
is not officially declared to be sensitive; (b) provide
improved access for the public to view (but not add to,
delete, or otherwise modify) this information/data,- and
(c) ensure that, to the maximum extent possible, Agency-
developed systems provide easy access, help screens, on-
line definitions, and on-line documentation.
34. Direct the CIO to assist in the establishment of
electronic data interchange capability within EPA for
collection, transmission, and dissemination of data.
35 Direct senior program managers to provide sufficient
resources on a continuing basis to: (a) successfully
perform any proposed new data collection endeavors; and
(b) accommodate adherence to EPA information/data
management policies.
47
Report No. E1SKG3-15-0098-4400038
-------
Special Review of EPA's Information Systems Program
(This page intentionally left blank)
48
Report No. E1SKG3-15-0098-4400038
------- |