Information Technology: Agencies Need to Fully Implement Key Workforce Planning Activities

The federal government annually spends over $90 billion on IT. Despite this large investment, projects too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. Effectively implementing workforce planning activities can facilitate the success of major acquisitions.

GAO was asked to conduct a government-wide review of IT workforce planning. The objective was to determine the extent to which federal agencies effectively implemented IT workforce planning practices. To do so, GAO compared IT workforce policies and related documentation from each of the 24 Chief Financial Officers Act of 1990 agencies to activities from an IT workforce planning framework GAO issued. GAO rated each agency as having fully, substantially, partially, minimally, or not implemented for each activity. GAO supplemented its reviews of agency documentation by interviewing agency officials.

Federal agencies varied widely in their efforts to implement key information technology (IT) workforce planning activities that are critical to ensuring that agencies have the staff they need to support their missions. Specifically, at least 23 of the 24 agencies GAO reviewed partially implemented, substantially implemented, or fully implemented three activities, including assessing gaps in competencies and staffing. However, most agencies minimally implemented or did not implement five other workforce planning activities (see figure).

Agencies provided various reasons for their limited progress in implementing workforce planning activities, including competing priorities (six agencies), and limited resources (three agencies). Until agencies make it a priority to fully implement all key IT workforce planning activities, they will likely have difficulty anticipating and responding to changing staffing needs and controlling human capital risks when developing, implementing, and operating critical IT systems.

GAO is making recommendations to 18 of the 24 federal agencies to fully implement the eight key IT workforce planning activities. Of the 18 agencies, 13 agreed with the recommendations, one partially agreed, three neither agreed nor disagreed, and one disagreed with the findings and provided evidence which led to a modification to its recommendation, as discussed in this report. For all of the remaining recommendations, GAO continues to believe that they are all warranted.

In fiscal year 2019, the federal government is expected to spend over $90  billion on information technology (IT). However, as we have reported, IT  projects have too frequently failed or incurred cost overruns and schedule  slippages while contributing little to mission-related outcomes. As a result,  we added “Improving the Management of Information Technology  Acquisitions and Operations” to our high-risk list in February 2015.

We have reported that effective workforce planning is key to addressing  the federal government’s IT challenges and ensuring that agencies have  staff with the necessary knowledge, skills, and abilities to execute a range  of management functions that support agencies’ missions and goals.  Further, we have noted that effectively implementing workforce planning  activities can facilitate the success of major IT acquisitions. To this end,  in November 2016, we issued an IT workforce planning framework that  identifies four workforce planning steps and eight activities, including  assessing gaps in competencies and skills, and developing strategies and  plans to address those gaps. This framework is based on relevant laws  and guidance issued over approximately the past 20 years. These include  the Clinger-Cohen Act of 1996, the legislation referred to as the Federal  Information Technology Acquisition Reform Act (FITARA), Office of  Management and Budget (OMB) guidance, and the Office of Personnel  Management’s (OPM) Workforce Planning Model.

This report responds to your request that we conduct a government-wide  review of federal IT workforce planning efforts. Our specific objective was  to examine the extent to which federal agencies have effectively  implemented IT workforce planning practices.

To address the objective, we obtained the IT workforce policies and other  workforce planning documents (e.g., workforce requirements and gap  assessments) from each of the 24 Chief Financial Officers (CFO) Act of  1990 agencies. We then analyzed these documents to determine  whether they were consistent with the eight workforce planning activities  identified in our November 2016 framework. We assessed each activity  as fully implemented, substantially implemented, partially implemented,  minimally implemented, or not implemented. Our review focused on IT  workforce planning efforts at the agency level, including processes for  maintaining visibility and oversight into component-level IT workforce  planning. In addition, we interviewed cognizant agency officials to discuss  their implementation of the workforce planning activities. See appendix I  for a more detailed discussion of our objective, scope, and methodology.

We conducted this performance audit from January 2018 to October 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

For over 20 years, Congress has enacted various laws, and federal  agencies have issued guidance, that call for agencies to perform  workforce planning activities to help ensure the timely and effective  acquisition of IT. These laws and guidance focus on the importance of (1)  setting the strategic direction for workforce planning, (2) analyzing the  workforce to identify skill gaps, (3) developing strategies to address skill  gaps, and (4) monitoring and reporting on progress in addressing skill  gaps. For example:

The Clinger-Cohen Act of 1996 requires agency chief information  officers (CIO) to annually (1) assess the requirements established for  agency personnel regarding knowledge and skills in information  resource management and the adequacy of such requirements for  facilitating the achievement of performance goals; (2) assess the  extent to which the positions and personnel at executive and  management levels meet those requirements; (3) develop strategies  and specific plans for hiring, training, and professional development to  address any deficiencies; and (4) report to the head of the agency on  the progress made in improving information resources management  capability.

The E-Government Act of 2002 requires the Director of OPM, in  consultation with the Director of OMB, the CIO Council, and the  Administrator of General Services to (1) analyze, on an ongoing basis,  the personnel needs of the federal government related to IT and  information resource management; and (2) identify where current IT  and information resource management training do not satisfy  personnel needs. In addition, the law requires the Director of OMB to  ensure that agency heads collect and maintain standardized  information on their IT and information resources management  workforce.

In 2010, OMB issued its 25-point plan for IT reform and outlined  several action plans to build workforce capabilities, including  capabilities for acquisition and program management. For example,  the plan directed OPM to create a specialized career path for IT  program managers. In addition, OMB stated that it would work with  OPM to provide agencies with direct hiring authority for program  managers. OMB also tasked agencies with identifying program  management competency gaps and reporting to OMB on those gaps.

Subsequent to the 25-point plan, in July 2011, OMB released  guidance for agencies to develop specialized IT acquisition cadres.  Among other things, this guidance required agencies to analyze  current acquisition staffing challenges; determine if developing or  expanding the use of cadres would improve program results; and  outline a plan to pilot or expand cadres for an especially high-risk  area, if the agency determined that such an effort would improve  performance.

Further, in November 2011, OPM issued guidance for developing  career paths for IT program managers. OPM’s career path guide  was to build upon its IT Program Management Competency Model  released in July 2011 by serving as a roadmap for individuals  interested in pursuing a career in this area. In addition, the roadmap  was to provide employees and their supervisors with a single-source  reference to determine appropriate training opportunities for career  advancement.

In December 2014, Congress enacted legislation commonly referred  to as FITARA. Among other things, the law aims to ensure timely  progress by federal agencies toward developing, strengthening, and  deploying IT acquisition cadres consisting of personnel with highly  specialized skills in IT acquisition, including program and project  managers. Almost all of the 24 CFO Act agencies (other than the  Department of Defense (Defense)) are required to update their annual  acquisition human capital plans to address how they are meeting their  human capital requirements to support timely and effective  acquisitions.

To assist agencies in implementing the provisions of FITARA and to  build upon agency responsibilities under the Clinger-Cohen Act of  1996, OMB issued guidance to agencies in June 2015. In doing so,  OMB directed agencies (other than Defense) to, among other things,  (1) develop a set of competency requirements for staff, including  leadership positions; and (2) develop and maintain a current  workforce planning processes to ensure that agencies can anticipate  and respond to changing mission requirements, maintain workforce  skills in a rapidly developing environment, and recruit and retain the  talent needed to accomplish their missions. Each agency is to conduct  an annual self-assessment of its conformity with these requirements  and develop an implementation plan describing the changes it will  make.

The Federal Cybersecurity Workforce Assessment Act of 2015  required OPM, with support from the National Institute of Standards  and Technology, to establish a coding structure to be used in  identifying all federal civilian and noncivilian positions that require the  performance of IT, cybersecurity, or other cyber-related functions.  The act also required agencies, in consultation with OPM, the  National Institute of Standards and Technology, and the Department  of Homeland Security (DHS), to then utilize this coding structure to  annually assess, among other things, the IT, cybersecurity, and other  cyber-related work roles of critical need in their workforce.

In April 2016, OPM issued an update to agency chief human capital  officers stating that it had recently revalidated the need to continue  working to close skill gaps in certain government-wide high-risk  mission critical occupations, including those in the cybersecurity and  the science, technology, engineering and mathematics functional  area.

OMB released its Federal Cybersecurity Workforce Strategy in July  2016. Among other things, the strategy cited the need for agencies  to examine specific IT, cybersecurity, and cyber-related work roles,  and identify personnel skills gaps, rather than merely examining the  number of vacancies by job series. The strategy identified several  actions that agencies could take to identify workforce needs, expand  the cybersecurity workforce through education and training, recruit  and hire highly skilled talent, and retain and develop highly skilled  talent.

In July 2016, OMB issued updated policy for the planning, budgeting,  governance, acquisition, and management of federal information,  personnel, equipment, funds, IT resources, and supporting  infrastructure and services. Among other things, OMB’s updated  policy requires an agency’s chief human capital officer, CIO, chief  acquisition officer, and senior agency official for privacy to develop a  set of competency requirements for staff and develop and maintain a  current workforce planning process.

Further, in September 2016, OPM updated its guidance regarding the  annual submission of agencies’ mission critical occupation resource  charts. These charts are to identify current staffing levels, staffing  targets, projected attrition, actual attrition, and retirement eligibility in  government-wide and selected agency-specific mission critical  occupations.

While these laws and guidance focus on IT workforce planning, other  broader initiatives have also been undertaken to improve federal human  capital management. For example, we and OPM have developed human  capital management models that call for implementing workforce planning  practices that can facilitate the analysis of gaps between current skills  and future needs. In addition, the models call for the development of  strategies for filling the gaps, as well as planning for succession.  Further, our Standards for Internal Control in the Federal Government  stress that management should consider how best to retain valuable  employees, plan for their eventual succession, and ensure continuity of  needed skills and abilities.

Based on the aforementioned laws, guidance, and initiatives, in  November 2016, GAO issued an evaluation framework to support the  assessment of whether selected federal agencies are adequately  assessing and addressing gaps in IT knowledge and skills. The  framework identifies four workforce planning steps and supporting  activities that address (1) setting the strategic direction for IT workforce  planning, (2) analyzing the IT workforce to identify competency and  staffing gaps, (3) developing and implementing strategies to address the  gaps, and (4) monitoring and reporting progress in addressing the gaps.

GAO Previously Reported on Shortfalls in Federal IT Workforce Planning

We have previously reported that effectively addressing mission critical  skill gaps in IT requires a multifaceted response from OPM and  agencies. Specifically, our high-risk update in February 2013 noted that  OPM and agencies would need to use a strategic approach that (1)  involves top management, employees, and other stakeholders; (2)  identifies the critical skills and competencies that will be needed to  achieve current and future programmatic results; (3) develops strategies  that are tailored to address skill gaps; (4) builds the internal capability  needed to address administrative, training, and other requirements  important to support workforce planning strategies; and (5) includes plans  to monitor and evaluate progress toward closing skill gaps and meeting  other human capital goals using a variety of appropriate metrics.

In January 2015, we reported that the Chief Human Capital Officers  Council had identified skill gaps in six government-wide occupations  including IT/cybersecurity and contract specialist/acquisition. We noted,  however, that the effort had shortcomings, and that it would be important  for the council to use lessons learned from these initial efforts to inform  subsequent ones to identify skill gaps. We also reported that key features  of OPM’s efforts to predict emerging skill gaps beyond those already  identified were in the early planning stages, and OPM and selected  agencies could improve the manner in which they address skill gaps by  strengthening their use of quarterly data-driven reviews.

Further, we reported that individual agencies across the federal  government have not always effectively planned for IT workforce  challenges. For example,  In May 2014, we concluded that the Social Security Administration’s  (SSA) IT human capital program had identified skills and  competencies to support certain workforce needs, but lacked  adequate planning for the future. The agency had developed IT  human capital planning documents, such as an Information  Resources Management plan, and skills inventory gap reports that  identified near-term needs, such as skill sets for the following 2 years.  Nevertheless, SSA had not adequately planned for longer-term needs  because its human capital planning and analysis were not aligned  with long-term goals and objectives and the agency did not have a  current succession plan for its IT efforts. Accordingly, we  recommended that SSA identify long-term IT needs in its updated  human capital operating plan. The agency agreed with, and  subsequently implemented the recommendation.

In August 2016, we determined that the Department of Veterans  Affairs (VA) had performed key steps, such as documenting an IT  human capital strategic plan and regularly analyzing workforce data.  However, the agency had not tracked and reviewed historical and  projected leadership retirements and had not identified gaps in future  skill areas. We recommended that the agency track and review  historical workforce data and projections related to leadership  retirements, and identify IT skills needed beyond the current fiscal  year, to assist in identifying future skills gaps. The agency concurred  with our recommendations and has partially implemented them by  identifying the IT skills it needed beyond the current fiscal year.

In November 2016, as a part of the review in which we developed the  IT workforce planning framework discussed previously, we assessed  five agencies—the Departments of Commerce (Commerce), Defense,  Transportation (Transportation), the Treasury (Treasury), and Health  and Human Services (HHS)—against the eight key workforce  planning activities. While all five agencies had demonstrated  important progress in either partially or fully implementing key  workforce planning activities, each had shortfalls. For example, only  one agency (Defense) had implemented a workforce planning  process, none had identified IT competency gaps for their entire  workforce, and three (Defense, Transportation, and Treasury) were  performing some level of monitoring toward the closure of identified  skill gaps. We reported that, until the agencies fully implemented key  workforce planning activities, they would have a limited ability to  assess and address gaps in knowledge and skills that are critical to  the success of major IT acquisitions. As a result, we recommended  that the agencies implement the eight IT workforce planning activities  to facilitate the analysis of gaps between current skills and future  needs, the development of strategies for filling the gaps, and  succession planning. Defense partially agreed with our  recommendations and the other four agencies agreed with our  recommendations. An updated assessment of actions to implement  our recommendations is described in our evaluation of agencies’  implementation of key IT workforce planning activities in appendix II.

In May 2018, as part of a review of the National Aeronautics and  Space Administration’s (NASA) approach to overseeing and  managing IT, we found that the agency had partially implemented five  of the eight key IT workforce planning activities and had not  implemented three. For example, NASA had not assessed  competency and staffing needs regularly or reported progress to  agency leadership. We reported that, until the agency implemented  the key IT workforce planning activities, it would have difficulty  anticipating and responding to changing staffing needs. As a result,  we recommended that NASA fully implement the eight key IT  workforce planning activities. The agency disagreed with our  recommendation stating that its workforce improvement activities  were already underway. Nevertheless, implementing the workforce  planning activities discussed in this report could enhance and  complement the agency’s ongoing and future efforts.

In a June 2018 report on the progress of agencies’ efforts to  implement the requirements of the Federal Cybersecurity Workforce  Assessment Act of 2015, we noted that most CFO Act agencies had  developed baseline assessments to identify cybersecurity personnel  within their agencies that held certifications. However, because  agencies had not consistently defined the workforce and the National  Initiative for Cybersecurity Education had not developed a list of  appropriate certifications, efforts such as conducting the baseline  assessment to determine the percentage of cybersecurity personnel  that hold appropriate certifications had yielded inconsistent and  potentially unreliable results. Further, we reported that, while most  CFO Act agencies had developed procedures for assigning  cybersecurity codes to positions, several agencies had not addressed  activities required by OPM to implement the requirements of the  Federal Cybersecurity Workforce Assessment Act.

As a result, we made 30 recommendations to 13 agencies to develop  and submit their baseline assessments and to fully address the  required activities in OPM’s guidance in their procedures for assigning  employment codes to cybersecurity positions. Of the 13 agencies,  seven agreed with the recommendations made to them, four did not  state whether they agreed or disagreed, one agency agreed with one  of the two recommendations made to it, and one did not provide  comments on the report. As of July 2019, the agencies had  implemented 20 of the recommendations.

In August 2018, as part of a government-wide review of CIO  responsibilities, we reported that CIOs are responsible for assessing  agency IT workforce needs and developing strategies and plans for  meeting those needs. However, we noted that the majority of the  agencies minimally addressed or did not address the role of their  CIOs in the area of IT workforce and reported major challenges  related to their IT workforce. Specifically, 19 agencies’ policies had  not addressed their CIOs’ role in conducting annual assessments of  IT management and skill requirements and the remaining five  agencies had only partially addressed this responsibility. We noted  that the shortcomings in agencies’ policies were attributable, at least  in part, to incomplete guidance from OMB. Consequently, we  recommended that OMB issue guidance that addresses the IT  workforce responsibilities of CIOs that were not included in existing  guidance. OMB partially agreed with the recommendation and has not  yet implemented it. We also recommended that 24 agencies ensure  that their IT management policies address the role of their CIOs in the  IT workforce management area. Of the 24 agencies, 14 agreed with  the recommendations, five had no comments, five partially agreed,  and one disagreed. We are monitoring the status of the agencies’  actions to implement our recommendations.

In March 2019, as part of an update on the status of agencies’  progress in implementing the requirements of the Federal  Cybersecurity Workforce Assessment Act, we reported, among  other things, that most of the 24 CFO Act agencies had not  completely or accurately categorized work roles for IT positions within  the 2210 IT management occupational series (IT management). The  agencies reported that this was, in part, because they may have  assigned the associated codes in error or had not completed  validating the accuracy of the assigned codes. We noted that, by  assigning work roles that are inconsistent with the IT, cybersecurity,  and cyber-related positions, the agencies were diminishing the  reliability of the information they needed to improve workforce  planning. We made recommendations to 22 agencies to take steps to  address the inaccuracies. Of these agencies, 20 agreed with the  recommendations, one partially agreed, and one did not agree with  one of the two recommendations. As of August 2019, three of the  agencies have implemented their recommendation, and two of the  agencies have implemented one of their two recommendations. We  continue to believe that all of the recommendations are warranted.

Agencies Had Mixed Progress Implementing IT Workforce Planning Activities

As previously noted, GAO issued an IT workforce planning framework  that includes eight key activities, based on federal laws, guidance, and  best practices. Implementing these activities is critical to adequately  assessing and addressing gaps in IT knowledge, skills, and abilities that  are needed to execute a range of management functions that support  agencies’ missions and goals. The eight key workforce planning activities  are identified in table 1.

None of the 24 agencies that we reviewed had fully implemented all eight  IT workforce planning activities. In this regard, nearly all of the agencies  had partially implemented, substantially implemented, or fully  implemented three of the workforce planning activities (develop  competency and staffing requirements, assess competency and staffing  needs regularly, and assess gaps in competencies and staffing).

However, most agencies had minimally implemented or did not implement  the five other workforce planning activities (including efforts to establish a  workforce planning process and address staffing gaps). Figure 1 shows  the agencies’ overall implementation of each of the eight key IT workforce  planning activities, as of May 2019.

Further, some agencies had made more progress than others.  Specifically, while five agencies (Defense, Department of State (State),  VA, Small Business Administration (SBA), and SSA) fully implemented or  substantially implemented three or more activities, 11 agencies did not  fully implement any of the activities, and 15 agencies did not implement  three or more activities. Figure 2 identifies the extent to which each of the  24 agencies had implemented the eight workforce planning activities. In  addition, appendix II provides our assessment of each agency’s  implementation of the activities.

Only One Agency Fully Established and Maintained a Workforce Planning Process

To fully implement the establish and maintain an IT workforce planning  process activity, an agency should have a documented IT workforce  planning process that describes how the agency will implement key IT  workforce planning activities, including those identified in the IT workforce  planning framework. The process should also define the CIO’s and  others’ roles and responsibilities for implementing the activities; align with  mission goals and objectives; and address both the agency-level and  component-level workforce, including how the agency is to maintain  visibility and oversight into component-level workforce planning efforts (as  applicable). In addition, the agency should periodically update the  process.

Only one of the 24 CFO Act agencies had fully implemented this activity.  Specifically, one agency had fully implemented the activity (Nuclear Regulatory  Commission (NRC)); one agency had substantially implemented the activity (Defense);  two agencies had partially implemented the activity (Department of  Housing and Urban Development (HUD), and SBA);

12 agencies had minimally implemented the activity (U.S. Department  of Agriculture (Agriculture), Commerce, Department of Energy  (Energy), HHS, DHS, Department of the Interior (Interior), Department  of Labor (Labor), State, Transportation, Treasury, VA, and SSA); and eight agencies did not implement the activity (Department of  Education (Education), Department of Justice (Justice),  Environmental Protection Agency (EPA), General Services  Administration (GSA), NASA, National Science Foundation (NSF),  OPM, and U.S. Agency for International Development (USAID)).

NRC fully implemented the activity. In February 2016, NRC developed  a strategic workforce plan that addressed all key IT workforce  planning activities in our framework. In addition, the process was  aligned with the agency’s goals and objectives. Further, the process  included general roles and responsibilities, including for the Office of  the Chief Human Capital Officer, Senior Management, and its  component offices. Moreover, the agency’s Management Directive  9.22 further defined the Chief Information Officer’s roles and  responsibilities with regards to IT workforce planning. In addition,  NRC has periodically updated the process. For example, the agency  updated the process in July 2017 to better integrate its workload  projection, skills identification, human capital management, individual  development, and workforce management activities.

Defense substantially implemented the activity. The agency’s June  2018 Human Capital Operating Plan addressed how Defense plans to  implement the workforce planning activities for its functional  communities, including the IT functional community. In addition, the  plan defined the CIO’s roles and responsibilities and was aligned with  the agency’s goals and objectives.

Further, the plan documented how the agency will maintain oversight  of and visibility into functional community planning efforts. However, it  called for the functional communities to develop strategic workforce  plans to further define their workforce planning process and the IT  functional community has not yet completed its plan or provided a  time frame for completion. With respect to maintaining the process,  Defense periodically updated its IT workforce process—the June 2018  plan replaced the process identified in the agency’s previous  workforce plans.

SBA partially implemented the activity. In April 2018, SBA released its  IT Workforce Plan for fiscal years 2018 through 2020 that addressed  how the agency intends to implement all of its IT workforce planning  activities, and was aligned with the agency’s mission goals and  objectives. In addition, in April 2018, the agency released its IT  Change Management and Communication Plan that defined the CIO’s  IT workforce planning roles and responsibilities and was aligned with  the agency’s mission goals and objectives. However, as it is a new  process, SBA had not updated it as of May 2019.

Interior minimally implemented the activity. Interior issued a policy in  2016 that directed its bureaus to develop IT workforce plans, which  the agency stated that it intends to use to develop an agency-wide IT  workforce plan. The policy identified efforts that should be addressed  in the plans, including most of the IT workforce planning activities.  However, as of May 2019, the bureaus’ plans and the agency-wide  plan had not been completed. Officials in the Office of the CIO stated  that they expect to finalize all of the plans by the end of fiscal year  2019.

GSA did not implement the activity. Officials in the Human Capital  Strategic Planning Division stated that GSA followed the process  described in OPM’s IT workforce planning guidance; however, the  agency did not document this in policy and had not developed any  other documentation to guide its implementation of workforce planning  activities.

Most Agencies at Least Partially Developed Competency and Staffing Requirements for Their IT Staff

To fully implement the develop competency and staffing requirements  activity, an agency should develop a set of competency requirements for  all or most of its IT workforce, including leadership positions. In addition,  the agency should develop staffing requirements, which include  projections over several years.

Most of the agencies had fully or substantially developed competency and  staffing requirements. Specifically,

12 agencies had fully implemented the activity (Defense, Education,  HUD, State, Transportation, Treasury, VA, GSA, NASA, SBA, SSA,  and USAID),  four agencies had substantially implemented the activity (Agriculture,  Commerce, HHS, and DHS), and eight agencies had partially implemented the activity (Energy, Interior,  Justice, Labor, EPA, NSF, NRC, and OPM).

State fully implemented the activity. State developed competency  requirements for its IT workforce, including for both its foreign and civil  services. In addition, State developed staffing requirements for its IT  staff, including projections over several years. Specifically, it  developed staffing requirements for its mission critical occupations,  which include IT management, in response to OPM’s requirement to  submit this information annually.

DHS substantially implemented the activity. DHS developed  competency requirements for two of the agency’s four IT functional  groups. According to officials in the Office of the CIO, the agency  expects to finalize competency requirements for the remaining two  groups by the end of fiscal year 2019. In addition, DHS developed  staffing requirements for its IT staff, including projections over several  years. Specifically, it developed staffing requirements for its mission  critical occupations, which include IT management, in response to  OPM’s requirement to submit this information annually.

OPM partially implemented the activity. OPM did not develop  competency requirements. However, the agency developed staffing  requirements for its IT staff, including projections over several years.  Specifically, it developed staffing requirements for its mission critical  occupations, which include IT management.

Most Agencies Periodically Assessed IT Staffing Needs, but Not Competency Needs

To fully implement the assess competency and staffing needs regularly  activity, an agency should periodically assess competency needs for all or  most of its IT workforce. In addition, the agency should periodically  assess staffing needs for all or most of its IT workforce.

Most of the agencies periodically assessed staffing needs, but did not  assess competency needs. Specifically,  three agencies had fully implemented the activity (Defense, VA, and  SSA);

20 agencies had partially implemented the activity by periodically  assessing IT staffing needs; however, these agencies did not  periodically assess competency needs (Agriculture, Commerce,  Education, Energy, HHS, DHS, HUD, Interior, Justice, Labor, State,  Transportation, Treasury, GSA, NASA, NSF, NRC, OPM, SBA, and  USAID); and one agency did not implement the activity (EPA).

VA fully implemented the activity. VA assessed competency needs  annually as a part of its professional development planning process.  For example, the agency performed an assessment in fiscal year  2017, which led it to add project management as a competency for all  IT staff. In addition, in fiscal year 2018, VA’s assessment resulted in  adding two new competencies—data analytics and risk management.  Further, VA annually assessed staffing needs for its IT staff in  response to the annual OPM reporting requirement to do so.

Commerce partially implemented the activity. The agency initially  developed its competency requirements in January 2016, but had not  since updated its needs. On the other hand, Commerce annually  assessed staffing needs for its IT staff in response to the OPM  reporting requirement to do so.

EPA did not implement the activity. EPA did not develop competency  needs for its IT workforce. In addition, the agency could not provide  documentation showing that it had regularly assessed staffing needs  for its IT staff.

Most Agencies Took Steps to Assess Competency and Staffing Gaps

To fully implement the assess gaps in competencies and staffing activity,  an agency should periodically assess gaps in competencies for all or  most of its IT workforce. Further, the assessment should be performed  based on the agency’s current competency needs. In addition, the agency  should periodically assess gaps in staffing for all or most of its IT  workforce.

Most agencies took steps to assess competency and staffing gaps.  Specifically,  two agencies had fully implemented the activity (VA and SSA); nine agencies had substantially implemented the activity (Agriculture,  Defense, DHS, HUD, State, Transportation, GSA, NASA, and SBA);

12 agencies had partially implemented the activity by periodically  assessing IT staffing gaps, but not periodically assessing competency  gaps (Commerce, Education, Energy, HHS, Interior, Justice, Labor,  Treasury, NSF, NRC, OPM, and USAID); and one agency had minimally implemented the activity (EPA).

SSA fully implemented the activity. SSA assessed gaps in its  competencies for its IT management staff biennially starting in fiscal  year 2014. In addition, SSA annually assessed staffing gaps for its IT  staff in response to the OPM reporting requirement.

HUD substantially implemented the activity. HUD assessed  competency gaps for its IT management staff biennially; it began  doing so in fiscal year 2014. However, HUD did not assess  competency needs regularly; thus, it could not ensure that the gap  assessments reflect the agency’s current competency needs. HUD  annually assessed staffing gaps for its IT staff in response to the OPM  reporting requirement.

Education partially implemented the activity. Education did not assess  gaps in competencies for its IT staff. However, the agency annually  assessed staffing gaps for its IT staff in response to the OPM  reporting requirement.

EPA minimally implemented the activity. EPA did not assess  competency gaps because, as previously stated, the agency did not  develop competency requirements. In addition, while EPA assessed  staffing gaps in 2018, it did not provide documentation showing that it  had assessed staffing gaps prior to or since then.

Most Agencies Did Not Develop Strategies and Plans to Address Competency and Staffing Gaps

To fully implement the develop strategies and plans to address gaps in  competencies and staffing activity, an agency should develop strategies  and plans, including specific actions and milestones, to address identified  competency gaps. In addition, the agency should develop strategies and  plans, including specific actions and milestones, to address identified  staffing gaps.

Most agencies did not develop strategies and plans to address  competency and staffing gaps. Specifically,  four agencies had substantially implemented the activity (Defense,  State, VA, and SBA), one agency had partially implemented the activity (Agriculture),  six agencies had minimally implemented the activity (HUD,  Transportation, EPA, GSA, SSA, and USAID), and

13 agencies did not implement the activity (Commerce, Education,  Energy, HHS, DHS, Interior, Justice, Labor, Treasury, NASA, NSF,  NRC, and OPM).

State substantially implemented the activity. State identified strategies  to address high-priority IT competency gaps, including developing  additional training, conducting quarterly reviews of IT workforce  issues, and improving hiring processes; however, it had not  developed plans, including actions and milestones, for how it would  carry out the strategies.

With respect to staffing, State identified strategies and plans to  address them in its Five-Year Workforce and Leadership Success  Plan for Fiscal Years 2016 through 2020. For example, State  identified using special hiring initiatives, such as its Pathways  Programs, to address staffing gaps. In addition, State developed the  Foreign Affairs IT Fellowship Program, which is intended to recruit  students by offering internships.

Agriculture partially implemented the activity. In 2019, Agriculture  developed strategies, which included providing training and  developing career paths, to address competency gaps identified for  two of 13 IT functional roles; however, the agency did not develop  associated plans, including actions and milestones. Further,  Agriculture did not develop strategies to address gaps for the other 11  IT functional roles because the agency had not assessed gaps for  those roles.

With respect to staffing, in 2019, Agriculture identified strategies to  address staffing gaps identified for two of its IT functional roles,  including collaborating with universities. However, it did not develop  plans to carry out the strategies. In addition, Agriculture did not  develop strategies and plans to address gaps in staffing for its other  11 IT functional roles.

HUD minimally implemented the activity. HUD’s Office of the CIO  developed a training plan for fiscal years 2017 through 2018, which  identified training courses to address specific technical competency  gaps. However, HUD has not updated its competency needs regularly  to ensure that the plan and underlying gap assessment reflect the  agency’s current competency needs. With respect to staffing, HUD did  not develop strategies and plans to address gaps.

DHS did not implement the activity. DHS did not develop strategies  and plans to address either competency or staffing gaps.

Most Agencies Minimally Implemented Strategies and Plans to Address Specific Gaps

To fully implement the implement activities that address gaps activity, an  agency should execute its strategies and plans to address identified gaps  in competencies and staffing. In addition, the agency should implement  other efforts to assist with addressing competency and staffing needs,  including the following efforts identified in FITARA: IT acquisition cadres,  cross-functional training of acquisition and program personnel, career  paths for program managers, plans to strengthen program management,  and the use of special hiring authorities.

Most of the agencies minimally implemented strategies and plans to  address competency and staffing gaps. Specifically,  two agencies had substantially implemented this activity (Defense and  VA),  seven agencies had partially implemented the activity (HHS, DHS,  State, Treasury, SBA, SSA, and USAID), and

15 agencies had minimally implemented the activity by implementing  workforce efforts identified in FITARA, but not implementing strategies  and plans to address its identified competency and staffing gaps  primarily because they had not developed strategies and plans to  address identified gaps (Agriculture, Commerce, Education, Energy,  HUD, Interior, Justice, Labor, Transportation, EPA, GSA, NASA, NSF,  NRC, and OPM).

VA substantially implemented the activity. VA implemented strategies  and plans to address gaps in competencies. For example, in its Office  of Information and Technology Training Gap Analysis report, VA  identified actions taken to address the prior year’s competency gaps.  These actions included developing additional training courses, as well  as providing on-the-job training activities. However, VA did not provide  documentation showing that it had implemented strategies and plans  to address identified staffing gaps.

With respect to the efforts identified in FITARA that can assist with  addressing competency and staffing needs, VA implemented an IT  acquisition cadre, developed plans to strengthen program  management, developed a career path for program managers, and  used special hiring authorities to hire IT staff.

SSA partially implemented the activity. SSA implemented strategies to  address gaps in competencies. For example, according to its gap  closure report, the agency closed competency gaps by providing  training to existing staff, hiring new staff, and hiring contractors with  needed skills. However, SSA did not implement strategies and plans  to address staffing gaps because it had not yet developed them.

With respect to the efforts identified in FITARA that can assist with  addressing competency and staffing needs, SSA used special hiring  authorities to hire eight IT specialists in fiscal year 2018. However,  SSA did not implement others, including IT acquisition cadres, cross- functional training of acquisition and program personnel, career paths  for program managers, and plans to strengthen program  management.

GSA minimally implemented the activity. GSA did not develop  strategies and plans to address identified gaps in competencies or  staffing.

With respect to the efforts identified in FITARA that can assist with  addressing competency and staffing needs, GSA implemented efforts to  provide cross-functional training for acquisition and program personnel  and used special hiring authorities to hire IT staff. However, the agency  did not implement others, including plans to strengthen program  management or career paths for program managers.

Most Agencies Did Not Establish Processes for Monitoring Progress in Addressing Gaps

To fully implement the monitor the agency’s progress in addressing  competency and staffing gaps activity, an agency should track progress in  implementing strategies and plans to address competency gaps. In  addition, the agency should track progress in implementing strategies and  plans to address staffing gaps.

Most agencies did not establish processes for monitoring progress in  addressing competency and staffing gaps. Specifically,  three agencies had partially implemented the activity (Defense, VA,  and SBA),  five agencies had minimally implemented the activity (HUD, State,  Transportation, SSA, and USAID), and

16 agencies did not implement the activity (Agriculture, Commerce,  Education, Energy, HHS, DHS, Interior, Justice, Labor, Treasury,  EPA, GSA, NASA, NSF, NRC, and OPM).

SBA partially implemented the activity. SBA established an IT  Workforce Steering Committee which monitored progress made in  implementing, among other things, strategies and plans to address  competency and staffing gaps. However, the agency did not monitor  whether the strategies and plans led to a closure in gaps.

State minimally implemented the activity. While State monitored its  progress in implementing recommended actions to address  competency gaps, the agency did not monitor whether the actions led  to closing gaps. With respect to staffing, State did not monitor  progress in addressing gaps because it did not develop strategies and  plans to close staffing gaps.

GSA did not implement the activity. GSA did not track progress in  addressing competency gaps because the agency did not assess  competencies to identify such gaps. Further, GSA did not monitor its  progress in addressing staffing gaps because it did not develop  strategies and plans to close the gaps.

Most Agencies Did Not Establish Processes for Reporting Progress in Addressing Gaps in Competencies and Staffing

To fully implement the report to agency leadership on progress activity,  an agency should periodically report to agency leadership on progress in  implementing strategies and plans to address gaps in competencies. In  addition, the agency should periodically report to leadership on progress  in implementing strategies and plans to address gaps in staffing.

However, most of the agencies did not establish processes for reporting  their progress in addressing competency and staffing gaps. Specifically,  three agencies had partially implemented the activity (Defense, VA,  and SBA),  three had minimally implemented the activity (HUD, SSA, and  USAID), and

18 did not implement the activity (Agriculture, Commerce, Education,  Energy, HHS, DHS, Interior, Justice, Labor, State, Transportation,  Treasury, EPA, GSA, NASA, NSF, NRC, and OPM).

VA partially implemented the activity. VA reported to agency  leadership on its progress in addressing competency gaps, including  the closure of gaps, and the actions planned and taken to address the  gaps. However, VA did not report on progress in addressing staffing  gaps because it did not implement strategies and plans to address  such gaps.

HUD minimally implemented the activity. HUD reported to agency  leadership on the closure of competency gaps from fiscal year 2014  through fiscal year 2016. However, the agency did not monitor or  report on its progress in implementing strategies and plans to address  gaps in competencies. With respect to staffing, HUD did not report on  its progress in addressing gaps because it did not implement  strategies and plans to close staffing gaps.

DHS did not implement the activity. DHS did not periodically report to  agency leadership on its progress in addressing competency or  staffing gaps. The agency did not do so because it did not develop  strategies and plans to address competency and staffing gaps.

Agencies Identified Various Factors That Limited Implementation of Key IT Workforce Planning Activities

Agency officials cited various factors that limited their progress in  implementing the key IT workforce planning activities. For example,  six agencies, including DHS and NRC, reported that they had not  completed key activities because they were reliant on finishing other  prerequisite activities. For example, officials in DHS’s Office of the  CIO stated that they had not updated their IT competency needs  because they had not yet finished identifying competency  requirements for all of the agency’s role-based groups;  four agencies, including HHS and NASA, reported that they had other  workforce related priorities, including those related to the  Cybersecurity Workforce Assessment Act;  three agencies, including GSA and USAID, reported that they lacked  resources to perform the activities; and  two agencies (OPM and Interior) reported that leadership turnover  affected their implementation of workforce planning activities.

Until agencies make it a priority to implement all of the key IT workforce  planning activities, they will likely have a limited ability to assess and  address gaps in the knowledge and skills that are critical to the success  of major acquisitions. As a result, it will be difficult for agencies to  anticipate and respond to changing staffing needs and control human  capital risks when developing, implementing, and operating critical IT  systems.

The majority of the agencies made significant progress implementing  three activities—develop competency and staffing requirements, assess  competency and staffing needs regularly, and assess gaps in  competencies and staffing—and in doing so took important steps towards  identifying the workforce they need to help them achieve their mission,  and the gaps that need to be addressed. In contrast, most agencies only  minimally implemented or did not implement the remaining five activities,  increasing the risk that they will not address the gaps. Agencies’ limited  implementation of the IT workforce planning activities has been due, in  part, to not making IT workforce planning a priority, despite the laws and  guidance which have called for them to do so for over 20 years. Until this  occurs, agencies will likely not have the staff with the necessary  knowledge, skills, and abilities to support the agency’s mission and goals.

We are making a total of 18 recommendations to federal agencies—one  recommendation to 18 agencies.

The Secretary of Agriculture should ensure that the agency fully  implements each of the eight key IT workforce planning activities it did  not fully implement. (Recommendation 1)

The Secretary of Education should ensure that the agency fully  implements each of the seven key IT workforce planning activities it  did not fully implement. (Recommendation 2)

The Secretary of Energy should ensure that the agency fully  implements each of the eight key IT workforce planning activities it did  not fully implement. (Recommendation 3)

The Secretary of Homeland Security should ensure that the agency  fully implements each of the eight key IT workforce planning activities  it did not fully implement. (Recommendation 4)

The Secretary of Housing and Urban Development should ensure that  the agency fully implements each of the seven key IT workforce  planning activities it did not fully implement. (Recommendation 5)

The Secretary of the Interior should ensure that the agency fully  implements each of the eight key IT workforce planning activities it did  not fully implement. (Recommendation 6)

The Attorney General should ensure that the agency fully implements  each of the eight key IT workforce planning activities it did not fully  implement. (Recommendation 7)

The Secretary of Labor should ensure that the agency fully  implements each of the eight key IT workforce planning activities it did  not fully implement. (Recommendation 8)

The Secretary of State should ensure that the agency fully  implements each of the seven key IT workforce planning activities it  did not fully implement. (Recommendation 9)

The Secretary of Veterans Affairs should ensure that the agency fully  implements each of the five key IT workforce planning activities it did  not fully implement. (Recommendation 10)

The Administrator of the Environmental Protection Agency should  ensure that the agency fully implements each of the eight key IT  workforce planning activities it did not fully implement.  (Recommendation 11)

The Administrator of the General Services Administration should  ensure that the agency fully implements each of the seven key IT  workforce planning activities it did not fully implement.  (Recommendation 12)

The Director of the National Science Foundation should ensure that  the agency fully implements each of the eight key IT workforce  planning activities it did not fully implement. (Recommendation 13)

The Chairman of the Nuclear Regulatory Commission should ensure  that the agency fully implements each of the seven key IT workforce  planning activities it did not fully implement. (Recommendation 14)

The Director of the Office of Personnel Management should ensure  that the agency fully implements each of the eight key IT workforce  planning activities it did not fully implement. (Recommendation 15)

The Administrator of the Small Business Administration should ensure  that the agency fully implements each of the seven key IT workforce  planning activities it did not fully implement. (Recommendation 16)

The Commissioner of the Social Security Administration should  ensure that the agency fully implements each of the five key IT  workforce planning activities it did not fully implement.  (Recommendation 17)

The Administrator of the U.S. Agency for International Development  should ensure that the agency fully implements each of the seven key  IT workforce planning activities it did not fully implement.  (Recommendation 18)

We are not making new recommendations to six agencies—Commerce,  Defense, HHS, Transportation, Treasury, and NASA—because we  previously made recommendations to these agencies to address the key  IT workforce planning activities.

We provided a draft of the report to the 24 CFO Act agencies for their  review and comment. Of the 18 agencies to which we made a  recommendation in this report, 13 agencies (Energy, DHS, HUD, Interior,  Labor, State, VA, GSA, NSF, OPM, SBA, SSA, and USAID) agreed with  the recommendation; one agency (Education) partially agreed with the  recommendation; three agencies (Agriculture, Justice, EPA) neither  agreed nor disagreed with the recommendation; and one agency (NRC)  did not agree with our findings. We also received technical comments  from a number of the agencies, which we have incorporated into the  report, as appropriate.

In addition, of the six agencies to which we did not make  recommendations in this report, two (Defense and the Treasury) provided  comments on the report and the remaining four (Commerce, HHS,  Transportation, and NASA) responded that they did not have any  comments on the report.

The following 13 agencies agreed with our recommendations:  In written comments (reprinted in appendix III), Energy concurred with  our recommendation. The agency stated that it plans to fully implement  all of the IT workforce planning activities, and described recently  completed and intended efforts to do so. For example, the agency stated  that it completed the development of competency and staffing  requirements in May 2019. In addition, the agency said it expects to finish  developing an IT workforce planning process in December 2020. While  the efforts described represent positive steps toward fully implementing  the IT workforce planning activities, Energy did not provide supporting  documentation for the activities it said were completed. As a result, we  did not change our ratings for these activities.

In its written comments (reprinted in appendix IV), DHS concurred with  our recommendation and stated that it remains committed to fully  implementing all of the IT workforce planning activities. Further, the  agency stated that it had completed developing competency  requirements and assessing gaps for its two remaining IT role based  groups. However, the agency did not provide documentation to support  its completion of these activities. As a result, we did not change our  ratings for the activities.

DHS also stated that the Office of the Chief of Staff Workforce  Engagement Division, within the Office of the CIO, plans to work with the  agency’s Chief Information Officer Council and the Office of Chief Human  Capital Officer to form an integrated project team by January 30, 2020.  According to DHS, this project team will be charged with discussing the  agency’s IT workforce planning strategy and outlining an action plan to  ensure the strategy addresses all of the key IT workforce planning  activities. DHS also provided technical comments which we incorporated,  as appropriate.

In written comments (reprinted in appendix V), HUD concurred with our  recommendation and stated that it plans to fully implement the remaining  workforce planning activities.

In its written comments (reprinted in appendix VI), Interior agreed with  our recommendation. The agency stated that it has begun taking steps to  implement the IT workforce planning activities and plans to fully  implement the remaining activities.

In its written comments (reprinted in appendix VII), Labor concurred with  our recommendation. The agency stated that it had made significant  progress since the completion of our review and had fully implemented  seven of the eight IT workforce planning activities. For example, the  agency described efforts to review position descriptions, including  identifying key IT competency areas. In addition, the agency stated that it  assessed competency and skills needs, and critical IT skill gaps, as part  of an IT workforce supply analysis. Further, Labor stated that, in June  2019, it developed hiring approval and prioritization templates, which  require a current workforce and competency assessment, and identified  IT competencies with each hiring request. The agency added that hiring  managers perform a job analysis prior to posting open positions, and that  this includes identifying key IT competencies for each position.

Moreover, Labor stated that, in June 2019, the Secretary approved the  use of direct hire authority for IT Specialists. In addition, the agency said  that the Office of the CIO and the Chief Human Capital Officer finalized  an action plan in March 2019 that identified strategies to address IT  workforce gaps. Further, it stated that progress had been monitored in  weekly discussions with and oversight from the Chief Information Officer  and Chief Human Capital Officer. However, while the actions described  indicate progress toward fully implementing the workforce planning  activities, the agency did not provide evidence to support the actions it  said it had taken. As a result, we did not change our ratings for the  activities.

In written comments (reprinted in appendix VIII), State agreed with our  recommendation and described steps it said the agency is taking to  implement the IT workforce planning activities. These steps included  developing an IT strategic workforce plan that it expected to finalize by  the end of fiscal year 2019. Further, the agency stated that it had  substantially implemented the report to agency leadership on progress in  addressing the competency and staffing gaps activity, which we  assessed as not implemented. As evidence, the agency stated that  departmental leadership is briefed regularly on efforts made to address IT  competency gaps. However, State did not provide supporting  documentation for these activities. As a result, we did not change our  rating for the activities.

In written comments (reprinted in appendix IX), VA concurred with our  recommendation. However, the agency said it believed that it had fully  implemented each of the five IT workforce planning activities we rated as  less than fully implemented. Specifically,

With regard to establishing and maintaining an IT workforce  planning process, VA stated that its Office of Information and  Technology had fully implemented a workforce planning process,  including developing and implementing strategies to address gaps  in competencies and staffing. The agency submitted two  documents as supporting evidence: the Office of Information and  Technology’s Human Capital Management Recruitment Strategy,  which we reviewed during our engagement and determined did  not sufficiently address the criteria; and the Office of Information  and Technology’s Human Capital Strategic Plan for fiscal years  2014 through 2020, a document that it had not previously provided  to us. We reviewed this document but have questions we need to  follow up on with VA to determine whether the agency has fully  implemented the activity. As a result, we did not change our rating  for this activity.

With regard to developing strategies and plans to address gaps in  competencies and staffing, VA stated that, for projected staffing  gaps, it has developed initial plans for deploying internal employee  growth mechanisms. In addition, the agency stated that, because  it anticipates no authorized staffing growth for fiscal years 2020  and 2021, the primary focus of its workforce strategies will be on  delivering IT services in a growing environment while experiencing  no authorized staff growth. Further, the agency stated that, due to  its low vacancy rate, its emphasis will change from filling gaps to  sustaining services while controlling workforce attrition. While the  actions described may be sufficient to fully implement the activity,  VA did not provide documented plans to address projected  staffing gaps; as a result, we did not change our rating for this  activity.

With regard to implementing activities that address gaps, the  agency stated that its Office of Information and Technology  Human Capital Management Recruitment Strategy outlines talent  acquisition approaches leveraged within the office to address  staffing gaps. We analyzed this document during our review and,  as noted in our report, found that it identified actions taken to  address the prior year’s gaps, but it did not provide documentation  showing that VA had implemented strategies and plans to address  projected staffing gaps. As a result, we did not change our rating  for this activity.

With regard to monitoring the agency’s progress in addressing  competency and staffing gaps, the agency stated that it has fully  implemented the activity because it believes it has fully  implemented the aforementioned dependent activities. However,  as previously stated, we did not change our ratings for the other  activities based on information that VA provided. Accordingly, we  did not change our rating for this activity.

With regard to reporting to agency leadership on progress in  addressing competency and staffing gaps, VA stated that, in June  2019, its Office of Information and Technology briefed the  agency’s Chief Information Officer and senior leadership on the  preliminary results of data collection that is expected to ultimately  result in a staffing model which accurately depicts the current  array of the office’s workforce, requirements to perform the  mission, functions, task assigned, and the associated staffing gap.  However, the agency did not provide documentation supporting  this activity. As a result, we did not change our partially  implemented rating designation for the activity.

In written comments (reprinted in appendix X), GSA agreed with our  recommendation and stated that it has established a project team to  implement the remaining workforce planning activities.

In comments provided via email on September 12, 2019, the Liaison to  GAO in NSF’s Office of the Director, Office of Integrative Activities, stated  that the agency agreed with our recommendation. The liaison added that  NSF had recently completed an iteration of an IT workforce plan that is to  inform its processes going forward, and address many of the IT  workforce planning activities. The liaison also stated that NSF recognizes  the importance of IT workforce planning and will continue to implement  improvements to its processes in this area.

OPM provided written comments (reprinted in appendix XI) in which the  agency stated that it concurred with the recommendation. In addition, the  agency stated that, to address its shortcomings, it has partnered with  GSA’s IT Modernization Center of Excellence to assess the current state  of its IT workforce planning activities. The agency stated that this effort is  intended to assist with identifying and addressing gaps.

In its written comments (reprinted in appendix XII), SBA agreed with the  recommendation. The agency stated that its Office of Human Resource  Solutions and the Office of the CIO will continue unified efforts to fully  implement the remaining seven key IT workforce planning activities noted  in our report. SBA added that it expects to complete the efforts by the  end of fiscal year 2021. SBA also provided technical comments which we  incorporated, as appropriate.

SSA provided written comments (reprinted in appendix XIII) in which it  agreed with the recommendation. The agency stated that it planned to  finish developing an IT Workforce Strategy by the end of fiscal year 2019,  which is to provide a framework to address its future IT workforce needs.  In addition, the agency stated that, in fiscal year 2020, it expects to begin  implementation of activities to address our findings. SSA also provided  technical comments which we incorporated, as appropriate.

In written comments (reprinted in appendix XIV), USAID stated that it  concurred with the recommendation. The agency said that it was taking  actions to fully implement each of the seven IT workforce planning  activities that we identified as not fully implemented. USAID added that it  expects to complete these actions by the end of the first quarter of fiscal  year 2021.

One agency—Education—partially agreed with the recommendation.  Specifically, in written comments (reprinted in appendix XV), Education  stated that it has taken actions to address the workforce planning  activities. For example, with regard to the assess competency and  staffing needs regularly activity, the agency stated that, in fiscal years  2018 and 2019, it conducted assessments of competency and staffing  needs for employees coded as cybersecurity employees. However, the  agency did not provide supporting documentation, including  documentation showing that it had assessed or updated competency  needs since they were originally developed. As a result, we did not  change our rating for the activity.

For the assess gaps in competencies and staffing activity, Education  stated that it conducted a two-part competency assessment of all  employees with cybersecurity responsibilities in March 2019. However,  the agency did not provide documentation of the assessment. As a result,  we did not change our rating for the activity.

With regard to developing strategies and plans to address gaps in  competencies and staffing, Education stated that, in April 2019, it  submitted to OPM its action plan to address competency and staffing  gaps identified in its Cybersecurity Work Roles of Critical Need report.  However, the agency did not provide documentation of the plan. As a  result, we did not change our rating for the activity.

In addition, the agency described its planned efforts to fully implement   the remaining IT workforce planning activities, including developing an IT  workforce planning process and monitoring and reporting on progress in  addressing competency and staffing gaps.

Three agencies commented on our findings but did not state whether they  agreed or disagreed with our recommendations:  In comments provided via email on September 6, 2019, the Director of  Strategic Planning, Policy, E-government and Audits in Agriculture’s  Office of the CIO stated that the agency concurred with our findings. In  addition, the agency provided technical comments, which we have  incorporated in the report as appropriate.

In comments provided via email on August 26, 2019, an official from  Justice’s Office of the CIO stated that the agency concurred with our  findings.

In comments provided via email on September 5, 2019, the GAO liaison  coordinator for EPA’s Office of Mission Support provided comments on  the findings. The agency stated that, in April 2019, it submitted two action  plans to address Cybersecurity Work Roles of Critical Need to OPM  which it believes address the eight IT workforce planning activities. For  example, with regard to the establish and maintain a workforce planning  process activity, the agency stated that the workforce action plans  present a model on how the agency plans to fill critical needs related to  IT and application project management, and information systems  security. While the action plans describe efforts to be performed to  address gaps for specific work roles of critical need, they do not describe  an overall IT workforce planning process for the agency, to include how  the agency will continue to develop its competency and staffing  requirements, assess for gaps, and develop strategies and plans to  address the gaps. As a result, we did not change our rating for the  activity.

Further, with regard to the remaining workforce planning activities, the  agency stated that the action plans, which it had not previously provided  during the course of our review, include actions and milestones focusing  on evaluating skill gaps and assessing current training and development  opportunities. However, the agency did not provide documentation of the  underlying IT competency requirements or competency gap assessments  used to identify the gaps. As noted in our report, if an agency has not  developed competency requirements, it is not able to implement the  subsequent activities relating to competencies. On the other hand, the  agency has developed staffing requirements, and as a result we have  updated our rating for the staffing evaluation criteria within the develop  strategies and plans to address gaps in competencies and staffing  activity. However, EPA did not provide documentation showing that it had  implemented the strategies and plans to address staffing gaps, or  monitored and reported on progress in addressing staff gaps. As a result,  we did not change our ratings for these activities.

One agency did not agree with our findings. Specifically, in its written  comments (reprinted in appendix XVI), NRC stated that it did not agree  with the findings that it had not developed an IT workforce planning  process or IT competency requirements. With regard to the IT workforce  planning process, we noted in our report that NRC had developed a  workforce planning process that addressed all the key IT workforce  planning activities; however, we stated that the process did not define the  Chief Information Officer’s roles and responsibilities for implementing the  activities or how the plan aligns with mission goals and objectives. In its  response, the agency stated that its Management Directive 9.22, which  was not provided to us during our review, defines the Chief Information  Officer’s roles and responsibilities for implementing activities, including  workforce planning by developing and maintaining the agency’s  IT/Information Management Strategic Plan and enterprise IT/Information  Management roadmap in alignment with the NRC Strategic Plan, and  reviewing all positions with IT responsibilities requested in the budget  request to ensure the positions meet the ongoing requirements of the  agency. We reviewed the directive and determined that it addresses the  Chief Information Officer’s roles and responsibilities. In addition, NRC  identified parts of its workforce planning process, that it believes  addresses alignment with mission and goals. We reviewed these parts,  and agree with NRC that the plan addresses alignment with mission and  goals. We have incorporated the change into this report, including  changing the rating from partially implemented to fully implemented for  this activity. As a result, we modified the recommendation from fully  implementing eight activities NRC did not implement to fully implementing  seven activities it did not fully implement.

With regard to developing competency requirements, the agency stated  that it specifies competencies for all IT positions in its position  descriptions. However, NRC did not provide documentation of the  position descriptions or the related competencies. As a result, we are not  changing our not implemented rating for this activity. NRC also noted that  it has joined other federal agencies to develop career paths and  competency models for 64 IT security roles across the federal  government, and that this effort is scheduled to be completed in October,  at which time the agency will decide which of the models to adopt.

In addition, the following two agencies to which we made  recommendations in prior reports provided comments.

In its written comments (reprinted in appendix XVII), Defense stated that  it concurred with the overall contents of the report.

In comments provided via email on September 5, 2019, an official from  Treasury’s Office of the CIO stated that the agency agreed with all but  two of our findings in this report, associated with three of the activities.  First, the agency disagreed with our finding that it minimally implemented  the establish and maintain a workforce planning process activity, stating  that it has a department-wide workforce planning process that includes  the IT workforce. However, while the agency issued a policy in 2013,  which we reviewed during our engagement, that directs bureaus to  annually conduct workforce planning, it did not define a process for doing  so. In addition as we further note, in 2018, the agency issued guidance  addressing workforce planning issues for bureaus to consider in  developing their own processes. However, this does not constitute an IT  workforce planning process. Since Treasury did not provide any  additional evidence of an IT workforce process, we are not changing our  rating for this activity. Second, Treasury disagreed with our finding that it  did not implement the activities associated with monitoring and reporting  on its progress in addressing competency and staffing gaps. Specifically  the agency stated that it has designed and begun implementing a new  governance structure for workforce management that reinforces the  monitoring and reporting of workforce related issues to agency leadership  during quarterly performance reviews. However, as we note in our report,  the monitoring and reporting activities are dependent on the developing  strategies and plans to address competency and staffing gaps activity  which Treasury has yet to implement. Until Treasury develops such  strategies and plans, it cannot monitor and report on their progress.

We are sending copies of this report to interested congressional  committees, the Director of the Office of Management and Budget, the  secretaries and agency heads of the departments and agencies  addressed in this report, and other interested parties. In addition, this  report will be available at no charge on the GAO website at  http://www.gao.gov.

Should you or your staffs have any questions on information discussed in  this report, please contact me at (202) 512-4456 or HarrisCC@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix XVIII.

Appendix I: Objective, Scope, and Methodology

Our objective was to examine the extent to which federal agencies are  effectively implementing information technology (IT) workforce planning  activities. To address this objective, we relied on practices from GAO’s IT  workforce planning framework as criteria. The framework identifies eight  key IT workforce planning activities that, when effectively implemented,  can facilitate the success of major acquisitions. These activities are listed  in table 2.

To ensure consistent understanding and application of the activities in our  evaluations, we reviewed the supporting laws, policy, and guidance for  each activity and identified specific evaluation criteria. The criteria are  listed in table 3.

We reviewed IT workforce planning policies and other workforce planning  documentation for each of the 24 Chief Financial Officers Act of 1990  agencies, including workforce planning processes; competency  requirements; annual mission critical occupation resource charts required  by the Office of Personnel Management (OPM) which document staffing  requirements and gap assessments; strategies and plans to address  gaps; and reports on progress in addressing gaps. For the six agencies  for which we previously performed IT workforce planning assessments,  we reviewed the previously reported information and obtained and  analyzed updates, as appropriate.

We compared the information obtained to our evaluation criteria and  identified gaps and their causes. We also interviewed cognizant officials  from each of the 24 agencies, to discuss their implementation of the IT  workforce planning activities and causes for any gaps. Our review  focused on the agency’s IT workforce planning efforts at the agency level,  including the extent to which the agency maintained visibility and  oversight into component-level IT workforce planning. Based on our  assessment of the documentation and discussions with agency officials,  we assessed each agency’s implementation of our evaluation criteria as:  fully implemented—the agency provided evidence which showed that  it fully or largely addressed the elements of the criteria. partially implemented—the agency provided evidence that showed it  had addressed at least part of the criteria. not implemented—the agency did not provide evidence that it had  addressed any part of the criteria.

To determine an overall rating for each of the eight key workforce  planning activities, we summarized the results of our assessments of the  evaluation criteria. Specifically, we assessed each activity as:  fully implemented—the agency fully implemented both of an activity’s  evaluation criteria.  substantially implemented—the agency fully implemented one of an  activity’s evaluation criteria and partially implemented the other  evaluation criteria. partially implemented—the agency fully implemented one of an  activity’s evaluation criteria and did not implement the other criteria, or  partially implemented both of an activity’s evaluation criteria. minimally implemented—the agency partially implemented one of an  activity’s evaluation criteria and did not implement the other evaluation  criteria. not implemented—the agency did not implement either of an activity’s  evaluation criteria.

We assessed the staffing evaluation criteria for the develop competency  and staffing requirements, assess competency and staffing needs  regularly, and assess gaps in competencies and staffing activities as fully  implemented if agencies provided evidence of a complete mission critical  occupation resource chart to meet OPM reporting requirements and were  able to demonstrate that the mission critical staff represented most or all  of their IT workforce. In addition, we assessed the competency evaluation  criteria for these activities as fully implemented if agencies provided  evidence that they performed them for most or all of their IT workforce.

For the implement activities that address gaps activity, we assessed  agencies as having fully implemented the evaluation criteria on other  efforts if they provided evidence as having implemented at least four of  the efforts identified in the Federal Information Technology Acquisition  Reform Act (FITARA). We rated this evaluation criteria as partially  implemented if agencies provided evidence of having implemented fewer  than four of the efforts.

Finally, in making our assessments, we also considered the extent to  which an agency had implemented prerequisite activities. For example, to  implement the competency evaluation criteria for the develop strategies  and plans to address gaps activity, the agency needed to have also  implemented the competency evaluation criteria for the assess gaps in  competencies and staffing activity. We did not assess any activity higher  than the prerequisite activity.

We also determined if there was a common factor which led to the rating  for a particular activity. For example, we noted whether most agencies  partially implemented an activity because they had fully implemented one  of the evaluation criteria, but had not implemented the other criteria. To  determine the reliability of staffing data in the mission critical occupation  resource charts, we reviewed the charts for obvious errors and for  completeness and obtained clarification from agencies on identified  errors. We determined that the data were sufficiently reliable for the  purpose of this report, which was to determine the extent to which  agencies had implemented the key activities.

We conducted this performance audit from January 2018 to October 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Agencies’ Implementation of Key IT Workforce Planning Activities

This appendix contains assessments of the extent to which the 24 Chief  Financial Officers Act of 1990 agencies implemented each of the eight  key IT workforce planning activities identified in GAO’s information  technology (IT) workforce planning framework.

Appendix III: Comments from the Department of Energy

Appendix IV: Comments from the Department of Housing and Urban Development

Appendix V: Comments from the Department of Homeland Security

Appendix VI: Comments from the Department of the Interior

Appendix VII: Comments from the Department of Labor

Appendix VIII: Comments from the Department of State

Appendix IX: Comments from the Department of Veterans Affairs

Appendix X: Comments from the General Services Administration

Appendix XI: Comments from the Office of Personnel Management

Appendix XII: Comments from the Small Business Administration

Appendix XIII: Comments from the Social Security Administration

Appendix XIV: Comments from the United States Agency for International Development

Appendix XV: Comments from the Department of Education

Appendix XVI: Comments from the Nuclear Regulatory Commission

Appendix XVII: Comments from the Department of Defense

Appendix XVIII: GAO Contact and Staff Acknowledgments

In addition to the individual named above, the following staff made key  contributions to this report: Sabine Paul (Assistant Director), Scott Borre  (Analyst in Charge), Rebecca Eyler, Cassaundra Pham, Thomas B.  Rackliff, and Marshall Williams, Jr.

Identifying skill gaps and staffing needs is key to addressing the federal government’s IT workforce challenges.

We evaluated how major executive agencies implemented the 8 IT workforce planning practices in our framework, like recognizing key skills employees will need and planning for them.

Agencies made the most progress with 3 practices, including assessing gaps in skills and staffing.

We recommended that three-quarters of the agencies fully implement the practices to anticipate and respond to changing staffing needs and to control risks with critical IT systems. We made the same recommendation to the remaining agencies in 2016 and 2018.