The Office of Inspector General of the U.S. Department of Homeland Security ("OIG") has found that the Federal Emergency Management Agency ("FEMA") has not implemented federally mandated information technology ("IT") management practices essential for effective oversight of its IT environment.
Specifically, according to the OIG's audit, FEMA has not established an IT strategic plan, architecture, or governance framework to facilitate day-to-day management of its aging IT systems and equipment.
The OIG pointed out that, for example, following the hurricanes and wildfires in 2017, some FEMA personnel used their personal laptop computers in place of FEMA's official systems to keep pace with mission requirements.
The OIG said that it conducted its audit to assess the extent to which FEMA had implemented federally mandated IT management practices and to identify challenges to ensuring that FEMA's IT systems adequately supported mission operations.
The OIG attributed the deficiencies it found to FEMA's chief information officer's "limited authority to manage IT agency-wide," as well as to a "decentralized resource allocation approach that hinders funding for the centralized IT environment."
The OIG pointed out that these deficiencies were not new, and were reported in prior OIG audits throughout the last 13 years. The OIG said that, "[c]ontinuation of this approach impedes budgeting for long-term IT enhancements, leads to overspending, and causes unnecessary IT support efforts."
The OIG made four recommendations to address FEMA's "longstanding IT management and planning challenges, and better align IT resources with agency and mission priorities."
In particular, it recommended the following to FEMA's acting administrator:
- Provide the office of the chief information officer with the necessary authority and resources to implement required IT management practices in accordance with federal mandates.
- Promote IT planning and management as an agency-wide priority by establishing a policy to implement and enforce a centralized IT investment management framework.
- Direct a strategic planning effort to define FEMA's vision for IT, along with a funding plan, to demonstrate how FEMA will direct investments to better align IT resources with agency and mission priorities.
The OIG also made the following recommendation to FEMA's chief information officer:
- Develop a systems modernization approach that includes a plan for resolving IT integration, information sharing, and reporting deficiencies.
FEMA's management concurred with the four OIG recommendations.
Learn more: OIG-19-58.
Victoria Spears
Victoria Prussen Spears is senior vice president of Meyerowitz Communications Inc., a law firm marketing communications consulting company. A graduate of Sarah Lawrence College and Brooklyn Law School, Ms. Spears was an attorney at a leading New York City law firm before joining Meyerowitz Communications. She may be contacted at [email protected].