|
|
FEDERAL
SECTOR REPORT
January 2004
IN THIS ISSUE
Improve
Scores on
Your OMB Exhibit 300s
Link of the
Month: Federal CIO CPIC Information
Consulting
Services
Home Page
IMPROVE THE
SCORES OF YOUR OMB EXHIBIT 300S
First of a
Three-Part Series on the Federal IT Capital Planning & Investment
Control Process
Funding for
federal information technology (IT) projects is becoming increasingly
competitive as more and more departments and agencies face a tightening
U.S. budget. Major IT projects, especially new initiatives, must score
well when OMB evaluates the Exhibit 300 Business Cases that support
project investments.
Background.
OMB has introduced a rigorous process for justifying major investments
in information technology. This process is known as Capital Planning
and Investment Control (CPIC), and the most visible part in the budget
process is submission of the Exhibit 300 Business Case to OMB. The
Exhibit 300 is defined in OMB Circular A-11, Section 300, and it is
a highly structured format submitted to OMB in Extensible Markup
Language (XML) code. The basic OMB guidance and a blank Exhibit 300
format are available at http://www.cio.gov/documents/s300.pdf.
Four years ago,
it was possible to fill up the OMB Exhibit 300 with platitudes, a few
numbers, and fuzzy promises of happy outcomes. That is no longer the
case, though we still observe some 300s that are written in
fantasyland. However, unless you do you your homework and prepare the
300 to score well, you risk being awarded a lump of coal or a switch
rather than
budget approval.
Last spring, an
OMB official told me that their reviews generally focus on priorities
that are not always obvious to IT system owners who oversee the
preparation of the Exhibit 300s. System owners tend to provide lengthy
narratives of need and justification of expenses. But they often fall
short on demonstrating sound homework in the areas of alternatives,
financial evaluation, earned value management, technical and business
architecture, risk, and security.
Today's scoring
system reminds me of a heartless banker. You could sing and dance about
how your company had a great future, but he would then go into the back
room and do his MBA number crunching. The computer would analyze
financial ratios and flows. Regressions would lead to trend analyses.
The banker would score the company and make a determination of whether
to
(1) provide a full line of credit if guaranteed with your life, (2)
award two dollars
and keep you on a short leash, or (3) offer
a tin cup so you could ask for money on a
Pennsylvania Avenue streetcorner.
Well, OMB may
not be heartless, but if you don't score well, you
may have to resort to the tin cup.
First in a
Series
This is the
first of
a series of three articles about how to improve
your agency's performance in management of
the Exhibit 300 Business Case process. All
three will be written within the context of
the broad CPIC process because the Exhibit 300 must reflect robust
CPIC management throughout a project's lifecycle.
This first
article focuses on the obvious but frequently ignored fact that your
Business Case must be prepared thoroughly with an intense focus on
scoring well, based on OMB's criteria. The second and third articles
will present:
- Steps for Developing New Exhibit 300
Business Cases
- How to Streamline
the Enterprise Management Process for Business Cases so You Don't Drown
in Paperwork
Go for the
Points
This first
article is perhaps the most difficult to write because it deals with
the obvious: OMB decision making is driven by published and well-know
rules. OMB is not arbitrary; it generally follows its rules ...
sometimes relentlessly. This leaves me sounding like a nag who fusses
about the obvious: "Wear your seat belt.
Eat your brocolli." But the bloody fact is
that many Exhibit 300 developers forget to focus on the points. Each
question must be answered to score the points, and this goes for having
detailed tables and timely milestone dates for risks, acquisition, and
security plans.
Reviewing OMB's
scoring system is about as exciting as eating broccoli, and one advance
reader of this issue of the newsletter gagged on reading through OMB's
language for top ratings needed to achieve a "5" on each of the ten
factors. But read it anyway, and memorize the rules for maximum points.
It may make the difference between budget funding and a tin cup.
Caveat: Hitch
Your Investment to an Effective Program, or Figure Out How to Make the
Program Effective. A good score on your Exhibit 300 Business Case
is just half the battle. A great business case that supports an
ineffective program will likely be torpedoed. As OMB states, "A
business case may score very high based on the criteria listed below
but if the program it supports is deemed ineffective there may be no
business case that can be made for
the investment." So you have two choices:
- Target IT investments to effective
programs that are cost efficient and achieve measurable results to
stakeholders and taxpayers
- Redesign weak programs and use IT
investments as part of the strategy for a major (and measurable)
turnaround.
A Perfect 50?
OMB's scoring
system has 10 factors, and a perfect score on individual factors is
weighted as 5. That means that a perfect Business Case would rate a
score of 50, a score that we've never seen achieved. Mid-40s is as high
as we've seen, and here are OMB's scoring categories:
- 41-50 Strong documented business cases
(including all sections as appropriate).
- 31-40 Very few weak points within the
business case but still needs strengthening
- 21-30 Much work remains to solidify and
quantify the Business Case
- 11-20 Significant
gaps in the required categories of the Business Case
- 1-10 Inadequate in every category of the
required Business
Case
Shooting for
Top Scores. In developing your Exhibit 300, you should aim to
prepare a Business Case that scores in the top rank (41 - 50). For a
new initiative, you will typically need three to eight months of time
to prepare your business case, depending upon complexity. The Exhibit
300 form can be prepared in as little as two weeks, but it is just the
tip of the iceberg: The form is a high-level document that simply
summarizes the CPIC requirements. You also must do your homework, which
encompasses many details:
- Lifecycle cost analysis
- Budget formulation and reviews
- A project description and justification
- Alignment with agency performance plans
and the President's management agenda
- Measurable performance goals
- A risk analysis and risk adjusted costs
- Cost-benefits analysis and Return on
Investment
- Acquisition Plan
- A detailed work breakdown structure with
schedule, milestones, and resources
- Alignment with the agency and Federal
Enterprise Architecture
- Information security documents
- A Privacy Impact Assessment
- Alignment with the Government Paperwork
Elimination Act and E-Governmen
|
READ
OUR FIRST LOOK AT THE NEW FORMAT
Send us your resume for
confidential review.
|
How to Score
a "5"
on Each Factor
To win a "5" for
each factor, you need to follow OMB's criteria for achieving the
maximum points. We have quoted verbatim the OMB criteria for each
factor's top score:
Life-Cycle
Costs Formulation (Multiple Sections). Life-cycle costs seem to
reflect formulation that includes all of the required resources and
is risk-adjusted to accommodate items addressed
in the RM. It appears that the investment
is planned well enough to come in on budget.
Supports the
President's Management Agenda Items (Multiple Sections of Exhibit
300). This is a collaborative investment that includes industry,
multiple agencies, State, local, or tribal governments, uses e-business
technologies, and is governed by citizen needs. If the investment is a
steady state investment, then an E-Gov strategy review is underway and
includes all of the necessary elements. If appropriate, this investment
is fully aligned with one or
more of the President's E-Gov initiatives.
Performance
Goals (Exhibit 300 Part I, Section I.C). Performance goals are
provided for the agency and are linked to the annual performance plan.
The investment discusses the agency's mission and strategic goals, and
performance measures are provided.
Project
(Investment) Management (Exhibit 300 Part I, Sections I.D and I.H,
and overall business case). Project is very strong and has resources in
place to manage it.
Alternatives
Analysis (Exhibit 300 Part I, Section I.E). 5 AA includes three
viable alternatives, alternatives were compared consistently, and
reasons and benefits were provided for
the alternative chosen.
Risk
Management (Exhibit 300 Part I, Section I.F). Risk assessment was
performed for all mandatory elements and risk is managed throughout the
investment.
Acquisition
Strategy (Exhibit 300 Part I, Section I.G). Strong Acquisition
Strategy that mitigates risk to the federal government, accommodates
Section 508 as needed, and uses contracts and statements of work (SOWs)
that are performance based. Implementation of the Acquisition Strategy
is clearly defined.
Performance
Based Management System (Exhibit 300 Part I, Section I.H). Agency
will use, or uses an Earned Value Management System (EVMS) that meets
ANSI/EIA Standard 748 and investment is earning the value as planned
for costs, schedule, and performance goals.
Enterprise
Architecture (Exhibit 300 Part II, Section II.A) for IT Only. This
project (investment) is included in the agency EA and CPIC process.
Project is mapped to and supports the
Federal Enterprise Architecture and is
clearly linked to the FEA Reference Models
(BRM, PRM, SRM, and TRM). BC demonstrates the relationship of the
investment to the business, data, application, and technology layers of
the EA.
Security and
Privacy (Exhibit 300 Part II, Section II.B). Security and privacy
issues for the investment are addressed, all questions are answered,
and a privacy impact assessment is provided in appropriate
circumstances. Security/privacy detail is provided about the individual
investment throughout the life-cycle to include budgeting for SE
[Security].
LINK OF THE
MONTH: FEDERAL CIO COUNCIL
CONSULTING
SERVICES
This is a great
time to explore quality options for consulting services. E-mail or call
to schedule a discussion with the P2C2 Group. Tell us more about
your needs, and we can recommend a solution
... complete with a project plan, a team,
and a cost estimate.
CPIC BRIEFING
We have prepared
a briefing for federal agencies about the CPIC process and our
services. Interested? Call us to schedule an appointment for our
one-hour mini-workshop.
|
OMB Uses A
5-Point Scale
This article
focuses on top scores (the "5" rating) for each of ten factors. We
believe that these should be the goals for all developers of Exhibit
300 Business Cases. However, each of the factors actually has a 5-point
rating scheme, and we are providing the scheme for one factor (Security
and Privacy) here:
Security and
Privacy (SE) (Part II, Section II.B)
5 Security and
privacy issues for the investment are addressed, all questions are
answered, and a privacy impact assessment is provided in appropriate
circumstances. Security/privacy detail is provided about the individual
investment throughout the life-cycle to include budgeting for SE.
4 Security and
privacy information for the investment is provided but there are
weaknesses in the information that need to be addressed.
3 Security and
privacy information for the investment is provided but fails to address
the minimum requirements.
2 Security and
privacy information points to an overall Agency Security Process with
little or no detail at this investment level.
1 There is no
security or privacy information provided for the investment.
|
HOME PAGE
We've just
completed an intensive project to support a new enterprise-wide
initiative at the U.S. Department of Agriculture. Our work involved
developing the:
- Requirements Analysis
- Questionnaire of User Requirements
- Lifecycle Cost Estimates and Integrated
Cost Models
- Risk Management and Mitigation Plan
- Cost Benefits Analysis and Alternatives
Analysis
- Enterprise-Wide Implementation Plan
- Privacy Impact Assessment
- Initial Information Security Documentation
- Exhibit 300.
Special thanks
to all
of the helpful people at USDA and our business partner, Disys, Inc.
We are
continuing our work at the Department of Labor, where we
look forward to supporting the Veterans Education
and Training Service through our business
partner, K.W.
Tunnell Company, Inc.
We are also
looking for additional projects. So please let us know if you hear of
challenging opportunities.
Jim Kendrick
4101 Denfeld
Avenue
Kensington, MD
20895
kendrick@p2c2group.com
301-942-7985
|
|
|
|
|