High-Risk Series: Critical Actions Needed to Urgently Address IT Acquisition and Management Challenges

What GAO Found

GAO has identified three major IT acquisition and management challenges: (1) strengthening oversight and management of IT portfolios, (2) implementing mature IT acquisition and development practices, and (3) building federal IT capacity and capabilities. To address these challenges, it has identified nine critical actions that the federal government urgently needs to take.

Nine Critical Actions Needed to Address Three Major IT Acquisition and Management Challenges

GAO has made over 1,800 recommendations to the Office of Management and Budget (OMB) and federal agencies aimed at improving their management of IT. However, many of these recommendations have not been implemented and many agencies continue to be challenged in effectively acquiring IT and managing IT projects. Of the 1,881 recommendations made since 2010 related to this high-risk area, 463 had not been implemented as of January 2025. GAO has also designated 69 as priority recommendations and, as of January 2025, 32 had not been implemented. Urgent actions are needed to address the ongoing challenges that the government faces in effective and efficient IT acquisition and management. Until OMB and federal agencies take the critical actions identified, they will continue to struggle with IT acquisitions that fail to consistently deliver capabilities in a timely manner, incur cost overruns and/or schedule slippages, and contribute little to mission-related outcomes.

Why GAO Did This Study

Federal agencies rely extensively on IT to carry out operations and fulfill their missions. Each year, the federal government invests more than $100 billion on IT. However, for several decades, GAO has reported that federal IT investments too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. Because of these challenges, GAO added the federal government's management of IT acquisitions and operations to its high-risk list as a government-wide challenge in 2015 and continues to designate it as a high-risk area.

Over time, this high-risk area has become increasingly more complex as technologies have matured and evolved. In addition, as technologies have changed, the skills needed to manage them have also changed.

This report provides an update to the IT acquisitions and operations high-risk area. To do so, GAO identified three key IT acquisition and management areas in which federal agencies face continued challenges and nine critical actions that the agencies need to take to address those challenges. GAO reviewed its prior reports and prioritized reports that were government-wide and had open recommendations, among other things. Based on the results of its work, GAO is renaming this high-risk area to Improving IT Acquisitions and Management.