Summary

  • GAO examined 53 selected major IT investments at 12 agencies. Its documented-risk assessment showed more risk than the associated CIO rating for 24, matched 27, and showed less risk for two. The comparison used April 2025 ratings and the investment records available around that period; it is not a failure rate for the entire federal portfolio.
  • Agencies had not updated 21 of the 53 ratings within the timing their own processes required. Education and Health and Human Services also had rating processes that could run longer than OMB’s at-least-quarterly standard. OMB announced a replacement for the public IT Dashboard in April 2026 without a release date in that announcement.

A color can remain on screen after the risk has moved

The GAO report published on October 7 puts a precise question to the federal IT Dashboard: what does a risk rating describe if the investment changed after the rating was last touched? The site is meant to let agencies, the Office of Management and Budget, Congress and the public see whether major technology investments are on course. OMB writes the rules, the General Services Administration operates the site, and agency CIOs rate their own investments. The displayed color is an institutional judgment, not a sensor wired directly to a project.

GAO used fiscal 2025 budget records from 26 agencies to choose investments with at least $35 million of development activity. That yielded 53 investments at 12 agencies. It compared the CIO ratings visible in April 2025 with its own assessments built chiefly from March risk registers, review-board briefings, performance information and other official reports. A risk register is the uncomfortable part of the filing cabinet: the project has already written down what could go wrong, how likely it is and what it might cost. GAO did not have to invent a danger to see whether the public rating reflected the agency’s own documents.

Twenty-seven comparisons matched. In two, GAO assessed less risk than the CIO had shown. In 24, GAO assessed more. Five of those 24 were high risk in GAO’s analysis even though the agencies had rated them medium or lower. Seven were moderately high where CIO ratings were medium or lower. The other 12 were medium where the published rating was moderately low or low. Saying “24 low-risk projects were in trouble” would flatten those differences and turn an audit of ratings into an invented list of failures. The actual result is sharp enough: almost half the selected ratings made the underlying risk look smaller.

The discrepancy crossed institutions. GAO found at least one more-risk case at nine of the 12 selected agencies. All six selected Veterans Affairs investments fell in that group; Transportation had five of eight, Health and Human Services four of nine, Treasury three of four, and Homeland Security two of four. These fractions belong to GAO’s selected investments. They say where the comparison landed, not how every project at those agencies performed.

The clock is part of the rating

A good judgment about last quarter’s project can be a poor signal about this quarter’s. GAO found that 21 of its 53 selected CIO ratings had not been updated in time under the agencies’ own processes. That is a distinct measurement from the 24 more-risk comparisons. Some ratings can be stale and still align; others can be current and still understate risk. The audit does not give readers a licence to subtract one count from the other.

The timing failures had concrete rules behind them. Commerce, Transportation and GSA called for monthly updates yet missed at least one April 2025 update among the investments GAO reviewed. HHS and DHS called for quarterly updates but had not updated certain ratings in the three months before the comparison. Nine of the 21 late ratings belonged to HHS. Education’s process called for a semiannual rating. HHS allowed some components to work quarterly and others semiannually. Both processes could exceed OMB’s current at-least-quarterly guidance. A dashboard cannot make a six-month judgment newly useful by displaying it in real time.

CIO risk scores involve judgment. GAO acknowledges that an agency may weigh factors differently; GSA, for example, considers characteristics such as a high-value asset designation and funding risk. GAO tried to anchor its comparison in the agencies’ own risk registers and other performance records. It also found two investments that CIOs rated more severely than GAO did. This is why the audit is a contest between dated evidence and dated judgments, rather than a claim that every yellow or green mark was a lie.

Replacing the screen will not update the files behind it

The transition adds another clock. OMB said in April 2026 that it was taking steps to sunset the IT Dashboard and move to a streamlined system, but gave no release timetable in the announcement GAO reviewed. GSA said the existing site remained available in May 2026. The report also says OMB had not acted on an earlier GAO recommendation to improve oversight of troubled investments identified through CIO-rating data. A new interface can inherit the old rating history, or discard the history needed to tell when a risk was known. Both decisions matter more than the animation on the home page.

GAO made 17 new recommendations to nine agencies, aimed at the accuracy and frequency of CIO ratings. Five agencies agreed with all their recommendations. Homeland Security agreed with one and disagreed with another; Commerce and Defense disagreed; Treasury gave no position. Those responses are part of the oversight story, not a proxy for whether an individual investment is safe. The next test is visible: a risk register changes, the CIO rating changes on a dated schedule, and someone responsible for the investment decides what to do.

Heng Lu’s account of an agency problem in governance supplies a way to ask who controls a public signal and who bears the cost when that signal is late. It supplies none of GAO’s federal facts. Here the practical chain is plain. The project team documents risk; the CIO converts that record into a rating; OMB and the public use the rating to decide where to look. If the conversion lags, the oversight queue looks orderly while the underlying work keeps changing. The dashboard’s job is to make that lag impossible to hide.

Sources