Summary

  • GAO paid a contractor about $1 million in fiscal year 2021 to develop a five-year IT modernization plan. Its three-phase roadmap estimated roughly $29 million for implementation. Less than 18 months after finalization, GAO switched to an ongoing strategy without documenting that significant decision, according to its own inspector general.
  • The initiatives continued in large part: as of May 2026, GAO reported 39 of the original 61 complete, 14 ongoing, one canceled, one replaced and six paused. The audit's problem is the missing rationale for the governance change and a cost system that did not tag some smaller plan activities separately.
  • GAO concurred with two recommendations. It has chartered a Technology and Data Governance Board, while controls for decision records and future project cost tracking carried projected completion dates extending to December 2026 and February 2027. A dated decision log and traceable project costs will show whether the response works.

The plan had a price and a public audience

GAO's Office of Inspector General report, OIG-26-2, begins with an unusually tidy premise. In fiscal year 2021, GAO paid about $1 million to have a contractor develop an IT modernization plan. The plan laid out three phases over an estimated five years, with implementation initiatives projected at about $29 million. It covered preparation for cloud capabilities, governance processes and application migration, and gathered some existing modernization work under one roof.

Congress later asked GAO for a schedule, cost and implementation plan for resilient data-center infrastructure. GAO responded with a summary of the five-year modernization plan. Its public fiscal 2024 performance plan still spoke of that plan and the efficiency and resilience it expected to produce. The roadmap was therefore more than a file on an internal drive. It was part of the agency's answer to its overseers.

Then the operating model changed. Less than 18 months after the September 2021 plan was finalized, GAO evolved toward an ongoing modernization strategy. The former acting and current chief information officers told the inspector general that the five-year plan was no longer actively used when they arrived in February and May 2023. A strategy that rolls forward can be sensible for technology work. The missing piece was the decision record: who chose the change, on what evidence, with which cost and accountability consequences, and how Congress was to compare the new approach with the plan it had been shown.

The inspector general found no documentation of that turn. Staff turnover made the loss practical, not philosophical. Later executives responsible for modernization were not fully aware of the decision process that had led away from the plan. Officials suggested earlier leaders may have seen the change as an evolution rather than a discrete decision. That is precisely how major governance changes escape a paper trail: each meeting feels incremental until the old governing document is gone.

The projects survived the plan; their accounting labels did not

The audit gives the work its due. GAO reported that 39 of the original 61 initiatives were complete as of May 2026. Fourteen were ongoing, one canceled, one replaced and six paused. Most initiatives were carried into the new strategy. The arithmetic matters because a missing transition memo does not erase completed migrations or cloud preparation. It also prevents a convenient fiction that the five-year plan was simply executed from first page to last.

The second problem sits in the cost ledger. GAO did track IT spending. Some smaller initiatives, however, were entered as activities within larger projects, without being identified in the cost system as efforts from the original plan. Separating their costs would require manual review. An official told the inspector general that identifying the total cost of the plan's initiatives would not be cost-effective. The original $29 million was a forecast for implementing the roadmap, not a verified amount spent. The audit could not easily produce an actual total that readers could place against it.

This is how a plan loses its financial identity while its projects keep running. A leadership team can point to 39 completions. A finance system can show broad IT spending. Neither alone reconstructs which activities belonged to the promise described to Congress, what they cost, or why management changed the rulebook midstream. The gap is especially sharp at GAO, whose public reports routinely demand that other agencies preserve exactly this kind of trail.

A new board is a control proposal, not a receipt

The inspector general recommended two concrete controls to the acting chief operating officer: document significant decisions, including changes to major IT projects, and fully identify costs of major future projects so stakeholders can receive a reportable total. GAO agreed with both. In its written response in the original report, the agency described a spring 2026 integrated leadership model spanning its CIO, data and analytics chief, technology chief and information security chief.

GAO also said its Executive Committee had chartered a Technology and Data Governance Board. In the response's timetable, the charter was completed in June 2026. Internal controls in standard procedures and planning documents were projected for December 2026. A structured budget review was also projected for December, followed by a decision on appropriate cost-tracking detail and an implementation plan by February 2027. These dates describe GAO's proposed response. The inspector general said it would look for sufficient evidence before closing the recommendations.

A board can give the decision a room, but the room still needs a record. For a major change, the useful entry has a date, an owner, the old and new plan boundaries, the reason for the switch, its budget effect and the audience told about it. For costs, the useful entry ties each significant activity to a project and to a reportable total. Another committee without those two artifacts would leave the old defect wearing a fresh nameplate.

GAO's self-audit is valuable because it lays out both the progress and the break in the chain. The agency kept many initiatives moving. It also lost the documented argument for retiring the form of plan it had paid to create, and it could not quickly price the whole set of activities under that plan. A published decision log and cost-tagged future project record would change this assessment. Until those appear, the memorable number is the smallest one: about $1 million for a roadmap that did not leave behind a map of its own exit.

Sources