Audit of the Millennium Challenge Corporation's Implementation of Selected Key Project Controls for the MCC Integrated Data Analysis System

We recommend that the Millennium Challenge Corporation's Chief Executive Officer develop a detailed, written plan to establish strong project management capabilities for information technology projects, with sufficient responsibility, authority, and resources to apply disciplined practices. The plan must include assigning a certified project manager to information technology projects with the required minimum competencies based on project risk and complexity.

We recommend that the Millennium Challenge Corporation's Chief Executive Officer develop written earned value management policies and procedures for information technology projects, as required by Office of Management and Budget memorandum M-05-23. At a minimum, this must include:
Performing surveillance reviews of the earned value management system.
Performing periodic compliance reviews of the earned value management system.
Establishing a performance baseline.
Conducting an integrated baseline review.

We recommend that the Millennium Challenge Corporation's Chief Executive Officer develop written policies and procedures to plan for, mitigate, monitor, and report on risks to information technology projects.

We recommend that the Millennium Challenge Corporation's Director of Contracts and Grants Management, in collaboration with the Chief Executive Officer, update the Contracts Operating Manual to include procedures for including risk management and earned value management in contracting actions, when required.

We recommend that the Millennium Challenge Corporation's Chief Executive Officer develop written policies and procedures to obtain written approval for relying on a contractor's systems development life cycle methodology.

We recommend that the Millennium Challenge Corporation's Chief Executive Officer develop written policies and procedures to address key decision points for information technology projects, including who is responsible for making those decisions and what information should be used as the basis for making those decisions.

We recommend that the Millennium Challenge Corporation's Chief Executive Officer, establish in writing what documentation must be prepared, updated, and maintained for information technology projects based on size and complexity of the project. At a minimum, this must include:
Office of Management and Budget Exhibit 300s
Project charters
Earned value management reports
Risk management plans and reports
Requirements documents
Reports to senior management

We recommend that the Millennium Challenge Corporation's Vice President for Compact Operations implement the following controls for the MCC Integrated Data Analysis System project before proceeding to the development phase to build additional functionality for the MCC Integrated Data Analysis System:
Risk management
Earned value management
Requirements management

We recommend that the Millennium Challenge Corporation's Senior Assessment Board review the Corporation's information technology project management capabilities and prepare a written determination regarding whether its weaknesses should be reported, tracked, and monitored as a material weakness pursuant to the Federal Managers' Financial Integrity Act of 1982.