The funding equation starts at 300

Agencies used to give their IT business cases the casual treatment.'A few years ago, agencies could fill out a 300 in a few days without doing their homework and get passing grades,' said management consultant Jim Kendrick, president of the P2C2 Group Inc. of Kensington, Md.That's not surprising. The Exhibit 300 business case hasn't been around that long. It is a progeny of the Clinger-Cohen Act of 1996, which required agencies to take a more businesslike approach to IT investments and to ensure that those investments were selected according to mission needs.The business case was codified a year later in a rewrite of the Office of Management and Budget's Circular A-11, Planning, Budgeting, Acquisition and Management of Capital Assets.'OMB focused initially on IT because those projects were increasingly important to program delivery and increasingly big-ticket items that ran into trouble,' said Jonathan Bruel, a senior fellow at the IBM Center for the Business of Government.'Initially, business cases were much sketchier in what they provided, and OMB's level of analysis was accordingly much less systematic and rigid,' said Bruel, who spent 20 years at OMB, his last 10 as senior adviser to the deputy director for management.In recent years, creating a business case has become increasingly complex as OMB has overlaid new requirements and implemented an elaborate scoring system.It also has become an integral element of capital planning and investment control.'It's really a living document,' said Debbie Flickinger, director of program control for Customs and Border Protection's modernization office. 'The business case is important not only for procuring funding. For us, it's part of our investment management process. It's a good vehicle for documenting what our program is and what we expect to get from the program in terms of outcomes and performance measures.'It's important that the business case is not just viewed as an exercise to satisfy OMB requirements,' she added. 'It's a key document from an investment standpoint.'Many agencies are still catching up with the notion of the business case as a tight, integrated part of overall capital planning and program management.'The 300 is not just a one-time thing,' said Keith Kerr, director of the solutions group and business-case product manager for Robbins Gioia LLC of Alexandria, Va., which provides program management services to Customs and Border Protection, among other agencies.'Unfortunately, that's the way a lot of people approach this,' he said. 'They try to get a good score so they get the funding, then they put it in the closet, move on and then go through this fire drill again the next year.''The 300 is more like a final exam on what you're supposed to be doing all year,' said Kendrick, who serves as a management consultant to several federal agencies. 'You can't cram for the exam anymore. You have to be doing it on an ongoing basis.'While the business case has become valuable as a year-round capital-planning tool, it also plays a more pivotal role in the funding game itself. You can't give business cases the casual treatment anymore.Before anything else, you have to make the case to OMB, the funding gatekeeper, both to start new initiatives and keep ongoing projects alive.The content requirements of Exhibit 300 are no secret. OMB's Circular A-11 lays them out explicitly and clearly.You have to provide an acquisition plan, project-management strategy, alternatives analysis (with three alternatives to the proposed project), and risk inventory and assessment. You have to address performance goals and how they link to your agency's annual performance plan. You have to address privacy and security. You have to formulate lifecycle costs. You have to tie it to the Federal Enterprise Architecture.You have to demonstrate use of an Earned Value Management System, which integrates the scope of the project with cost and schedule milestones.Business cases also have to be linked to an array of federal mandates and laws. For example, you have to show how it supports the goals of the President's Management Agenda and how it complies with the Government Paperwork Elimination Act.'You can go through A-11 for all the pieces,' Bruel said. 'They all link back together. They are all of a piece.'Even once you have all the pieces, building a powerful business case goes far beyond simply meeting OMB's list of requirements.For starters, you have to understand the big picture, how the pieces fit together.'There's a technical way of satisfying each piece,' Bruel said. 'But the point is to understand the purpose of it all, which is why you would invest in this particular project. Is it a wise investment?'Each piece of the business case in A-11 is an important element, and failure on any of them could really sink the project,' he added.That's especially true in the area of IT security.'A wise investment is not going to be one that's full of security and privacy problems,' Bruel said.'Security is by far the most important thing that you could ever do in your business-case planning,' said William McVay, vice president for e-government solutions at DigitalNet Inc. of Herndon, Va.'Security is about the business of the organization, not about security,' McVay, a former senior policy analyst for OMB, told a conference on IT security in Washington earlier this year.'It's a problem if it looks like the security in the business case was put in at the last minute,' Kerr said. 'Security should get put right up front with the main functional requirements. In a lot of cases, that is still not happening.'Indeed, security should be integrated throughout the business case. Take the alternatives analysis section, for instance.'If security issues are not addressed in the alternatives, then those are not three viable alternatives,' McVay said.That's precisely why you have to include security managers on the business-case development team.In fact, it's critical that all managerial components of the agency provide input into a fully coordinated business case. Make it clear that developing the business case is serious business.'You don't want to create a committee of volunteers that just meets without doing anything,' Kendrick said. 'If you want to get to success, [you need input from] your contracting people, your budget people and your management people so you don't trip up somewhere along the way.'As for writing the business case, it's a good idea to give that lead role to the initiative's project manager, Kerr said.'We think the project manager needs to own the business case just like he drives the project,' he said. 'We've seen some cases where the business case gets parsed out to different functional areas and is written as individual stovepipe pieces.'To streamline the process, Kendrick suggests establishing a small 'roving team' of capital-planning and investment control specialists who can help managers develop or overhaul Exhibit 300s throughout the year.'A project manager for a big investment has a lot of things on his or her plate other than just worrying about OMB paperwork,' he said. 'A lot of OMB's documentation is similar and it's silly for every project manager to have to have a learning curve for everything.'Overall, it's critical to convey in the 300 how the project serves the agency's overall mission. And that point has to be made succinctly and cogently.'IT projects have got to support the mission of the particular department or agency,' said Bruel. 'And you've got to be able to articulate that in a way that can be stated practically in a sentence.'With the abundance of new requirements and business-case development becoming a year-round enterprise, is it prudent to hire an outside consultant to guide the business case process, as many agencies do?'I think in many cases it's necessary for agencies to get help because they don't have the skills in those particularly tough areas such as risk analysis, security and privacy,' Bruel said.'But at the end of the day, the 300 has to fit with the rest of the agency's budget request,' he added. 'If the 300 just stands out as an odd duck that doesn't satisfy the agency's mission requirements and doesn't reflect input by the rest of [the agency's functional managers], then OMB is going to be mighty suspicious.'The business case, certainly, is a necessary component to getting funding. But alone it's not sufficient.'The 300 is how you get into the game. But it simply gets you into the game,' Bruel said. He called it a qualifying round.'Funding happens from an overall perspective of the agency,' said Karen Evans, OMB's administrator for e-government and IT. 'Business cases are one of the many tools that OMB uses to make recommendations to go forward with an agency's budget.'A major factor is performance, Evans said.OMB isn't going to approve funding for a project if the program it supports is failing. It doesn't matter that the agency has submitted a brilliant business case.To this end, OMB has fused business cases to its Program Assessment Rating Tool process. If your program metrics aren't up to snuff, you can forget getting funding for the IT that supports it.As OMB says in A-11: 'A business case may score very high based on [the criteria] but if the program it supports is deemed ineffective there may be no business case that can be made for the investment.'But OMB officials are not looking just at current individual program and project performance. They're looking at an agency's overall track record on performance, Evans said.'You have to demonstrate success,' she said. 'It's past performance. Agencies have to show that they have a proven track record of completing projects on cost and schedule, meeting all their due dates, managing their dollars wisely. It's the same question we ask when we hire contractors. You have to look at the contractor's history and ability to perform.'