VA Software Asset Management: Adherence to Leading Management Practices Needed to Achieve Intended Outcomes

Summary

What GAO Found The Department of Veterans Affairs (VA) has not fully implemented selected leading planning and management practices for its enterprise software asset management (eSAM) program. eSAM is a department-wide effort intended to change how VA manages software assets by, among other things, requiring VA offices to coordinate with, and centrally report software license data to, VA’s IT management organization. This will require a change in organizational practices, given that VA programs have historically acquired their software independently. Department of Veterans Affairs’ (VA) Implementation of Selected Leading Program Planning and Management Practice Areas for the Enterprise Software Asset Management (eSAM) Program Selected practice area Overall assessment Strategic alignment ◔ Minimally implemented Stakeholder engagement ◑ Partially implemented Life cycle management planning ◑Partially implemented Managing changes needed to support the program ◔ Minimally implemented Governance framework ○ Not implemented Software license management ◔ Minimally implemented Source: GAO analysis of VA eSAM program documentation. | GAO-26-108641 In addition, VA has not fully implemented selected leading planning and management practices for its software license inventory project. Of the six selected practice areas, VA partially implemented two areas (scope management and risk management) and minimally implemented the other four areas (project governance, stakeholder engagement, resource management, and software license management). For example, VA documented certain project risks but did not document all identified risks in a register. It also did not develop planned responses (e.g., mitigation strategies) for them all, which limits VA’s ability to address the risks before they become issues. Further, VA has not engaged with all stakeholders to identify their needs, nor developed plans for doing so. As such, eSAM is at risk of performing work that does not meet stakeholder needs. Part of the reason for the shortfalls noted in the practice areas is that VA did not perform oversight to ensure that eSAM and the inventory project (1) finalized and received approval for several key plans and (2) followed the leading practices. VA officials stated that turnover in the IT management organization—including the absence of a permanent Chief Information Officer (CIO) since January 2025—impacted VA’s oversight of eSAM and the project. VA officials anticipated that, once a permanent CIO is on board, VA would consider implementing a new (1) IT governance board to oversee programs such as eSAM and (2) IT governance process. However, there are opportunities for current VA officials to provide oversight to the program and inventory project to ensure they continue moving forward to meet intended outcomes. Until VA fully implements the selected practices for eSAM and the inventory project, it may not achieve departmentwide software asset management. As such, it is also at risk of missing opportunities to achieve significant cost savings possible from analyzing departmentwide software license data to make informed investment decisions. Why GAO Did This Study VA spends billions of dollars annually on its IT and cyber-related investments, including for purchases of commercial software licenses. For fiscal year 2025, the department planned to spend about $985 million on software, including commercial software licenses. In 2015, GAO identified the management of software licenses as a focus area in its High-Risk report. GAO has also previously reported on the need for VA to ensure better management of software licenses. VA has taken actions intended to improve its software license management, including establishing the eSAM program, which includes a project to implement a centralized software license inventory, among other things. GAO was asked to review VA’s software asset management policies and practices. This report examines the extent to which VA implemented selected leading planning and management practices for its (1) eSAM program and (2) software license inventory project. GAO reviewed industry guidance on program and project management and leading software license management practices identified in its prior work and selected 12 planning and management practice areas to review (six for the eSAM program and six for the inventory project). The selected areas and practices relate to early planning and execution of the program and inventory project. GAO compared the guidance in these 12 areas to VA documentation and interviewed VA officials.