Agile in Government: What GAO Reviews Keep Finding

Few organizations publish detailed, independent assessments of their own agile adoption. The U.S. federal government is an exception. The Government Accountability Office (GAO) has reviewed agile programs since at least 2012 and publishes its findings, recommendations and follow-up status. For a leader planning a transformation, in or out of government, it is one of the most useful public bodies of evidence available.

The stakes are large. GAO's Agile Assessment Guide (GAO-24-105506) notes that the federal government spends at least $100 billion annually on IT investments, and that GAO added management of IT acquisitions and operations to its high-risk list in February 2015.

This guide summarizes the recurring themes in GAO's work and what they suggest for planning.

The legal and policy backdrop

Federal agile adoption sits inside a specific framework. The Federal Information Technology Acquisition Reform Act, commonly called FITARA, enacted in December 2014, requires chief information officers at covered agencies to certify that certain IT investments are adequately implementing incremental development as defined in OMB capital planning guidance. GAO explains that OMB's implementing guidance called for covered agencies to use incremental approaches that deliver new or enhanced functionality to users at least every six months. FITARA also gives covered agency CIOs authority to approve IT contracts.

Around the same time, the government created the 18F office at the General Services Administration and the U.S. Digital Service, and published the Digital Services Playbook, whose fourth play is to build services using agile and iterative practices, and the TechFAR handbook on agile acquisition under the Federal Acquisition Regulation. GAO's guide lists these alongside later efforts such as the Department of Defense's software acquisition pathway.

Finding 1: the hardest problems are organizational

GAO's 2012 report (GAO-12-681) identified 14 challenges agencies reported when applying agile, grouped into organizational commitment and collaboration, preparation, execution and evaluation. Few were about team technique. They included trouble committing staff, procurement practices that may not support agile, customers who did not trust iterative solutions, compliance reviews that did not fit an iteration, and reporting, artifact reviews and status tracking that did not align with agile.

The same report identified 32 effective practices. Ten were used and found effective by officials from all five agencies studied, including starting with agile guidance and an adoption strategy, identifying and addressing impediments at both organization and project levels, and gaining trust by demonstrating value at the end of each iteration.

Finding 2: sponsorship has to reach the program office

GAO's guide recounts its 2019 review of the Mobile User Objective System (MUOS) program, which found the contractor lacked an agile advocate in the program office. Even after the contractor adopted agile, the program office directed it to plan all work across software builds to maintain control over requirements, which GAO characterized as similar to waterfall and inefficient in agile. GAO cites the Software Engineering Institute's view that without an agile advocate in a program's leadership, organizations tend to use only a partial or agile-like approach.

The lesson for leaders: executive endorsement is not enough if the managers closest to the work still run it the old way.

Finding 3: follow your own guidance

Several GAO reviews found programs that had adopted agile on paper but not in practice. In 2016, GAO found that the U.S. Citizenship and Immigration Services Transformation program had produced software increments but was not consistently following its own guidance and leading practices, and was not setting outcomes for its agile development. In 2017, GAO reported that the TSA's Technology Infrastructure Modernization program did not define key agile roles, prioritize system requirements or implement automated capabilities.

Finding 4: measure the transition itself

GAO's 2020 review of the Department of Homeland Security (GAO-20-213) found DHS had clarified expected outcomes for its transition, such as reduced risk of large, expensive IT failures, but had not tied those outcomes to target measures. "Without these," GAO wrote, "DHS will not know if the transition is achieving its desired results." GAO made 10 recommendations.

GAO's follow-up records show DHS later finalized agile core metrics: a July 2021 DHS guidebook requires programs to report monthly on six agile core metrics, such as availability, cycle time and unit test coverage, and by September 2022 DHS had established targets for those metrics and mapped them to its desired outcomes. As of August 2024, GAO listed the recommendation to establish agile training requirements for senior stakeholders as only partially addressed.

Finding 5: contracts and reviews must match the cadence

GAO's guide says agile contracts should include frequent deliverables rather than delivery milestones spanning several months, align oversight reviews with agile practices, and allow detailed requirements to be refined. The Digital Services Playbook's checklist makes the same point: structure contracts to request frequent deliverables, not multi-month milestones.

The Air Force's Space Command and Control program illustrates both progress and limits. In June 2023, GAO found the program substantially or fully met the agile adoption best practices at the team, program and organization levels. Program officials said multi-year contracts had hampered agile implementation, which they took steps to address in a January 2023 contract modification. Yet in the same review, GAO found the program's documentation and reporting did not give a clear picture of progress, and recommended consistent performance metrics and metrics tracking how much work remains. Adopting the practices did not, by itself, make progress visible to overseers.

Applying the lessons outside government

Most of these findings translate to any regulated or audited organization. Replace "contracting officer" with "vendor management," and "oversight body" with "investment committee," and the patterns hold. For planning purposes:

• Put compliance, procurement and oversight functions on the transformation roadmap from the start, not after teams hit them.
• Make sure sponsorship reaches the managers who direct day-to-day work.
• Audit your own adherence to your new guidance, as GAO does.
• Define target measures for the transition early, and report them.

Key takeaways

• GAO has published independent reviews of federal agile programs for over a decade, making it a rare public evidence base.
• FITARA and OMB guidance push federal programs toward incremental delivery at least every six months.
• Recurring findings are organizational: sponsorship, adherence to guidance, contracts, reviews and measurement.
• DHS's experience shows the value of tying transition outcomes to target measures.
• Adopting agile practices does not automatically make progress visible; reporting has to be designed too.

Sources

• U.S. Government Accountability Office, Agile Assessment Guide: Best Practices for Adoption and Implementation, GAO-24-105506 (reissued December 15, 2023)
• U.S. Government Accountability Office, Software Development: Effective Practices and Federal Challenges in Applying Agile Methods, GAO-12-681 (July 27, 2012)
• U.S. Government Accountability Office, Agile Software Development: DHS Has Made Significant Progress in Implementing Leading Practices, but Needs to Take Additional Actions, GAO-20-213 (June 1, 2020)
• U.S. DOGE Service, Digital Services Playbook