VA SOFTWARE ASSET MANAGEMENT:

Report to the Subcommittee on Technology Modernization,

Committee on Veterans’ Affairs,

House of Representatives

July 2026

GAO-26-108641

United States Government Accountability Office

A report to the Subcommittee on Technology Modernization, Committee on Veterans' Affairs, House of Representatives

Contact: Carol C. Harris at harriscc@gao.gov

What GAO Found

The Department of Veterans Affairs (VA) has not fully implemented selected leading planning and management practices for its enterprise software asset management (eSAM) program. eSAM is a department-wide effort intended to change how VA manages software assets by, among other things, requiring VA offices to coordinate with, and centrally report software license data to, VA’s IT management organization. This will require a change in organizational practices, given that VA programs have historically acquired their software independently.

Selected practice area	Overall assessment
Strategic alignment	◔ Minimally implemented
Stakeholder engagement	◑ Partially implemented
Life cycle management planning	◑ Partially implemented
Managing changes needed to support the program	◔ Minimally implemented
Governance framework	○ Not implemented
Software license management	◔ Minimally implemented

Source: GAO analysis of VA eSAM program documentation.  |  GAO-26-108641

In addition, VA has not fully implemented selected leading planning and management practices for its software license inventory project. Of the six selected practice areas, VA partially implemented two areas (scope management and risk management) and minimally implemented the other four areas (project governance, stakeholder engagement, resource management, and software license management). For example, VA documented certain project risks but did not document all identified risks in a register. It also did not develop planned responses (e.g., mitigation strategies) for them all, which limits VA’s ability to address the risks before they become issues. Further, VA has not engaged with all stakeholders to identify their needs, nor developed plans for doing so. As such, eSAM is at risk of performing work that does not meet stakeholder needs.

Part of the reason for the shortfalls noted in the practice areas is that VA did not perform oversight to ensure that eSAM and the inventory project (1) finalized and received approval for several key plans and (2) followed the leading practices. VA officials stated that turnover in the IT management organization—including the absence of a permanent Chief Information Officer (CIO) since January 2025—impacted VA’s oversight of eSAM and the project. VA officials anticipated that, once a permanent CIO is on board, VA would consider implementing a new (1) IT governance board to oversee programs such as eSAM and (2) IT governance process. However, there are opportunities for current VA officials to provide oversight to the program and inventory project to ensure they continue moving forward to meet intended outcomes. Until VA fully implements the selected practices for eSAM and the inventory project, it may not achieve departmentwide software asset management. As such, it is also at risk of missing opportunities to achieve significant cost savings possible from analyzing departmentwide software license data to make informed investment decisions.

Why GAO Did This Study

VA spends billions of dollars annually on its IT and cyber-related investments, including for purchases of commercial software licenses. For fiscal year 2025, the department planned to spend about $985 million on software, including commercial software licenses.

In 2015, GAO identified the management of software licenses as a focus area in its High-Risk report. GAO has also previously reported on the need for VA to ensure better management of software licenses. VA has taken actions intended to improve its software license management, including establishing the eSAM program, which includes a project to implement a centralized software license inventory, among other things.

GAO was asked to review VA’s software asset management policies and practices. This report examines the extent to which VA implemented selected leading planning and management practices for its (1) eSAM program and (2) software license inventory project.

GAO reviewed industry guidance on program and project management and leading software license management practices identified in its prior work and selected 12 planning and management practice areas to review (six for the eSAM program and six for the inventory project). The selected areas and practices relate to early planning and execution of the program and inventory project. GAO compared the guidance in these 12 areas to VA documentation and interviewed VA officials.

What GAO Recommends

GAO is making 18 recommendations to VA to fully implement selected leading planning and management practices for eSAM and the software license inventory project. VA concurred with all 18 recommendations.

 

 

 

 

CIO                              chief information officer

eSAM                          enterprise software asset management

FITARA                       Federal Information Technology Acquisition Reform
                                    Act

IT                                 information technology

MEGABYTE Act         Making Electronic Government Accountable by
                                    Yielding Tangible Efficiencies Act of 2016

OIT                              Office of Information and Technology

PMBOK® Guide         A Guide to the Project Management Body of
                                    Knowledge

SAMOSA Act              Strengthening Agency Management and Oversight
                                    of Software Assets Act

VA                               Department of Veterans Affairs                                 

VAMOSA Act              Veterans Affairs Management and Oversight of
                                    Software Assets Act of 2025

July 22, 2026

The Honorable Tom Barrett
Chairman
The Honorable Nikki Budzinski
Ranking Member
Subcommittee on Technology Modernization
Committee on Veterans’ Affairs
House of Representatives

The Department of Veterans Affairs (VA) spends billions of dollars annually on its information technology (IT) and cyber-related investments, including for purchases of software. For fiscal year 2025, the department planned to spend about $985 million on software, including commercial software licenses.

Effective management of software assets, such as commercial software licenses, can help organizations avoid purchasing too many licenses that result in unused software (which we refer to as over-purchasing). In addition, effective management can help avoid purchasing too few licenses (which we refer to as under-purchasing), which may result in noncompliance with license terms and lead to additional fees.

In 2014, we first reported on the need for agencies—including VA—to ensure better management of software licenses.[1] We noted that, to maximize the value of these investments, agencies should effectively manage them by, among other things, regularly (1) tracking and maintaining a comprehensive inventory of software licenses, and (2) analyzing agencywide software license data.

We also first identified IT acquisitions and operations as a high risk area in our 2015 High Risk report and continue to designate it as such today.[2] In that report, we identified the management of software licenses as a focus area, in part, because of the potential for cost savings. To that end, in May 2025, we reported that, since 2014, agencies had reported about $4.6 billion in cost savings related to better management of software licenses.

To improve VA’s software asset management, the department initiated its Enterprise Software Asset Management (eSAM) program in 2023. The program is to be a department-wide effort that is intended to change how VA manages its software assets. Historically, VA’s administrations, hospitals, and mission programs have acquired software independently to meet their needs without a requirement to report those acquisitions centrally or to coordinate with other existing contracts. The eSAM program plans to change the department’s software acquisition approach by (1) implementing a framework with new processes for managing software assets throughout their life cycle and (2) requiring offices and personnel to centrally report information about their software licenses to VA’s Office of Information and Technology (OIT)—which is responsible for managing the majority of VA’s IT-related functions, including the purchase of enterprise software licenses for use throughout the department. As of April 2026, VA officials stated that the eSAM program remains in an early planning phase.

The eSAM program includes seven proposed projects that are intended to enhance the platform[3] that supports the eSAM program; establish artificial intelligence and increase automation of tasks; and integrate eSAM data with data from other VA systems (e.g., financial systems and the repository of cloud software). The primary project is to implement a centralized software license inventory.[4] As of March 2026, VA had implemented initial functionality for this inventory and the project was continuing in its planning and early execution phases.

You asked us to review VA’s software asset management policies and practices. Our objectives were to determine the extent to which VA implemented selected leading planning and management practices for its (1) eSAM program and (2) software license inventory project.

To address our first objective, we reviewed leading industry practices for program planning and management from the Project Management Institute and leading software license management practices from our prior work.[5] These leading practices were grouped into performance domains (which we refer to as practice areas). We selected six practice areas to assess, including five from the Project Management Institute (strategic alignment, stakeholder engagement, life cycle management planning, managing changes needed to support the program, and governance framework) and one from our prior work (software license management). The selected practice areas aligned with the eSAM program’s formulation and planning phases.

From each of the six selected broad practice areas, we also selected practices within them for assessment. The selected practices were of particular importance to successful program and software license management.

To determine the extent to which VA had implemented the selected leading practices, we analyzed eSAM program policies, procedures, plans, and documentation and compared them to the selected practices. We also interviewed department officials responsible for managing the eSAM program to discuss the department’s implementation of the selected practices.

We rated VA’s implementation of each selected practice using a five-point scale: fully implemented, substantially implemented, partially implemented, minimally implemented, and not implemented. We also determined a summary rating for each selected practice area that reflected a composite of the selected practice ratings within the area.

To address the second objective, we reviewed leading project planning and management practices from the Project Management Institute and leading software license management practices from our prior work.[6] These leading practices were grouped into broad practice areas. We selected six practice areas to assess, including five from the Project Management Institute (project governance, stakeholder engagement, scope management, resource management, and risk management) and one from our prior work (software license management).

From each of the six selected practice areas, we also selected practices within them for assessment. Specifically, we selected practices that were applicable to earlier phases in a project’s life cycle, such as initiation and planning. The selected practice areas and practices are relevant to the ongoing planning and development phases of the eSAM software license inventory project.

To determine the extent to which VA had implemented the selected leading planning and management practices, we analyzed the department’s plans and project documentation for the eSAM software license inventory project, as well as relevant eSAM program policies and documentation, and compared them to the selected practices. We also interviewed cognizant VA officials about the department’s implementation of the selected leading practices for the inventory project.

For each selected practice, we determined whether VA had fully implemented, substantially implemented, partially implemented, minimally implemented, or not implemented the practice. We also determined a summary rating for each selected practice area that reflected a composite of the selected practice ratings within the area. For more detailed information on our objectives, scope, and methodology, see appendix I.

We conducted this performance audit from July 2025 to July 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

VA operates a centralized organization, called OIT, that performs most key functions intended for effective IT management. The office is led by the Assistant Secretary for Information and Technology, also known as VA’s Chief Information Officer (CIO). It is responsible for providing strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department. It also is responsible for working with its VA business partners, such as the Veterans Health Administration, to identify and prioritize business needs and requirements for IT systems.

Further, OIT is responsible for managing the majority of VA’s IT-related functions, including the purchase of enterprise software licenses throughout the department. The office’s budget for fiscal year 2026 is about $5.9 billion, which includes over $3.9 billion for operations and maintenance, nearly $1.4 billion for staffing and administrative support, and about $578 million for new development.[7]

As of April 2026, eSAM program officials estimated that VA manages millions of software licenses department-wide. The officials stated that the department had identified about 4,500 unique software titles (e.g., applications) installed on VA endpoints (e.g., laptops) and used over 200 Software as a Service titles.[8] However, OIT does not have complete visibility into, or data about, all of the software the department acquires or the agreements used to acquire those licenses.

Recent VA Efforts to Improve Software Asset Management

In January 2024, we reported on work we performed in 2022 and 2023 in which we determined that agencies’ (including VA’s) software product data were inconsistent and incomplete. We also found that VA had not yet implemented two key software license management activities for its five most widely used licenses: (1) tracking the software licenses that were in use and (2) regularly comparing its inventories of software licenses to purchase records. Further, VA had not developed and implemented procedures for both activities to determine whether its licenses had been over- or under-purchased. We recommended that the department implement these two key activities. As of May 2026, VA had not yet fully addressed the recommendations.

Since our prior audit, OIT has taken multiple actions intended to improve its software asset management, including establishing the eSAM program in late 2023. VA officials told us that they initiated the eSAM program, in part, to address the gaps we previously identified in the department’s software license management practices.[9] Specifically, VA began planning work on the eSAM program in October 2023 (during the final phase of our prior audit) and formally initiated the program in May 2024 when the program’s two original executive sponsors approved the eSAM charter (discussed in more detail later).

As of April 2026, VA OIT officials reported that the eSAM program remained in an early planning stage and the department was still establishing the program’s scope. The officials expected to implement the program through fiscal year 2028, but the program did not yet have an approved schedule (discussed in more detail later).

With the eSAM program, VA plans to centralize the license data about software products acquired by different VA business lines and offices. These data are currently stored in systems dispersed across the department and in its medical centers. Centralizing this data is intended to, among other things, give OIT visibility into all of the software licenses in use across the department and enable VA to incorporate analysis into purchasing decisions, optimize resources, and achieve cost savings.

Also as part of eSAM, VA intends to establish standard processes for managing software across the department. Implementing eSAM will be a change in organizational practices, given the planned involvement of OIT in the acquisition and management of software that programs have historically acquired without OIT (e.g., software acquired to support a mission program that was acquired using the program’s funds instead of VA’s IT budget).

The eSAM program includes seven proposed projects that are intended to implement a centralized software inventory and tools for tracking software usage; enhance the platform used for the inventory; and provide artificial intelligence and automation of tasks. The program is also intended to integrate the inventory with other VA systems, including its financial management system and repository of cloud software.

As we have previously reported, centralizing management of software licenses and establishing a comprehensive software license inventory are leading practices for software license management.[10] Centralizing software license management and establishing a comprehensive inventory of licenses can help agencies improve compliance with software license agreements, allow for agency-wide visibility and analysis of software licenses, and enable department-wide decisions on software purchases. For example, VA could analyze data from the inventory to identify multiple purchases of the same software product across the department and then decide to consolidate them into one centralized enterprise agreement and/or reduce the number of licenses acquired that are not getting used.

As previously discussed, of eSAM’s seven proposed projects, the primary project is to implement a centralized software license inventory.[11] VA officials stated that this inventory project initially began in 2023 as a small project with a much narrower scope focused on OIT’s software assets. In September 2024, OIT executed a contract to obtain contractor support for developing the centralized software license inventory. In 2025, the project grew to encompass all of VA’s software.

However, development of VA’s centralized software license inventory, a key focus of eSAM, achieved its initial deployment in March 2026 after a number of delays. Figure 1 depicts a timeline of key dates for the eSAM program, including those pertinent to the centralized software license inventory project.

Another action OIT took to improve its software asset management was conducting ad hoc analyses of its software license data that led to the department identifying opportunities for cost avoidance. For example, VA reported that, by centralizing its software licenses for one widely used software product into one enterprise agreement and ensuring that the department is only purchasing necessary software licenses from that vendor, VA expected to realize $136 million in cost avoidance from fiscal years 2025 through 2029.

Federal Laws and Guidance Related to Software Asset Management

In December 2014, Congress enacted IT acquisition reform legislation, commonly referred to as the Federal Information Technology Acquisition Reform Act or FITARA.[12] FITARA is intended to enable Congress to monitor covered agencies’ efficiency and effectiveness of IT investments, as well as enable it to hold agencies accountable for reducing duplication and achieving cost savings.[13] Among other things, FITARA contained a provision authorizing the General Services Administration to allow for the purchase of a government-wide software licensing agreement available for use by all executive agencies as one user.[14] In November 2015, the General Services Administration’s CIO testified that, at that time, software licensing terms and conditions varied not only from agency to agency, but even within agencies.[15] The CIO noted that varied purchase methods and limited visibility on pricing and terms created inefficiencies across government. By centralizing the acquisition and management of software licenses—both governmentwide and within agencies themselves—the federal government can reduce duplication of efforts and leverage the collective annual IT spending of the government to negotiate as one buyer, likely decreasing costs.

In addition, the Making Electronic Government Accountable by Yielding Tangible Efficiencies (MEGABYTE) Act of 2016 requires agency CIOs to establish a software licensing policy and comprehensive software inventory to track and maintain licenses, among other requirements.[16]

In June 2016, the Office of Management and Budget issued a memorandum that provided software license management guidance to federal agencies.[17] The memorandum stated that government-wide strategies were needed to increase the number and use of government-wide software agreements and optimize the government’s use of commercial and commercial off-the-shelf software agreements and licenses. Specifically, the guidance directed, among other things, that agencies

·       move to a more centralized and collaborative software management approach that includes appointing a software manager to be responsible for managing software licenses;

·       maintain an agency-wide inventory of software licenses; and

·       analyze inventory data to ensure compliance with software license agreements, consolidate redundant applications, and identify other cost-saving opportunities.

More recently, Congress has proposed legislation on improving software license management. Specifically:

·       In September 2025, legislation was re-introduced in Congress titled the Strengthening Agency Management and Oversight of Software Assets Act (SAMOSA) to provide Congress improved visibility of federal agency software asset management practices.[18] If enacted, the proposed legislation would build upon the 2016 MEGABYTE Act by requiring each agency to complete a comprehensive assessment of its software entitlements[19] and software inventories, which would be used to develop a plan for addressing costly, unnecessary licenses. In particular, the proposed legislation specifies that each agency must use the information from these assessments to develop a plan to consolidate software licenses and adopt enterprise license agreements by type or category of software.

·       In December 2025, additional legislation was introduced in Congress titled the Veterans Affairs Management and Oversight of Software Assets (VAMOSA) Act of 2025.[20] The proposed legislation calls for VA to develop a comprehensive policy for managing software assets, including establishing a comprehensive inventory of the department’s software licenses, identifying under-utilized licenses and vendor billing inconsistencies, and adopting cost-effective licensing strategies.

Software License Management Leading Practices

In a May 2014 report,[21] we identified leading practices that federal agencies can follow for managing their software licenses, including

·       centralizing management of software licenses,

·       establishing a comprehensive inventory of software licenses,

·       regularly tracking and maintaining comprehensive inventories of software licenses using automated discovery and inventory tools and metrics,

·       analyzing the software license data to inform investment decisions and identify opportunities to reduce costs, and

·       providing appropriate agency personnel with sufficient software license management training.

We assess VA’s implementation of these practices in this report.

VA’s eSAM Did Not Fully Implement Selected Leading Program Planning and Management Practices and Lacked Governance

The Project Management Institute’s The Standard for Program Management identifies guidance on principles and practices that are generally recognized to support good program management practices. The practices, which are grouped into broad practice areas,[22] are applicable to most programs, including software asset management programs like eSAM.[23] Five of the selected practice areas include practices designed to (1) support the strategic alignment of programs with organizational goals and objectives, (2) ensure stakeholder engagement,[24] (3) enable life cycle management planning (e.g., planning for managing program costs, schedules, risks, and performance), (4) support the management of changes needed in order to implement a program,[25] and (5) provide a governance framework. The sixth selected area, software license management, also contains leading practices that we previously identified that can help agencies improve their management of software assets.[26]

VA’s eSAM program has not fully implemented the selected leading program management practices. Specifically, of the six selected practice areas, VA partially implemented two areas (stakeholder engagement and life cycle management planning), minimally implemented three areas (strategic alignment, managing changes needed to support the program, and software license management), and did not implement one area (providing a governance framework). Table 1 identifies the department’s implementation of the six selected leading planning and management practice areas for the eSAM program.

Selected practice area	Overall assessmenta
Strategic alignment	◔
Stakeholder engagement	◑
Life cycle management planning	◑
Managing changes needed to support the program	◔
Governance framework	○
Software license management	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of VA enterprise software asset management program documentation. | GAO‑26‑108641

^aThe practice area ratings are summary ratings that reflect a composite of GAO’s ratings for the selected practices within each area.

VA’s eSAM Minimally Implemented Selected Strategic Alignment Practices and Lacked Complete Program Management Plans

VA minimally implemented the strategic alignment practice area for the eSAM program. Specifically, of three selected leading practices in this area, VA partially implemented one practice, minimally implemented another, and did not implement the remaining practice. Table 2 identifies the three selected strategic alignment leading practices and the extent to which VA implemented them for the eSAM program.

Selected practice	Summary of practice characteristics	Assessment
Establish a program business case	The business case establishes the authority, intent, philosophy of the business need, and program sponsorship, while providing direction for the structure, guiding principles, and organization of the program. It links the program to the organization’s strategic plan. The business case involves collaboration with key stakeholders and an assessment of the program’s investment against its intended benefits and describes success criteria to be maintained throughout the program, including planned tangible and intangible benefits. The business case is required as one of the deliverables before the program can be chartered and may be considered as the primary justification for an investment decision. Formulating a program is often exploratory in nature, looking at a number of possible alternatives to help ensure the ones best aligned with strategy and organizational preferences can be identified and approved for inclusion in the program.	○
Develop a program charter	A charter should justify the program, outline its vision for the end state and how it will benefit the organization, address key strategic drivers and the program’s relationship to the organization’s strategic objectives, and discuss the scope of the program. A charter defines the approach for ensuring that the program produces the expected benefits, including defining how projects and other components are configured to deliver the program and its intended benefits and managing interdependencies among their outputs. A charter also identifies the program’s assumptions, constraints, and dependencies.	◑
Create a program management plan	Program management plans outline major program events to aid in the development of more detailed schedules. Such plans should be continually updated in response to changes in the program’s environment and life cycle. Program planning also involves developing a program roadmap (a chronological representation of a program’s intended direction that depicts dependencies between major milestones and decision points and reflects the linkage between the organizational strategy and program work). Program management plans should address strategic alignment, executive ownership, program components, dependencies, and the period during which benefits are to be realized and sustained.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Establish a business case – not implemented. VA did not establish a business case for the eSAM program. According to VA officials, the department initiated planning for the program in 2023 in response to our prior work and recommendations we made.[27] Specifically, the Deputy CIO for End User Operations directed OIT staff to develop a comprehensive software license inventory and establish the eSAM program.

However, the department did not establish or obtain approval for a business case for the program. Without a business case for eSAM, VA began investing funds in the program without assessing the investment against the program’s intended benefits. According to VA officials, the department had spent approximately $800,000 on eSAM development in fiscal year 2025 and expected to spend a similar amount in fiscal year 2026. However, lacking a business case that assessed the investment against the program’s intended benefits, VA did not know—and still does not know—whether it is a sound investment. Further, by not establishing a business case, the department did not document how it considered alternative approaches and determined that the eSAM program was the optimal approach for how to achieve the program’s objectives and deliver the intended benefits.

·       Develop a program charter – partially implemented. VA developed an eSAM program charter, which the program’s two original executive sponsors approved in May 2024. The charter and other program documentation described the program’s purpose and vision for the desired end state, which is for OIT units to oversee the entire software life cycle, among other things. Other program documentation identified the department’s intent to establish governance, life cycle management, and oversight of software assets across the enterprise, and implement leading practices we previously identified for software license management.[28] The charter also addressed the program’s scope and the expected benefits for the program (e.g., improved software license management and increased visibility in determining when more licenses need to be purchased).

However, the eSAM charter did not identify (1) the program’s components (e.g., IT projects), (2) the approach for realizing the program’s benefits, (3) how the program is to manage interdependencies among the outputs of its components, and (4) how the program’s goals and objectives align with VA’s strategic objectives. For example, while the charter stated that the program aligned with OIT’s direction, it did not specify how it aligned and did not link the program’s goals and objectives to VA’s strategic objectives. The charter also did not identify the program’s assumptions, constraints, and dependencies.

·       Create a program management plan - minimally implemented. From February 2025 to August 2025, VA developed plans that addressed how the eSAM program intended to manage requirements, stakeholders, risks, and program performance. However, as of March 2026, the plans were still in draft and the department had not established time frames for when they will be approved. In addition, while the charter stated that the program intended to establish plans for managing eSAM’s IT projects, the program has not yet developed such plans.

Further, while VA developed a roadmap for the eSAM program that depicted six planned stages that were to occur from October 2023 to September 2028, this roadmap is now out of date. Specifically, certain critical tasks for stages one through three that were planned to occur between October 2023 and December 2025 (e.g., migrate information about commercial off-the-shelf software into the inventory and initiate VA-wide software asset management governance) were not yet completed, as of early March 2026. VA had also not updated the roadmap to reflect these delays and any impacts they may have on future program work. In addition, while the roadmap included time frames for the centralized inventory, it did not include planned time frames for the program’s other IT projects, including those intended to enhance the platform for the inventory, provide artificial intelligence, and integrate the inventory with other VA systems.

VA officials stated that turnover in the OIT organization impacted VA’s oversight of the program. Without ongoing oversight, OIT officials did not prioritize developing and finalizing program plans and ensuring the program fully addressed leading planning and management practices.

Until VA fully implements the strategic alignment leading practices, including updating (as necessary) and finalizing program plans, the eSAM program is at risk of planning and performing work that does not align with VA’s strategic objectives. The program is also at risk of failing to deliver expected benefits.

VA Took Steps to Identify and Analyze eSAM Stakeholders but Did Not Fully Develop Plans for Engaging with Them

VA partially implemented the stakeholder engagement practice area for the eSAM program. Specifically, of three selected leading practices in this area, VA substantially implemented one practice, partially implemented another, and minimally implemented the remaining practice. Table 3 identifies the three selected stakeholder engagement leading practices and the extent to which VA implemented them for the eSAM program.

Selected practice	Summary of practice characteristics	Assessment
Identify program stakeholders	Programs should establish a stakeholder register to list identified stakeholders, categorize their relationship to the program, identify their abilities to influence the program, document their degree of support for the program, and document other characteristics or attributes that could influence their perceptions and the program’s outcomes. The register should include key program stakeholders, such as the program sponsor, steering committee, program manager, organizational support functions, customers, and suppliers.	◕
Analyze program stakeholders	Analyzing program stakeholders involves categorizing them to highlight differences in their needs, expectations, or influence, and prioritizing them to focus on people and organizations with the most positive and negative influence on the program. Programs should also regularly review and update the register and stakeholders’ priority as the program progresses.	◑
Plan for stakeholder engagement	Stakeholder engagement plans should contain a detailed strategy and guidelines for stakeholder engagement, provide insight into how stakeholders are engaged in various program components, and document metrics for measuring the performance of stakeholder management activities. Providing guidelines and appropriate program plans and information to stakeholders helps to establish common, high-level expectations for the delivery of program benefits. Programs should maintain a log of all interactions with stakeholders, including documenting, prioritizing, and tracking stakeholder issues and concerns to help the entire program team understand the stakeholders’ feedback.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Identify program stakeholders – substantially implemented. In August 2025, VA developed a draft stakeholder management plan for the eSAM program that identified stakeholder groups and their roles, level of interest, and extent of their influence. The plan also identified key stakeholders, including the CIO, other OIT stakeholders, VA’s business lines (the Veterans Health Administration, Veterans Benefits Administration, and National Cemetery Administration), the Office of General Counsel, vendors and contractors, and end users. However, as of March 2026, the plan was still in draft and officials did not know when it would be approved. In addition, the department did not document the stakeholders in a register that would allow the program to regularly track, update, and analyze information about them.

As previously discussed, VA officials stated that turnover in the OIT organization impacted VA’s oversight of the program. Without ongoing oversight, OIT officials did not prioritize finalizing program plans, including the stakeholder management plan, and ensuring the program fully addressed leading planning and management practices.

·       Analyze program stakeholders – partially implemented. The draft stakeholder management plan identified each stakeholder group’s needs and expectations, a strategy for engaging with them, and a high-level engagement plan. The plan also categorized the groups as those who need to be managed closely, kept satisfied, kept informed, or monitored. However, VA was unable to provide documentation of a supporting analysis it conducted to categorize and prioritize its stakeholders. The eSAM stakeholder management plan also did not state that the program will regularly review or update the stakeholder list or analysis as the program progresses. Moreover, as discussed earlier, the plan was still in draft as of March 2026.

·       Plan for stakeholder engagement – minimally implemented. The stakeholder management plan identified a high-level strategy for managing stakeholders, how stakeholders are to be engaged, and four success measures (e.g., stakeholder satisfaction to be measured via surveys, timely stakeholder approvals). However, it did not specify guidelines for stakeholder engagement or state that a log (or similar mechanism) for tracking stakeholder engagement is to be developed (and VA has not developed such a log). In addition, the plan was still in draft as of March 2026, as previously discussed.

Further, leading practices call for stakeholder engagement to involve more than just communication; however, that was the plan’s primary focus. For example, while the plan stated that VA’s business lines are to have a role in establishing requirements, it did not address how the department intends to involve those stakeholders in establishing or approving requirements. Moreover, while the plan stated that the program intends to communicate with VA’s business lines by (1) getting their feedback and (2) providing them with training, it lacked detail about how or how often VA plans to obtain such feedback about requirements, what types of training it will provide to the business lines, and how, if at all, the training relates to their role in establishing requirements.

Until VA fully implements the stakeholder engagement leading practices, the eSAM program is at risk of planning and performing work that does not fully meet stakeholder needs and expectations. Moreover, without effective stakeholder management plans, the program may be unable to achieve department-wide usage of the inventory as intended.

VA Partially Implemented Life Cycle Management Planning Practices but Did Not Develop eSAM Cost and Schedule Estimates

VA partially implemented the life cycle management planning practice area for the eSAM program. Specifically, of three selected leading practices in this area, VA partially implemented two practices and minimally implemented one practice. Table 4 identifies the three selected life cycle management leading practices and the extent to which VA implemented them for the eSAM program.

Selected practice	Summary of practice characteristics	Assessment
Develop program cost and schedule estimates	Organizations use initial high-level cost estimates to decide whether to fund programs. Program cost estimation also involves developing and baselining estimates for the program’s components and updating and re-baselining the program budget when approved changes significantly impact costs. Schedule estimation begins with a high-level program schedule with major milestones. Next, programs develop and baseline an integrated master schedule, including schedules for component projects and dependencies among them. Managing the schedule involves tracking and monitoring the start and finish of all high-level component activities, monitoring the critical path, updating the integrated master schedule, and keeping it aligned with the program roadmap.	◔
Plan and manage program risks	Programs should develop an initial risk assessment by identifying key program risks, their relative likelihood and impact, and the organization’s willingness to accept and deal with them. Programs should establish a risk management strategy with risk thresholds, a high-level risk response strategy, and a process for communicating risks. Leading practices also call for organizations to establish and update a risk register and actively identify, analyze, accept, mitigate, or retire program risks. This involves monitoring risks and taking action to mitigate any negative consequences.	◑
Develop program performance management framework	A performance management framework for the program and its projects determines the optimum measurement, analysis, and dissemination of performance information to track progress against program objectives and baselines. Programs should continuously monitor performance to obtain insight into the program’s health and identify areas that may require special attention. Reporting on performance should include a summary of progress on all program components, whether the program’s goals can be met and benefits delivered, and the current status (e.g., work remaining to be completed, changes under consideration, and predictions about its future state).	◑

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Develop program cost and schedule estimates – minimally implemented. The program team defined a roadmap that provided a high-level program schedule with multiple planned phases. However, VA had not yet developed an integrated master schedule or cost estimate for the eSAM program. According to VA officials, as of March 2026, the department was in the process of developing a master schedule and high-level cost estimate. The officials further stated that VA was still in the initial stages of defining what will be needed to fully establish the scope of the program.

·       Plan and manage program risks – partially implemented. VA developed a risk management plan that called for risks to be identified, assessed, and tracked in a risk register. The plan also outlined a process for scoring identified risks based on their likelihood, impact, and risk level. Further, the plan called for the use of dashboards to monitor risks, monthly reviews of risks with stakeholders, and quarterly reporting to the CIO and Inspector General.

However, as of March 2026, the risk management plan was still in draft. In addition, while VA established a risk register for the inventory it is developing, as of March 2026, VA officials stated that the program was not yet monitoring risks using dashboards, meeting with stakeholders about risks, or reporting to the CIO or the Inspector General.

According to OIT officials in March 2026, the program has been prioritizing development activities and intends to address risk management in the future. In addition, as noted earlier, VA officials stated that turnover in the OIT organization impacted VA’s oversight of the program. Without ongoing oversight, OIT officials did not prioritize finalizing program plans, including the risk management plan.

·       Develop program performance management framework – partially implemented. In June 2025, VA developed a draft eSAM performance management plan that established six key performance indicators and targets and specified the frequency with which each should be measured. The plan also identified four success criteria, including demonstrating cost savings and software license optimization. In addition, the plan outlined the performance review process, which is to include: monthly internal team reviews of key performance indicators and trends; quarterly reporting to OIT leadership; an annual assessment of program maturity; and, if a need is identified through this assessment, the establishment of new performance goals.

However, the plan did not call for managing performance against cost or schedule baselines or include related metrics for assessing when the program needs corrective action to get back on track. The draft plan has also not yet been approved because OIT officials did not prioritize finalizing program plans, as previously discussed.

Until the eSAM program fully implements the life cycle management leading practices, VA is unable to hold the program accountable to cost, schedule, and performance targets. The department will also be limited in its ability to effectively manage eSAM program risks and mitigate potential issues before they occur.

VA Partially Analyzed Organizational Changes Needed for eSAM, but Lacked Complete Plans and Defined Leadership Roles

VA minimally implemented the change management practice area for the eSAM program. Specifically, of three selected leading practices in this area, VA partially implemented one practice and minimally implemented the other two. Table 5 identifies the three selected leading practices and the extent to which VA implemented them for the eSAM program.

Selected practice	Summary of practice characteristics	Assessment
Analyze the need for changes to support the program and how they impact the organization	Identifying or clarifying the need for change can help organizations manage changes needed to support their programs. Programs should actively involve stakeholders in group decisions and assess the organization’s readiness for change. Programs can involve stakeholders by, among other things, organizing workshops or interviews with the key stakeholders to (1) understand their needs and how they align with strategic objectives and (2) reach agreement on critical success factors for the change and how it will be measured. Analyzing the need for change involves: (1) assessing the systems and structures that need to be improved or that will support the change as well as the people and culture that can support or resist it; (2) identifying environmental factors or conditions not under the team’s control that may influence, constrain, or direct the program; (3) evaluating the impact that other change initiatives may have on the organization and its capacity to absorb additional change; and (4) estimating the likelihood and possible impacts of the change and proposing actions to enable the program to respond to such changes in a positive, rather than a disruptive, way.	◑
Establish the approach or process for implementing and communicating the change	Programs should define the change approach, ensuring the program’s capability to respond effectively to an evolving environment (e.g., through feedback). They should also establish measures for success of the change process. In addition, organizations should assess stakeholder support or resistance to the change by considering, among other things, the organizational culture and acceptance of change, attitudes about the program and its sponsors, and the ability to influence the program’s outcome. Programs are to use data from the change readiness assessment to plan to implement and integrate the change and ensure they allow enough time to absorb the change. This requires the right scheduling and sequencing of delivery activities and the preparation of the people and systems for the new reality.	◔
Have an executive sponsor or champion in order to ensure senior leadership buy-in	A program sponsor is an individual or group that provides resources and support for the program, advocates for it, and is accountable for enabling success. Among other things, the sponsor provides valuable guidance and support to the program manager and may support and assist the program manager in stakeholder engagement, among other activities. In many organizations, the program sponsor acts as the chairperson of the program steering committee and assigns and oversees the progress of the program manager. The program manager is also accountable to the program sponsor. The sponsor should have sufficient authority, influence, power, enthusiasm, and time to resolve any conflicts that impede the change in a timely and appropriate fashion and ensure leadership involvement throughout the change life cycle. Successful sponsors exhibit visible sponsorship and advocacy for the change effort, assess and mitigate any resistance to the change, and oversee the business and management issues that surface. During the program change process, the team works with the sponsor to confirm that the necessary resources are committed to the program and that the organization is ready for change.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition and Managing Change in Organizations: A Practice Guide and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Analyze the need for changes to support the program and how they impact the organization – partially implemented. In the 2024 eSAM program charter, VA identified that technology and policy changes are needed to support the program. The department subsequently determined that it may need to make changes to its 2015 policy on software asset management, including updating it to establish (1) centralized governance through an eSAM program office and (2) an authoritative system of record (the inventory) for tracking software licenses, among other things. However, as of March 2026, VA had not yet updated and implemented the policy. VA officials noted that, as of April 2026, the department did not have a permanent CIO (VA has not had a permanent CIO since January 2025). They stated that, before issuing an updated policy, they plan to wait for a CIO to be appointed so that person can review the proposed technology and policy changes to support the program.

Further, while VA began in early 2026 to actively involve certain stakeholders from outside OIT in group decisions about the changes needed to support the eSAM program, it had not yet held workshops or interviews about the changes with all key stakeholders. VA officials stated in March 2026 that the department was prioritizing conversations with the Veterans Health Administration because that administration comprises the majority of VA’s software usage. VA had also not yet assessed the department’s readiness for making changes to support the program, nor reached agreement with stakeholders on what the critical success factors of the changes will be and how achievement will be measured.

·       Establish the approach or process for implementing and communicating the change – minimally implemented. While the department identified mechanisms it plans to use to measure eSAM program success (e.g., using surveys to measure stakeholder satisfaction), it had not yet documented plans for how it will approach managing the changes required for the program to succeed or established measures for success of the change process. In January 2026, VA officials told us that the program is aware of several potential risks that may impact the success of the program. For example, the officials described potential organizational culture issues, as well as resistance to (1) process changes for how software acquisitions and licenses are managed and (2) the involvement of OIT in the acquisition and management of software that VA programs have historically acquired without OIT (e.g., software acquired to support a mission program that was acquired using the program’s funds instead of VA’s IT budget.) The officials said there may be a need to establish a department-wide policy to address those issues. However, they have not yet documented those issues nor established an approach for addressing them.

Further, as of April 2026, OIT had not yet developed a formal communications plan for the eSAM program; as such, it was unknown how OIT plans to communicate with and get feedback from stakeholders regarding the changes needed for the program to succeed. Officials stated that VA intends to develop this plan as the program matures and key processes, roles, and stakeholder needs become more clearly defined. However, they were unable to provide a date for when they would develop the plan.

·       Have an executive sponsor or champion in order to ensure senior leadership buy-in – minimally implemented. The eSAM program had two executive sponsors that signed the 2024 eSAM program charter. Specifically, the Deputy CIO for End User Services in OIT and the Executive Director for Contract and Operations Management in OIT’s Strategic Sourcing Office signed the program charter.

As of April 2026, VA officials stated that the Executive Director for End User Operations within OIT serves as the executive sponsor for the eSAM program. However, VA did not document the change in sponsor in the charter. In addition, the current sponsor is also a lower level of management in VA’s organizational structure than the former sponsor (the Deputy CIO for End User Services in OIT). As such, it is unclear whether the current sponsor has sufficient authority, influence, and power to (1) resolve any conflicts (e.g., stakeholder resistance to process changes) that may impede the implementation of the eSAM program and (2) ensure that the changes are successfully implemented.

Further, the department had not yet defined, in an approved policy or program plan, the roles and responsibilities for the (1) executive sponsor, (2) program manager, and (3) VA leadership positions (e.g., the CIO and each Deputy CIO within OIT’s organizations) responsible for supporting eSAM and managing any needed organizational changes. In 2025, VA had drafted proposed revisions to its software asset management policy that identified eSAM-related responsibilities for VA leadership, but as previously noted, the updated policy was not yet approved as of April 2026 because VA was waiting for a permanent CIO to be appointed before finalizing the policy.

Moreover, it was unclear whether the eSAM program has full senior leadership buy-in. Specifically, while VA officials told us that the Deputy CIO and former CIO had provided approval for the program in May 2024, they were unable to demonstrate any subsequent involvement from those officials or any program approvals that they had granted since then. In addition, VA has not had a permanent CIO since January 2025 and, as discussed in more detail later, no governance council has approved the program. More recently, in mid-December 2025, VA officials began briefing a new Senior Advisor for OIT (who was subsequently appointed by the Secretary of Veterans Affairs as the Deputy CIO in February 2026) about eSAM, but VA was unable to provide documentation of any approval, feedback, or guidance the advisor provided to the program.[29]

Until VA fully implements the change management practices for the eSAM program, the department is at risk of being unable to effectively manage the organizational and cultural changes needed for the program to succeed. In addition, without effectively managing these changes, the eSAM program may be unable to meet its objectives and deliver its anticipated benefits efficiently and effectively.

VA Did Not Establish a Governance Framework for eSAM

VA did not implement the practice area for establishing a governance framework for the eSAM program. Specifically, VA did not implement either of the two selected leading practices in this area. Table 6 identifies the two selected leading practices and the extent to which VA implemented them for the eSAM program.

Selected practice	Summary of practice characteristics	Assessment
Establish a program governance plan	The governance plan should describe the systems and methods used to monitor, manage, and support a given program, and the responsibilities of specific roles for ensuring the timely and effective use of those systems and methods. In addition, a governance framework ensures that oversight is carried out by a review and decision-making group responsible for approving all program recommendations under its purview. The program governance plan should detail the organization’s expectations for governance framework reviews. For example, such reviews held at key decision points (e.g., at the end of a phase) in the program life cycle result in the review and approval of decisions about whether or not to continue to the next phase, continue with modification, or end a program or program component.	○
Define governance framework roles	A governance framework typically includes a program sponsor, a steering committee, a program manager, a program management office, project managers, and other stakeholders (including the portfolio manager and operational and product managers receiving capabilities delivered by the program).	○

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Establish a program governance plan – not implemented. In 2025, VA developed a draft charter for a proposed Technology Council—an executive-level IT governance board—that was intended to have responsibility for (1) performing enterprise governance and (2) creating a process to integrate technology governance between the new council and other existing VA boards or committees. VA had intended to escalate unresolved eSAM issues to the proposed council. However, while VA OIT officials had expected the council to begin meeting in October 2025, that did not occur. In May 2026, the officials stated that establishment of the council was on hold until a permanent CIO is appointed (as previously discussed, VA has not had a permanent CIO since January 2025).

In addition, the program has not established a program governance plan that documents the framework of systems and methods for monitoring, managing, and supporting the program. Consequently, the program has been operating since 2024 without fully established governance plans and processes, and without being authorized by an executive-level IT governance board.

As of May 2026, VA officials stated that the approval of plans to establish additional governance and oversight for the program is on hold pending the appointment of a permanent CIO. The officials anticipated that, once a permanent CIO is on board, the department would consider implementing a new (1) executive-level IT governance board to oversee programs such as eSAM and (2) IT governance process.

·       Define governance framework roles – not implemented. While VA appointed a program manager for the eSAM program, as noted above, the department had not yet formally established (e.g., in policy) the creation of a program management office nor defined its role, as of March 2026. In addition, the eSAM program lacked a program steering committee (such as the proposed Technology Council that was on hold as of May 2026). Further, while VA considered updating its software asset management policy to include documenting the responsibilities of the proposed Technology Council, an eSAM program director, and the eSAM program office, the department had not yet approved or implemented updates to that policy or eSAM governance roles because the department was awaiting the appointment of a permanent CIO.

Until VA establishes a governance framework for the eSAM program, the program will lack important oversight needed to ensure it is aligned with the department’s vision and strategic goals. The program will also lack a governance board or other oversight entity to review and approve program decisions, such as whether or not to continue to the next phase.

VA Took Initial Steps to Centralize Software License Management but Did Not Fully Develop Training Plans

VA minimally implemented the software license management practice area for the eSAM program. Specifically, of two selected leading practices in this area, VA minimally implemented one practice and did not implement the other. Table 7 identifies the two selected leading software license management practices and the extent to which VA implemented them.

Selected practice	Summary of practice characteristics	Assessment
Centralize management of software licenses	This practice involves employing a centralized software license management approach that is coordinated and integrated with key personnel (e.g., the acquisition and IT management personnel responsible for software purchases and decisions). Such an approach allows for centralized record keeping of software licensing details including the terms of the licenses. Further, agencies should centralize the governance and oversight of specific enterprise and commercial software licenses consistent with agency policy (e.g., software licenses reflective of the majority (80 percent) of agency software license spending and/or agency enterprise licenses) in order to make department-wide decisions.	◔
Provide appropriate agency personnel with sufficient software license management training	This practice involves providing appropriate agency personnel (e.g., legal, acquisition, technical, and user) with sufficient training on managing software licenses, including training on contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. Sufficient training allows organizations to develop the skills and knowledge of employees so they can perform their roles effectively and efficiently.	○

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of software license management practices identified in GAO‑14‑413 and VA enterprise software asset management program documentation. | GAO‑26‑108641

·       Centralize management of software licenses – minimally implemented. By initiating the eSAM program, VA had begun planning for and taking action to centralize management of software licenses, including developing proposed procedures for collecting data about such licenses from department units. However, as of May 2026, the establishment of the program office had not yet been approved, as previously discussed. VA had also not yet updated and implemented its software asset management policy to formalize the program and require central oversight of licenses or to fully address the seven elements of a comprehensive software licensing policy.[30]

·       Provide appropriate agency personnel with sufficient software license management training – not implemented. VA OIT officials noted that the department is still in the initial stages of establishing the scope of the eSAM program and, as such, they have not yet defined the program’s training needs and plans. The officials stated that proposed revisions to the department’s software asset management policy are expected to serve as the precursor to formalizing the training plan. The officials added that they plan to deliver training in a virtual, on-demand format to ensure accessibility across the enterprise.

Centralizing its management of software licenses, including implementing procedures for collecting data about licenses across the department, would position the department to more consistently and cost-effectively manage software throughout the department. Providing personnel with sufficient training on software license management would also help the department improve the efficiency and cost-effectiveness of its software acquisitions.

VA Did Not Fully Implement Selected Leading Practices for Planning and Managing Its Software License Inventory Project

The Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) identifies guidance on commonly used practices, activities, and processes that fit most projects, including eSAM’s centralized software inventory project.[31] The five selected project management practice areas are comprised of practices designed to (1) provide a governance framework to support project management decisions and optimize the project’s value delivery; (2) ensure effective stakeholder identification, analysis and engagement; (3) ensure that the scope and quality meet the project’s objectives and standards to maximize project value; (4) support effective and efficient planning for and utilization of available resources; and (5) support planning for and responding to risks.[32] The sixth selected area, software license management, also contains leading practices that we previously identified that can help agencies improve their management of software assets.[33]

VA did not fully implement selected leading planning and management practices for its project to establish a software license inventory.[34] Specifically, of the six selected planning and management practice areas, VA minimally implemented four areas and partially implemented the other two. Table 8 identifies the department’s implementation of the six selected leading planning and management practice areas for the software license inventory project.

Selected practice area	Overall assessmenta
Project governance	◔
Stakeholder engagement	◔
Scope management	◑
Resource management	◔
Risk management	◑
Software license management	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of VA Enterprise Software Asset Management program and project documentation. | GAO‑26‑108641

^aThe practice area ratings are summary ratings that reflect a composite of GAO’s ratings for the selected practices within each area.

VA Took Steps to Monitor Project Performance but Did Not Have Plans for Governance

VA minimally implemented the project governance practice area for the eSAM inventory project. Specifically, of three selected leading practices in this area, VA minimally implemented one practice and did not implement two practices. Table 9 identifies the three selected project governance leading practices and the extent to which VA implemented them for the inventory project.

Selected practice	Practice summary	Assessment
Authorize the project	Organizations should officially authorize the start of a project and grant the project manager the authority to allocate organizational resources to project activities, typically through the creation of a project charter or similar document. This authorization establishes a direct link between the project, the business case, and the organization’s strategic goals, creating an official record of the project and demonstrating the organization’s commitment to the project.	○
Develop a project management plan	Developing a project management plan involves specifying how the project will be executed, monitored and controlled, and closed. This involves integrating, aligning, and coordinating all plan components (e.g., scope, schedule, and resource management plans) and consolidating them into a unified project management plan or similar document. The primary benefit of this process is the creation of a thorough document outlining the basis for the various aspects of all project activities and how they will be executed. The project management plan should be documented and communicated to key project stakeholders.	○
Manage project execution and monitor performance	Project planning and management involves managing the project’s execution and monitoring its performance against the deliverables and objectives outlined in the project management plan.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Authorize the project – not implemented. VA officials stated that the software license inventory project initially began in 2023 as a small project with a much narrower scope focused on OIT’s software assets. In 2025, the project grew to encompass all of VA’s software. However, VA did not document leadership approval authorizing the project, nor develop and approve a project charter or similar document to authorize it. Officials noted that the project was initiated under different leadership.

·       Develop project management plan – not implemented. According to the eSAM program charter, VA intended to develop project-level management plans. However, VA was unable to provide documentation of any such project-level plans being developed for the inventory project.

In lieu of such project-level management plans, the inventory project could potentially follow the processes outlined in the eSAM program-level management plans. However, those program plans did not discuss the inventory project’s scope, schedule, and stakeholders; as such, it was unclear whether any aspects of the plans or processes should be modified for the project. Further, as previously discussed, those plans were still in draft and not yet approved, as of March 2026, because of leadership turnover and a resulting lack of program oversight.

·       Manage project execution and monitor performance – minimally implemented. The eSAM contractor provided weekly reports to the department about its progress developing functionality for the inventory. VA’s OIT project officials also stated that they meet with the contractor on a weekly basis to discuss progress and upcoming work. However, aside from the contractor’s progress reports, VA did not provide supporting documentation that demonstrated the department was managing project execution and monitoring performance.

Moreover, as previously discussed, VA developed draft plans for managing performance of the overall eSAM program but did not develop project-level management plans for the inventory project. As such, the department is unable to manage project execution against such plans. It also cannot monitor performance against the deliverables and objectives that should be outlined in such plans.

Until VA establishes effective governance for the centralized software license inventory, it will not be positioned to evaluate whether the project’s approaches are appropriate or determine if they should be modified. Moreover, the department may miss opportunities to identify problems with the project’s execution or performance early enough to prevent an impact on the project’s cost or effectiveness.

VA Identified, Engaged, and Communicated with Some, but Not All, Stakeholders

VA minimally implemented the stakeholder engagement practice area for the eSAM inventory project. Specifically, of three selected leading practices in this area, VA partially implemented one practice and minimally implemented two practices. Table 10 identifies the three selected stakeholder engagement leading practices and the extent to which VA implemented them for the inventory project.

Selected practice	Practice summary	Assessment
Identify stakeholders	Identifying project stakeholders involves selecting the individuals, groups, or organizations that have a stake in the project. Stakeholder identification also includes analyzing and documenting relevant information regarding their interests, involvement, interdependencies, influence, and potential impact on project success. Continuous stakeholder identification can work as a risk management strategy as the project environment evolves. This process is performed periodically throughout the project as needed.	◔
Manage stakeholder engagement	To plan for stakeholder engagement, projects develop strategies to engage identified project stakeholders based on their needs, expectations, interests, requirements, and potential impact on the project.	◔
Manage communications	Projects should plan for how to communicate with stakeholders, both inside and outside the team.	◑

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Identify stakeholders – minimally implemented. VA identified project stakeholders at each of the department’s business lines (the Veterans Health Administration, Veterans Benefits Administration, and National Cemetery Administration). In addition, as previously discussed, VA developed a draft eSAM stakeholder management plan that identified key program stakeholders, such as the CIO and OIT stakeholders, among others. However, the eSAM program-level plan did not specifically address whether the same stakeholders are included in the inventory project; their roles for the project (which may be different than for the overall program); and their interests, involvement, interdependencies, influence, and potential impact on project success. In addition, VA did not develop a stakeholder register to regularly track and analyze information about the project’s stakeholders.

·       Manage stakeholder engagement – minimally implemented. While VA took ad hoc actions to engage with stakeholders about the new software license inventory, it had not yet developed and documented a plan for when and how it would engage with all stakeholders. For example, to mitigate a risk the program identified regarding possible resistance to change from its business lines, the department planned to conduct stakeholder engagement. As part of this, VA officials stated in January 2026 that the department was prioritizing conversations with the Veterans Health Administration regarding its software and licenses because that administration comprises the majority of VA’s software usage. However, while VA identified points of contact for its other business lines (the Veterans Benefits Administration and National Cemetery Administration), OIT had not yet engaged those stakeholders in planning for the inventory because it had not made outreach to those stakeholders a priority.

·       Manage communications – partially implemented. VA took actions to communicate with certain stakeholders about the inventory project, but it had not yet communicated with all stakeholders. For example, as previously discussed, the project team began meeting with Veterans Health Administration officials in January 2026 to review the administration’s software titles. However, as of March 2026, the project had not yet held such meetings with VA’s other business lines (the Veterans Benefits Administration and the National Cemetery Administration). In addition, VA officials stated that the eSAM program used bulletins to communicate enterprise-wide changes to OIT stakeholders, as well as provides regular updates through existing progress reports and meetings. However, it was unclear whether and how such changes and updates would be communicated to stakeholders outside of OIT. Moreover, as previously discussed, VA did not document the specific stakeholders for the inventory project and did not have an approved stakeholder management plan; as such, it is unknown to what extent the project was appropriately communicating with all key stakeholders.

Until VA improves its stakeholder management plans and practices, the department is at risk of proceeding with deployment of a centralized software license inventory that may fail to meet the needs of stakeholders across the department. Moreover, the department may be unable to incorporate data about software products currently acquired and managed by the administrations and medical centers.

VA Did Not Fully Define the Project’s Scope, Break Down the Work Needed, or Plan for Controlling Scope

VA partially implemented the scope management practice area for the eSAM inventory project. Specifically, VA partially implemented all five of the selected leading practices in this area. Table 11 identifies the five selected scope management leading practices and the extent to which VA implemented them for the software license inventory project.

Selected practice	Practice summary	Assessment
Plan scope management	A scope management plan defines how the project will be delivered, establishes all of the work required to complete the project, and eliminates or removes unnecessary work that will not add value to the project.	◑
Elicit and analyze requirements	Eliciting project requirements involves defining and documenting stakeholders’ needs and requirements in order to meet project objectives. Project teams collect requirements in the form of user stories and then analyze and prioritize them in a backlog.	◑
Define scope and develop a project roadmap	To define a project’s scope, organizations should develop a detailed or high-level description of the project, product, and value to be delivered. To ensure projects’ progress, organizations also identify the quality requirements and standards for deliverables and how the project is to demonstrate compliance with them. This is typically documented in a high-level project roadmap that outlines product releases. The key benefit of this process is that it helps ensure that the stakeholders and project team understand the value that will be delivered through a product, service, or result.	◑
Develop product backlog and break down work	Projects should break down work into smaller, more manageable components. In Agile-based projects, this effort corresponds to the decomposition of the product backlog, where work items can be broken down into epics and user stories. The key benefit of this process is to provide a strategic view of the project’s scope and value, which helps the project team to be aligned and working toward a common goal.	◑
Monitor and control scope	To manage scope, projects should monitor the status of the project and manage changes to the scope baseline to ensure the fulfillment and quality of deliverables against the required standards and meets stakeholder needs. This process controls how requests for changes to the detailed project scope statement will be processed, while also ensuring the deliverables meet the specified quality requirements and that the scope and quality are aligned to the scope baseline.	◑

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Plan scope management – partially implemented. VA provided documentation outlining processes for evaluating and approving new inventory requirements. The documentation also described how development work is to be requested, approved, executed, tested, and deployed. In addition, VA’s proposal documentation for the project stated that scope changes would require a change request. However, VA did not provide evidence that these documents had been approved and the proposal documentation was not complete. Further, the department did not demonstrate that it had established a plan or process for developing and approving the initial scope baseline.

·       Elicit and analyze requirements – partially implemented. VA identified and documented certain inventory requirements in the form of Agile user stories.[35] Project officials also began meeting with Veterans Health Administration stakeholders in January 2026 to determine how to collect data about and manage the administration’s health-related software licenses. However, the project had not yet collaborated with all stakeholders to identify their needs because it had not made outreach to those stakeholders a priority. As such, it was unclear whether the project’s identified user stories fully address the requirements of all stakeholders.

·       Define scope and develop a project roadmap – partially implemented. In February 2025, VA developed a business case that described the inventory project’s high-level scope, as well as the product and value to be delivered. In addition, VA developed a roadmap that outlined planned product releases through September 2026. Further, the department established acceptance criteria for its user stories to help ensure that inventory development work meets quality requirements. However, as of April 2026, the business case and roadmap had not been approved due to leadership turnover and a resulting lack of oversight, and VA did not have documented time frames for when they would be approved. In addition, because VA had not yet collaborated with all stakeholders to identify their needs, it is unknown whether the planned releases will fully meet stakeholders’ needs and requirements.

·       Develop product backlog and break down work – partially implemented. VA developed a product backlog that prioritized the work the project team is to perform and broke down the work items into epics and user stories.[36] However, because the project had not yet collaborated with all stakeholders to identify their needs, it is unknown whether this backlog included all work necessary to implement the project.

·       Monitor and control scope – partially implemented. VA provided evidence demonstrating that it had monitored the project’s scope by identifying certain user stories that needed to be removed from the project. However, the project did not provide evidence demonstrating that it had controlled the project’s scope by implementing its established processes for evaluating and approving new inventory requirements, as previously discussed. Moreover, because the project had not yet collaborated with all stakeholders to identify their needs, it is unknown whether the project can determine that the deliverables meet all stakeholder requirements.

Without improving its practices for planning how to manage the scope of the centralized software license inventory project, including identifying requirements to meet the needs of all identified stakeholders, VA will not be positioned to manage the project’s scope efficiently. Moreover, it will lack a means for monitoring and controlling the scope of work for the project, increasing the risk of cost overruns or schedule delays.

VA Initiated, but Did Not Yet Complete, Planning for and Estimating Resource Needs

VA minimally implemented the resource management practice area for the eSAM inventory project. Specifically, VA minimally implemented both selected leading practices in this area. Table 12 identifies the two selected scope management leading practices and the extent to which VA implemented them for the inventory project.

Selected practice	Practice summary	Assessment
Plan resource management	Planning for project resources involves determining and identifying an approach to ensure that sufficient resources are available for the successful completion of the project, including consideration of and planning for the availability of scarce resources. This process establishes the approach and level of management effort needed to manage project resources based on the type and complexity of the project.	◔
Estimate resource needs	To estimate resource needs, projects identify the type, quantity, and characteristics of resources needed to complete the project. All aspects of the projects should be analyzed and considered to ensure that the appropriate resources are allocated efficiently. This process aids in anticipating potential resource shortages or surpluses, allowing for proactive adjustments. It also enhances the ability to manage resource allocation and usage risks.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Plan resource management – minimally implemented. VA took ad hoc actions to plan and address resource needs for the inventory project. For example, VA officials stated in March 2026 that the project had recently obtained approval from the program sponsor to add additional developer resources and enterprise architecture staff during the project’s development. However, officials stated they had not developed a resource management plan. VA also did not provide documentation demonstrating that it had established an approach for how it would estimate resources needed for the project and ensure that sufficient resources are available for it. VA did not develop a resource management plan for the inventory project because department leadership did not require such a plan to be developed. According to VA officials, they routinely evaluate workload demands and skill gaps to determine when additional resources are needed, but were unable to provide documentation of these evaluations.

·       Estimate resource needs – minimally implemented. VA provided an incomplete draft document that included two options for continuing development of the inventory. For each option, VA officials had identified the number of contractor development and testing staff needed, but did not identify other resources needed (e.g., government staff). In addition, the document was still in draft and the department had not made a decision about which option it would implement. The officials also did not provide a timeline for making this decision and obtaining approval for the resources identified. Moreover, VA had not yet developed a cost estimate for the inventory project, so it was unclear how much funding will be needed to fully implement it.

Without developing plans for managing resources for the software license inventory project, VA is at risk of not having enough staff to complete the necessary development work on time or to effectively adapt when new requirements are established. Moreover, VA may lack staff with the skills needed to execute the inventory project in a timely and cost-effective manner.

VA Planned for Risk Management but Did Not Fully Identify, Analyze, or Monitor Risks

VA partially implemented the risk management practice area for the eSAM inventory project. Specifically, of five selected leading practices in this area, VA substantially implemented one practice, partially implemented two practices, and minimally implemented two other practices. Table 13 identifies the five selected risk management leading practices and the extent to which VA implemented them for the inventory project.

Selected practice	Practice summary	Assessment
Plan risk management	Organizations should define processes for conducting risk management at the start of the project, typically through the development of a risk management plan.	◕
Identify risks	Risks should be identified and assessed as information becomes available and throughout the evolution of the project.	◑
Perform risk analysis	Risk analysis includes assessing the probability of risk occurrence and impact throughout the project.	◔
Plan risk responses	Planning for how a project will respond to risks includes developing options, selecting strategies, and agreeing on actions to address overall project risk exposure and individual project risks. Projects should assign individuals with responsibility for selecting and implementing an appropriate risk response strategy and monitoring risks. A risk owner is someone dedicated to managing risk, which includes assessing it thoroughly and ensuring appropriate response planning. Assigning an owner to a specific risk will ensure they own it, are accountable for it, and provide the right amount of detail in order to manage it effectively.	◑
Monitor risks	Risks should be monitored throughout the project, including monitoring the implementation of risk response plans, tracking identified risks, and evaluating the effectiveness of risk responses and processes throughout the project.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and Risk Management in Portfolios, Programs, and Projects: A Practice Guide (2024), and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Plan Risk Management – substantially implemented. VA developed a risk management plan for the eSAM program that (1) called for the identification and assessment of risks, and (2) provided guidance for managing risks and developing mitigation strategies. VA developed a risk register for the inventory project, in accordance with the program risk management plan. However, the plan did not explicitly document that the project should follow the program plan and, as previously discussed, the plan was still in draft as of April 2026.

·       Identify Risks – partially implemented. VA identified and documented certain risks to the inventory project but did not document all risks in a risk register, as called for in the draft eSAM risk management plan. For example, while officials documented four risks in the project’s risk register, they provided other project documentation that identified different risks that were not included in the risk register (e.g., risks related to implementing the vendor’s latest release of upgrades to the inventory system’s platform). In addition, officials verbally described to us another risk about the platform used for the inventory, but the project had not documented this risk. According to OIT officials in March 2026, the project has been prioritizing development activities and plans to address risk management in the future.

·       Perform Risk Analysis – minimally implemented. VA analyzed some, but not all, characteristics of the four risks included in the project’s risk register. Specifically, VA analyzed and documented the potential severity of the risks but did not analyze the probability of occurrence or potential impact of any of them. In addition, VA did not conduct risk analyses for the risks that it had identified and documented outside of the register, as discussed earlier. Further, although the register included a place to document projected risk realization dates, VA did not identify any such dates.

·       Plan Risk Responses – partially implemented. VA developed and documented mitigation strategies for most of the project risks it identified but did not develop such strategies for all risks. In addition, while the department assigned ownership for certain risks to various offices, it did not assign this ownership to specific individuals or positions. Moreover, it did not assign any ownership for certain risks. As such, it was unclear who would be held accountable for managing them effectively.

·       Monitor Risks – minimally implemented. While VA provided documentation of a contractor status report that identified inventory-related risks, the department was not monitoring these risks in its register. VA later encountered impacts from one of these risks, which delayed implementation of certain functionality.

In addition, VA did not provide evidence that it was evaluating the effectiveness or implementation of risk response plans or tracking actions due to address identified risks. For example, in its risk register, VA did not identify dates for implementing mitigation plans for any of the risks and also did not document updates on actions taken to implement those plans.

Until VA documents and analyzes all risks in its register and takes action to actively manage all identified project risks, the department is at risk of failing to act in time to address project risks before they become issues. In addition, unless VA improves its practices for monitoring risks, it may not take timely action to address or mitigate the impact of known risks.

VA Took Initial Steps to Centralize Software Management and Track and Analyze Licenses

VA minimally implemented the software license management practice area for the eSAM inventory project. Specifically, the department minimally implemented each of the three selected leading practices in this area.[37] Table 14 identifies the three selected software license management leading practices and the extent to which VA implemented them for the inventory project.

Selected practice	Practice summary	Assessment
Establish a comprehensive inventory of software licenses	This practice calls for establishing a comprehensive inventory of the software licenses consistent with agency policy (e.g., an inventory representative of majority (80 percent) of the agency’s software license spending and/or enterprise licenses). This inventory should incorporate automated discovery and inventory tools that provide easy search and access to software license information (e.g., contract terms and agreement records). Such a repository allows managers to monitor performance (e.g., how many employees are using software compared to the amount of software purchased) and conduct analysis reporting needed for management decision making. A comprehensive inventory will better ensure compliance with software license agreements and allow for agency-wide visibility that consolidates redundant applications and identification of other cost-saving opportunities.	◔
Regularly track and maintain comprehensive inventories of software licenses using automated discovery and inventory tools and metrics	Regularly track and maintain comprehensive inventories of software licenses using automated discovery and inventory tools and metrics (e.g., metrics related to employee usage and number of licenses purchased) to ensure that the agency has the appropriate number of licenses for each item of software in use to reconcile with current use. Agencies should track inventories and compare software licenses purchased with licenses installed regularly (e.g., at least annually) and consistent with their policies.	◔
Analyze the software license data to inform investment decisions and identify opportunities to reduce costs	Make decisions about software license investments that are informed by an analysis of department-wide software license data (e.g., costs, benefits, usage, and trending data). Such an analysis helps agencies make cost-effective decisions, including decisions about what users need.	◔

● = Fully implemented ◕ = Substantially implemented ◑ = Partially implemented ◔ = Minimally implemented ○ = Not implemented

Source: GAO analysis of selected practices from GAO‑14‑413 and VA’s enterprise software asset management program and project documentation. | GAO‑26‑108641

·       Establish a comprehensive inventory of software licenses - minimally implemented. In March 2026, VA implemented initial functionality for a new centralized inventory of software licenses (discussed in more detail later). Going forward, the department plans to add data about its different software products. VA also plans to implement additional tools to support its analysis of the department’s software license spending and enterprise licenses, including tools that automatically discover software in use. However, the newly implemented inventory did not yet contain sufficient data to be considered a comprehensive inventory.

·       Regularly track and maintain comprehensive inventories of software licenses using automated discovery and inventory tools and metrics – minimally implemented. In January 2026, VA officials stated that the department was using automated tools to track certain software. In addition, in March 2026, the department implemented initial functionality for the centralized software license inventory. However, VA had not yet completed development of the inventory, fully incorporated department-wide software license data, or fully implemented automated discovery tools and metrics intended to track software license usage across the department. In April 2026, department officials stated that they had begun adding data about certain licenses to the inventory and were working to implement tools intended to (1) discover certain software in use and (2) support metrics. However, VA officials stated that, for certain software products, they continued to conduct manual data calls on a quarterly basis to track information on how many licenses VA owned or was entitled to operate.

·       Analyze the software license data to inform investment decisions and identify opportunities to reduce costs – minimally implemented. As previously discussed, VA conducted ad hoc analyses of software license data that led to the department identifying opportunities for cost avoidance. For example, VA reported that it expected to realize $136 million in cost avoidance from fiscal years 2025 through 2029 by ensuring that it is only purchasing necessary software licenses from one vendor. However, as of April 2026, VA did not yet have complete department-wide data in the inventory to drive investment decisions and had not yet fully implemented tools and procedures for analyzing software license data to identify opportunities to reduce costs.

Until VA establishes a comprehensive software license management inventory, the department will be limited in its ability to improve the consistency of software asset management across VA. Moreover, until the department uses automated discovery and inventory tools and metrics and regularly analyzes software license data across the department, it will not be positioned to improve its investment decision-making about software assets or to identify opportunities to reduce costs, as expected.

Conclusions

For more than a decade, VA has struggled to improve its management of the millions of software licenses in use across the department. More recently, VA has taken actions aimed at strengthening its approach for managing these licenses, including implementing initial functionality for a centralized software license inventory. The department has also begun to identify opportunities for cost avoidance by analyzing its software licenses, including expecting to avoid more than $100 million in future costs by analyzing its use of licenses for one software product, centralizing them into an enterprise agreement, and ensuring it purchases those licenses from just that one vendor.

However, significant gaps in the department’s plans for the eSAM program and inventory project reduce VA’s assurance that the actions taken to date and planned are a sound investment that will improve software asset management. Specifically, without established cost and schedule estimates, engagement with all stakeholders, and ongoing program performance reviews, VA is not positioned to measure its progress and ensure eSAM and the inventory project achieve their intended results. This concern is further compounded by the lack of governance and executive leadership involvement in the program. Such oversight and guidance will be critical for managing the organizational changes needed to support the program. While VA put decisions about changes to IT governance and policy on hold pending the appointment of a new CIO, there are opportunities for current OIT officials to provide important oversight and guidance to, and approve program and project plans for, the eSAM program and its inventory project to ensure they continue moving forward to meet their intended outcomes. Until VA addresses the gaps we identified in its management practices for eSAM and the inventory project, the department is at risk of failing to meet stakeholder needs and not achieving department-wide usage of the inventory as intended. Moreover, VA may miss opportunities to achieve the potentially significant cost savings and efficiencies possible from centralizing software asset management.

Recommendations for Executive Action

We are making a total of 18 recommendations to VA.

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology updates the eSAM program charter to identify (1) the program’s components (e.g., IT projects); (2) the approach for realizing the program’s benefits; (3) how the program is to manage interdependencies among the outputs of its components; (4) how the program’s goals and objectives align with VA’s strategic objectives; and (5) program assumptions, constraints, and dependencies. (Recommendation 1)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology updates (as necessary) and finalizes the draft eSAM program management plans and program roadmap. (Recommendation 2)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology establishes a stakeholder register for the eSAM program and regularly reviews, updates, and analyzes the register as the program progresses. (Recommendation 3)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology develops a detailed strategy and guidelines for stakeholder engagement on the eSAM program, including how it plans to reach agreement with stakeholders on program requirements, and shares the strategy, guidelines, and other relevant program information with stakeholders to establish common, high-level expectations for the delivery of program benefits. (Recommendation 4)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology requires the eSAM program to log or document its engagement with stakeholders and track stakeholder issues and concerns to help the entire program team understand stakeholder feedback. The CIO should also require the eSAM program to document this requirement in a finalized stakeholder management plan. (Recommendation 5)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology establishes a baseline cost estimate for the eSAM program. (Recommendation 6)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology establishes a baseline integrated master schedule for the eSAM program and maintains it throughout the implementation of the program. (Recommendation 7)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology updates and implements the eSAM performance management plan to call for managing performance against cost and schedule baselines and include related metrics for assessing when the program needs corrective action to get back on track. (Recommendation 8)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology conducts a change readiness assessment to identify the need for changes to support the eSAM program, including assessing known risks, such as the potential for resistance to process changes for how software acquisitions and licenses are managed, and to the involvement of OIT in the acquisition and management of software that VA programs have historically acquired without OIT. (Recommendation 9)

The Secretary of Veterans Affairs should direct the department’s CIO to (1) ensure that the eSAM program sponsor has sufficient authority, influence, and power to resolve any conflicts (e.g., stakeholder resistance to process changes) impeding the successful implementation of the eSAM program, and (2) clearly define the roles and responsibilities for the executive sponsor, program manager, and VA leadership responsible for supporting the program. (Recommendation 10)

The Secretary of Veterans Affairs should develop and implement a governance framework that establishes how the department will review, oversee, and approve the eSAM program. (Recommendation 11)

The Secretary of Veterans Affairs should update VA’s software asset management policy to ensure that it fully addresses the seven elements of a comprehensive software licensing policy and incorporates the software license management leading practices described in this report. (Recommendation 12)

The Secretary of Veterans Affairs should direct the department’s CIO to review plans and progress for the software inventory project. (Recommendation 13)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology fully develops, approves, and implements plans for managing the eSAM software license inventory project—or use the eSAM program management plans and modify as needed to create sub-plans for the project—to define the framework within which decisions will be made and define how the project will be executed, monitored and controlled, and closed. (Recommendation 14)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology develops, implements, and maintains a detailed plan for identifying and managing stakeholders for the eSAM software license inventory project that addresses the leading stakeholder engagement practices included in our review. (Recommendation 15)

The Secretary of Veterans Affairs should direct the department’s CIO to direct that the Office of Information and Technology ensures that the inventory project (1) collaborates with all stakeholders to fully identify their needs and requirements and (2) follows established processes for evaluating and approving new requirements. (Recommendation 16)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology develops, implements, and maintains plans for estimating and managing resources needed for the eSAM software license inventory project, including identifying the type, quantity, and characteristics of resources needed. (Recommendation 17)

The Secretary of Veterans Affairs should direct the department’s CIO to ensure that the Office of Information and Technology establishes and maintains a comprehensive risk register for the eSAM software license inventory project that: (1) documents all project risks, (2) includes an analysis of the potential degree of impact and probability of occurrence for each risk, (3) documents mitigation strategies for each risk, and (4) assigns responsibility for risks to individual risk owners. (Recommendation 18)

Agency Comments

We provided a draft of this report to the Department of Veterans Affairs for review and comment. In written comments, reprinted in appendix II, the department concurred with all 18 recommendations. VA also stated that it intends to provide the steps taken and actions planned to address the recommendations in its 180-day update to the final report.[38]

We are sending copies of this report to the appropriate congressional committees, the Secretary of Veterans Affairs, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at HarrisCC@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Carol C. Harris
Director, IT Acquisition Management Issues

Our objectives were to determine the extent to which the Department of Veterans Affairs (VA) implemented selected leading planning and management practices for its (1) enterprise software asset management (eSAM) program and (2) software license inventory project.

To address our first objective, we reviewed leading industry practices for program planning and management from the Project Management Institute’s The Standard for Program Management and Managing Change in Organizations: A Practice Guide.[39] This standard and guide group the practices by performance domain (which we refer to as practice area). We selected five practice areas that are relevant to a program’s formulation and planning phases because they aligned with the eSAM program’s status when we initiated this review. Specifically, the five practice areas are designed to (1) support the strategic alignment of programs with organizational goals and objectives, (2) ensure stakeholder engagement, (3) enable life cycle management planning (e.g., planning for managing program costs, schedules, risks, and performance), (4) support the management of changes needed in order to implement a program, and (5) provide a governance framework.

In addition, we identified leading planning and management practices from our prior work. We then selected a sixth practice area for review, software license management.[40] This practice area contains leading practices that can help agencies improve their management of software assets.

For each of the six broad practice areas, we identified and selected for assessment practices from within them that are relevant to planning for and initial management of the eSAM program. Each practice has various characteristics associated with it.[41] We selected and assessed one or more characteristics for each practice. The selected practices and characteristics aligned closely with the status of VA’s eSAM program and were of particular importance to successful program management.

Table 15 identifies the six selected practice areas and the associated selected practices for each area.

Practice area	Selected practice
Strategic alignment	Establish a program business case
	Develop a program charter
	Create a program management plan
Stakeholder engagement	Identify program stakeholders
	Analyze program stakeholders
	Plan for stakeholder engagement
Life cycle management planning	Develop program cost and schedule estimates
	Plan and manage program risks
	Develop program performance management framework
Managing changes needed to support the program	Analyze the need for changes to support the program and how they impact the organization
	Establish the approach or process for implementing and communicating the change
	Have an executive sponsor or champion in order to ensure senior leadership buy-in
Governance framework	Establish a program governance plan
	Define governance framework roles
Software license management	Centralize management of software licenses
	Provide appropriate agency personnel with sufficient software license management training

Source: GAO analysis of program management practice areas and practices from the Project Management Institute’s The Standard for Program Management, Fifth Edition (2024) and Managing Change in Organizations: A Practice Guide (2013) and software license management leading practices from GAO‑14‑413. | GAO‑26‑108641

To determine the extent to which VA had implemented the selected leading planning and management practices for eSAM, we analyzed the department’s eSAM program policies, procedures, plans, and documentation and compared them to the selected practice characteristics. Specifically, we analyzed, among other things, the program charter, roadmap, and draft plans for managing risks, stakeholders, and performance. We also interviewed department officials responsible for managing the eSAM program to discuss the department’s implementation of the selected practices. These interviews included officials from VA’s Office of Information and Technology and Office of Acquisitions, Logistics, and Construction.

For each selected practice, we determined whether VA had fully implemented, partially implemented, or not implemented the selected characteristics within the practice. We assessed a characteristic as fully implemented if VA provided supporting documentation that demonstrated all aspects of the characteristic. We assessed a characteristic as partially implemented if VA provided supporting documentation that either demonstrated (1) some, but not all, aspects of the characteristic, or (2) all aspects of the characteristic. We assessed an characteristic as not implemented if VA did not provide any supporting documentation for that characteristic, or if the documentation provided did not demonstrate any aspect of the characteristic.

We used the results of our assessments of the selected characteristics to rate VA’s implementation of each selected practice.[42] Specifically, we used the following five-point scale:

·       Fully implemented: VA provided evidence that it had fully implemented all selected characteristics and none of the evidence was in draft form.

·       Substantially implemented: VA provided evidence that it had either

·       fully implemented the majority of selected characteristics and partially implemented the remaining selected characteristics;

·       partially implemented the majority of selected characteristics and fully implemented the remaining selected characteristics; or

·       fully implemented an equal number of selected characteristics as it had partially implemented.

·       Partially implemented: VA provided evidence that it had either

·       partially implemented all selected characteristics;

·       partially implemented more selected characteristics than it had fully implemented or not implemented;

·       partially implemented all but one of the selected characteristics (for practices with more than two characteristics); or

·       partially implemented one selected characteristic, fully implemented one selected characteristic, and not implemented one selected characteristic (for practices with three characteristics).

·       Minimally implemented: VA provided evidence that it had either

·       partially implemented the majority of selected characteristics and not implemented the remaining selected characteristics;

·       partially implemented three selected characteristics and not implemented two selected characteristics (for practices with five characteristics);

·       partially implemented an equal number of selected characteristics as it had not implemented; or

·       not implemented the majority of the selected characteristics and partially implemented at least one remaining selected characteristics.

·       Not implemented: VA did not provide evidence that it had implemented any aspect of any of the selected characteristics.

We also determined a summary rating for each selected practice area that reflects a composite of the selected practice ratings within the area. For example,

·       if both practices for a practice area were partially implemented, we rated the practice area as partially implemented.

·       if the three practices within a practice area were assessed as partially implemented, minimally implemented, and not implemented, we rated the practice area as minimally implemented.

To address the second objective, we reviewed relevant leading practices for project planning and management identified in the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide).[43] Similar to the Project Management Institute’s other guidance (as discussed earlier), this guide groups the practices by practice area.[44]

We selected five practice areas that are relevant to planning for and initial management of the software license inventory project, which aligned with the status of the project. Specifically, the five practice areas are designed to (1) provide a governance framework to support project management decisions and optimize the project’s value delivery; (2) ensure that the scope and quality meet the project’s objectives and standards to maximize project value; (3) ensure effective stakeholder identification, analysis and engagement; (4) support effective and efficient planning for and utilization of available resources; and (5) support planning for and responding to risks.[45] We also identified and selected a sixth practice area, software license management, that contains leading practices that we previously identified that can help agencies improve their management of software assets.[46]

For each of the six selected broad practice areas, we identified and selected for assessment practices from within them that are relevant to planning for and early management of the eSAM software license inventory project. The selected practices aligned closely with the current status of the inventory project. Specifically, they were applicable to earlier phases in a project’s life cycle, such as initiation and planning. The selected practice areas and practices are of particular importance to successful project management.

Table 16 identifies the six selected practice areas and the associated selected practices for each area.

Practice area	Selected practice
Project governance	Authorize the project
	Develop project management plan
	Manage project execution and monitor performance
Stakeholder engagement	Identify stakeholders
	Manage stakeholder engagement
	Manage communications
Scope management	Plan scope management
	Elicit and analyze requirements
	Define scope and develop a project roadmap
	Develop product backlog and break down work
	Monitor and control scope
Resource management	Plan resource management
	Estimate resource needs
Risk management	Plan risk management
	Identify risks
	Perform risk analysis
	Plan risk responses
	Monitor risks
Software license management	Establish a comprehensive inventory of software licenses
	Regularly track and maintain comprehensive inventories of software licenses using automated discovery and inventory tools and metrics
	Analyze the software license data to inform investment decisions and identify opportunities to reduce costs

Source: GAO analysis of project management practice areas and practices from the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Eighth Edition and The Standard for Project Management (2025) and Risk Management in Portfolios, Programs, and Projects: A Practice Guide (2024), and software license management leading practices from GAO‑14‑413. | GAO‑26‑108641

To determine the extent to which VA had implemented the selected leading planning and management practices for the software license inventory project, we analyzed the department’s plans and project documentation for the eSAM software license inventory project, as well as relevant eSAM program policies, procedures, plans, and documentation and compared them to the selected practices. Specifically, we analyzed, among other things, the draft eSAM inventory project proposal, the project’s schedule and roadmap, risk register, user stories, and relevant draft program plans for managing eSAM risks, stakeholders, and performance. We also interviewed cognizant VA officials about the department’s implementation of the selected leading practices for the inventory project.

We assessed VA’s implementation of each selected practice as follows:[47]

·       Fully implemented: VA provided evidence that fully satisfied the entire practice and none of the evidence was in draft form.

·       Substantially implemented: VA provided evidence that either (1) satisfied a large portion, but not all, of the practice or (2) fully satisfied the entire practice but at least part of the evidence was in draft form.

·       Partially implemented: VA provided evidence that satisfied about half of the practice.

·       Minimally implemented: VA provided evidence that satisfied a small portion of the practice.

·       Not implemented: VA did not provide any evidence that satisfied any aspect of the leading practice.

We also determined a summary rating for each selected practice area that reflects a composite of the selected practice ratings within the area. For example,

·       if all practices for a practice area were minimally implemented, we rated the practice area as minimally implemented;

·       if the practice area had five practices that were assessed as one substantially implemented, two partially implemented, and two minimally implemented, we rated the practice area as partially implemented.

We assessed the reliability of eSAM project management data (e.g., risk register, user stories, and schedule data) by reviewing related documentation, electronically testing the data for obvious errors and anomalies, and interviewing agency officials to discuss the completeness of the data. We determined that the data used in this report were sufficiently reliable, with the exception of the risk and schedule data. We discuss limitations with these data in the report.

As part of our overall assessment of the department’s efforts to manage the eSAM program and inventory, we assessed the relevance of standards for internal control.[48] We determined that the risk assessment and control activities components of internal control—the actions management establishes to identify or analyze risk and design policies, procedures to achieve objectives and respond to risks—were significant to both objectives. Of specific relevance were internal control principles that emphasize that management should: (1) define objectives clearly to enable the identification of risks and define tolerances, (2) identify, analyze, and respond to risks related to achieving the defined objectives, and (3) design control activities to achieve objectives and respond to risks.

We conducted this performance audit from July 2025 to July 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO Contact

Carol C. Harris at HarrisCC@gao.gov

Staff Acknowledgments

In addition to the contact named above, Emily Kuhn (Assistant Director), Amanda Gill (Analyst-in-Charge), Rebecca Eyler, Anh-Thi Le, Elizabeth Simonelli, Walter Vance, and Adam Vodraska made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what‑gao‑does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact‑us