View source for Capital Planning and Investment Control (CPIC)

'''Capital Planning and Investment Control (CPIC)''' is a structured decision-making and governance process used by United States federal agencies to plan, select, fund, oversee, and evaluate investments in information technology. It connects agency missions and strategic plans with investment proposals, budget decisions, acquisition, implementation performance, and the results achieved during an investment's operational life. Its central purpose is to direct limited public resources toward justified IT investments while controlling risk and ensuring accountability for outcomes.<ref name="cio">Federal Chief Information Officers Council, ''CIO Handbook: Roles and Responsibilities'', [https://www.cio.gov/assets/files/Handbook-Roles-and-Responsibilities.pdf official handbook], section on Capital Planning and Investment Control.</ref>

CPIC is generally described through three connected activities: '''Select, Control, and Evaluate'''. Selection assesses prospective and continuing investments; control reviews performance and requires corrective decisions; evaluation compares actual outcomes with expectations and informs future choices. Agencies may add an explicit planning or pre-selection phase. The process is iterative: continued funding, changes in mission need, and results from operating systems can lead to renewed selection decisions rather than a one-time approval.<ref name="gao">U.S. Government Accountability Office (2004), ''Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity'', GAO-04-394G, [https://www.gao.gov/products/gao-04-394g report].</ref>

CPIC is a specific federal-government application of [[Information Technology Investment Management (ITIM)|IT investment management]]. Its scope extends beyond a capital budget or project delivery plan, covering governance of the investment throughout planning, acquisition, development, operation, evaluation, and possible retirement. The precise procedures, review bodies, reporting categories, and approval thresholds differ among agencies and are shaped by applicable law and current Office of Management and Budget (OMB) guidance.

== Purpose and context ==

Federal agencies must make technology decisions under mission, budget, security, acquisition, and public-accountability constraints. CPIC supplies a common investment-governance mechanism that connects these constraints. A proposed system may have a strong technical justification but still compete with more urgent mission requirements, create excessive long-term operating costs, duplicate existing capabilities, or present risks that its sponsoring program cannot manage.

A functioning CPIC process therefore asks whether a technology investment is needed, whether it is preferable to available alternatives, whether the agency can deliver and operate it, and whether the resulting capability produces the expected public value. Cost, schedule, technical risk, cybersecurity, accessibility, interoperability, and mission performance may be relevant to different decisions; they should not be reduced to a single financial return measure when benefits are primarily public-service outcomes.

CPIC also links [[Enterprise Architecture|enterprise architecture]], [[IT Governance|IT governance]], [[IT budgeting]], and [[IT Portfolio Management (ITPM)]]. Architecture helps assess fit with current and target capabilities; portfolio review exposes competing priorities; budgeting makes funding limits explicit; governance assigns the authority to approve, continue, change, or terminate an investment.

== The CPIC lifecycle ==

=== Planning and pre-selection ===

Many agency processes begin by identifying a mission problem, service deficiency, statutory obligation, modernization requirement, or security risk. Sponsors establish the need, desired outcome, possible options, cost assumptions, affected stakeholders, and dependencies. The result is a proposal suitable for comparative evaluation, rather than an automatic commitment to the first proposed technology.

A planning or pre-select step may be documented as a separate phase. For example, GAO's description of the Social Security Administration's process identifies Plan, Select, Control, and Evaluate, while GAO's general IT investment model emphasizes Select, Control, and Evaluate.<ref name="ssa">U.S. Government Accountability Office (2025), ''IT Investment Management: Social Security Administration Needs to Oversee Investments in Operations and Better Evaluate Performance'', GAO-25-107200, [https://files.gao.gov/reports/GAO-25-107200/index.html report].</ref>

=== Select ===

The '''Select''' phase compares investment proposals and continuing investments against mission requirements, strategic alignment, risks, expected benefits, costs, and affordability. The responsible decision body may approve funding, request further analysis, conditionally approve a proposal, defer it, or reject it. Selection is a portfolio decision: the best individual project may not be the best use of scarce resources when other investments are considered together.

Typical decision evidence includes an investment business case, alternatives analysis, lifecycle cost estimate, performance objectives, risk assessment, and architectural or security considerations. An agency should preserve the assumptions on which the decision was made so that subsequent reviews can test whether they remain valid.

=== Control ===

The '''Control''' phase provides oversight during acquisition, delivery, deployment, and, where applicable, ongoing operations. Reviews examine cost and schedule performance, achieved milestones, risks, issues, security posture, mission fit, and deviations from the approved baseline. Management may require corrective action, change the scope, rebaseline with appropriate authorization, suspend expenditure, or reconsider whether the investment should continue.

Control is not merely collecting status reports. Its distinguishing feature is the connection between observed performance and decisions by people with authority to act. GAO has documented agency CPIC control reviews focused on performance, schedule, cost, risk, security, and corrective action.<ref name="gao-control">U.S. Government Accountability Office (2003), ''Information Technology Management: Governmentwide Strategic Planning, Performance Measurement, and Investment Management Can Be Further Improved'', GAO-04-49, [https://www.gao.gov/products/gao-04-49 report].</ref>

=== Evaluate ===

The '''Evaluate''' phase tests whether an implemented investment delivered the capabilities and mission outcomes expected in its business case. Agencies may conduct post-implementation reviews, examine user and service performance, compare actual benefits and costs with forecasts, and identify lessons for future proposals and oversight.

An investment delivered on time and within budget may still disappoint if it does not improve mission performance. Conversely, an investment that encountered implementation difficulties may provide valuable outcomes that require more nuanced evaluation. Evaluation evidence should inform decisions to maintain, enhance, consolidate, replace, or retire the capability, as well as improvements to the CPIC process itself.<ref name="gao" />

== CPIC decisions, inputs, and outputs ==

{| class="wikitable"
! Decision point
! Typical inputs
! Typical decision or output
|-
| Define need
| Mission requirement, service problem, policy obligation, architectural context
| Investment concept and defined outcomes
|-
| Select and prioritize
| Business case, alternatives, costs, risks, benefits, portfolio constraints
| Approval, conditions, deferral, or rejection
|-
| Control performance
| Milestones, actual and forecast costs, delivery evidence, risk and security reports
| Continue, intervene, change, suspend, or reconsider
|-
| Evaluate outcomes
| Operating results, realized benefits, lifecycle costs, user and mission measures
| Findings, lessons, reinvestment, or retirement recommendations
|}

These are representative artifacts rather than a universal list of mandatory documents. An agency's governing policy and applicable OMB reporting instructions determine which records are required for a particular investment category.

== Governance and accountability ==

CPIC depends on documented decision rights. The exact organizational structure varies, but the following participants commonly contribute:

* '''Agency leadership and investment review boards''' evaluate competing mission priorities and authorize decisions within their delegated powers.
* '''Chief Information Officer (CIO)''' brings enterprise technology, architecture, investment oversight, and IT management considerations into agency decisions.
* '''Chief Financial Officer (CFO) and budget offices''' align investment proposals and performance information with financial planning, budget formulation, execution, and cost estimates.
* '''Program and mission owners''' define the operational need and remain accountable for business or mission results.
* '''Project and investment managers''' maintain delivery plans, risk and performance data, and evidence needed for oversight.
* '''Acquisition, security, privacy, and architecture specialists''' assess constraints that affect the feasibility, compliance, and sustainment of a proposed solution.

Decision authority should be distinguished from advisory participation. A review board can receive analyses from multiple specialists, but the agency still needs a clear record of who approved an investment, the conditions imposed, and who is responsible for follow-up.

== Policy and statutory foundations ==

CPIC developed within federal efforts to connect IT spending with mission results and management accountability. The Clinger-Cohen Act of 1996 is a major statutory foundation for federal IT management and investment oversight. GAO's IT investment management framework explicitly links its select/control/evaluate model to that legislation.<ref name="gao" />

OMB Circular A-130 provides federal information-resources management policy, while Circular A-11 and its capital programming guidance address budget planning and capital investment practices. Reporting requirements, agency instructions, and specific provisions must be checked against the editions applicable to the relevant fiscal year. The OMB circulars directory provides access to published issuances and revisions.<ref name="omb">Office of Management and Budget, ''OMB Circulars'', [https://www.whitehouse.gov/omb/information-resources/guidance/circulars/ official directory], accessed 27 October 2026.</ref>

The Federal Acquisition Regulation also connects IT acquisition planning to CPIC. FAR 8.001 states that IT acquisitions must comply with the capital planning and investment control requirements in 40 U.S.C. 11312 and OMB Circular A-130. These requirements show why CPIC is connected to procurement as well as to investment approval.<ref name="far">Federal Acquisition Regulation, ''8.001 General'', [https://www.acquisition.gov/far/8.001 Acquisition.gov], accessed 27 October 2026.</ref>

CPIC should not be presented as a single, identically implemented software methodology. Laws and governmentwide policy establish obligations; each agency operationalizes those obligations through its approved processes, investment classifications, boards, calendars, and evidence requirements.

== Relationship to GAO's ITIM maturity framework ==

The U.S. Government Accountability Office's '''Information Technology Investment Management (ITIM)''' framework is a tool for assessing and improving the maturity of investment management, including selection, control, and evaluation. It is related to CPIC but is not the same thing as an individual agency's CPIC procedure. GAO's framework describes five progressive stages, ranging from ad hoc practices through increasingly institutionalized project-level and portfolio-level governance to more advanced evaluation and improvement.<ref name="gao" />

The distinction is useful: CPIC describes how an agency governs investment decisions, while GAO's ITIM framework can help assess how consistently and effectively those decisions are made. Having a documented CPIC policy does not itself demonstrate mature investment governance; evidence is needed that the policy informs real decisions, triggers corrections, and incorporates measured outcomes.

== Measures of CPIC effectiveness ==

CPIC effectiveness can be evaluated through both the quality of decisions and the results of investments. Useful measures include the proportion of investments with current business cases and credible baselines, completeness of lifecycle cost estimates, timely closure of corrective actions, delivery and operating performance, and the extent to which mission benefits are actually measured.

Financial and delivery metrics alone are insufficient. An agency might have high rates of completed reviews without making any consequential intervention. Conversely, a portfolio showing several cancelled investments may indicate that management identified weak proposals or changed conditions early enough to avoid further losses. Interpretation therefore requires case-level evidence rather than assuming that every cancellation is a failure.

== Common implementation problems ==

'''Compliance without decision impact.''' Collecting investment forms and review slides can satisfy an administrative calendar while leaving funding and continuation choices unchanged.

'''Inconsistent investment data.''' Financial, project, procurement, and operational systems may use different investment identifiers and cost definitions, weakening comparisons across the portfolio.

'''Weak benefits measurement.''' Agencies may specify technical outputs, such as system deployment, without establishing measurable improvements in service, mission performance, or user outcomes.

'''Infrequent or ineffective intervention.''' Performance problems can remain visible for several reporting periods when investment boards lack clear thresholds, escalation procedures, or authority to redirect work.

'''Incomplete operating-life coverage.''' Oversight may concentrate on development and acquisition while neglecting the cost, risk, and effectiveness of established systems. GAO's 2025 review of the Social Security Administration specifically examined oversight of investments in operations and evaluation of performance.<ref name="ssa" />

'''Poor connection to enterprise architecture and acquisition.''' Approval can commit an agency to fragmented designs, duplicated capabilities, or procurement decisions inconsistent with the intended target architecture.

== Illustrative federal agency example ==

Consider a hypothetical federal agency proposing to replace an aging case-management system. During planning, the mission owner defines processing delays, data-quality problems, and security requirements. In selection, an investment board compares replacement, incremental modernization, and shared-service alternatives using lifecycle costs, delivery risks, and expected service improvements.

During control, the board examines delivery milestones, expenditure, cybersecurity test results, and operational readiness. If integration costs exceed the approved assumptions, the board may require a revised plan or reassess continued funding. After deployment, evaluation compares case-processing performance, availability, user outcomes, and ongoing costs against the original expectations. Those findings inform future releases and portfolio decisions.

The example is illustrative, not a description of a specific agency or a guarantee that any one CPIC review structure is universally required.

== CPIC compared with related disciplines ==

{| class="wikitable"
! Discipline
! Primary focus
! Relationship to CPIC
|-
| [[Information Technology Investment Management (ITIM)]]
| Enterprise-wide decisions about technology value, funding, risk, and results
| CPIC is a structured federal-government application of investment management.
|-
| [[IT budgeting]]
| Estimating, allocating, and controlling authorized financial resources
| CPIC supplies investment justification and performance evidence for budget decisions.
|-
| [[IT Portfolio Management (ITPM)]]
| Balancing and prioritizing investments across a portfolio
| CPIC uses portfolio analysis when selecting and reviewing investments.
|-
| [[IT project management]]
| Delivering a bounded initiative within agreed objectives and constraints
| CPIC governs whether a project should be funded, continued, changed, or ended.
|-
| [[Enterprise Architecture]]
| Coherence of business, information, applications, and technology capabilities
| Architecture informs investment fit, duplication, dependencies, and modernization choices.
|}

== See also ==

* [[IT Governance]]
* [[Information Technology Investment Management (ITIM)]]
* [[IT Portfolio Management (ITPM)]]
* [[IT budgeting]]
* [[IT project management]]
* [[Enterprise Architecture]]
* [[Chief Information Officer (CIO)]]

== References ==

<references />