Capital Planning and Investment Control (CPIC)

Capital Planning and Investment Control (CPIC) is a structured decision-making and governance process used by United States federal agencies to plan, select, fund, oversee, and evaluate investments in information technology. It connects agency missions and strategic plans with investment proposals, budget decisions, acquisition, implementation performance, and the results achieved during an investment's operational life. Its central purpose is to direct limited public resources toward justified IT investments while controlling risk and ensuring accountability for outcomes.

CPIC is generally described through three connected activities: Select, Control, and Evaluate. Selection assesses prospective and continuing investments; control reviews performance and requires corrective decisions; evaluation compares actual outcomes with expectations and informs future choices. Agencies may add an explicit planning or pre-selection phase. The process is iterative: continued funding, changes in mission need, and results from operating systems can lead to renewed selection decisions rather than a one-time approval.

CPIC is a specific federal-government application of IT investment management. Its scope extends beyond a capital budget or project delivery plan, covering governance of the investment throughout planning, acquisition, development, operation, evaluation, and possible retirement. The precise procedures, review bodies, reporting categories, and approval thresholds differ among agencies and are shaped by applicable law and current Office of Management and Budget (OMB) guidance.

Purpose and context

Federal agencies must make technology decisions under mission, budget, security, acquisition, and public-accountability constraints. CPIC supplies a common investment-governance mechanism that connects these constraints. A proposed system may have a strong technical justification but still compete with more urgent mission requirements, create excessive long-term operating costs, duplicate existing capabilities, or present risks that its sponsoring program cannot manage.

A functioning CPIC process therefore asks whether a technology investment is needed, whether it is preferable to available alternatives, whether the agency can deliver and operate it, and whether the resulting capability produces the expected public value. Cost, schedule, technical risk, cybersecurity, accessibility, interoperability, and mission performance may be relevant to different decisions; they should not be reduced to a single financial return measure when benefits are primarily public-service outcomes.

CPIC also links enterprise architecture, IT governance, IT budgeting, and IT Portfolio Management (ITPM). Architecture helps assess fit with current and target capabilities; portfolio review exposes competing priorities; budgeting makes funding limits explicit; governance assigns the authority to approve, continue, change, or terminate an investment.

The CPIC lifecycle

Planning and pre-selection

Many agency processes begin by identifying a mission problem, service deficiency, statutory obligation, modernization requirement, or security risk. Sponsors establish the need, desired outcome, possible options, cost assumptions, affected stakeholders, and dependencies. The result is a proposal suitable for comparative evaluation, rather than an automatic commitment to the first proposed technology.

A planning or pre-select step may be documented as a separate phase. For example, GAO's description of the Social Security Administration's process identifies Plan, Select, Control, and Evaluate, while GAO's general IT investment model emphasizes Select, Control, and Evaluate.

Select

The Select phase compares investment proposals and continuing investments against mission requirements, strategic alignment, risks, expected benefits, costs, and affordability. The responsible decision body may approve funding, request further analysis, conditionally approve a proposal, defer it, or reject it. Selection is a portfolio decision: the best individual project may not be the best use of scarce resources when other investments are considered together.

Typical decision evidence includes an investment business case, alternatives analysis, lifecycle cost estimate, performance objectives, risk assessment, and architectural or security considerations. An agency should preserve the assumptions on which the decision was made so that subsequent reviews can test whether they remain valid.

Control

The Control phase provides oversight during acquisition, delivery, deployment, and, where applicable, ongoing operations. Reviews examine cost and schedule performance, achieved milestones, risks, issues, security posture, mission fit, and deviations from the approved baseline. Management may require corrective action, change the scope, rebaseline with appropriate authorization, suspend expenditure, or reconsider whether the investment should continue.

Control is not merely collecting status reports. Its distinguishing feature is the connection between observed performance and decisions by people with authority to act. GAO has documented agency CPIC control reviews focused on performance, schedule, cost, risk, security, and corrective action.

Evaluate

The Evaluate phase tests whether an implemented investment delivered the capabilities and mission outcomes expected in its business case. Agencies may conduct post-implementation reviews, examine user and service performance, compare actual benefits and costs with forecasts, and identify lessons for future proposals and oversight.

An investment delivered on time and within budget may still disappoint if it does not improve mission performance. Conversely, an investment that encountered implementation difficulties may provide valuable outcomes that require more nuanced evaluation. Evaluation evidence should inform decisions to maintain, enhance, consolidate, replace, or retire the capability, as well as improvements to the CPIC process itself.

CPIC decisions, inputs, and outputs

Decision point	Typical inputs	Typical decision or output
Define need	Mission requirement, service problem, policy obligation, architectural context	Investment concept and defined outcomes
Select and prioritize	Business case, alternatives, costs, risks, benefits, portfolio constraints	Approval, conditions, deferral, or rejection
Control performance	Milestones, actual and forecast costs, delivery evidence, risk and security reports	Continue, intervene, change, suspend, or reconsider
Evaluate outcomes	Operating results, realized benefits, lifecycle costs, user and mission measures	Findings, lessons, reinvestment, or retirement recommendations

These are representative artifacts rather than a universal list of mandatory documents. An agency's governing policy and applicable OMB reporting instructions determine which records are required for a particular investment category.

Governance and accountability

CPIC depends on documented decision rights. The exact organizational structure varies, but the following participants commonly contribute:

• Agency leadership and investment review boards evaluate competing mission priorities and authorize decisions within their delegated powers.
• Chief Information Officer (CIO) brings enterprise technology, architecture, investment oversight, and IT management considerations into agency decisions.
• Chief Financial Officer (CFO) and budget offices align investment proposals and performance information with financial planning, budget formulation, execution, and cost estimates.
• Program and mission owners define the operational need and remain accountable for business or mission results.
• Project and investment managers maintain delivery plans, risk and performance data, and evidence needed for oversight.
• Acquisition, security, privacy, and architecture specialists assess constraints that affect the feasibility, compliance, and sustainment of a proposed solution.

Decision authority should be distinguished from advisory participation. A review board can receive analyses from multiple specialists, but the agency still needs a clear record of who approved an investment, the conditions imposed, and who is responsible for follow-up.

Policy and statutory foundations

CPIC developed within federal efforts to connect IT spending with mission results and management accountability. The Clinger-Cohen Act of 1996 is a major statutory foundation for federal IT management and investment oversight. GAO's IT investment management framework explicitly links its select/control/evaluate model to that legislation.

OMB Circular A-130 provides federal information-resources management policy, while Circular A-11 and its capital programming guidance address budget planning and capital investment practices. Reporting requirements, agency instructions, and specific provisions must be checked against the editions applicable to the relevant fiscal year. The OMB circulars directory provides access to published issuances and revisions.

The Federal Acquisition Regulation also connects IT acquisition planning to CPIC. FAR 8.001 states that IT acquisitions must comply with the capital planning and investment control requirements in 40 U.S.C. 11312 and OMB Circular A-130. These requirements show why CPIC is connected to procurement as well as to investment approval.

CPIC should not be presented as a single, identically implemented software methodology. Laws and governmentwide policy establish obligations; each agency operationalizes those obligations through its approved processes, investment classifications, boards, calendars, and evidence requirements.

Relationship to GAO's ITIM maturity framework

The U.S. Government Accountability Office's Information Technology Investment Management (ITIM) framework is a tool for assessing and improving the maturity of investment management, including selection, control, and evaluation. It is related to CPIC but is not the same thing as an individual agency's CPIC procedure. GAO's framework describes five progressive stages, ranging from ad hoc practices through increasingly institutionalized project-level and portfolio-level governance to more advanced evaluation and improvement.

The distinction is useful: CPIC describes how an agency governs investment decisions, while GAO's ITIM framework can help assess how consistently and effectively those decisions are made. Having a documented CPIC policy does not itself demonstrate mature investment governance; evidence is needed that the policy informs real decisions, triggers corrections, and incorporates measured outcomes.

Measures of CPIC effectiveness

CPIC effectiveness can be evaluated through both the quality of decisions and the results of investments. Useful measures include the proportion of investments with current business cases and credible baselines, completeness of lifecycle cost estimates, timely closure of corrective actions, delivery and operating performance, and the extent to which mission benefits are actually measured.

Financial and delivery metrics alone are insufficient. An agency might have high rates of completed reviews without making any consequential intervention. Conversely, a portfolio showing several cancelled investments may indicate that management identified weak proposals or changed conditions early enough to avoid further losses. Interpretation therefore requires case-level evidence rather than assuming that every cancellation is a failure.

Common implementation problems

Compliance without decision impact. Collecting investment forms and review slides can satisfy an administrative calendar while leaving funding and continuation choices unchanged.

Inconsistent investment data. Financial, project, procurement, and operational systems may use different investment identifiers and cost definitions, weakening comparisons across the portfolio.

Weak benefits measurement. Agencies may specify technical outputs, such as system deployment, without establishing measurable improvements in service, mission performance, or user outcomes.

Infrequent or ineffective intervention. Performance problems can remain visible for several reporting periods when investment boards lack clear thresholds, escalation procedures, or authority to redirect work.

Incomplete operating-life coverage. Oversight may concentrate on development and acquisition while neglecting the cost, risk, and effectiveness of established systems. GAO's 2025 review of the Social Security Administration specifically examined oversight of investments in operations and evaluation of performance.

Poor connection to enterprise architecture and acquisition. Approval can commit an agency to fragmented designs, duplicated capabilities, or procurement decisions inconsistent with the intended target architecture.

Illustrative federal agency example

Consider a hypothetical federal agency proposing to replace an aging case-management system. During planning, the mission owner defines processing delays, data-quality problems, and security requirements. In selection, an investment board compares replacement, incremental modernization, and shared-service alternatives using lifecycle costs, delivery risks, and expected service improvements.

During control, the board examines delivery milestones, expenditure, cybersecurity test results, and operational readiness. If integration costs exceed the approved assumptions, the board may require a revised plan or reassess continued funding. After deployment, evaluation compares case-processing performance, availability, user outcomes, and ongoing costs against the original expectations. Those findings inform future releases and portfolio decisions.

The example is illustrative, not a description of a specific agency or a guarantee that any one CPIC review structure is universally required.

CPIC compared with related disciplines

Discipline	Primary focus	Relationship to CPIC
Information Technology Investment Management (ITIM)	Enterprise-wide decisions about technology value, funding, risk, and results	CPIC is a structured federal-government application of investment management.
IT budgeting	Estimating, allocating, and controlling authorized financial resources	CPIC supplies investment justification and performance evidence for budget decisions.
IT Portfolio Management (ITPM)	Balancing and prioritizing investments across a portfolio	CPIC uses portfolio analysis when selecting and reviewing investments.
IT project management	Delivering a bounded initiative within agreed objectives and constraints	CPIC governs whether a project should be funded, continued, changed, or ended.
Enterprise Architecture	Coherence of business, information, applications, and technology capabilities	Architecture informs investment fit, duplication, dependencies, and modernization choices.

See also

• IT Governance
• Information Technology Investment Management (ITIM)
• IT Portfolio Management (ITPM)
• IT budgeting
• IT project management
• Enterprise Architecture
• Chief Information Officer (CIO)