GAO: CIOs Often Underestimated Technology Investment Risks

What happened

The US Government Accountability Office (GAO) has found that chief information officers often underestimated the risks attached to technology investments. The watchdog's audit examined the method federal agency IT officials use to assess those risks, as reported by FedScoop.

The findings bear on the federal IT Dashboard, the public platform where investment information is posted. FedScoop notes that the dashboard is being phased out, so the audit lands as the government moves away from one of its main channels for tracking how agencies spend on technology.

The core issue is one of judgement rather than data alone. Risk assessment is a practical task, and the GAO's conclusion is that the way it has been carried out has tended to understate exposure before projects are funded.

Why it matters

Government technology programmes have a long record of cost overruns, delays and projects that fail to deliver what was promised. Underestimated risk is one of the earliest points where those problems take root. If the assessment that informs a funding decision is too optimistic, leaders approve work with a thinner margin for error than they believe they have, and the consequences surface later in service delivery.

For anyone leading digital transformation, the lesson extends beyond government. Modernisation programmes increasingly depend on cloud, data and automation platforms whose risks are operational, security-related and behavioural, not only financial. Those risks can be easy to underweight when the people judging them are also accountable for the investment's success. Transparency tools such as public dashboards can help, but only if the underlying assessments are sound and the people using them can trust the inputs.

The Renascence take

Most coverage of an audit like this will focus on the headline failing: a dashboard being retired and a risk process found wanting. The more useful question is why intelligent, experienced people keep reaching the same optimistic conclusion. Behavioural economics offers a clear answer. Planning fallacy and optimism bias are well documented, and they are strongest when a project has a champion, a deadline and a budget already in motion.

Risk assessment that is run by the same people who want the project to proceed will almost always drift towards optimism, however well the framework is designed. The fix is not a better template; it is separating the person who advocates for an investment from the person who prices its downside. Service design teams already know this from customer research, where observers are kept apart from the people who built the product. Organisations that want honest risk numbers should build that separation in before they build the dashboard.

For leaders, the practical step is to stress-test every major technology case against a red-team review run by people with no stake in approval, and to track the actual customer and staff outcomes of funded programmes against the risks that were predicted. If the forecasts and the outcomes keep diverging, the process needs repair before the next budget cycle, regardless of which reporting tool sits on top of it.