Tech is 3.6% of what audits find. It's what they keep finding.
Summary
Across 98,767 federal-money audit findings from 2019 through 2025, only 3.6% name a core information-technology problem — and 96 of them, one in a thousand, name legacy technology outright. But a finding that names a system comes back 42.8% of the time against 31.5% for everything else. Where a system really is the cause, the remedy is a capital project rather than a memo: California's replacement projects have waited up to 109 months just for permission to begin. Mostly, though, old technology sets the volume and the cost of auditing rather than the verdict — files information-system controls outside the three impediments that block an opinion on the government's books. Behind all of it sits a federal IT workforce a decade older than the same work outside government.
The problem: government runs on systems 23 to 60 years old, staffed a decade older than the same work outside it. The approvals: 79 percent of federal IT money keeps what exists running, and replacements wait years for permission. Where it goes wrong: findings that name a system repeat 42.8 percent of the time against 31.5. How it's caught: GAO's annual audit, and the Clearinghouse's own file, recomputed.
The problem ·Government runs on machinery it cannot easily replace. The federal systems GAO calls most in need of modernization are 23 to 60 years old and cost about $754 million a year to operate. The oldest was developed in 1964 and its architecture is largely in use today. The people who run federal IT have a median age near 50.5, against 40.7 for the same work economy-wide.
The approvals ·The money decides what happens next. About $83 billion, or 79 percent of planned federal IT spending for fiscal 2025 across the largest agencies, goes to operating what already exists. A replacement must first win approval. California's eight highly critical IT projects waited between 9 and 109 months in the state's approval pipeline for permission to begin building.
Where it goes wrong ·So a finding whose cause is the system cannot be closed with a memo. Findings that name an information system repeat 42.8 percent of the time against 31.5 percent for everything else. The volume lands on the auditors: 984 of the Department of War's 2,485 notices of findings were IT, though only 6 of its 26 agency-wide material weaknesses were. The department's fiscal 2024 audit cycle cost $1.577 billion, $1.177 billion of it remediation.
How it's caught ·It is caught twice over. GAO's annual audit has carried information security as a government-wide material weakness since fiscal 1997 and flagged 13 of the 24 largest agencies again in fiscal 2025. The Federal Audit Clearinghouse's own bulk file, recomputed here, supplies the cross-tab no issuer publishes. Treasury concurred with all three of GAO's new recommendations.
The verdict: technology is a small minority of what audits find and a disproportionate share of what they keep finding. It sets the volume and the cost of the work, not the opinion, and the remedy is a capital project nobody has approved yet.
Where the system really is the cause
Sometimes the fix isn't a memo. California's State Auditor found eight highly critical IT projects⧉ in the state's approval pipeline in November 2025, waiting 9 to 109 months for permission to begin. The 109-month one replaces a State Hospitals mainframe “built more than 30 years ago” that “matches patient records incorrectly in 1 of every 20 readmitted patients.” On the wider IT classifier the repeat gap looks like a government effect: +8.5 points in local government, +4.3 in state. In non-profits and universities it is not detectable, and the tribal cell is too small to call either way.
California's own statewide audits show the same shape: 82 of 188 findings since FY2016 are repeats — 43.6%, about a third above the national 33.1% — and 12 of 25 in FY2025, 48%. And when the State Auditor had the causes of California's chronically late financial reporting audited⧉, the answer was communication failures, unclear roles between the Controller's office and Finance, no single authority on accounting guidance. Not the system.
View data as table
| Findings that name an information system | 42.8% repeat (1,535 of 3,584) |
|---|---|
| Every other finding | 31.5% repeat (29,948 of 95,183) |
IT sets the volume. It doesn't set the verdict.
The Department of War's inspector general is the only federal auditor that sorts its findings into IT and non-IT with stated denominators. In FY2025, 984 of 2,485 notices⧉ were IT — nearly 40% of the volume. Only 6 of its 26 agency-wide material weaknesses were, and 916 of the 984 attach to how controls were designed on the 245 systems it means to keep. A discipline problem, not a vintage problem. The three impediments GAO names⧉ to an opinion on the government's books — 's financial management, intragovernmental accounting, statement preparation — include no technology. The old systems set the bill instead: $1.577 billion⧉ for the FY2024 cycle, $1.177 billion of it remediation.
View data as table
| Child Care Workforce Registry (Social Services) | 9 | months in the approval queue |
|---|---|---|
| Electronic Adjudication Management (Industrial Relations) | 16 | months in the approval queue |
| Life Outcome Improvement System (Developmental Services) | 24 | months in the approval queue |
| EDDNext (Employment Development Department) | 40 | the replacement for the state's unemployment benefits systems |
| Mobile Driver's License Pilot (Motor Vehicles) | 50 | months in the approval queue |
| Firearms IT Systems Modernization (Justice) | 71 | months in the approval queue |
| Emerging Threats 2 System (Food and Agriculture) | 83 | months in the approval queue |
| Electronic Health Records System (State Hospitals) | 109 | replaces a mainframe built more than 30 years ago that mismatches 1 in 20 readmitted patients |
The old guard is an architecture, and a hiring pattern
's 11 most critical legacy systems⧉ run 23 to 60 years old and cost about $754 million a year to keep alive. The oldest — developed in 1964, architecture “largely in use today” — belongs to the Defense Department, the one that got disclaimed. That pairing is ours: 's legacy work and its audit work never cite each other. Meanwhile 79% of planned federal IT spending in FY2025, about $83 billion, keeps what exists running, and information security has been a government-wide material weakness since fiscal 1997 — 29 straight years, with 13 of the 24 Act agencies flagged on information-system controls again in FY2025.
Median age in federal IT — OPM's series 2210, 92,049 people, our count off the June 2022 microdata — is about 50.5; BLS puts⧉ the same work economy-wide at 40.7. Under-25s are 0.88% of federal IT against 5.99% outside it. The “it's really management” objection doesn't survive: computer and information systems managers, the oldest computer row publishes, sit at 46.4. The pipeline reproduces the shape — of 10,310 IT hires in FY2023, 18.27% were under 30, 23.88% were 50 or older — and retirements are 33.97% of IT exits against 25.99% government-wide.
View data as table
| Federal IT (OPM occupational series 2210) | 0.9% | 812 of 92,049 employees |
|---|---|---|
| U.S. computer and mathematical occupations | 6% | 402,000 of 6,711,000 employed |
None of that is an argument about anyone's birth year. These people run machinery they did not choose, and they answer on the record: Treasury, flagged over access-recertification reports⧉ that could not establish whether the access granted was appropriate, concurred with all three of 's new recommendations and stated its ongoing commitment to improving federal financial reporting. What 2025 did to the workforce is unmeasured — agencies spent $9.5 billion⧉ in salary on paid administrative leave that year, and no dataset splits those exits by age.
- Technology is 3.6% of what federal-money audits find and 42.8% against 31.5% of what they keep finding. Only the second half is a story.
- IT sets the volume and cost of auditing, not the verdict: files information-system controls outside the three impediments that block an opinion on the U.S. government's books.
- Where a system really is the cause, the remedy is a capital project: California's highly critical IT projects waited up to 109 months for permission to start. But most IT findings are not about vintage — 916 of the Department of War's 984 were about how controls were designed on systems it means to keep.
- Federal IT is a decade older than the same work outside government and hires the same way. Whether that moves audit outcomes has never been tested.
The limits. Every figure here is an association, not a cause: nothing separates “the system made the finding repeat” from “complicated findings both mention systems and take years to close.” The 3.6% is a floor on a keyword proxy — an auditor who writes that a department could not produce a reconciliation, without naming the system, is invisible to it. Contractors are unmeasured, because no issuer publishes the age structure of the federal IT contractor* workforce. And the workforce data ends June 2022, where 's downloadable microdata stops.
Method. Cut from the BlackLeaf meta report, docs/research/old_guard_meta_report.md in the public repository — 208 extraction records and a 62-item corrections log from its own blind adversarial verification; figures that log struck do not appear here. The scripts behind every our computation* figure were re-run independently on September 23, 2026 and reproduced. Four documents below have no Internet Archive capture — the Archive's save endpoint has returned HTTP 500 for days — and carry a content-addressed seal instead.
Sources(13) ▾
- U.S. Government Accountability Office, Financial Audit: FY 2025 and FY 2024 Consolidated Financial Statements of the U.S. Government (GAO-26-108073) (2026-03-19) — 's audit of the U.S. government's own books. Source for the 29 straight fiscal years in which information security has been a government-wide material weakness, the count of Act agencies reporting information-system control weaknesses in FY2025, and — the strongest fact against this article's own thesis — 's three named impediments to an opinion, none of which is technology. gao.gov · original document
- U.S. Government Accountability Office, Information Technology: Agencies Need to Plan for Modernizing Critical Decades-Old Legacy Systems (GAO-25-107795) (2025-07-17) — 's census of the federal government's 11 most critical legacy systems. Source for their 23-to-60-year age range and $754 million annual operating cost, for the 1964 Department of Defense contract system that is the oldest on the list, and for the share of federal IT spending that goes to operations and maintenance rather than to new systems. gao.gov · original document
- U.S. Government Accountability Office, U.S. Consolidated Financial Statements: Improvements Needed in Controls over Treasury Preparation Processes (GAO-26-109081) (2026-09-15) — 's FY2025 review of how Treasury prepares the government-wide statements. Source for the three new control deficiencies — one of them an information-system access-recertification failure, two of them accounting-disclosure failures — and for Treasury's on-record response concurring with all three recommendations. gao.gov · original document
- U.S. Government Accountability Office, Federal Workforce: Deferred Resignation Program Largely Responsible for Sixfold Increase in Paid Administrative Leave Salary Costs (GAO-26-108477) (2026-09-15) — 's audit of paid administrative leave across 76 agencies. Source for the $9.5 billion in 2025 salary costs and the 435 percent increase since 2023. Read for this article's workforce section and found to contain NO age or occupational breakdown — which is the point it is cited for: the 2025 exits are unmeasured by age. gao.gov · original document
- Department of War Office of Inspector General, The FY 2025 DoW Financial Statement Audit Explained (DOWIG-2026-081) (2026-05-11) — The only federal audit document that sorts its own findings into IT and non-IT buckets with stated denominators. Source for the 984 IT-related notices of findings out of 2,485, the six IT weaknesses out of 26 agency-wide material weaknesses, the 916 of 984 that attach to control design on systems the department intends to keep, and the eighth consecutive disclaimer of opinion. oversight.gov · original document
- Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer, DoD Financial Improvement and Audit Remediation (FIAR) Report, July 2025 (2025-07-31) — The department's statutory audit-remediation report. Source for the FY2024 audit-cycle cost: $1.577 billion total, $401 million to the accounting firms and audit support, $1.177 billion to remediating findings. FIAR's own note says numbers may not sum due to rounding, and its 'audit remediation' definition includes the cost of achieving an auditable systems environment. comptroller.war.gov · original document
- U.S. General Services Administration, Federal Audit Clearinghouse, Federal Audit Clearinghouse public dissemination data, "Current data: 2016-Present" (general.csv, findings.csv, findings_text.csv) (2026-09-19) — Every Single Audit finding filed with the federal government since audit year 2016 — the denominator for every cross-tab in this piece. All FAC figures here are OUR computation from these files, not statistics the Clearinghouse publishes: a finding is one distinct (report_id, reference_number); text-based figures run 2019-2025 because audit years 2016-2018 carry a migration placeholder instead of finding text. Recipe and code: docs/research/old_guard/scripts/agg.py, legacy_hits.py and ca_statewide.py. fac.gov · original document
- U.S. Office of Personnel Management, FedScope Employment Cube, June 2022 (FACTDATA_JUN2022.TXT) (2022-06-30) — One row per federal civilian employee. Source for OUR recomputation of the age structure of federal IT: 92,049 employees in occupational series 2210 (Information Technology Management), their five-year age bands, and the interpolated median. June 2022 is the most recent Employment Cube publishes as a downloadable file; the successor portal serves the same data only through a dashboard with no machine-readable endpoint. opm.gov · original document
- U.S. Office of Personnel Management, FedScope Accessions Cube, FY2020-FY2024 (ACCDATA) (2023-09-30) — New-hire actions by age band. Source for OUR computation of who the government hires into IT: 10,310 accessions into series 2210 in FY2023, against 305,646 federal new hires overall. opm.gov · original document
- U.S. Office of Personnel Management, FedScope Separations Cube, FY2020-FY2024 (SEPDATA) (2023-09-30) — Separation actions by type. Source for OUR computation of how federal IT staff leave: retirements as a share of FY2023 separations from series 2210, against the government-wide share. opm.gov · original document
- U.S. Bureau of Labor Statistics, Table 11b. Employed persons by detailed occupation and age (Current Population Survey, 2025 annual averages) (2026-02-20) — The comparator for the federal IT workforce: the same kind of work, measured the same year, across the whole economy. Source for the published median age of computer and mathematical occupations, for the under-25 share we compute from its published counts, and for the median age of computer and information systems managers — the oldest computer row publishes, which exists here to test the objection that federal series 2210 is really a management layer. bls.gov · original document
- California State Auditor, State High-Risk Audit Program (Report 2025-601) (2025-12-11) — The State Auditor's high-risk report. Source for the months the state's eight highly critical IT projects spent in the Project Approval Lifecycle — time waiting for permission to begin, not time building — and for the State Hospitals mainframe error rate, the cleanest quantified harm from system age in the record. auditor.ca.gov · original document
- California State Auditor (performance audit conducted by KPMG LLP), State High Risk: State of California's Late Financial Reporting (Report 2025-602) (2026-07-31) — The root-cause audit of why California's statewide financial report is chronically late — commissioned by the State Auditor into its own process as well as others'. Source for the causes actually named: communication, unclear roles between the Controller's Office and Finance, no single authority on accounting guidance, no centralized training, and departments filing late. auditor.ca.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Federal money comes with a mandatory audit, and every finding lands in one national file. Of the 98,767 findings with usable text⧉ from 2019 through 2025, 3.6% name a core information-technology problem; 96 — one in a thousand — name legacy or obsolete technology outright. Technology is a rounding error in what government auditors find. It is not a rounding error in what they keep finding: a finding naming a system comes back 42.8% of the time, against 31.5% for everything else. That cross-tab is ours, off the Clearinghouse's own bulk files. No agency publishes it.