Audit of offender management system modernization - phase 3

• Acronyms and abbreviations
• Overall audit objective
• Phase 3 audit conclusion
• Summary of conclusions
• Phase 3 audit recommendations
• Follow-up from phase 2 recommendations
• Findings - governance
• Findings - organizational change management
• Findings - project management processes
• Findings - project human resources
• Findings - procurement
• Findings - business requirements
• Findings - design
• Findings - development
• Findings - security, privacy, and internal controls
• Findings - data
• Management response to recommendations

Overall audit objective

The objective of this multi-phased audit approach is to provide assurance that the management control framework in place for the Offender Management System Modernization (OMS-M) Project ensures successful achievement of its planned outputs and intended outcomes, while completing the project on time, on budget, and in accordance with specifications.

The multi-phased audit approach is broken down into three lines of enquiry:

1. Project Governance and Planning
2. Project Management
3. System Development Life Cycle (SDLC)

The objective of this third audit phase was to provide assurance that CSC is adequately prepared to execute on the design and development of the first release for case management capabilities of the OMS-M project, and has adequate plans in place to manage the organizational change, data, and contracting to support the project.

A risk assessment was performed at the beginning of each phase to determine the specific scope for the audit phase. This report is for Phase 3 of the audit. Phase 1 of the audit was completed in January 2022, and phase 2 of the audit was completed in November 2023. A follow-up to the recommendations issued for Phase 2 was conducted as part of this phase and results are presented in this report.

Phase 3 audit conclusion

The audit team determined that CSC has only partially achieved the objectives of this audit phase, and some course corrections are recommended for the project. A solution developer and system integrator have been successfully procured and onboarded to the project, and development work has begun on the first phase for case management functionality. However, notable challenges remain in the project’s organization and velocity to meet the planned schedule. Execution of the data strategy remains an ongoing risk. The high-level plan is for the project to be completed in 2027 to 2028 at a cost of $205.6M.

There is already significant risk in the project’s ability to meet the first planned release of case management functionality in January 2026. Project velocity has started slower than anticipated relative to the project plan. Additionally, following more detailed business analysis, additional change requests have been required which may increase the level of effort required by Abilis and CSC. Lastly, the overall project plan for the first release includes many high-level technological aspects which have the potential to require greater effort and time. Significant work is needed to evaluate and plan architecture, integration with the legacy offender management system, perform data cleanup, design cloud and operational support models, and plan the decommissioning of functionality in the legacy OMS.

An organizational change management strategy has been developed and key stakeholders have been engaged in discussions on the project. No significant gaps were noted in change management activities to date, and sentiment across the business stakeholders interviewed in the audit noted a general willingness to change and adopt the new system across the department.

Activities were undertaken to address recommendations from the previous audit phase, however residual risks remain in key areas, including the data strategy.

Summary of conclusions

Audit Criteria	Result	Description of results by criteria
Project Governance and Planning
1a) Governance	Partially Met	There are numerous committees and working groups with representation from the project team, IMS, and operational staff from regions and headquarters. Specific working sessions were also undertaken over summer/fall 2024 between the project team and IMS staff. Despite the numerous forums, coordination, communication, and decision-making remain challenging across the numerous groups.
1b) Organization Change Management	Met	The project has a change management and training strategy and change management activities have begun in multiple areas. Various working groups and committees have been established which include representatives from across the department. No distinct or significant opposition to change was noted based on interviews with operational staff.
Project Management
2a) Project Management Processes	Not met	The agency has a defined Project Management Framework. The project team is continuing to draft a gating strategy to align with the multi-phased release plan for OMS-M. Although still early in the development and execution of the project, there are already notable risks to the project schedule and ability to deliver the first case management module by the January 2026 timeframe. Review of the viability of the project plan is recommended.
2b) Project Human Resources	Partially met	In 2024 CSC onboarded additional staff to the project, developed an organizational chart, and undertook work to clarify roles and responsibilities through a ‘Ways of Working’ exercise and document. A ‘decision-making framework’ was also developed. Despite these efforts residual risks remain in ensuring effective coordination across teams. There were further reorganizations in fall 2024, and timely decision-making has been noted as a key risk in project reporting.
2d) Procurement	Partially met	CSC has contracted and onboarded a solution provider (Abilis) and a System Integrator (Accenture). Contracts are managed through task authorizations enabling clear deliverables and flexibility in managing the overall project. A deliverable review and approval process is in place to manage contractor work. Roles and responsibilities could be more formally defined with the SI, and a more comprehensive and documented procurement plan is possible.
System Development Lifecycle (SDLC)
3a) Business Requirements	Partially met	Work is underway to refine requirements with Abilis and the project team. A fit/gap assessment was conducted in 2023 to 2024, however with further analysis a series of change requests have been required. The impact of these is still being analysed.
3b Design	Partially met	Significant system integration and technology work is required to support the project. IMS is evaluating an ‘Event Driven Architecture’ model and is in ongoing discussions with SSC on the future cloud model. Risks exist that efforts to support the planned solution may not be fully accounted for in the current project plan and budget.
3c Development	Partially met	System development has begun but the pace of development already appears to be falling behind, and more refined measurement of development progress is possible. It is recommended to evaluate the release plan to consider a smaller, interim release.
3g Security, Privacy, Internal Controls	Partially met	CSC has a defined Security Assessment and Authorization (SA&A) process which the OMS-M project has begun. However, a dedicated IT security practitioner has not yet been assigned to support the design and development of the project.
3h) Data	Not met	Data work to support OMS-M has undergone numerous reorganizations, and responsibilities to lead the data strategy remain ambiguous. A more detailed data plan is needed.

Phase 3 audit recommendations

Audit Objective	Recommendations
Project Governance and Planning	No recommendations.
Project Management	The project team should review the project plan in coordination with IMS with the goal to refine effort and schedule estimates, particularly for system integration and IMS aspects of the project. The project team, in consultation with IMS, should work with the System Integrator to develop more clear documentation on the SI roles and responsibilities. The project team should update the procurement strategy artefact to outline high level roles and responsibilities, processes for contract and issue management, planned procurement expenditures per year, and contracting to date. This strategy should be updated annually.
2. To provide assurance that CSC has implemented effective project management practices that includes project management monitoring & reporting (that is, scope, time, budget, and quality management), project human resources, risks & issues management, and procurement management.
System Development Lifecycle (SDLC)	CSC should develop a high-level support model for what resources will be needed to operate both the legacy OMS and new solution in tandem, and accompanying decommissioning plan for functionality in the legacy system. CSC should evaluate options for interim releases of functionality between phases, namely before the primary release of the case management module. Interim releases should focus on smaller pieces of functionality, integration testing, user satisfaction, and data quality. The project team should enhance its reporting of development activities to measure whether it is completing the development of business requirements in keeping with the project plan. IT Security should assign a dedicated IT Security practitioner to provide input on the OMS-M project. CSC should update its OMS-M data strategy and plan to clarify roles and responsibilities, effort required, and alignment to the OMS-M project plan.
3. To provide assurance that CSC has implemented effective system development lifecycle methodology that includes business requirements, design, development, testing, implementation & rollout, transition to operations, and security/privacy/ internal controls.

Follow-up from phase 2 recommendations

Six recommendations were made in the previous audit phase completed in November 2023. This section outlines the results of a follow-up exercise specifically on the actions taken to address those recommendations and residual risk remaining. General findings on all criteria examined in this audit phase are covered in the detailed findings section.

Recommendations	MAP Status	Results	Residual Risk
1. The OMS-M project sponsor should ensure adequate governance committees and working groups with IMS staff, management, and continued engagement by operational staff.	Complete	Committees, working groups, and working sessions have been conducted between IMS and the OMS-M project team, however ongoing challenges were noted in communication and coordination across the project.	Medium
2. CSC should develop a data plan to support OMS-M design and development and ensure it is aligned with the department’s overall enterprise data strategy.	Ongoing	A high-level data strategy was developed in spring 2023 and presented to oversight committees, however a viable plan to execute the data strategy is still in development. Roles and responsibilities to execute the data plan are still not defined and documented.	High
3. The OMS-M steering committee should receive regular reporting on the progress and dependencies of the department’s overall data strategy.	Complete	The steering committee has been provided with regular reporting on project risks and issues, of which the data strategy has been reported as a key risk.	Low
4. The OMS-M project team should update the project gating plan and clarify the System Development Life Cycle (SDLC) and project artefacts required for each gate.	Ongoing	The project team is in the process of creating an updated project gating strategy which accounts for the three planned releases over the project lifecycle. This strategy should be finalized and approved by governance before the next project gating decision. Residual risks remain in the project management area related to the schedule and project plan.	High
5. The OMS-M project team should work with IMS to finalize the organizational chart, roles and responsibilities, and Human Resources (HR) strategy.	Complete	The OMS-M project team worked with IMS in developing an organizational chart and Ways of Working documentation to help delineate the roles and responsibilities across the organization. Over summer and fall 2024 the project team and IMS have undergone a number of reorganizations in the resources and team structure working on the project. Challenges remain in ensuring effective communication and efficient decision-making across the various project stakeholders.	Moderate
6. IMS should articulate the cloud infrastructure and support requirements needed to support OMS-M and ensure alignment of OMS-M cloud infrastructure and support requirements to the department’s Cloud Strategy.	Ongoing	IMS has refreshed the departmental cloud strategy, but continuing uncertainty exists in SSC’s planned role in the CSC project’s cloud model. There is the risk of additional departmental costs compared to original projections for maintaining a cloud infrastructure if SSC involvement is minimal.	Low

Findings - governance

1.1 Criterion - Effective and adequate governance structures are in place to provide oversight of the project, including residual risks from follow-up to past recommendations

Strengths noted

The OMS-M steering committee was established in 2022 and is meeting regularly. Risks and issues are reported to the committee.

There are several committees and working groups across the department where OMS-M is discussed and decisions are made. This includes departmental management committees (for example, EXCOM, MCOM), a project steering committee, committees with regional representation (for example, ROME, Change Enablement Network), a DG Working Group, and a training working group. The OMS-M project is also under TBS project oversight and the project team provides regular status and dashboard reporting to TBS.

Risks, challenges and opportunities for improvement

Attendance at some committees could be improved upon, such as the ROME committee.

Numerous stakeholders across the department noted that communication and coordination remains a challenge for the project. In particular related to decisions on technology, the data strategy, and IMS activities in the project.

Impact

Failure to ensure adequate inclusion of IMS in OMS-M project governance and working groups could lead to inefficient design and development activities, possible rework, and gaps in technological aspects necessary to deliver a deployed solution.

Recommendation

None

Findings - organizational change management

1.2 Criterion - CSC is appropriately managing organizational readiness, resistance to change and stakeholder buy-in.

Strengths noted

The OMS-M project team has a group dedicated to change management. A change management strategy and training strategy have been developed for the project and the early activities are being executed upon.

Key stakeholders have been engaged across the department. Working groups and committees have been established, with representatives from regions and headquarters. A recent communications effort around naming of the new OMS-M solution was undertaken, contributing towards project awareness amongst staff.

The Samson audit team conducted interviews with a selection of management representing operations and business functions throughout various regions in the organization. Those interviewed noted that the legacy Offender Management System was viewed as in need of replacement, and staff would welcome a new and easier to use replacement. No particular resistance to change was noted by staff or operational groups at present.

Risks, challenges and opportunities for improvement

A considerable amount of business process, policy, and training has yet to occur or be planned in detail. Some interviewees noted the importance of ensuring sufficient training opportunities for staff in advance of the product release.

Impact

Change management activities have strong linkages to solution development and rollout plans, so delays in system development can have downstream effects on compressing the time available for change management.

Recommendation

None

Findings - project management processes

2.1 Criterion - Adequate processes are in place to manage the project schedule, scope, budget, and quality of the project, including residual risks from follow-up to past recommendations

Strengths noted

The OMS-M team has opted to pursue a project approach where the development and implementation is divided into 3 phases based on business capabilities, starting with case management.  Release of the case management module is currently scheduled for January 2026. Project management activities are managed by the OMS-M project team and supported by Accenture resources.

CSC has a defined Project Management Framework which guides projects through a gating process with both project management and system development artefacts. The OMS-M project has followed this gating process up to present, completing gates 1, 2, 2.5 and a project baseline change request with approval from the Investment Management Board (IMB).

Given the phased development process, the OMS-M project team is working with the PMO of IM/IT governance to modify the gating strategy to contain separate gating decisions for each module’s development and rollout. Work on tailoring the gating strategy and associated deliverables for this phased approach is ongoing.

The OMS-M project team has developed a high-level roadmap and integrated project plan for the development and release of the case management module.

Risks, challenges and opportunities for improvement

Although still early in the development and execution of the project, there are already notable risks to the project schedule and ability to deliver the first case management module by the January 2026 timeframe.

The project team developed an integrated project plan in 2024, however many of the activities in the plan are defined only at a high-level with estimates of work effort needed. In particular, the plan contains numerous technological aspects needing direct involvement by IMS which have the potential to take longer than originally estimated. These include the development of an event driven architecture, cloud infrastructure, data cleanup, and integration of the legacy Offender Management System. Numerous individuals interviewed within IMS noted that they had limited involvement in the development of the estimates in the project plan, and that the plan was subject to considerable risk of requiring additional work.

At the same time, following more detailed business requirements analysis it was determined that additional customization is needed to the core solution in order to meet the department’s case management requirements. Multiple change requests have been submitted to Abilis and level of effort was being estimated at the time of the audit. The potential increased level of effort required puts additional pressure on the project release schedule for January 2026.

Impact

Unreliable estimates in project planning can lead to project delays and the necessary postponement of product releases.

Recommendation

The CSC project team should review the project plan in coordination IMS with the goal to refine effort and schedule estimates, particularly for system integration and IMS aspects of the project.

Findings - project human resources

2.2 Criterion - Adequate HR management practices have been planned and implemented for the project, including residual risks from follow-up to past recommendations

Strengths noted

The OMS-M project team onboarded additional staff in 2024 and augmented its workforce with SI resources across numerous roles in the project and system development. Subject matter experts from across the department were onboarded onto the project team.

CSC undertook a structural reorganization to consolidate project accountability and HR management under a single senior executive. In October 2024 there was another reorganization to merge the project and IMS technology teams into one integrated group.

The project team updated the organizational chart and developed a ‘Ways of Working’ document in consultation with IMS to help clarify responsibilities and working relationships across teams. A decision-making framework document was also developed by the project team to help delineate responsibilities and accelerate decision-making at the appropriate seniority level proportionate to the importance of the decision.

Risks, challenges and opportunities for improvement

The project team continues to experience turnover in key project lead positions and over 2024 there were continued team reorganizations between the project team and IMS in the areas of technology and data.

Given the scope of the project, there are several different teams across the department which are involved in project activities, in addition to the solution vendor and system integrator. Communication, coordination, and decision-making were noted by multiple interviewees as an ongoing challenge and have been noted in the project risk register.

Impact

Insufficiently integrated project teams at the working level can impede project efficiency and delay decision-making.

Recommendation

None

Findings - procurement

2.4 Criterion - Adequate procurement vehicles are available in a timely manner to support the project

Strengths noted

CSC conducted procurements and has contracted a solution developer and System Integrator (SI) for the project. Both vendors have been onboarded and work has begun on system design and development. Contracting for both vendors is managed by the OMS-M project team.

CSC has adopted a contracting approach with Task Authorizations which enables the department to contract work with the vendors in multiple pieces with defined deliverables.

There is a documented contracting process in place to manage the work and acceptance of contract deliverables. The Samson team reviewed contracting documentation and confirmed the contracting process is appropriately designed and in place. Ongoing due diligence is required by the OMS-M project team to ensure contractor performance is meeting expectations and deliverables are completed in line with stated requirements.

Risks, challenges and opportunities for improvement

The OMS-M project involves multiple groups across the department, and roles and responsibilities of the SI were noted as not always clear at a working level in some areas, notably in IMS and in decisions related to technology. There is no RACI matrix or roles and responsibilities document with respect to the SI.

CSC still does not have a comprehensive documented procurement plan for the project. Contracts are in place and there is an approved funding envelope for contracting activities outlined in TB submissions. The upcoming project gate will require articulation of procurement plans; however, these only require listing of the outlays to date.

Impact

Ambiguous roles and responsibilities of the System Integrator can lead to inefficiencies in the decision-making process and the pace of project completion. Timelines for decision-making were noted as one of the key risks in recent project status reporting. In particular, at this phase of the project there are many design and technical decisions related to system integration which require coordination between the SI and IMS and clear accountability for project decisions.

The lack of a documented and comprehensive procurement plan impedes the organization’s ability to monitor and report on procurement activities relative to the broader project plan. For example, to date CSC has used less contracting resources than originally anticipated under the initial procurement envelope, however the extent of reduced contractor activities relative to the initial plan and potential downstream impacts have not been fully analyzed. A procurement plan also serves as contract management tool to clarify expectations and roles and responsibilities for vendors. Although CSC has opted not to establish a separate value management office for the project, the project team remains responsible for contract management functions to ensure value for money is achieved throughout the lifecycle of the procurement.

Recommendations

The OMS-M project team, in consultation with IMS, should work with the System Integrator to develop more clear documentation on the SI roles and responsibilities.

The OMS-M project team should update the Procurement Strategy artefact to outline high level roles and responsibilities, processes for contract and issue management, planned procurement expenditures per year, and contracting to date. This strategy should be updated annually.

Findings - business requirements

3.1 Criterion - Business requirements have been formally documented, prioritized, and approved for the project, and processes are in place throughout the project

Strengths noted

The project has a team dedicated to refining business requirements and solution design.

A fit/gap analysis was completed to evaluate the solution’s ability to meet business requirements. Results of this analysis were positive showing good fit.

Work is actively underway with Abilis to refine requirements related for case management.

Risks, challenges and opportunities for improvement

More detailed requirements analysis has revealed areas of unexpected incompatibility between the Abilis core solution and CSC requirements. This has resulted in some requirements not being accepted in the development process, requiring greater work than anticipated, as well as a number of change requests. The ability for the Abilis product to meet the requirements in the change requests is still being analyzed, and the impact on solution design and product schedule are not yet known.

The OMS-M project team responsible for business analysis has experienced turnover.

Impact

Unanticipated change requests can lead to project delays and changes to the release schedule or solution design.

Recommendation

None

Findings - design

3.2 Criterion - System design activities, including architecture and user stories, are effective in providing adequate direction for development, including residual risks from follow-up to past recommendations.

Strengths noted

CSC has opted to develop and deploy the new OMS-M solution in tandem while the existing legacy OMS-M system remains in operation. This approach reduces the risk of “big-bang” deployments but adds integration complexity. CSC is exploring an ‘Event Driven Architecture’ model to connect the department’s databases and systems.

The OMS-M team has opted for a cloud-based model to deliver the solution which will require significant support by IMS to stand up and maintain the cloud infrastructure. In late 2023 the Government announced plans for SSC to play a larger role in the department’s cloud activities, however SSC has still not clarified its level of involvement in the management of the planned OMS-M cloud. Work on the cloud strategy to support OMS-M is consequently ongoing, with the small IMS team supporting current cloud needs for testing in the development process.

Risks, challenges and opportunities for improvement

The Event Driven Architecture model presents the opportunity to integrate systems in a modern architecture but would be a new model to the department and could require significant effort not fully accounted for in the current project plan and budget. Additional procurement may also be necessary.

IMS operates a lean infrastructure team for cloud operations and could face financial pressures to operate an OMS-M cloud.

Comprehensive work has yet to begin to define how the operating model will look to operate both the legacy Offender Management System and the new OMS-M solution in tandem.

Impact

Complex architectural work to support the OMS-M project may not be fully funded or accounted for in the project timelines.

The timing of when functionalities will be decommissioned in the legacy OMS will impact IMS resourcing and costs.

Recommendation

CSC should develop a high-level support model for what resources will be needed to operate both the legacy OMS and new solution in tandem, and accompanying decommissioning plan for functionality in the legacy system.

Findings - development

3.3 Criterion - Effective development practices are in place to ensure the project can deliver on the business requirements and design.

Strengths noted

System development is primarily undertaken by the solution vendor Abilis, and OMS-M solution development is embedded into the broader product release plan for the Abilis CORIS solution which makes software updates approximately every four months. The CSC project team works to provide business requirements for development to Abilis for each release cycle.

Risks, challenges and opportunities for improvement

Project velocity has started to fall behind to refine business requirements for each Abilis release cycle. The CSC project team does not have a detailed methodology to measure and report the pace of development activity accomplished per release cycle. As such, slippage in development activities are not necessarily reflected in broader project health and schedule reporting.

The project has divided development into three phases starting with a case management module release scheduled for January 2026. Risks to the ability for CSC to meet this deadline are already materializing as development will approach a critical path for functionality to be developed in winter 2025.

Although the project has already been divided into three phases, the case management phase is a large and complex phase with few interim milestones along the way or instances where new functionalities is deployed to the business before the launch. As the first phase, it also faces more dependencies with architectural and technological work needed to support the new solution which need to be set up anew. As a result of this waterfall approach for each phase, delays to any of these key pieces have the potential to impact the planned release schedule, which already appears at risk of not being met after only a few months of development activities.

Impact

Lack of detailed reporting of completion of business requirements into developed product can lead to the buildup of technical debt in the project, resulting in more requirements necessary to be completed in latter parts of the project that are not reflected in the project plan and project dashboards.

Reduced velocity in development, time lost from rework, or additional requirements may not be able to be made up by greater efficiencies/productivity down the road, resulting in delays to the overall project schedule.

Longer phases, such as those for case management, may run the risk of being delayed while smaller pieces of functionality could be developed and deployed earlier. Releases of smaller and less critical pieces of functionality also provide the opportunity for greater integration testing and less data cleanup for each release.

Recommendation

CSC should evaluate options for interim releases of functionality between phases, namely before the primary release of the case management module. Interim releases should focus on smaller pieces of functionality, integration testing, user satisfaction, and data quality.

The OMS-M project team should enhance its reporting of development activities to measure whether it is completing the development of business requirements in keeping with the project plan.

Findings - security, privacy, and internal controls

3.7 Criterion - IT security, privacy, and information integrity risks are assessed, and adequate controls are integrated into design and development activities.

Strengths noted

CSC has a documented Security Assessment and Authorization (SA&A) process which the OMS-M project will follow. The CSC IT Security team has been engaged to start the process and the OMS-M project team has developed drafts of some of the early deliverables for the security assessment process, including a Privacy Impact Assessment and Statement of Sensitivity.

A renewed security assessment and authorization was recently completed on the legacy Offender Management System, providing assurance of its security posture while the new solution is in development and for when the two systems are used in parallel.

Risks, challenges and opportunities for improvement

Important projects will frequently have a dedicated security practitioner from IT Security assigned to a project to provide advice and input throughout solution design and development. This process is generally called ‘secure by design’. No security practitioner has been assigned or working on OMS-M to date. A new role has been created with plans for more IT Security involvement.

Impact

Lack of IT Security input into the development process can lead to security gaps in solution design that require rework.

Recommendation

IT Security should assign a dedicated IT Security practitioner to provide input on the OMS-M project.

Findings - data

3.8 Criterion - Effective data governance and management practices are in place throughout the project, including data migration, and including residual risks from follow-up to past recommendations.

Strengths noted

In 2023 to 2024 the project had a ‘tactical data team’ housed within IMS responsible for both the department’s enterprise data strategy as well as data activities for the OMS-M project. The department has data strategy which has been periodically updated and was last approved by governance in 2023.

Steering and management committees have received regular updates on the department’s data strategy and associated risks.

The data foundations project has been in the execution phase for multiple years and is potentially nearing completion. A number of data mapping and quality tools were developed from the project which can be leveraged to support OMS-M.

Data mapping activities have been undertaken over 2024 and work is ongoing in this area.

Risks, challenges and opportunities for improvement

Data work in the organization has undergone many reorganizations in 2024. In summer, the tactical data team was disbanded and multiple contracting staff were let go from the department. A number of remaining data staff were transferred to the OMS-M technical and business analysis project teams.

In fall 2024, further reorganization was done to merge the OMS-M technical project team into an integrated technology team within IMS.

Following these reorganizations, responsibility to lead and execute the data strategy for OMS-M is still unclear in the organization. Multiple groups across the project team and IMS have necessary roles to play in data cleanup and migration, however accountability to lead the data strategy is still ambiguous.

Although the department has a high-level data strategy there is not a clear and detailed data plan on what activities need to be accomplished for data modernization to support the next case management release.

Previous assessments of the legacy Offender Management System’s data quality have noted there are a significant number of errors and data quality issues which will require cleanup.

Data cleanup activities are just beginning but will require effort from operational staff from across the organization to make manual updates. This effort is being led by the business analysis project team and will require significant coordination.

Impact

Failure to provide accurate and reliable data for the new OMS-M solution will impede system development, testing, and could negatively impact the rollout and use of the new system.

Recommendation

CSC should update its data strategy and plan to clarify roles and responsibilities, effort required, and alignment to the OMS-M project plan.

Management response to recommendations

Management has accepted the recommendations, and a management action plan has been created in response to the recommendations.