Follow-up on Audit of Non-Public Property Information Management / Information Technology Rationalization: Phase 1 – Governance

CFMWS has developed ToR for the RMC, which were approved by the DGMWS on July 8, 2013 and amended on January 11, 2016. The ToR require production of agendas and minutes for every meeting.

CFMWS has also created a specific file directory to store RMC agendas, minutes and supporting documents.

1. Reduction of National Manager positions (July 2011);

2. Director IM/IT Operations hired (July 2011);

3. Request for RMC approval of additional PM (September 2011);

4. Strategic Analyst IM/IT CC Coordinator position considered by RMC (September 2011); and

5. Initial re-assessment of the number of Application Developers (December 2011).

Since 2011, several modifications have been made to the IS Division organizational chart and the CIO has confirmed his commitment to re-evaluate the organizational chart regularly.

In order to support CFMWS activities more effectively, the operations of the IS division have been centralized under four management groups (Operations, Business Services, Administration Services and IM/IT Strategic Planning) and the percentage of managerial positions has been reduced from 43 percent to 22 percent.

In addition, to reduce delays in the application development field, the number of PMs has increased from four to seven and external resources are being used more frequently to address temporary requirements.

The development of a comprehensive divisional risk management plan has not yet been undertaken.

This recommendation has been rendered obsolete. Risk management is an issue that affects multiple divisions within CFMWS. ADM(RS) will undertake an engagement to assess the maturity of Risk Management within CFMWS in FY 2016-2017.

1. “Data only” recovery site implemented in Valcartier (June 2011);

2. Complete disaster recovery site implementation (May 2012, assuming corporate Business Continuity Plan is completed by February 2012)

The development of a DRP has not yet been undertaken.

A “data only” recovery site has not yet been created.

The development of a DRP cannot be undertaken before the requirements are set-up in a corporate Business Continuity Plan. The CFMWS Business Continuity Plan is presently under development with Military Personnel Command and is expected to be developed by Spring 2017.

This MAP item will remain open until a DRP is developed. Management expects to have completed the development of a CFMWS DRP (including high level costing estimates) by March 31, 2017.

A re-evaluation of the methodology used to determine the contributions from Canadian Forces Exchange System, North Atlantic Treaty Organization Exchange System, and Service Income Security Insurance Plan Financial Services has not yet been undertaken.

Since 2011, the IS Division management activity has been streamlined and resources are no longer associated with specific divisions. Recommendations are supported and will be addressed through:

1. The ongoing development of a service-level agreement between CFMWS and Military Personnel Command;
2. The development of the Total Cost of Ownership exercise that will be led by the IS Division with support by the Finance Division; and
3. A zero-based baseline review of the IM/IT allocation agreed upon at reference.

This MAP item will remain open until the actions above have been undertaken. Management expect to have completed all the actions by March 31, 2017.

During FY 2013/14, a help desk activity tracking system was implemented. The system tracks information and generates various reports on Help Desk demands, productivity and trends.

Due to a high degree of variability in customer service demands on the Help Desk, several years of data will be required to identify trends that help reliably establish an IM/IT funding baseline. Nonetheless, management has used trend information generated from the data collected to date in order to support a request for increase in baseline funding for temporary Help Desk urgency at the RMC.

An “off-hours requirements of the Network and Systems section of the IS Division” agreement has been developed.

The agreement provides clarification on the duties, responsibilities and compensation of “off hours” work for Category II IT Support Specialist.

The agreement has to be signed by every Category II IT Support Specialist on a yearly basis.

The development of a CFMWS technology roadmap has not yet been undertaken.

An Enterprise Architect position, specializing in IM/IT strategic planning has been established to obtain the sets of skill and knowledge required to develop a technology roadmap. The position is presently in the process to be staffed.

This MAP item will remain open until a CFMWS technology roadmap is developed and updated periodically. Management expects to have completed the development of a CFMWS technology roadmap by December 31, 2016.

1. Inclusion of “impact/risk of doing nothing” (completed);

2. Not applicable

This recommendation is considered obsolete since the methodology used to prioritize projects has changed from a risk-based process to a requirement/classification based process.

The prioritization criteria have been simplified and reduced to two criteria in order to facilitate more objective and consistent project assessments.

Recommendation 11. The CIO should revise their PMF to incorporate guidance on the BNA, risk assessments and appropriate sign-offs for all associated tools. (This recommendation supersedes recommendations 11,¹ 13 and 15.)

The BNA form has been modified. PMs are no longer required to develop a project schedule before the project is officially launched. The PMF is currently under review to include further guidance on the BNA requirements.

A compliance review has been conducted on 21 projects managed by the IS Division. The results noted that a risk statement had been developed for 84 percent of the projects and a rough order of magnitude estimate for project cost had been created 87 percent of the time.

This MAP item will remain open until the PMF is reviewed. Further guidance should be included on the BNA requirements, risk assessment obligations and client signatures; in addition, actions should be taken to ensure compliance. Management expects to have completed the actions above by October 1, 2016.

Current guidance does not require IS Division PMs to develop a formal project risk assessment. The PMF is under review to include the requirement for a project risk assessment.

This recommendation has been rendered obsolete. This issue will be resolved through the implementation of recommendation 11.

1. Establish independent QA function (May 2015); and

2. Create separate directory (June 2011)

Since the initial audit, two new project sign-offs templates have been created and implemented – the Solution Development Approval and Solution Implementation Approval. The PMF is under review to formalize the requirements for the use of these templates.

A compliance review has been conducted on 21 projects managed by the IS Division. The results were as follows:

• BNA forms are signed off 89 percent of the time;
• Statements of requirements are signed off 45 percent of the time;
• Project Charter / Definition documents are signed off 45 percent of the time;
• Solution Development Approval documents are signed off 40 percent of the time;
• Solution Implementation Approval documents are signed off 33 percent of the time;
• User acceptance testing is signed off 33 percent of the time; and
• Project Completion Sign-Off documents are signed off 75 percent of the time.

This recommendation has been rendered obsolete. This issue will be resolved through the implementation of Recommendation 11.

A compliance review has been conducted on 87 financial transactions made by the IS Division as part of their projects.

It was noted through the review that the commitment of funds was exercised appropriately in each case; however, some payments were approved by individuals without the appropriate IM/IT signing authority, and the requisition process did not identify these anomalies.

Since the time of this review, the delegation of authority has been updated of include provisions that address the process-related shortcomings associated with payment approval and requisitioning. These changes will be communicated in writing to all requisitioning authorities by September 30, 2016. In addition, approval of a new delegation of authority document will be sought by March 31, 2017 to better address operational realities of payment approvals.

The IS Division PMs provide multiple project status reports throughout the year to members of the SRB and WG.

The reporting process has been formalized through a template and the PMF is under review to include further guidance on the development of project status reports.