Audit of the Human Resources Management Information System - Management Response and Action Plan

Recommendation 1

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership) develop a formal approach, including the use of a risk register, to managing the operational risks of using PeopleSoft, in order to identify, assess and mitigate risks.

Management agrees with the recommendation.

PeopleSoft partners will be informed of the requirement for Health Canada and the Public Health Agency of Canada to establish a risk register. A risk register will be developed and approved by the Assistant Deputy Minister of the Corporate Services Branch and shared with PeopleSoft partners.

The Human Resources Services Management Committee will review the risk register on a quarterly basis, thereby ensuring that risks are being managed.

Communication of the Health Canada/Public Health Agency of Canada audit requirement to partner departments.

December 31, 2013

Executive Director, Executive Group Services & Strategic Human Resources Management (Shared Services Partnership).

A risk register is developed and shared with partner departments.

March 31, 2014

Recommendation 2

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership), in collaboration with the Director General, Financial Operations Directorate (Shared Services Partnership), ensure that Express Lane Staffing be reviewed in order to determine how to maximize its use.

Management agrees with the recommendation.

Management will seek endorsement of Express Lane Staffing by Partnership Executive Committee in October 2013 on the understanding that appropriate compensatory full-time equivalent/salary controls will be identified.

Partnership Executive Committee endorsement in principle obtained for Express Lane Staffing.

Action completed on October 31, 2013

Executive Director, Client Services Division, Human Resources Services Directorate (Shared Services Partnership).

Assessment of feasibility to change human resources transactions and recommendations to deputy heads.

April 2014

Director General, Financial Operations Directorate (Shared Services Partnership).

Decision regarding implementation of Express Lane Staffing and timelines if applicable.

June 2014

Director General, Financial Operations Directorate (Shared Services Partnership).

Recommendation 3

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership), ensure that guidance is provided to compensation advisors concerning the use of the PeopleSoft Pay Interface and the Regional Pay System.

Management agrees with the recommendation.

The Compensation Unit will update and distribute enhanced standard operating procedures for the PeopleSoft pay interface and the Regional Pay System to all compensation advisors.

Updated standard operating procedures that clearly specify when PeopleSoft and the Regional Pay System can be used are communicated to all compensation advisors.

Action completed on November 30, 2013

Executive Director, Client Services Division, Human Resources Services Directorate (Shared Services Partnership).

Recommendation 4

It is recommended that the Assistant Deputy, Corporate Services Branch (Shared Services Partnership), ensure that processes and procedures are put in place to achieve timely correction and follow-up of the errors identified in PeopleSoft.

Management agrees with the recommendation.

The Human Resources Services Directorate will strengthen data integrity controls by:

1. documenting data integrity procedures;
2. maintaining a list of all data integrity issues, including a description, the frequency, impact, and criticality;
3. ensuring that data owners (that is, human resources directors) receive error reports on a bi-monthly basis;
4. requiring data owners to report on remediation actions and progress on a bi-monthly basis; and
5. providing bi-monthly progress reports to the Human Resource Services Management Committee.

A list of all data integrity issues, which includes a description, the frequency, impact and criticality, developed and communicated to Human Resources Services Management Committee.

December 31, 2013

Executive Director, Executive Group Services & Strategic Human Resources Management (Shared Services Partnership).

Data error reports shared with data owners, and remediation commitments identified.

December 31, 2013

Documented data integrity procedures.

January 31, 2014

Bi-monthly progress report shared with Human Resources Services Management Committee.

February 28, 2014

Recommendation 5

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership), ensure that all manual leave adjustments are sufficiently explained and verified in PeopleSoft.

Management agrees with the recommendation.

Compensation will update and communicate enhanced standard operating procedures for manual leave entries in PeopleSoft, specifying requirements for explanatory notes and leave transaction approvals.

Compensation will implement regular quality assurance reviews of randomly selected files to document that standard operating procedures are being followed.

Updated standard operating procedures for manual leave entries in PeopleSoft, clearly specifying the requirements for explanatory notes and leave transaction approvals, are communicated to all compensation advisors.

Action completed on November 30, 2013

Executive Director, Client Services Division, Human Resources Services Directorate (Shared Services Partnership).

A quality assurance review report is produced and shared with Human Resource Services Management Committee.

January 31, 2014

Recommendation 6

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership), ensure that there is reconciliation between the Regional Pay System and the PeopleSoft Pay Interface.

Management agrees with the recommendation.

Corporate Compensation and the Chief Financial Officer Branch will produce a tool that will easily compare and identify discrepancies between the two systems.

Corporate Compensation has requested a report from Public Works and Government Services Canada that will show the number of Regional Pay System transactions and their financial impact. This data will then be compared with a PeopleSoft report, and any discrepancies between the two systems will be identified and corrective action taken.

A reconciliation report between the two systems to identify discrepancies and any financial impact will be generated on a monthly basis.

May 2014 (pending Public Works and Government Services Canada e-confirmation that it can produce the Regional Pay System report we requested).

Executive Director, Client Services Division, Human Resources Services Directorate (Shared Services Partnership).

Recommendation 7

It is recommended that the Assistant Deputy Minister, Corporate Services Branch (Shared Services Partnership), take the necessary actions to improve the protection of employee information managed by PeopleSoft.

Management agrees with the recommendation.

Management will review the 2011 threat and risk assessment and develop an action plan for residual risks.

Management will address the risks identified in the 2013 privacy impact assessment:

1. Require Agriculture and Agri-Food Canada to improve the information sharing and privacy clauses of the service agreement to meet the standards noted in the 2013 privacy impact assessment.
2. Revise the user privacy notices that are received at system login to more accurately reflect the terms and conditions of use and the requirements of the Privacy Act.
3. Determine and clearly document the appropriate uses and disclosures of this personal information (for example, for human resources planning purposes).

Action plan approved by Human Resource Services Management Committee for residual risks identified in the 2011 threat and risk assessment.

January 31, 2014

Executive Director, Executive Group Services & Strategic Human Resources Management (Shared Services Partnership).

Formal request to Agriculture and Agri-Food Canada to improve the information sharing and privacy clauses of the service agreement to meet the standards noted in the 2013 privacy impact assessment.

December 31, 2013

Formal request to Agriculture and Agri-Food Canada to revise the user privacy notices that are received at system login.

December 31, 2013

Report approved by Human Resource Services Management Committee that documents appropriate uses and disclosures of personal information.

June 30, 2014