Corporate Administration System Utilization Audit
Corporate Audit and Evaluation Branch
October 2005
Executive Summary
Background: The Corporate Administrative System (CAS) is an enterprise resource planning (ERP) system that uses SAP R/3 (System Applications and Products) software. ERP systems provide an organization with the means to: automate most of its business processes, share common data and practices across the enterprise, and produce and access information in a real-time environment. CAS became operational on April 1, 1999. A team from Revenue Canada including various consultants prepared the 1997 CAS Scoping and Planning Report, addressing the SAP R/3 solution for Revenue Canada. The expected benefits identified in this report include providing managers with improved resource management information to effectively budget, plan, forecast and account for costs. The benefits derive from quick and easy access to accurate, complete and timely information.
Financial Administration Directorate (FAD) and Resource Management Directorate (RMD), Finance and Administration Branch (FAB), are the functional owners of the resource, financial, controlling and funds management processes supported by CAS. Business Enterprise Solutions (BES) within Corporate Enterprise Solutions Directorate (CESD), Information Technology Branch (ITB) is responsible for the ongoing operation, maintenance and development of CAS. A FAB/Human Resource Branch (HRB)/ITB Integration Committee was established in 2003 to ensure the joint development, integration and prioritization of FAB and HRB information technology-related initiatives.
Objective: The objective of the audit was to provide assurance on the effective use of CAS, and assess whether the intended benefits are being monitored and realized. The audit was restricted to the use of CAS as an expenditure management tool and was performed at Headquarters and three Regions: Atlantic, Prairie and Pacific. The audit planning and examination phases were conducted from January 2004 to December 2004. The reporting phase began in early 2005. The audit was not an assessment of the automated information system controls of CAS or an attest audit of CAS financial data.
Conclusion: Continuous improvement of a system requires assessing the effectiveness of business processes and the monitoring of intended benefits. The effectiveness of a business process can best be measured by identifying clear and measurable objectives and performance indicators, which are regularly assessed and monitored. The results from the audit indicate that business processes are not linked to clear and measurable objectives and thus the effectiveness of CAS in meeting its intended benefits cannot be appropriately monitored.
An essential benefit of ERP systems is to support decision making with timely, relevant and reliable information. Most managers and “power users” interviewed indicated that CAS reports are essential to achieving their business objectives, and they expressed satisfaction with the accuracy, completeness and timeliness of CAS financial information. However, tests performed on the Payroll Error Analysis report, as part of the audit, identified many discrepancies that could be the result of inaccurate or incomplete salary expenditure information. Managers also said that they find the system complex and the audit found that CAS reports are under-utilized.
Interviews and audit tests indicate that improved use of the reports is achievable by: providing improved direction on the use of key reports; providing better reference material and enhanced training; and more monitoring of their use and the information required. As an example, reports that identify discrepancies in salary expenditure data between CAS and the Regional Pay System (RPS) are ineffectively used to correct salary discrepancies. These discrepancies may affect a manager's Free Balance report, because the errors lead to incomplete postings to key financial reports.
Ownership responsibility for Role 1 is unclear resulting in weak control over its content, assignment and training. Role 1 is given to anyone who has another CAS role and allows users to monitor, view, and display screens and reports containing non-sensitive information.
Finally, CAS Help Desk information can be more effectively used to monitor and mitigate user issues.
It is recognized that FAB resources are currently involved with other CRA priorities but are committed to substantially addressing the weaknesses identified in this report by the end of the 2005-06 fiscal year.
Action Plan: CAS is an integrated system, thus, one Business Process owner cannot unilaterally introduce changes without the other stakeholders agreeing with them. FAD and RMD agree with the recommendations included in this report and commit to bring them forward to the appropriate CAS steering and change management committees for actions and resolution.
FAD and RMD will develop a Continuous Improvement Strategic document by March 31, 2006 to present to the Coordinating Committee for FAB, HRB and ITB to inform, sensitize and get their approval on the need for continuous monitoring and improvement.
RMD will review the manager reports, make essential management reports available through the CAS Management Self Service portal and eliminate reports that are no longer required. They will implement this plan by March 31, 2006.
FAD will reiterate the role, responsibility and accountability of managers and ensure that managers are provided clear, concise and manager-focused reference to manager and CAS financial reports. Specific training modules will be provided when developed. It is expected that the first module will be available as early as November 2005 with continuous delivery that will extend the next 3 years.
FAD and RMD, in consultation with HRB and ITB will propose the raising of a change request for CESD to evaluate the implementation of the User Menu option. The proposal will be made by March 31, 2006.
FAD will take a lead role in ensuring that monitoring of payroll discrepancies is increased. Significant progress will be made on this deliverable by March 31, 2006.
CESD with the collaboration of FAB and HRB have launched a “CAS Security Project” that will help resolve the “CAS Security” problems and Role 1 by the end of 2006.
FAD will request, by December 2005, that the CAS Help Desk service be expanded to include analysis of problem information, and periodic reports on trends and proposed corrective action.
Introduction
Enterprise resource planning (ERP) systems have a business process focus and are owned and driven by business process owners. The benefits of ERP systems can include: productivity improvements, reduction of financial close cycle time, procurement cost reduction and IT cost reduction. Intangible benefits can include: integration and standardization, information visibility, and consistent and reliable information across business areas. To realize these benefits, new business risks are introduced as changes are required within such areas as organizational change management and training. The role of users and the impact of their actions on these highly integrated and shared information systems is often under estimated. These risks are mitigated by establishing business process owners who are tasked with ensuring that the organization has a common understanding of system objectives and ensuring that employees acquire appropriate training. In ERP systems it is important that users acquire a sound understanding of the impact of their actions on the system and on others, and that appropriate procedural controls are defined and monitored.
Financial Administration Directorate (FAD) and Resource Management Directorate (RMD), Finance and Administration Branch (FAB), are the functional owners of the resource, financial, controlling and funds management processes supported by CAS. Similarly, Human Resources Branch (HRB) is the functional owner of the human resources processes supported by CAS.
Business Enterprise Solutions (BES) within Corporate Enterprise Solutions Directorate (CESD), Information Technology Branch (ITB) is responsible for the ongoing operation, maintenance and development of CAS.
A FAB/HRB/ITB Integration Committee was established in 2003 to ensure the joint development, integration and prioritization of FAB and HRB information technology-related initiatives. Providing common strategic recommendations, the committee reports to the F&A Branch Management Committee (BMC) IT Sub Committee, the HRB Projects Portfolio Governance Organization, and the Enterprise Solutions Steering Committee (ESSC).
Chaired by the Assistant Commissioner, ITB and comprised of senior management from ITB, FAB, HRB and other regions and branches, the Enterprise Solutions Steering Committee is responsible for the prioritization of FAB and HRB IT-related initiatives. IT serves as the central decision-maker and approves any major changes and modifications to all major corporate IT systems.
Focus of the review
The objective of the audit was to provide assurance on the effective use of the CAS, and assess whether intended benefits are monitored and realized. The audit examined CAS as an expenditure management tool. The audit focused on business process improvement, usage of reports to monitor and control budgets, user accessibility, and Help Desk activities related to resolving and reducing user problems.
The audit was conducted in several branches at Headquarters: FAB, ITB, Assessment and Client Services and Compliance Programs Branch; and at three Regional offices: Atlantic, Prairie and Pacific. The planning phase of the audit started in January 2004 and the examination phase was completed December 2004. The report has been updated to reflect Fiscal Year (FY) 2004-2005 year-end data.
Findings, recommendations and action plans
The absence of measurable objectives reduces opportunities to monitor and continuously improve CAS.
Improving business processes encompasses assessing workflows, and discovering new ways of accomplishing desirable results by doing work more efficiently and effectively. Typically, business areas, as process owners of an ERP system, periodically review their business process objectives, set measurable performance indicators, monitor and analyse results and finally coordinate changes for improvements.
The 1997 CAS Scoping and Planning Report describes anticipated business process improvements to be derived from the implementation of CAS. Benefits were described in general terms, but included readily available information, easy access to reports, and elimination of delays.
FAD and RMD exercise continuous improvement practices to a limited degree. The Directorates coordinate all changes to business processes and informally monitor system benefits through normal business contact with managers and financial officers. However, business processes are not linked to clear and measurable objectives and thus cannot be appropriately monitored and measured. There are no defined measurable performance indicators to monitor the achievement of anticipated benefits or to help with improving CAS. Performance indicators such as percent reduction in cycle time could provide clearer targets. Without current and measurable performance indicators, success in effecting meaningful change to financial business processes is at risk.
The audit team interviewed a sample of Headquarters (HQ) and regional managers (27) and “power users” (those most familiar with CAS processes and reports) who support managers (18) regarding their perception of the extent to which anticipated benefits had been gained. We tried to identify the managers that used CAS or would have the most use of CAS information. The HQ interviews (10) were with two branches while the rest of the interviews took place in three regions. The regional interviews included 5 Tax Services Offices, 3 Regional Offices and 1 Tax Centre. The interviews fail to indicate a perception of substantial improvements to business processes since CAS has been in place. Overall, “power users” expressed a slightly higher satisfaction level than the managers. The managers said that they found the system to be complex and so they are reluctant to extract reports themselves. The most favourable opinions of both groups were with regard to the accuracy, completeness and timeliness of CAS information. As well, all agree with the importance of CAS to assist them in meeting their business objectives.
Recommendation
FAD and RMD should initiate, within the CAS governance structure, the identification and communication of measurable objectives for the purpose of monitoring and continuous improvement of CAS.
Action Plan
FAD and RMD will develop a Continuous Improvement Strategic document by March 31, 2006 and will approach the Coordinating Committee for FAB, HRB and ITB to inform, sensitize and get their approval on the need for continuous monitoring and improvement. It will be up to the Coordinating Committee to approve the Strategic document.
CAS reports are under-utilized by managers and others who provide financial (FI), materiel management (MM) and human resources (HR) information to managers.
As stated in the introduction of the Financial Administration Control Framework document, the responsibility for accurate, complete, useful and timely accounting information rests, ultimately, with the manager. The document further states that the manager must ensure that CAS transactions are properly reviewed and that sufficient resources are applied in order to ensure that management can rely on the information contained in CAS with due consideration to materiality.
The responsibilities of a manager include the following: the review of the budget allocation and actual charges against the budget; commitment review and procurement compliance; and physical assets review and validation. The necessary tools for the review and validation are provided through CAS and include the Free Balance Report, Variance Analysis (both from the original plan and from the previous year's actual), actual charges, commitment detail, Payroll Posting detail and Salary History reports.
Using the Financial Administration Control Framework and the CAS Report Guide, the audit team analysed statistics that were provided by CESD on the usage of key CAS reports intended for managers. The statistics cover a four-month period (October 2003 to January 2004) and include all sixty-seven CAS reports that were intended for managers at that time (as of March 31, 2005 there were 90 reports for managers).
Of the sixty-seven reports, the 10 most-used reports were accessed by approximately 25% of authorized users per month. The remaining fifty-seven reports were accessed by approximately 2% of authorized users per month. The five most accessed reports were HR time and leave management, and employee data reports. Consequently, managers did not appear to be heavy users of CAS for financial information.
In an analysis of report use, it is recognized that several of these CAS reports present identical information in different formats and that reports may be accessed by the financial officer for distribution to the manager. Nevertheless, the principles underlying the introduction of CAS was to allow managers to directly have timely access to financial information. Therefore, the extent of under-utilization of most of the CAS reports, as identified above, by managers warrants further analysis for the following reasons: there is risk that limited management monitoring and control is taking place, which may result in incorrect information used for decision-making and reporting; and there is also the risk of unnecessary training, maintenance and support costs associated with reports of indiscernible value to management.
Recommendations
FAD should confirm roles, responsibilities and accountability of managers to review, monitor and control the accuracy, completeness, usefulness and timeliness of CAS information and reports.
RMD should review the large number of CAS reports that are intended for the use of managers with the aim of reducing the quantity, and thereby potentially reducing associated training, maintenance and support costs.
Action Plan
FAD will reiterate the role, responsibility and accountability of managers and ensure that managers are informed on the use of manager reports. This will be accomplished through training programs, currently through EX/SM and MG workshops. FAD is also in the process of building a Financial Management concepts course that integrates all financial activities and related CAS reports. Specific training modules will be provided when developed. It is expected that the first module will be available as early as November 2005 with continuous delivery that will extend the next 3 years.
RMD will review the manager reports, make essential management reports available through the CAS Management Self Service portal and eliminate reports that are no longer required. RMD will work closely with CAS personnel to review and implement this plan by March 31, 2006.
Managers do not have access to clear, concise, manager-focused reference material or training on the efficient and effective use of CAS.
An extensive amount of CAS information, including available reports intended for managers, is published on InfoZone. Sites include the following: Manager's F&A Gateway; Manager's Corner; and the FAB and CESD websites. In addition, the Finance and Administration Manual – Financial Administration and Resource Management Volumes, Financial Administration Control Framework 2004, CAS Transition to New Year, and the CAS Report Guide all contain information on CAS reports.
A review of the websites and documentation noted above, indicate that the information does not provide clear, concise manager-focused reference on the use of CAS reports. The CAS Report Guide published on the CESD website describes more than sixty-seven reports intended for managers. However it was noted that these reports are not ranked in order of importance or relevance to the management cadre. Such a ranking could be of great use to managers faced with an extensive amount of information on the effective use of CAS.
Managers interviewed during the audit indicated dissatisfaction with CAS training. Training on CAS reports is entirely self-directed. There is no formal learning for managers on the subject of efficient and effective use of CAS. Managers support the need for relevant reference material. In response to the following, “Managers and administrators have easy access to tools and reports in support of in-year salary management, work plans, performance/cost analysis, the preparation of resource projections and upcoming budgets”, only 9 of the 27 managers interviewed expressed some degree of satisfaction with the current tools. This is a clear indication of the relevance of existing reference material.
Recommendations
RMD should review and consolidate CAS reference material so that managers can more easily use it to learn about the effective and efficient use of CAS.
FAD and RMD should develop or promote new training and learning activities or promote those that already exist in order to meet the needs of the managers in support of a more effective and efficient use of CAS.
Action Plan
FAD will ensure that managers are provided clear, concise and manager-focused reference to CAS financial reports. This will be accomplished through training programs, currently through EX/SM and MG workshops. FAD is also in the process of building a Financial Management concepts course that integrates all financial activities and related CAS reports. Specific training modules will be provided when developed. It is expected that the first module will be available as early as November 2005 with continuous delivery that will extend the next 3 years.
RMD will target the same audience as FAD and will work closely with CAS personnel to review and implement by March 31, 2006.
The CAS menu is complex and discourages managers from directly using the system.
The SAP R/3 system makes information directly available to users by means of several menu options. The standard SAP Menu displays all SAP R/3 options to the user -providing a window to more than 50,000 transactions. The system displays all application transactions, including uninstalled SAP components, and all system transactions including technical transactions that are intended for use by system support staff and application developers.
In the interest of simplifying the user interface, the SAP R/3 system provides the option of implementing a customized Company Menu, which displays only the transactions that have been implemented. In both the SAP and Company menus, the user can only execute those transactions where access has been granted.
With Release 4.6C, SAP R/3 introduced an additional option – a User Menu. The User Menu facilitates system use by displaying only those transactions that the user has been given authorization to execute. The Integrated Finance & Material System Program Office of Public Works Government Services Canada, which provides SAP R/3 implementation and technical support to government departments, is supporting the use of the User Menu option, as a best practice in its current release. Similarly, the CRA upgrade in December 2000 of the SAP R/3 Revenue Ledger System to Release 4.6C included the implementation of the new SAP User Menu for the Revenue Ledger.
CRA implemented SAP Release 4.6C for CAS in July 2002. However, CRA disabled the User Menu in CAS because of difficulties created by the excessive number of transactions and the duplication of transactions within roles. Consequently, CAS users must navigate through the system using the old standard and complex SAP Menu.
A review of the CAS SAP Menu demonstrated that this Menu is not “user friendly”. Interviews confirm that the CAS user-interface is complex and locating manager reports is difficult. After logon, the system displays 6 folders. The “Information Systems” folder contains the “CRA Mgmt Reports” directory wherein agency-specific reports are located. To access the Free Balance Report, a frequently used report, a manager needs to navigate through three other folders--“Info Systems”, “CRA Mgmt Reports”, and “Planning and Actuals”. Within each folder, the user has up to 10 options to choose from. Furthermore, the user encounters folders and reports with similar and misleading names. This is clearly a complex and labourious process and does not facilitate accessibility to CAS.
Recommendation
FAD and RMD, in consultation with Human Resources Branch, should raise, for evaluation by CESD, a CAS change request, to re-install the User Menu option.
Action Plan
FAD, in consultation with HRB and ITB will propose the inclusion of this recommendation in the Security Review Project currently underway. The proposal will be made by March 31, 2006.
RMD recommends that the ”Favourites” menu option in CAS, be used to store at a glance the key reports that managers and their designates need for their work. They should have resolution on this issue by March 31, 2006.
Lack of Regular Use of the Payroll Error Analysis Reports could result in incorrect financial reporting.
As stated above, key CAS reports are under-utilized. It was noted during the audit, that reports that identify discrepancies in salary expenditure data between CAS and the Regional Pay System (RPS) are ineffectively used or not being used to correct salary discrepancies by managers and others who provide FI and HR services to the manager. Therefore, errors or discrepancies may not be identified and followed up in a timely manner.
The Payroll Error Analysis report, comparing CAS and the Regional Pay System salary expenditure data, is used to determine if errors/discrepancies exist. The report contains eight types of errors/discrepancies. Three types are automatically identified as resolved by the system, when corrective action occurs. All others require a manual entry to identify the discrepancy as resolved after corrective action has occurred.
Uncorrected errors may affect a manager's free balance report and could also result in employee over or under-payment.
A CAS report produced by Internal Audit on April 18, 2005 identified a number of outstanding discrepancies:
- 64,338 items - FY 2004-2005;
- 28,848 items - FY 2003-2004; and
- 1,004 items - FY 2002-2003.
Of the above items, just over 3,100 of the discrepancies will be automatically marked as resolved once corrective action has occurred. The balance requires a manual entry to mark them as resolved after corrective action has occurred.
Over 47,700 of the items are missing timesheets/substitution schedules that can result in incomplete and/or inaccurate postings to a Freebalance report. About 33,500 items refer to two-week pay discrepancies between CAS and RPS—a difference between the annual salary in CAS and RPS. Over 7,500 items pertain to payroll postings that exist for inactive employees; and approximately 2,300 items indicate that there is either no record for regular pay in CAS for the pay period, or there is no record for regular pay in RPS for the pay period. For complete and accurate salary expenditure information, all payroll posting discrepancies must be monitored and reviewed for validity and accuracy.
The effective use of the Payroll Error Analysis report is diminished by several factors. Firstly, the report contains complicated selection criteria and is not easy to produce. Secondly, roles, responsibilities and procedures are not clearly defined regarding error identification, corrective action, and confirmation that corrective action is completed. Thirdly, the consequences of uncorrected errors and the financial impact to managers' Freebalance reports are not clearly stated.
FAD responsibilities include the integrity and accuracy of CRA financial information. This entails monitoring the reconciliation process in the CAS system. According to the Financial Administration Control Framework document, Corporate Accounting Division requires justification of errors that are over two months old from financial offices in Regions and Branches. Based on the number of discrepancies noted above it appears that monitoring of the reconciliation process is not working. The audit team found no evidence of policy or documented procedures regarding year-end reconciliation of salary expenditures from CRA to PWGSC by FAD.
Recommendations
FAD should ensure that payroll discrepancies are monitored and corrected in a timely manner.
FAD should ensure that managers and financial officers are better informed of the importance of the following: review of Payroll Error Analysis Reports; the financial impact of errors/discrepancies; the need for regular reconciliation and provision of clear explanations of corrective actions needed to resolve errors/ discrepancies.
FAD should review the Payroll Error Analysis Reports in order to improve their use.
Action Plan
FAD will take a lead role in ensuring that monitoring of payroll discrepancies is increased. Our first step, (Corporate Accounting Division) will be to work with HRB to design an error correction process for both payroll and time errors. Secondly, in consultation with ITB, the necessary tools will be built to address these issues. Finally, FAD will reinforce the importance of monitoring payroll discrepancies through the Financial Management Concepts course and the recently approved Payroll Process Improvements Initiative. Significant progress will be made on this deliverable by March 31, 2006.
Ownership responsibility for Role 1 is unclear resulting in weak control over its content, assignment and training.
The SAP authorization concept generates roles (grouping of access privileges) along business area lines. A role is typically assigned to a business area. As the role owner, the business area responsibilities include: initial definition, approval of changes, participation in assigning the role to users, and consideration of critical combinations of roles.
Role 1 contradicts the SAP authorization concept. Role 1 is given to anyone who has another CAS role and allows users to monitor, view, and display screens and reports containing non-sensitive information. Role 1 also provides access to 40 of 62 financial reports that are intended for managers. These reports include: Free Balance, Functional Free Balance, Cost Centre, Actual Line Item, Order Actual Line Item, Activity Monitoring, and Activity Type: Time and Cost Summary. In addition, Role 1 provides access to in excess of 500 reports that cross SAP module areas and to an excessive number of transactions. Some reports may be of questionable value to every CAS user (i.e. SAP Business Workplace, SAP Appointment Calendar).
Further, Role 1 is not assigned to a specific business area. This challenges effective ownership and control over content and definition of Role 1 and any changes to the role as well as diminishes control over users and training. Finally, it potentially contradicts the principle of assigning access to reports on a “need-to-know” basis.
Adherence to the SAP R/3 authorization concept is important for a successful implementation. The authorization concept is the means by which the system allows users to enter, change or extract information. The concept is built on the principle that authorizations are based on tasks and positions that exist within the enterprise and implemented by constructing user roles. The roles reflect tasks that groupings of users perform in the SAP system. A general role is typically implemented for non-critical system functions required by every user. Standardized roles reduce the risk of excessive access privileges being unintentionally given to employees.
Recommendations
FAD and RMD, in consultation with CESD, should initiate a change request to isolate the manager reports of Role 1 to serve the specific financial management reporting needs of managers.
FAD and RMD should exercise ownership responsibilities for the above role or roles.
Action Plan
CESD with the collaboration of FAB and HRB have launched a “CAS Security Project” that will answer the observation. Resolution of the “CAS Security” problems and Role 1 is expected by March 31, 2006.
RMD is of the opinion that Role 1 does not necessarily need an owner. As long as the information Role 1 can access is not sensitive or confidential, then no restriction should be imposed. However, RMD will work with the other stakeholders to explore this issue further for March 31, 2006.
Information on problem trends is inconsistent and is not reported to FAB for analysis and corrective action.
Help Desk software tools are typically used to track user calls (problem tickets), monitor progress made on problems and reduce their reoccurrence. The software tools frequently make use of drop-down lists to ensure consistency in information such as problem type. The CAS Help Desk uses the Remedy system to record and track problem ticket information. The Remedy fields include caller's first/last name, phone number, user ID, Branch, and a short problem description. The description field is an input box used to briefly describe the type of problem encountered by a user. The drop-down list that Help Desk agents are able to select from is quite limited and generic. Thus the problem is not adequately identified and difficult to provide the proper analysis and solution to solve problems.
The CAS Help Desk system provides an effective means of retrieving problem information, identifying assigned individuals, and monitoring progress and elapsed time in resolving problems. However, the captured information does not lend itself to effective reporting, tracking and containment of problems. The absence of categorization of problems and meaningful information hampers the identification and reporting of persistent errors/problems for corrective action. In addition, there was no evidence that the Help Desk or other CAS support personnel use problem ticket information to identify and communicate trends to business areas for corrective action. As a result, mechanisms to support continuous improvement of CAS are not fully in place.
Recommendation
FAD and RMD should request that CESD expand the CAS Help Desk services to include analysis of problem information, and periodic reports on trends and proposed corrective action.
Action Plan
By December 2005, FAD will send a formal memo to CESD, ITB, to request that the CAS Help Desk service be expanded to include analysis of problem information, and periodic reports on trends and proposed corrective action.
RMD agreed that FAD would initiate and send the required memo.
Conclusion
Continuous improvement of a system requires assessing the effectiveness of business processes and the monitoring of intended benefits. The effectiveness of a business process can best be measured by identifying clear and measurable objectives and performance indicators, which are regularly assessed and monitored. The results from the audit indicate that business processes are not linked to clear and measurable objectives and thus the effectiveness of CAS in meeting its intended benefits cannot be appropriately monitored.
An essential benefit of ERP systems is to provide assurance that decisions are supported by timely, relevant and reliable information. Most managers and “power users” interviewed indicated that CAS reports are essential to achieving their business objectives, and they expressed satisfaction with the accuracy, completeness and timeliness of CAS financial information. However, tests performed on the Payroll Error Analysis report, as part of the audit, identified many discrepancies that could be the result of inaccurate or incomplete salary expenditure information. Managers also said that they find the system complex and the audit found that CAS reports are under-utilized.
Interviews and audit tests indicate that improved use of the reports is achievable by: providing improved direction on the use of key reports; providing better reference material and enhanced training; and more monitoring of their use and the information required. As an example, reports that identify discrepancies in salary expenditure data between CAS and the Regional Pay System (RPS) are ineffectively used to correct salary discrepancies. These discrepancies may affect a manager's Free Balance report, because the errors lead to incomplete postings to key financial reports.
Ownership responsibility for Role 1 is unclear resulting in weak control over its content, assignment and training. Role 1 is given to anyone who has another CAS role and allows users to monitor, view, and display screens and reports containing non-sensitive information. Finally, CAS Help Desk information can be more effectively used to monitor and mitigate user issues.
Page details
- Date modified: