2003 Annual Systems Under Development Audit Report for CSLGS and ISP-ITR

Table of Contents

---

The complete report in Adobe Acrobat format To view the files in Adobe Acrobat format you need "Adobe Acrobat Reader".

---

2003 Annual Systems Under Development
Audit Report for CSLGS and ISP-ITR

Final Audit Report

Audit and Evaluation Directorate
Policy and Strategic Direction
Social Development Canada

Project Team:

Director General: J. Blain

IT Audit Director: P. LePage

IT Audit Managers: K. Allen — Canada Student Loans and Grants Systems (CSLGS)
M. Winterburn — Income Security Program Information Technology Renewal (ISP-ITR)

March 2004

SDC-A-001-03-04E
(également disponible en français)

1. Introduction

1.1 Systems Under Development (SUD) Objective

The objective of Audit and Evaluation Directorate' (AED) — previously Internal Audit & Risk Management Systems (IARMS) — Systems Under Development (SUD) audits is to provide management with an on-going, proactive and value-added service by monitoring a project throughout the different phases of its Project Life Cycle (see Appendix A) by:

• becoming involved with the project as independent observers;
• reviewing and offering advice on project management and deliverables; and
• assessing the project's risk.

1.2 Methodology

AED methodology for performing a SUD audit is adaptive to synchronizing with the project so as to ensure both the project and SUD objectives are met. Usually, AED conducts a SUD audit by selectively:

• participating in various project management meetings with technical and user representation (Oversight Steering Committees, Directors, Project Managers, Technical Services, regional conference calls, etc.);
• interviewing stakeholders (technical and user);
• reviewing documentation, key deliverables and decision items;
• ensuring risks, issues and concerns are addressed;
• analyzing test scripts for data conversion modules and special project scripts extracts binder; and
• conducting Treasury Board (TB) mandated Gate Assessments — per project requirements re: Canada Student Loans and Grants Systems (CSLGS) & Income Security Program Information Technology Renewal (ISP-ITR).

2. Systems Under Development (SUD) Reports

2.1 Canada Student Loans and Grants Systems (CSLGS) — Year 2003

Project No.: 6572/02

2.1.1 Background

On December 16, 2001, TB approved a submission from Human Resources Development Canada (HRDC), Canada Student Loans Program (CSLP) for the new business model required to support the 'Direct Loans' program. The model addresses adaptation to emerging trends, issues in post-secondary education, and changes in the demand for student loans relevant to CSLP operations and policy. Conditions for approval requires the program to develop a results based accountability framework and a risk-based audit framework.

Within the submission, a Systems (CSLGS) component outlined the Information Technology (IT) elements needed to support the program's efforts. With its signing, Systems received funding and approval, pursuant to TBM Chapter 2.01 Effective Project Approval (EPA), to proceed with all projects for the remaining three years, with one exception being the CSLP Government On-Line (GOL) project, for which CSLP is required to submit a 'Blueprint' that further detailed its 'GOL Vision'. This exception is to be dealt with separately from the EPA. Annually, future year funding and EPA will be sought for this project near the end of each fiscal year. Finally, HRDC will need to return to TB before the conclusion of year four for confirmation of ongoing funding.

2.1.2 Year 2003 Findings

In early 2003, AED managed the Gate 2 CSLGS Assessment which was a review of the status of the CSL projects and a health check assessment of risks. The Gate 2 report, submitted to TB, presented the results of the AED' independent review for Gate 2 of the CSLGS project by identifying issues, risks and concerns and providing recommendations for remedial actions. AED's Gate 2 report concluded that CSLGS met TBS requirements and is being satisfactorily managed using sound processes and products, including the gating process.

Although CSLGS is in a maintenance mode throughout 2003, AED has noted other items through its SUD which include:

• Business alignment. Ongoing weekly meetings with client to review requirements and discuss any issues or concerns.
• Accountability. Costs\Schedule reports are produced monthly as well as Px forecasts (monthly financial forecasts for each reporting period).
• Ongoing transition of UNIX to an IBM Platform with an estimated completion date of June 2004.
• Update of Oracle 6i to 9i. CSLGS is due for completion in June of 2004.
• The transition to IBM platform of the CSLGS Data Warehouse was 6 months ahead of schedule with a completion date of March 2003. Iteration 2.1 which included bilingualism of CSLGS is due for release in February 2004.
• Bilingualism under the CSLGS applications was initiated in 2003 and is due to be completed by March 31^st 2004.

2.1.3 Conclusion

Along the lines of the Systems Branch Planning exercise, all initiatives under the CSLGS project have been broken down as per approved Modernizing Service for Canadians (MSC) maintenance activities which consist of Run (essential maintenance), Adaptive (technical changes) and Enhancements (legislative changes) as defined below:

1. Run (Essential maintenance) consisting of bug fixes and ongoing 3^rd level support;
2. Adaptive — consists of technical change prefaced by 'must upgrade or lose service support or high risk that hardware will fail'. An example is CSLGS is moving from client server based applications to the IBM consolidated platform, which necessitates the move to Oracle designer 9i;
3. Enhancements — which included approved changes such as new and/or added functionality. For example the completion of CSLGS bilingualization and implementation of legislative changes. Currently meeting with clients to establish priorities for 2004-2005 and planning for future years funding.

In AED' opinion, CSLGS has done an outstanding job in addressing all deliverables and we conclude that this is a well managed project.

2.2 Income Security Program Information Technology Renewal (ISP-ITR) — Year 2003

Project No.: 6524/01

2.2.1 Background

ISP-ITR is a multi-year project, spanning from 1999-2006, with a core objective of modernizing the computer systems that support the delivery of Old Age Security (OAS) and Canada Pension Plan (CPP) benefits. This initiative will enable ISP to meet the demands of an aging population and is the foundation to the GOL and MSC systems initiatives which cannot be achieved using the multiplicity of ISP's legacy "stovepipe" systems. Further, ISP-ITR will provide the flexibility to more easily integrate legislative and policy changes in the future.

As part of TB's funding requirements of the ISP-ITR project, key deliverables and key decision items must be regularly reviewed by a independent third party (i.e. AED) and reported against in project 'Gate Reports'. These Gate Report results are then presented to and reviewed by TB for "project health and viability".

ISP-ITR gating assessments and associated reports are now planned at the end of each fiscal year until year 2006.

2.2.2 Year 2003 Findings

Accomplishments within the last year include the key deliverables and key decision items being successfully met. This was also evidenced by the Gate 3 report that AED managed. In addition, work has started on Gate 4 key deliverables and key decision items.

The new integrated system being developed under the ITR project is the Income Security Program Delivery System (ISP-DS). The ISP-DS underwent its first major national release in fiscal year 2002-2003 with the implementation of ISP-DS: Client View. ISP-DS provides service delivery agents with a consolidated view of the ISP client data previously contained in the OAS, CPP and International Agreement databases through an enhanced and easier-to-read computer display. As progress on the creation of the ISP-DS continues, it will become to focal point for all access and modification to the ISP client information, as well as the entry point for fully automated benefit adjudication — whether initiated by a service delivery agent or by client directly through the Internet.

In the last six months, two additional releases of the ISP-DS were implemented nationally which are Client Notes and View Payment.

Client Notes provides the ISP SDAs with a consolidated repository for notes/workbook/notepad information gathered through ongoing client interactions. This greatly enhances the support for the ongoing relationship between ISP and the client.

View Payment provides the SDA with a consolidated view of detailed payment information for all ISP benefits. Payment details (benefit amounts, withholds, etc.) are viewable in addition to historical views which address such questions as "what was my cheque last month"?

An array of additional development is underway and the ISP-ITR project will continue to add functionality to the ISP-DS that will enhance the operational environment for staff and further facilitate the introduction of Internet self-service products.

Scheduled for implementation next summer, the CPP Retirement release will be the first fully automated end-to end benefit processing service to be moved into the new system. The project's "gated" approach and the modular architecture of the ISP-DS allowed this upcoming release to be expanded to address and incorporate the streamlined business processes and simplified applications defined through the MSC / CPP Simplification project.

The ISP-ITR project continues to focus on the next set of releases of the ISP-DS with the target of decommissioning the CPP benefit system in the fourth quarter of fiscal year 2004-2005 after which time the replacement of the OAS legacy system will be addressed.

As reported last year, regular ISP-ITR meetings are held to discuss issues, concerns and risks with the Project Steering Committee, Directors and Project Managers. The ISP-ITR project has a well-documented and accepted governance structure. The structure reflects the need to have business partners work closely with systems experts. There is clear accountability for project deliverables and the project teams are respecting the roles and responsibilities of the other teams. Following the TB Enhance Management Framework (EMF), a risk management framework and a permanent project office has been in place for some time and contribute to the success of this project. As well, the overall management of ISP-ITR adheres to TB's EMF principles.

2.2.3 Conclusion

Through this SUD, AED will continue to monitor Gate 4 key deliverables and key decision items. The ISP-ITR project has met the TBS Gate 3 objectives. The processes and products used to manage ISP-ITR are working well and the project is being managed in a professional and conscientious manner. The current management environment is transparent and open and actively seeks to improve the management processes and practices.

Appendix A