Follow-up Audit of Industry Canada's
Year 2000 Readiness
September 1999
Executive Summary
Background
The Audit and Evaluation Branch (AEB) led an audit of Industry Canada's Year 2000 readiness in early 1999 to provide assurance to senior management that Industry Canada had taken all possible measures to be Year 2000 ready. The audit report dated March 1, 1999 concluded that Industry Canada was well advanced in its Year 2000 preparations and made several recommendations to enhance the state of readiness. This audit is a follow-up to the March 1, 1999 audit.
Findings and Recommendations
Industry Canada has virtually completed the readiness phase of the Year 2000 Project. Currently, it is working on the validation phase of the business continuity plans (BCP) which was scheduled for completion October 15, 1999.
A summary of the findings related to each of the three audit objectives of this audit follows:
Objective 1: Follow-up on all outstanding items reported as of the March 1, 1999 report.
All outstanding items reported in the March 1, 1999 Audit Report have been addressed. As a result of observations noted during this follow-up audit, the following recommendations are made to enhance Year 2000 readiness:
- As reported in the Business Continuity Plan Methodology Audit report dated October 4, 1999, the Year 2000 (Y2K) Project Office should implement procedures to ensure responsible managers monitor their significant vendor compliance statements. This will ensure that there are no changes to compliance statements that could adversely affect the state of Year 2000 readiness.
- The approval process of Industry Canada compliance statements should be clarified. All responsible managers should be informed on how to deal with the preparation, approval and issuance of compliance statements. We recommend that Legal Services review compliance statements.
- IT Infrastructure: Wide Area Network technical staff should verify the compliance of the Domain Name System (DNS) provided by Government Telecommunications and Informatics Services (GTIS) and update the compliance documentation accordingly. Compliance of the DNS provided by GTIS needs to be revisited and the documentation updated to reflect the current status.
- Due diligence requirements necessitate documentation for major decisions taken for any application.
Compliance documents should be updated to reflect the status of the Electronic Business Environment (EBE) to Strategis interface and to support the decision to test a limited number of dates.
The reasons for deciding not to test all the mandatory dates also needs to be added to the compliance file for the IT Infrastructure: Wide Area Network (WAN) and the Spectrum Management System (SMS).
- The Year 2000 Project Office should follow-up on the outstanding sign-off memo from the Integrated Financial and Materiel System (IFMS) Project Manager.
Objective 2: Audit the internal dependencies and external interfaces list to evaluate progress and status.
Internal dependencies have been identified, evaluated and the information on common dependencies has been shared across the department as appropriate. This work is now completed.
The assessment of external interfaces is nearly complete. Of the 20 external interfaces identified, four need to complete test results and report these to the Year 2000 Project Office.
Objective 3: Perform a detailed audit of two critical systems, two high impact, small-scale applications, two branches and one region using the procedures defined during the March 1, 1999 audit.
This audit confirmed that readiness procedures have been followed for the sample selected except for outstanding items that require completion under the following recommendations:
- The Strategis Year 2000 manager should provide appropriate documentation to the Year 2000 Project Office upon completion of the decision as to which CD-ROMs of its library collection should be supported.
- The Year 2000 Project Office should follow-up with Spectrum Management staff to obtain a Year 2000 compliance letter for the external interface with the Toronto Dominion Bank.
- Year 2000 Project Office should follow-up with the First Nations SchoolNet project to ensure all the outstanding readiness issues are addressed and a complete Year 2000 documentation package is submitted to the Project Office for quality assurance audit.
Management Action Taken
The department actioned all recommendations from the second report. There was no failure of any critical system during the transition to 2000 – a testament to Industry Canada's effort in preparing itself for Y2K.
See also…
Adobe Acrobat Version (PDF - 59KB - 18 pages)
Note: to read the PDF version, you need Adobe Acrobat Reader on your system. If the Adobe download site is not accessible to you, you can download Acrobat Reader from an accessible page. If the accessibility of PDF is a concern, you can have the file converted to HTML or ASCII text by using one of the access services provide by Adobe.
Date Created: 2000-04-26
|