Follow-up Review of PeopleSoft/HRMS
March 22, 2000
Report
Introduction
The follow-up of the 1998 review of the PeopleSoft/Human Resource Management System (PS/HRMS) was carried out over the period October 1999 through January 2000. The review focused on management controls in five selected areas as follows:
- Objective 1: Addressing the needs of human resource mangers and assistants;
- Objective 2: Implementing strong security measures;
- Objective 3: Strengthening the data integrity control framework;
- Objective 4: Improving the quality of reports; and
- Objective 5: Stabilizing the PeopleSoft Project Team.
Background
The Human Resources (HR) Branch of Industry Canada processes human resource information using the PeopleSoft software product. The PS application was purchased as part of the Treasury Board Secretariat's Shared System Initiative in 1994. Industry Canada participates in the PS "CORE" and Management Board to share information with other departments and to promote CORE functionality valuable to the Department.
The Government of Canada Version 7 of PS/HRMS went into production at Industry Canada in January 1999 to meet Year 2000 readiness. Subsequent phases of this multi-year initiative will introduce more functionality to existing HR users (e.g., user friendly tools), will expand the user group to the non-HR community (e.g., time management), and will provide system interfaces for the sharing of data with other corporate initiatives.
The PeopleSoft Project Team has been working hard to respond to the requirements of users, to keep the system operational, and to constantly improve the integrity of PS data. In spite of these efforts, significant work remains to be done to meet the expectations of users and to meet the myriad of demands that result not only from ongoing changes to systems and to business environments (e.g., PS version changes and UCS, respectively), but also from unanticipated change such as the high turn-over rate of HR users across the Department.
Findings
Objective 1: Address the needs of human resource managers and assistants.
Recommendations raised in the 1998 Review, that addressed high or moderate risks, have been actioned or are being addressed. A number of issues identified during our review, however, represent new risks or risks of an ongoing nature brought about as a result of changes to the PS application and to the environment in the Department. Risk mitigation recommendations include re-establishment of PS User Groups, development of a client supported PS Communications Strategy, and ongoing review of development priorities and service standards.
A number of risks were identified during our review that require mitigation by the PS Project Team in order to lower the risks to an acceptable level. The following actions are recommended:
- User Groups: Provide direction and support to PS client managers to assist them in re-establishing PS User Groups.
- Communications Strategy: Develop and implement a client supported Communications Strategy.
- Ongoing Review of Development Priorities: Amend the process for setting PS development priorities and initiatives to include ongoing input from a representative and appropriate PS User Group.
- Update Service Level Standards: Service Level Standards for System Change Requests should be reviewed, revised and approved by a joint PS Client & Project Team on a periodic basis. Resources should be assigned to ensure the maintenance of service levels.
- Training Needs Assessment: An assessment of PS training, with regard to user turn-over, training needs, course or instruction offerings and costs/benefits, should be considered by a joint PS Client & Project Team.
- Review the Pay Interface: A pre-implementation review of the new pay interface for PeopleSoft should be considered for the second quarter of 2000/01.
Objective 2: Implement strong security measures.
Significant progress has been made towards enhancing PS security, including implementation of the security module to track position and personnel security and implementation of a security awareness program for PeopleSoft users. A number of important security initiatives, however, remain to be undertaken. Given the complex and vulnerable nature of data in applications such as PS, security should be addressed based on a comprehensive strategy that includes participation and support from both the Information Management Branch and Departmental Security.
A number of risks were identified during our review that require mitigation by the PS Project Team in order to lower the risks to an acceptable level. The following actions are recommended:
- Security Strategy: Develop and implement a PS Security Strategy, in conjunction with Information Management Branch and Department Security, that will be integrated with other PS and security initiatives. The strategy should comprehensively address identified security concerns, including the following:
- the system Change Control Process;
- Data Base monitoring; and
- automatic recording/reporting of critical PS data for user monitoring.
Objective 3: Strengthen the data integrity control framework
Although, improvements have been made to the data integrity control framework i.e., coding matrix for the staffing function and quality assurance reports, the integrity of PeopleSoft data remains an ongoing concern.
HR Managers have primary responsibility for the integrity of PeopleSoft data. To effectively deal with data integrity concerns across the Department, HR managers and the PS Team require a comprehensive Data Integrity Strategy.
A number of risks were identified during our review that require mitigation by the joint effort of HR Managers and the PS Project Team to lower the risks to an acceptable level. The following actions are recommended:
- Data Integrity Strategy: Develop and implement a data integrity strategy to identify the: level of data completeness, accuracy and timeliness required in each PS module and sub-process of PS; tasks required from each group to achieve each level/target; and, means to monitor the progress towards achieving these targets. The strategy should be a joint HR Manager & PS Project Team effort. The strategy should remain in force until all data integrity targets have been achieved and maintained for a specified period of time, e.g. six months.
- A follow-up audit be conducted in the fourth quarter of the fiscal year 2000-2001 to provide assurance as to the success of meeting the targets set by the data integrity strategy.
Objective 4: Improve the quality of reports.
The quality of PeopleSoft reports remains a concern across government. Industry Canada is currently susceptible to reporting problems, having upgraded last year from PS Version 5 to Version 7 and switched system configurations to one that is consistent with the PS Cluster. The effort to provide PS users with required reports will be an ongoing for some time. It will continue to require dedicated resources, ongoing assessments, and revised user expectations.
A number of risks were identified during our review that require mitigation by the PS Project Team in order to lower the risks to an acceptable level. The following actions are recommended:
- Staffing Reports: While the PS Project Team is addressing problems related to staffing reports, a current reporting priority, consideration should be given to strengthening the report development effort. Report development in each area of PS should be managed as formal sub-projects complete with an appropriate level of project management controls (e.g., defined deliverables, assigned resources, development processes and products, quality assurance, and user acceptance and sign-off for the Department).
- Ad Hoc Reporting: A independent review of the process for requesting, assessing and delivering ad hoc PS reports should be undertaken. (Note: This recommendation should be considered in conjunction with the recommendation to assess the workload of the PS Team Business Analyst).
Objective 5: Stabilize the PS Project Team.
A major effort has been successfully completed over the past year to permanently staff and train the PS Project Team. While creation and staffing of a Business Analyst position has been completed, the overwhelming workload currently tasked to that position is a new concern.
A new risk was identified during our review that requires mitigation by the PS Project Team. The following action is recommended:
- Business Analyst Workload: The job requirements, workload, work measurement and impact of the PS Team Business Analyst should be reviewed. Work activities should be measured or benchmarked for the purpose of determining the level of resources required for that position.
Management Action Taken
Audit and Evaluation Branch monitoring indicates that the PS Project Team is making good progress in addressing these issues. An additional follow-up audit will be done in 2001.
See also…