Audit of Peoplesoft

Audit of PeopleSoft

August 2012

Key Dates

Opening conference (launch memo) / July 2011
Audit plan sent to management / October 2011
End of fieldwork / Closing conference (exit debrief) / March 2012
Audit report sent to management / May 2012
Management response received / June 2012
Penultimate draft report approved by CAE / June 2012
Audit committee recommended / June 2012
Deputy Minister approval / August 2012

List of Acronyms

ADM
CAAR
CASS
CSB
CIOB
EC
GC
HR
HRMIS
HRMS
HRSO
IES
PWGSC
RPS
SMS
SOP / Assistant Deputy Minister
Corporate Accountability and Administrative Renewal
Corporate Administrative Shared Services
Corporate Services Branch
Chief Information Officer Branch
Environment Canada
Government of Canada
Human Resources
Human Resources Management Information System
Human Resources Management System
Human Resources Senior Officer
Integrated Enterprise Services
Public Works and Government Services Canada
Regional Pay System
Salary Management System
Standard Operating Procedures
TBS
UPK
WFA / Treasury Board Secretariat
User Productivity Kit
Work Force Adjustment

Prepared by the Audit and Evaluation Team

Acknowledgments

The audit team, composed of Graça Rebelo Cabeceiras, Daniel Chenier, Lise Gravel, Elizabeth Mountford and Kenneth Gourlay, under the direction of Jean Leclerc, would like to thank those individuals who contributed to this project and, particularly, employees who provided insights and comments as part of this audit.

Audit of PeopleSoft

Table of Contents

EXECUTIVE SUMMARY

1INTRODUCTION

1.1Background

1.2Objectives and Scope

1.3Statement of Assurance

2FINDINGS AND RECOMMENDATIONS

2.1Quality of some of the data migrated to PeopleSoft from HRMIS was not assessed

2.2Key indicators of success were not formally evaluated

2.3Data Integrity Issues

3CONCLUSION

Annex 1 Audit Methodology and Criteria

Audit of PeopleSoft

EXECUTIVE SUMMARY

The purpose of the audit was to provide assurance that the governance surrounding the implementation, testing and operation of the PeopleSoft system was adequate. PeopleSoft is the Government of Canada’s selected system for the management of human resources. As a result of the risks identified during the preliminary survey for this audit, the audit set out to provideassurance that thegovernance over the implementation of the system was adequate andto provide assurance that the governance of the data within the system during operations is adequate.

Using a combination of interviews, document reviews, data analyses and tests, we concluded that the implementation was, from an EC perspective, well governed. Using the same methodology, we also concluded that opportunities exist for improvement in the way that data are managed during operations.

Summary of Recommendations

1 The Assistant Deputy Minister (ADM) of the Human Resources (HR) Branch should assess (estimate) the quality of the information in PeopleSoft so that managementcan take the quality into consideration when using the information for decision making. Based on this assessment, the ADM should also define an approach for the continued improvement of the quality of the data.

2The ADM of the HR Branch, in consultation with the ADMs of Finance Branch and Corporate Services Branch, should review and document the controls and processes related to the data issues that have been identified to ensure that weaknesses are corrected or risks adequately mitigated.

Management Response

We generally agree with the findings of this audit report and will address the recommendations in a management action plan that manages the risks in a costeffective manner.

Environment Canada1

Audit of PeopleSoft

1INTRODUCTION

This audit of PeopleSoft was included in the departmental Risk-based Audit and Evaluation Plan 2011–2014 as approved by the Deputy Minister, upon the recommendation of the External Audit Advisory Committee. It was included in the plan based on initial concerns about the duration and cost of implementing the PeopleSoft application and on concerns about whether the functionality that was finally delivered was the same as had been originally promised.

1.1Background

In 2006, the Treasury Board Secretariat (TBS) identified the PeopleSoft Government of Canada (GC) Human Resources Management System (HRMS) as the target system to be used for the management of human resources (HR) for all federal government departments. GC HRMS is the Government of Canada Human Resources Management System and is not to be confused with HRMIS, which is Environment Canada’s (EC) legacy Human Resources Management Information System. PeopleSoft is an information system that stores and enables the processing of departmental HR information such as the classification levels of positions, appointments to posts, and leave information. This system allows the Department to use its HR information in a more efficient and effective fashion in support of departmental decision-making.

In implementing PeopleSoft across government, the main goals were to reduce the number of HR systems requiring integration, to improve HR information management and to meet common requirements of all users for HR information (streamline and standardize). The anticipated result of achieving this goal was an overall reduction in cost and improvement in effectiveness of the HR function government-wide.

Phase 1: The CASS Initiative

The Corporate Administrative Shared Services (CASS) initiative was a TBS initiative that was already in place when EC became involved in 2005. It was meant to help all government departments install common systems for financial and HR management under the leadership of a specially appointed assistant comptroller general.

During that period, EC’s HRMIS (developed by EC in the 1980s) was nearing the end of its useful life and was becoming increasingly expensive to maintain. It was also becoming increasingly difficult to attract and retain employees to work on it; this raised concerns about the system’s ability to continue to support human resource activities across the Department.

EC managers viewed participation in the CASS initiative as an opportunity to upgrade the Department’s HR applications, to provide the Department with dedicated project funding, and to reduce future costs through expense and resource sharing with other federal government organizations. As a result, EC approved the implementation of PeopleSoft, under the TBS CASS initiative, in 2006.

Participation in the CASS initiative for the implementation of PeopleSoft was really the first of two phases in the implementation. Internally, this phase was led by the Integrated Enterprise Services (IES) group in Finance from 2005–2006 to 2008–2009. During that period the Department spent $4.5 million, much of it on salaries, training and helping develop common procedures for HR. One benefit accruing from this was that EC's contribution gave the Department a seat at the CASS table where decisions were being made regarding the government-wide PeopleSoft implementation. Further, given the financial component of CASS (the implementation of a new financial system), within EC the CASS initiative was included under the umbrella of EC’s Corporate Accountability and Administrative Renewal (CAAR) initiative.

Unfortunately, it proved difficult for the Department to access CASS funding during the years that EC participated in the CASS initiative. The CASS initiative also experienced numerous delays—beyond EC’s control—in replacing both the financial and the HR systems. By 2008 HRMIS had to be replaced as a matter of priority. It was no longer capable of providing support to critical HR functions.

Phase 2: the PeopleSoft Implementation Project

Given the lack of progress on the TBS CASS initiative, the diminishing likelihood of being able to access CASS funding and the urgent need to replace HRMIS early in 2009, EC decided to implement version 8.9[1] of PeopleSoft as a stand-alone project outside of the CASS initiative. The decision to implement GC HRMS on our own marked the beginning of a second phase in the implementation of PeopleSoft at EC.

This second phase of PeopleSoft implementation was managed by the HR Branch in collaboration with Corporate Services Branch (CSB).[2] The project had an approved budget of $4.9 million and involved the implementation of a scaled-down version of PeopleSoft that would allow the HR Branch to meet its legal and policy commitments for managing leave and would allow the Department to decommission its aging legacy HR application (HRMIS). The new scope did not include the replacement of the Regional Pay System (RPS) or the Salary Management System (SMS). The system was successfully implemented between April 2009 and March 2010 at a cost of $4.4 million—on time and within budget. The legacy HRMIS system was decommissioned in 2010.

To date, all of the components of PeopleSoft v8.9 that are necessary for employee leave management and other related functions have been implemented at EC. This includes modules for

base benefits
workforce administration
position management
leave self-serve which allows the employees to have more control over how they process and modify leave
recruiting (partial)
HR reporting from the corporate data warehouse using Discoverer software
Nakisa (a reporting tool for organizational charts)
UPK[3] for online help/training
some central agency interfaces[4]

Since implementation, other modules have either been implemented or partially implemented, including a single sign-on solution (to enhance system security), multiple company structures (allowing one installation to support both EC and the Canadian Environmental Assessment Agency) and an upgrade to the HRSO Portal.[5]

EC has the fundamental modules in place and is in a position to add modules to expand the functionality of its PeopleSoft system. EC was scheduled to implement other modules after the initial roll-out, but funding and resource constraints have placed the implementation of most of those modules on hold. This includes the GC Pay Interface, ePay Card and the Enterprise Learning modules. In 2011, however, the priority management module was implemented and put into production to help the Department handle Work Force Adjustment (WFA) issues; EC is currently demonstrating this functionality to other government departments.

1.2Objectives and Scope

The formal objectives for the audit were to provide assurance of the adequacy of the following:

key governance, risk management and control processes over system implementation (meant to ensure that the HR functionality that was delivered was based on the needs of the user community)
key governance, risk management and control processes over data confidentiality, integrity and accessibility, including controls over the interfaces with other government systems.

Even though the PeopleSoft implementation was carried out in two phases,the audit’s implementation objective only deals with the second phase of the implementation because the preliminary survey indicated that most of the risks associated with the first phase were outside the direct control of Environment Canada. Therefore, the first phase is presented only to provide context for the second phase of the implementation, which was managed by HR (in collaboration with CSB) between the project kick-off in April2009 and the implementation of an operational system in April 2010.

For the second objective on the governance of data during operations, the auditcovered the periodbetween system implementation (April 2010) andMarch 2012. As of the latter date PeopleSoft had been in operation for 24 months.

While this audit was national in scope, most of thefieldworkwas carried out in the National Capital Region. Interviews involving regional staff were carried out by teleconference.

1.3Statement of Assurance

This audit has been conducted in accordance with the International Standards for the Professional Practice of Internal Auditing and the Policy on Internal Audit of the Treasury Board of Canada.

In our professional judgement, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the conclusions reached and contained in this report. The conclusions were based on a comparison of the situations, as they existed at the end of the fieldwork in March 2012, against the audit criteria.

2FINDINGS AND RECOMMENDATIONS

Overall, we found many good or best practices in the way that the PeopleSoft system was implemented and operated. We found a high level of engagement on the part of both the client (HR Branch) and the project team (HR Branch and CSB). We found good governance practices, including frequent status reporting to executive managers in a format that highlighted accomplishments, problems and risks and clearly identified where management support or decisions were required.

In operations, we found a widespread culture of respect for the confidentiality of data maintained in the system.

As detailed in Annex 1, of the 18 audit criteria that we examined, we found that the Department had met 10 completely and had met another 5 with only minor issues. We did identify three issues of moderate concern, and the findings below deal with these issues.

2.1Quality of some of the data migrated to PeopleSoft from HRMIS was not assessed

In order for PeopleSoft to function as the system of record for management information about HR and to allow management to use that information for decision-making purposes, we expected to findthat the managers knew to whatdegree they could trust thequality of data in the system. This implied that managers would be able to assess the reliability of the data for each of the implemented modules and for the critical data elements within those modules.

We found thatwhen data were convertedfrom the legacy HR system (HRMIS), a decision was takento convert whatever data were in HRMIS without validating them against the paper files (the paper files are the current system of record for HR data). Roughly500 records had to be entered manually because the data qualitywould not allow the automated conversion process to completesuccessfully. Managers informed us that the strategy was to incrementally improve the quality of the converted dataover time. HR staff indicated that whenever an HR file was opened to add or modifya transaction, the person doing the entry would look for inconsistencies between what was in the paper file and what was in the system and any errors would be corrected.

We found no evidence of any attempt to assess the quality of data (estimate the error rate)after conversion or to define a clear strategy or approach to fix the data over time.

Not knowing thequality of the information available for decision making might cause managers to make poor decisions related to HR.

Recommendation 1

The ADM of the HR Branch should assess (estimate) the quality of the information in PeopleSoft so that managementcan take the quality into consideration when using the information for decision making. Based on this assessment the ADM should also define an approach for the continued improvement of the quality of the data.

Management Response

While we generally agree with this finding, the HR Branch is confident that human resources data are quite reliable.While it is true that some data was brought into the new system from the old HRMIS system, HR Branch has continually worked to improve the quality of that older HR data and we are also confident that any human resources data entered directly into the new system is quite reliable. Processes that are already established to ensure the reliability of data in our system for the purpose of decision making include:

Validating reports that are used for decision making against other sources to ensure their validity.

HR staff cleansing data for any file they work on during their day-to-day activities.

Reconciling EC data with corresponding data from central agencies

As well, our interaction with clients via the HR portal, the HR service desk, HR dashboards, self-service and ad-hoc reporting as well as the reconciliations undertaken with Finance data contribute to our confidence in the quality of the data and our ability to improve it over time.

Given the above, the HR Branch does not intend to do a further assessment of the quality of the data imported into PeopleSoft from HRMIS but we will continue to address other issues arising from this finding and recommendation in an action plan that will adequately manage any risks in a costeffective manner.

2.2Key indicators of success were not formally evaluated

We expected to see that a post-implementation review had been completed and that it included an evaluation of the performanceagainstthe initial key indicators identified in the project charter.

We found that the system was delivered on time and within budget and we found evidence that changes to the scope, project schedule, threats, accomplishments, risks and costs had been regularly reported toand approved bythe ADM Steering Committee during the course of the implementation project.

We also found that a post-implementation review had been conducted at the end of the project. The resulting report, which was signed off by the client, states that the review was meant to address change management issues and any unmitigated security issues arising from the system implementation. While the report met those goals, the review did not follow up on the original key indicators of success for the project as outlined in the original project charter.

We note that the original key indicators had been defined before the project scope was defined, presented and approved. While a set of conditions for success was included in the scoping document, the original key indicators of success were not replaced or updated to reflect the changes to the scope. As a result some of the original key indicators were not entirely applicable to the scoped-down version of the project. Senior managers in HR did indicate that they were satisfied that the functionality provided by PeopleSoft as implemented was what they expected given the revisions to the scope approved by the Steering Committee at the beginning of the second phase of the implementation.

Closing the loop by reporting on the original key indicators of success at the end of a project gives an organization valuable information that can be used as "lessons learned" in the conduct of future projects. We suggest that this “loop” be closed in future projects so that continual learning can take place.