HomeMy WebLinkAboutFollow-up on IT strategic plan
Follow-up of
Information Technology Strategic Plan
(issued 9/29/00 by Pacific Technologies, Inc.)
Presented to the
Deschutes County Audit Committee
by the
Internal Audit Program
David Givans, CPA – County Internal Auditor
Report# 03/04 - 4 Dated November 14, 2003
Deschutes Count y,
Oregon
Report# 03/04 - 4 (Dated November 14, 2003)
Follow -up of
Information Technology Strategic Plan
TABLE OF CONTENTS:
EXECUTIVE SUMMARY
1. INTRODUCTION
1.1. Background …………………………………………………………………............ 1
1.2. Object ives and scope …….…………………………………………………............ 1
1.3. Methodology …………………………………………………………………….. 1-2
2. RESULTS
2.1. Finding …….…………………………………………………………………….. 2-3
2.2. Reco mmendat ions - not implemented …………………………………............… 3-4
2.3. Reco mmendat ion - pending …………..……………………………….................… 4
2.4. Reco mmendat ions - partially implemented ……………………………............... 4-6
3. INFORMATION TECHNOLOGY RESPONSE ………………………………... 6
4. APPENDIX……………………………….................................................................. 7
APPENDIX I - Comments from discussion with Dave Peterson, IT Director ... 8-15
Report# 03/04 - 4 (Dated November 14, 2003)
{THIS PAGE LEFT BLANK}
Report# 03/04 - 4 (Dated November 14, 2003) i
Follow -up of Information Technology Strategic Plan
(issued 9/29/2000 by Pacific Technologies, Inc.)
Report# 03/04-4 (Dated November 14, 2003)
EXECUTIVE SUMMARY
Purpose
The purpose of this report is to follow-up on recommendat ions provided in the Informat ion
Techno logy Strategic Plan (the Plan) report and to ident ify reco mmendat ions st ill open
(unreso lved) that need to be fo llowed-up.
What we did
The fo llow-up was primarily through interviews wit h Informat ion Techno logy (IT) Director,
Dave Peterson. Appendix I to the report summarizes the interview informat ion detailing
the original recommendat ion, status and associated comments. In determining the status of
recommendat ions, we relied on assert ions provided the IT Director and did not attempt to
independent ly verify those assertions.
What we found
The Plan report included some 30 recommendat ions that were fo llowed-up.
· 13 of the recommendat ions were implemented (44%)
· 12 of the recommendat ions were partially implemented (40%)
· 1 of the recommendat ions had a pending resolut ion (3%)
· 4 of the recommendat ions were not implemented (13%)
What we concluded
The County did not develop a formal response to the Plan after it was issued. It is
recommended the County, in the future, provide a written response to any recommendat ions
provided in reports and monitor progress implement ing corrective act ion.
For the recommendations that had not been implemented (these relate to the recommended
decisio n model), the County and IT should develop a response to these recommendat ions so
that Departments will know what procedures they are to follow in software acquisit ions.
These procedures might be scaled back based on the ant icipated cost of the software.
For the pending recommendat ion, IT should co mplete its work on developing and
communicat ing help desk response targets and results.
For partially implemented recommendations, the County and IT should determine if any
addit ional work is required.
Report# 03/04 - 4 (Dated November 14, 2003) Page 1
1. INTRODUCTION
1.1 BACKGROUND
Audit Authorit y:
The fo llow-up of the Information Techno logy Strategic Plan (the Plan) prepared by Pacific
Techno logies, Inc. (PTI) and issued September 29, 2000 was pursuant to the direct ion of the
County’s Audit Committee. The Deschutes County Audit Committee authorized the fo llow-
up by its approval o f the County’s internal audit workplan for fiscal year 2003/2004. The
fo llo w-up was prompted by audit committee concerns about the implementation of
recommendat ions included in the Plan.
Purpose:
The purpose of this report is to follow-up on recommendat ions provided in the Plan report.
The Study:
The County contracted PTI to provide an Informat ion Techno logy Strategic Plan (the Plan).
Work on the Plan started in December 1999 and the report was presented in September
2000. The process required the time and efforts of numerous County emplo yees. The cost
for the study exceeded $150,000. The object ives of the study included:
· providing an object ive assessment of the state of informat ion techno logy within the
County,
· developing strategies designed to meet the County’s present and future informat ion
techno logy needs, and
· developing an implementation plan that lays out projects and associated costs over
the next several years.
1.2 OBJECTIVES and SCOPE
Object ives:
The object ive was to follow-up on recommendat ions ident ified in the Plan.
Scope:
The fo llow-up included all significant recommendations that were ident ified within the Plan.
An effort was made to consolidate the recommendations because they were separately stated
many times through the Plan document.
1.3 METHODOLOGY
The fo llow-up included interviews with Information Techno logy (IT) Director, Dave
Peterson, and some o f the County management that had been invo lved in the earlier process.
Interviews of Count y management included Tom DeWo lf, Marty Wynne, and George Read.
This fo llow-up is, by nature, subject ive. Appendix I includes co mments fro m the IT
Director as well as discussio n of those recommendations that is integral to the report. The
status and comments were based on discussio ns with IT Director, who has reviewed the
appendix for accuracy. Some co mments from the County Administrator, Mike Maier, were
also included.
Report# 03/04 - 4 (Dated November 14, 2003) Page 2
In determining the status of recommendat ion that were fo llowed-up, we relied on assertions
provided by the IT Director and did not attempt to independent ly verify those assertions.
Since no audit work was performed, Government Auditing Standards issued by the
Comptroller General of the United States were not fo llo wed.
2. RESULTS
We fo llowed up on some 30 recommendat ions ident ified in the Plan documents. The
fo llo wing informat ion is from the informat ion assembled in Appendix I to the report fro m
discussio ns with Dave Peterson, IT Director. Figure I includes a breakdown of the status
for the recommendations included in the Plan.
Figure 1
Were recommendations implemented?
Pending
3%No
13%
Yes
44%
Partially
40%
Nearly 84% of the recommendations have been partially or fully responded to. This
indicates IT and County departments have generally been responsive to the Plan
recommendat ions.
2.1 FINDING
County and IT management did not formally respond to Plan
recommendations
County and IT management did not develop a formal written response to the Plan developed
by PTI.
The County frequently obtains studies and consult ants’ input on matters. A written and
formal reply to those reports whether used internally or provided to the writer of the report
ident ifies, unambiguously, the steps the County and Departments plan to take for corrective
action. This allows for better resolut ion of reco mmended items and more effect ive fo llow-
up.
Report# 03/04 - 4 (Dated November 14, 2003) Page 3
Government Audit ing Standard 6.13 states, “Much of the benefit fro m audit work is not in
the findings reported or the recommendat ions made, but in their effect ive reso lution.
Auditee management is responsible for resolving audit findings and recommendat ions, and
having a process to track their status can help it fulfill this responsibilit y. If management
does not have such a process, auditors may wish to establish their own. Continued attention
to significant findings and reco mmendat ions can help auditors assure that the benefits of
their work are realized.” (Government Auditing Standards)
Wit hout a sufficient action plan, there might be no resolut ion to the recommendations
provided.
It is recommended the County, in the future, provide a written response to any
recommendations provided in reports and monitor progress made in implementing any
suggested corrective actions.
2.2 RECOMMENDATIONS - NOT IMPLEMENTED
All o f the recommendat ions that were not implemented relate to the decisio n model
developed for software purchases presented in the Plan.
· Reco mmended the County implement the decisio n making process detailed in the
Plan.
The IT Director indicated the specific model developed was never formally adopted
and therefore is not being fo llowed by depart ments. IT has been making an effort to
educate Departments by providing the model as Departments re-evaluate internal vs.
external so ftware in their operations. IT is unable to make departments follow the
model when there has been no specific response to the Plan by Count y management.
· Reco mmended the County adopt the ident ified decisio n-making roles and
responsibilit ies.
The IT Director indicated the specific roles and responsibilit ies formalized in the
Plan are not necessary in mo st circumstances and have never been formally adopted
by the County.
· Reco mmended the County perform cost-benefit analyses on projects.
The IT Director was unaware of any depart ments doing this analysis during so ftware
select ion. {Mike Maier, County Administrator, says IT projects are presented to the
Board of County Commissioners and management and include costs of the project,
benefits to the department or County, anticipated efficiencies (such as reduced staff
time), improved effectiveness (such as more work accomplished), and improved
communication flow to name a few. }
Report# 03/04 - 4 (Dated November 14, 2003) Page 4
· Reco mmended the County review annually progress with the Plan.
The IT Director has not evaluated progress with the Plan since the Plan was not
adopted b the County and no course of action was developed for the
recommendat ions provided.
The County and IT should develop a response to these recommendations so that
Departments will know what procedures to follow in software acquisitions. These
procedures might be scaled back based on the anticipated cost of the software.
2.3 RECOMMENDATION – PENDING
· Reco mmended IT develop and co mmunicate help desk response targets and results.
The IT Director indicates they have been doing work to develop performance targets
and will then co mmunicate results to users.
The County and IT should develop a timeline for completing the response to this
recommendation.
2.4 RECOMMENDATIONS - PARTIALLY IMPLEMENTED
· Reco mmended the County adopt a strategy of transit ioning off the current mainframe
operating environment over the long term. This will allow the Count y to take
advantage of the invest ment it has already made in these system, while mo ving the
County's application suite to modern packaged applicat ions wit h up to date
funct ionalit y and ways o f doing business.
The IT Director indicated that no specific policy has been adopted. The general
sentiment after the Plan was that the County should push towards packaged software
solut ions and reduce the reliance on internally developed software. Decisio ns to
implement packaged software are supported by the IT Department through
techno logical assistance (planning and implementation) as well as providing
sufficient network infrastructure.
· Reco mmended the County adopt a strategy of mo ving off the mainframe as
programming staff leave.
The IT Director indicated that no specific policy has been adopted. IT staff turnover
has been and cont inues to be low. He believes departments are reluctant to invest
significant ly on internal programming. Over time, it is believed departments will
shift fro m internally developed software to packaged software as better featured and
solut ions that are more economical become available in the marketplace.
Report# 03/04 - 4 (Dated November 14, 2003) Page 5
· Reco mmended IT put in place a charge-back mechanism that is open, fair, and
predictable.
The IT Director believes the indirect cost allocat ion they perform is based on
reasonable practices and has been effect ively co mmunicated to departments. The
allocat ion method might be made fairer in the future by so me adjust ments to how the
charges are calculated. These will likely be addressed in the next budget cycle.
· Reco mmended IT be more accountable for its decisions.
The IT Director believes this is an unfair assessment since they are always available
if customers have quest ions. Some of Count y management interviewed indicated the
IT department has been more open and accountable since the Plan was issued.
· Reco mmended IT better link its charges with its services.
The IT Director believes this reco mmendat ion is unwarranted. IT links its charges to
service levels through time charges and type and amount of hardware. They have
also been co mmunicat ing with depart ments each mo nth on time charges incurred.
· Reco mmended that IT undertake an effort to document its current methodologies and
applicat ions, developing new methodologies where appropriate (e.g. software
procurement, web development, etc...) and revise exist ing practices to meet industry
"best practices" as necessary.
The IT Director is open to developing addit ional documentation but only spends that
time at the request of departments.
· Reco mmended IT implement application documentation and development
methodologies.
The IT Director indicated they perform only essential program documentation and
that this documentation is often done within the program. They can provide more
traditional user documentation at the request of the department.
· Reco mmended IT develop training approaches and curricula for all Count y business
applicat ions (especially mainframe based).
The IT Director indicates they can provide user training and documentation at the
request of a department.
· Reco mmended the County conduct a criminal just ice data sharing study to highlight
opportunit ies for improved informat ion flow, define a costed project plan, and
develop specificat ions for a pilot project - applying any lessons learned fro m the
pilot to other external data sharing relationships. Public safet y applications do not
interface with state and interstate court systems.
Report# 03/04 - 4 (Dated November 14, 2003) Page 6
The IT Director indicates the County just recently obtained support from the Cit y o f
Bend to come onto the County developed COPS system. Up to this time, there has
not been sufficient support to warrant any study’s of this interface.
· Reco mmended the County support a plan to address key so ftware efforts as
ident ified during this process.
The IT Director indicated that the County never formally adopted the projects within
the Plan. Some of the projects ident ified have been moved forward based on
department efforts. Without sufficient Department support, many o f these projects
cannot be moved forward.
· Reco mmended the County perform an outcomes based review before and after
undertaking a project to determine the success of each project.
The IT Director is not aware of any other departments performing an outcomes based
review of their so ftware improvements. IT performs a review of its activit ies in
upgrading and improving so ftware.
· Reco mmended the County centralize its purchasing of co mputers
The IT Director indicates that most PC’s and significant ly all network components
are specified and ordered through the IT department. The Sheriff and Road have
technical personnel who do some ordering of co mputer equipment. This has not been
a problem.
The County and IT should review these recommendations and determine if any additional
work is required.
3. INFORMATION TECHNOLOGY RESPONSE
The fo llowing summarizes the IT Department’s response to the above findings. Detailed
responses to individual recommendations are included in Appendix I.
In response to the recommendations that have not been responded to (regarding the decisio n
model developed for software purchases), IT indicates those recommendat ions require a
Board policy or similar directive to departments that was never done or contemplated after
the receipt of the Plan. IT does not believe addit ional work is necessary in this area.
In response to the recommendation pending for the help desk, IT is working on developing
statist ics on its response to customer service requests at the help desk.
In response to recommendat ions partially implemented, IT indicates that they cont inue to
work on these items and they periodically review the Plan document to make sure they are
going in the right direct ion.
Report# 03/04 - 4 (Dated November 14, 2003) Page 7
4. APPENDIX
{Appendix I – Comments from discussion with Dave Peterson, IT Director begins on the
following page.}
Report# 03/04 - 4 (Dated November 14, 2003)
To: Audit Co mmittee
CC: Mike Daly, Tom DeWolf
From: David Givans, Count y Internal Auditor
Subject: Fo llow-up of Informat ion Techno logy Strategic Plan (issued 9/29/00)
(Report #03/04-4)
Date: November 14, 2003
The enclosed report is a fo llow-up on the recommendat ions outlined in the Informat ion
Techno logy Strategic Plan issued in September 2000. Informat ion contained in this reports is
primarily fro m interviews wit h Dave Peterson, Information Techno logy Director.
The report has been discussed with Dave Peterson as well as Mike Maier, County Administrator.
The IT Department’s responses to the recommendations have been summarized and included at
the end of this report.
Mike Maier suggests the audit committee consider making the recommendat ion included in this
report to the Board of Count y Co mmissio ners, for County management to provide a written
response to recommendat ions and the internal auditor monitor progress made in implement ing
any suggested corrective act ions.
The cooperation extended by Dave Peterson and the input of Mike Maier during this fo llow-up
was appreciated.
Deschutes Count y,
Oregon
Internal Audit Program
David Givans, CPA
County Internal Auditor
Deschutes County-Administration building
1130 NW Harriman
Bend, OR 97701
Phone: 541-330-4674
Fax: 541-388-4752
davidg@co.deschutes.or.us