Summary

High Risk Update— California Department of Technology Lack of Guidance, Potentially Conflicting Roles, and Staffing Issues Continue to Make Oversight of State Information Technology Projects High Risk C O M M I T M E N T Y TIRGETNI March 2015 Report 2014-602 L E A D E R S H I P The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the California State Auditor’s Office at the following address: California State Auditor 621 Capitol Mall, Suite 1200 Sacramento, California 95814 916.445.0255 or TTY 916.445.0033 OR This report is also available on our Web site at www.auditor.ca.gov. The California State Auditor is pleased to announce the availability of an online subscription service. For information on how to subscribe, visit our Web site at www.auditor.ca.gov. Alternate format reports available upon request. Permission is granted to reproduce reports. For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. For complaints of state employee misconduct, contact the California State Auditor’s Whistleblower Hotline: 1.800.952.5665. Elaine M. Howle State Auditor Doug Cordiner Chief Deputy March 19, 2015 2014-602 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: The California State Auditor presents this audit report concerning the California Department of Technology’s (CalTech) oversight of the execution stage of information technology (IT) projects. The State has a history of failed IT projects—between 1994 and 2013, for example, the State terminated or suspended seven IT projects after spending almost $1 billion. In our September 2013 assessment of high-risk issues the State and certain agencies face, we concluded that based on the high costs of certain projects and the failure of others, the State’s oversight of IT projects should remain designated as an area of ongoing concern. Currently, the State has 45 projects under development with a reported cost of more than $4 billion that are subject to oversight by CalTech. Six of these projects with total costs of over $575 million have problems that are negatively impacting the project’s progress, which could result in delays and cost overruns. This report concludes that CalTech faces challenges in pursuing effective oversight. Specifically, CalTech’s independent project oversight (IPO) analysts are unclear when to recommend corrective actions to their managers, or when CalTech management should suspend or terminate a project. Furthermore, CalTech does not formally set expectations with agencies that are implementing IT projects. On a broader level, there is a potential conflict between IPO analysts’ role to oversee IT projects and their role to provide advice to agencies. Finally, high turnover, an insufficient state job classification, constrained resources, and inconsistent training of staff impacts CalTech’s ability to oversee state IT projects. With the assistance of our IT expert, we reviewed oversight documents related to four IT projects and concluded that for two of the projects CalTech was aware of significant problems but did not intervene to require the agencies to correct such problems. After spending hundreds of millions of dollars on these two IT projects, the State terminated one and suspended the other. For the remaining two projects, our IT expert concluded that the agencies implementing those projects were adequately addressing the issues; therefore, CalTech did not need to intervene. Because of the needed improvements in CalTech’s oversight discussed in this audit report and the negative impact to the State’s fiscal health when IT projects fail, we will continue to designate IT project oversight as a high-risk issue. Future audits my office will conduct regarding IT oversight may include IT project planning and procurement and IT security. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor 621 Capitol Mall, Suite 1200 Sacramento, CA 95814 916.445.0255 916.327.0019 fax www.auditor.ca.gov Blank page inserted for reproduction purposes only. California State Auditor Report 2014-602 v March 2015 Contents Summary 1 Introduction 5 Audit Results The California Department of Technology Lacks Certain Procedures to Make Its Oversight More Effective 13 Although Staffing Problems Still Pose a Risk to CalTech’s Oversight Effectiveness, It Is Taking Actions That May Reduce That Risk 22 CalTech Allowed Significant Problems to Continue Without Correction on Two of the Four IT Projects We Reviewed 29 The California State Auditor Will Continue to Monitor CalTech’s Oversight of State IT Projects 39 Recommendations 39 Response to the Audit California Department of Technology 43 California State Auditor’s Comments on the Response From the California Department of Technology 49 vi California State Auditor Report 2014-602 March 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2014-602 1 March 2015 Summary Results in Brief Audit Highlights . . . In September 2013 the California State Auditor published its most Our audit of the California Department recent assessment of the high‑risk issues the State and certain of Technology’s (CalTech) oversight of agencies face. Our assessment identified oversight of the State’s information technology (IT) projects, information technology (IT) projects as one area of ongoing highlighted the following: concern. Our focus with this audit is the State’s oversight of the » CalTech faces challenges in pursuing execution stage of IT projects. In addition to having the authority effective project oversight. to approve IT projects, the California Department of Technology (CalTech) has the responsibility to provide oversight during the • It lacks guidance for suspending or execution stage of the projects it approves. IT project oversight terminating an IT project and for continues to be a high‑risk issue, in part, because of the needed recommending corrective actions improvements in CalTech’s oversight discussed below and because to managers. of the negative impact to the State’s fiscal health when these IT projects fail. For example, between 1994 and 2013, the State • It does not formally set expectations terminated or suspended seven IT projects after spending almost for its oversight authority with $1 billion. Furthermore, as of February 2015, the State had 45 IT sponsoring agencies—the state projects under development that were under CalTech’s oversight, agencies that are implementing with a reported cost of more than $4 billion. IT projects. Despite clear statutory authority to curtail troubled state IT » There is a potential conflict between projects, CalTech faces challenges in pursuing effective project the independent project oversight (IPO) oversight. One challenge is that CalTech lacks guidance in analysts’ role to oversee IT projects two critical situations: when CalTech management should and their role of providing advice to suspend or terminate a project and when its independent sponsoring agencies. project oversight (IPO) analysts should escalate concerns to » CalTech needs to document the oversight CalTech management. In addition, CalTech does not formally set actions taken on projects and consistently expectations for its oversight authority with sponsoring agencies— retain its oversight documents. the state agencies that are implementing IT projects. This lack of communication may contribute to an environment wherein » High turnover, an insufficient state job sponsoring agencies view CalTech as a service provider whose classification, potentially inadequate oversight they do not have to rigorously follow. personnel resources, and inconsistent training impact CalTech’s staffing Moreover, there is a potential conflict between IPO analysts’ role practices and present risks to IT oversight. to oversee IT projects and their role to provide lessons learned and advice to sponsoring agencies, which heightens the risk » Although CalTech was aware of that CalTech’s oversight will not be sufficiently independent and significant problems with two troubled objective. Finally, CalTech needs to document the oversight actions IT projects, it did not intervene to require taken on projects and consistently retain its oversight documents, the sponsoring agencies to correct and it also needs to provide sponsoring agencies clearer guidance to such problems. CalTech ultimately ensure that the project status reports they submit contain accurate terminated one of these projects and and appropriate information. suspended the other. High turnover, an insufficient state job classification, potentially inadequate personnel resources, and inconsistent training impact CalTech’s staffing practices and present risks to the oversight of state IT projects. Specifically, high turnover contributes to the loss of 2 California State Auditor Report 2014-602 March 2015 project knowledge and perspective, which disrupts the consistency and reliability of its oversight of state IT projects. Further, the current job classification used for IPO analysts may not ensure that they have adequate experience, as required by CalTech’s own policy. However, CalTech is taking steps that may mitigate these risks. For example, to develop a stronger IT oversight workforce, CalTech is pursuing the modification and use of an existing job classification more relevant to IPO work, and it is developing a training plan for both new and current oversight staff. In addition, CalTech is developing a workload analysis tool to determine whether it needs additional resources for oversight or could use its existing resources more effectively. However, CalTech does not plan to contract with IPO consultants if the assessment indicates that it has insufficient staff available or lacks the necessary expertise. Our IT expert assessed at least 12 monthly reports for each of the four state IT projects we reviewed—the California Department of Motor Vehicles’ IT Modernization Project, the California State Controller’s Office’s MyCalPays Project, the Employment Development Department’s Unemployment Insurance Modernization Project, and the Franchise Tax Board’s Enterprise Data to Revenue Project—to determine the nature and significance of oversight findings and review any evidence of CalTech’s response. He determined that although CalTech was aware of significant problems with the IT Modernization and MyCalPays projects, it did not intervene to require the sponsoring agencies to correct such problems. Our IT expert believes earlier intervention might have improved the outcomes of the projects. However, CalTech ultimately terminated the IT Modernization Project and suspended the MyCalPays Project. For the remaining two IT projects, our IT expert concluded that CalTech’s actions were appropriate and that there were no significant issues the sponsoring agencies were not adequately addressing that would require CalTech’s intervention. Until the conditions we discuss in this report are effectively addressed, the oversight of state IT projects will remain a high‑risk area. Recommendations By December 2015 CalTech should develop and adopt criteria to guide the type and degree of intervention it will take to prevent IT projects with significant problems from continuing without correction, including the following: • When and how IPO analysts should recommend corrective action and escalate issues to CalTech’s management. California State Auditor Report 2014-602 3 March 2015 • What conditions could trigger CalTech to consider suspending or terminating an IT project. To address the challenges it faces in providing effective oversight, CalTech should do the following: • Develop, by December 2015, a method to formally document and communicate its expectations with sponsoring agencies. • Develop a policy and training plan regarding expectations for the independence of its IPO analysts. • Track oversight actions taken and consistently retain oversight documents. • Provide sponsoring agencies clear guidance for accurately reporting IT project status. To address its staffing issues, CalTech should continue its efforts to modify and use an existing, more relevant job classification for the IPO analyst role; conduct a workload assessment, by December 2015, to determine the resources needed for oversight activities; and implement, by June 2015, a consistent and repeatable training program for IPO analysts. Agency Comments CalTech agrees with our recommendations and indicates it will continue its efforts to improve the oversight of state IT projects. 4 California State Auditor Report 2014-602 March 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2014-602 5 March 2015 Introduction Background In September 2013 the California State Auditor (state auditor) published its most recent assessment of the high‑risk issues the State and certain agencies face.1 Our assessment identified oversight of the State’s information technology (IT) projects as one area of ongoing concern. Within this high‑risk area, we further identified three key IT oversight areas: security, planning and procurement, and project execution. Our focus with this audit is on the State’s oversight of the project execution stage of IT projects, as shown in Figure 1. Future audits of the State’s IT projects will examine the other key oversight areas we identified as high risk. Figure 1 Information Technology Project Management Life Cycle Internal Department Concept Initiation Planning* Executing*† Closing Approvals External Control Agency or Department Status Post–Implementation Agency Approvals Information Technology Feasibility Study Report Reports Evaluation Report Capital Plan (such as the California Department of Technology (CalTech) and the California Department of Finance) Statewide Information Independent Budget Change Proposal Technology Capital Plan Project Oversight Reports Information Technology Procurement Plan Security occurs during development and continues after implementation Source: California State Auditor’s analysis of CalTech’s State Information Management Manual, Section 17A, July 2013. Note: This audit covers the executing stage, which is highlighted in green. * Procurement activities occur in these stages of the life cycle. For example, development of the information technology procurement plan will occur during the planning stage, while review and selection of procurement bids will occur in the executing stage. † Independent verification and validation, which provides technical oversight of system development, also primarily occurs in the executing stage. The Entity Responsible for Providing IT Oversight Has Changed Over Time As shown in Figure 2 on page 7, over the last 30 years the Legislature and the governor have tried different approaches to overseeing the development of IT projects. Between 1983 and 2002, a single entity was tasked with 1 High Risk: The California State Auditor’s Updated Assessment of High‑Risk Issues the State and Select State Agencies Face (Report 2013‑601, September 2013). 6 California State Auditor Report 2014-602 March 2015 oversight of state IT projects, which became the California Department of Information Technology (DOIT). However, the department was not successful in its mission of overseeing state IT projects, so in July 2002, the Legislature allowed the statutes that established DOIT to sunset. As a result, the responsibility for statewide IT policies, procedures, approval, and oversight was split between the California Department of Finance and the California Department of General Services. In 2006 the Office of the State Chief Information Officer was created and was headed by the State Chief Information Officer (State CIO). The responsibilities for IT project approval and oversight were transferred to the Office of the State CIO in 2007, which gave the State CIO the power to suspend, terminate, and reinstate IT projects. Several more government reorganizations and legislative changes gave the Office of the State CIO responsibility over IT procurement policy and several other IT‑related duties, and in 2012 it was renamed the California Department of Technology (CalTech). CalTech, under the direction of the State CIO, has a host of responsibilities for managing the State’s IT activities. The State CIO manages a workforce of approximately 900 staff and oversees a wide range of critical state IT activities, including information security, statewide IT procurement, the State’s data centers, networking, and overseeing the development of the State’s IT projects. Thus, CalTech’s responsibility to oversee IT projects under development, performed by 40 of its 900 staff, is only one facet of its overall responsibilities. CalTech’s Role in Performing IT Project Execution Oversight In addition to having the authority to approve IT projects, CalTech has the responsibility to provide oversight of the projects it approves. Although this oversight covers a variety of activities, it is performed primarily during the planning and execution stages of the IT project management life cycle. Oversight during the execution stage includes both independent verification and validation (IV&V) and independent project oversight (IPO). IV&V provides independent oversight of the IT project’s specification, development, and implementation to ensure that it can accomplish its intended purposes. In contrast, IPO provides an independent review and analysis of project management practices to ensure that the sponsoring agencies follow required processes and standards. CalTech’s project oversight framework requires IPO analysts to possess subject‑matter expertise on IT project management, procurement, risk management, communications, and system engineering that has been gained on multiple similar projects. Table 1 on page 8 illustrates some of the differences between IPO and IV&V. In addition, CalTech requires all state IT projects requiring more than 500 hours of effort to complete to follow the California Project Management Methodology, which prescribes a standardized project management process for IT project managers. California State Auditor Report 2014-602 7 March 2015 Figure 2 Entity Providing Information Technology Project Oversight Has Changed Over Time and Its Responsibilities Have Expanded 1983 California Department of Finance (DOF) Office of Information Technology (OIT) 1995 California Department of Information DOIT sunset in 2002 and while the State Chief Information Technology (DOIT) Officer (State CIO) was retained, DOIT’s duties were passed to other agencies 2002 2002 2002 California Department of DOF State CIO General Services (DGS) Information technology IT strategy and direction IT procurement policy (IT) project oversight Network services (existing responsibility) 2006 Office of the State CIO State CIO elevated to a cabinet-level position to advise the governor on IT issues and to promote effective and 2005 efficient use of IT systems California Department of Technology Services (Technology Services) State’s two data centers and DGS’ 2007 Legislation moved IT project oversight from DOF network services to the Office of the State CIO Governor’s 2009 IT reorganization moved the following to the Office of the State CIO, which 2007 further expanded the office’s IT responsibilities: 1. IT procurement policy State and Consumer 2. All Technology Services duties 2009 Services Agency* 3. All Information Security duties Office of Information Security and Privacy Protection (Information Security) 2010 California Technology Agency Renamed from the Office of the State CIO and codified the governor’s 2009 IT reorganization 2012 California Department of Technology (CalTech) Renamed from the California Technology Agency, lowered status from agency to department, removed State CIO from the governor’s cabinet, and created the Statewide Technology Procurement Division within CalTech Sources: California State Auditor’s (state auditor) analysis of state laws and prior reports by the state auditor and Little Hoover Commission on state IT policy. Note: Not all responsibilities of these entities are included. * In 2012 this agency was eliminated and its responsibilities were split between two newly created agencies: the Government Operations Agency and the Business, Consumer Services, and Housing Agency. 8 California State Auditor Report 2014-602 March 2015 Table 1 Comparison of Independent Project Oversight and Independent Verification and Validation INDEPENDENT PROJECT OVERSIGHT (IPO) INDEPENDENT VERIFICATION AND VALIDATION (IV&V) Primary focus Project management. Systems engineering. Oversight role Oversight of project management, including processes, Oversight of information technology (IT) system, including activities, and performance. specifications, development, and implementation. Type of expertise Project management, risk management, and system Engineering, software, hardware, and system development engineering expertise. technical expertise. Assurance provided Determines if project management follows required Helps build quality into the system and assesses products and processes and standards. processes throughout the project life cycle. Problems identified Identify management problems and risks that could result Detects process or technical problems early that otherwise in greater costs, delays, or incomplete functionality. could cause delays and greater costs, or result in incomplete functionality. Provider Typically provided by the California Department of Typically provided by a private consultant.† Technology (CalTech).* Sources: CalTech; Institute of Electrical and Electronics Engineers, Inc. ; and our IT expert. * CalTech provides IPO services for medium‑ and high‑criticality projects and requires low‑criticality projects to obtain IPO services using sponsoring agencies’ internal independent resources or through contracting with an IPO consultant. Projects determine their criticality rating based on templates CalTech provides. † CalTech monitors IV&V reports as part of its oversight. CalTech’s IT Project Oversight and Consulting Division (oversight and consulting division) is responsible for providing IPO services for medium‑ and high‑criticality IT projects to determine whether a project is on schedule and on budget, and if it will provide the functionality the state agency that is implementing the project (sponsoring agency) requires. To this end, the oversight and consulting division produces IPO reports that inform sponsoring agencies and CalTech of findings and risks related to the IT project’s management practices and processes. By providing appropriate notice of identified issues and risks to sponsoring agencies and CalTech’s executive management, CalTech’s IPO services reduce the risk that an IT project will not address identified problems or will fail. Under state law, CalTech has the authority to intervene and to require sponsoring agencies to perform remedial measures on troubled projects, such as to establish remediation plans, secure appropriate expertise, or require additional reporting. CalTech’s Consulting and Planning Division can assist sponsoring agencies in implementing the remedial measures that its oversight and consulting division recommends. However, sponsoring agencies retain responsibility for project management and successful implementation of the IT project. If identified problems are not effectively mitigated, CalTech has the authority to suspend or terminate troubled IT projects. California State Auditor Report 2014-602 9 March 2015 The State Has Had Many Costly IT Project Failures and Is Projected to Spend Billions of Dollars on Current IT Projects Like many other states, local governments, and private entities, California has a history of costly failed IT projects and is at risk for more failures with some of its current IT projects. For example, as shown in Table 2, between 1994 and 2013, the State terminated or suspended seven IT projects after spending almost $1 billion. In addition, during that time, the State paid $1 billion more in federal penalties for its delay in implementing the California Department of Social Services’ Child Support Automation System. Table 2 Examples of Suspended or Terminated Information Technology Projects Between 1994 and 2013 YEAR TERMINATED AMOUNT SPENT AGENCY PROJECT TITLE/DESCRIPTION OR SUSPENDED (IN MILLIONS) California Department of Motor Vehicles Database Redevelopment Project 1994 $49 California Department of Social Services Child Support Automation System 1997 111* California Department of Developmental Services California Developmental Disabilities Information System 2006 10 California Department of Transportation Truck‑Permit System 2007 10 Administrative Office of the Courts Court Case Management System 2012 407 California Department of Motor Vehicles IT Modernization Project 2013 136 California State Controller’s Office MyCalPays Project 2013 262 Total $985 Source: California State Auditor’s (state auditor) review of prior reports on state information technology projects by the state auditor, the Legislative Analyst’s Office, and the Little Hoover Commission. * The State also paid about $1 billion in federal penalties for its eight‑year delay in implementing the Child Support Automation System until a system was ultimately developed and certified by the federal government in 2008. The State has a substantial commitment to current IT projects under development. As shown in Table 3 on the following page, as of February 2015, the State has 45 IT projects currently under development that are subject to CalTech’s oversight, with a reported cost of more than $4 billion.2 In addition to being overseen by CalTech’s oversight and consulting division, all project teams must periodically submit project status reports, which include a self‑assessment of their project’s health. According to CalTech’s Web site, six of those 45 projects, or 13 percent, representing total project costs of over $575 million, are reporting a Yellow rating, 2 According to state law, all contracts for the acquisition of IT projects exceeding specified thresholds—referred to as reportable IT projects—are required to be made by or under the supervision of CalTech. CalTech’s Web site indicates that the specified thresholds vary by sponsoring agency and generally range from $200,000 to $5 million. Contracts for the acquisition of IT projects that fall below these specified thresholds are required to be overseen by the respective sponsoring agency and may be reviewed by CalTech on a selected basis. 10 California State Auditor Report 2014-602 March 2015 indicating the existence of problems that are negatively impacting the project’s progress. Further, the sponsoring agency for one of the 45 projects, with an estimated cost of $6 million, has self‑reported a Red rating, indicating that the project’s success is in jeopardy and in need of immediate intervention. Finally, Table 3 indicates that 12 projects do not have current project status reports, and according to CalTech’s Web site, the sponsoring agencies for six of those projects appear to have never submitted a report in previous reporting periods. According to the deputy director of the oversight and consulting division, although some sponsoring agencies submit their reports late or stop submitting reports because of more pressing issues related to the project, other sponsoring agencies are not complying with the reporting requirements and have not submitted some or all of their required project status reports to CalTech. Table 3 Approved Information Technology Projects Under Development February 2015 PROJECT HEALTH RATING† PROJECT NUMBER OF TOTAL COST NO REPORT CRITICALITY* PROJECTS (IN MILLIONS) GREEN YELLOW RED AVAILABLE High 19 $4,358 15 2 0 2 Medium 22 232 11 3 1 7 Low 4 18 0 1 0 3 Totals 45 $4,608 26 6 1 12 Source: California Department of Technology’s (CalTech) Web site. * Project criticality is determined by a rating system for business and technical complexity as defined in the Statewide Information Management Manual. This rating helps to determine the degree of project oversight CalTech exercises. † Project health ratings are self‑reported by the sponsoring agency in project status reports and do not represent an independent assessment of the project’s status. Health ratings are defined as follows: Green indicates a project that is currently not reporting many significant issues. Yellow indicates that there are problems that are beginning to negatively impact the project’s progress. Red indicates a problem with the project that is beyond the sponsoring agency’s ability to recover from and that the project’s success is in jeopardy and thus the project is in need of immediate intervention. No Report Available indicates that the sponsoring agency did not submit a project status report for the reporting period. IT project failure is not unique to California government. In fact, according to a private consulting firm study, during the eight years between 2004 and 2012, more than half of industry projects were troubled or failed each year. Further, in 2012 the same study indicated that roughly 38 percent of large projects failed and 52 percent had significant challenges. IT project development is California State Auditor Report 2014-602 11 March 2015 an inherently risky endeavor because of the complexity of merging new and emerging software and hardware for a multitude of tasks not previously done. A well‑disciplined and experienced project management team and development staff will help ensure success. However, in California government IT projects—as well as other public and private sector IT projects—the level of staff discipline and experience varies greatly, which adds risk to IT development. Thus, the money involved and the rate of project failure underscores the importance and necessity for CalTech’s oversight role in the State’s IT projects. Scope and Methodology State law authorizes the state auditor to establish a state high risk audit program and to issue reports with recommendations for improving state agencies or statewide issues it identifies as high risk. State law also authorizes the state auditor to require state agencies identified as high risk and those responsible for high‑risk issues to report periodically to the state auditor on the status of their implementation of recommendations made by the state auditor. Programs and functions that are high risk include not only those particularly vulnerable to fraud, waste, abuse, and mismanagement, but also those that have major challenges associated with their economy, efficiency, or effectiveness. In September 2013 the state auditor issued its latest assessment of high‑risk issues that the State and selected agencies face.3 Based on our continued inclusion of IT as a high‑risk issue, we performed this audit of CalTech’s oversight of state IT projects. We list the audit objectives we developed and the methods we used to address them in Table 4 on the following page. 3 High Risk: The California State Auditor’s Updated Assessment of High‑Risk Issues the State and Select State Agencies Face (Report 2013‑601, September 2013). 12 California State Auditor Report 2014-602 March 2015 Table 4 Audit Objectives and the Methods Used to Address Them AUDIT OBJECTIVE METHOD 1 Review and evaluate the laws, regulations, Obtained, reviewed, and evaluated laws, regulations, and procedures pertaining to CalTech’s and procedures significant to the oversight of state IT projects. California Department of Technology (CalTech) performing oversight of state information technology (IT) projects. 2 Review and evaluate CalTech’s policies, • With the assistance of our IT expert, reviewed and evaluated CalTech’s policies and procedures procedures, tools, and guidance related to its oversight of IT projects to determine whether it provides adequate guidance to for IT project oversight, tracking, independent project oversight (IPO) analysts. and reporting. • Interviewed CalTech’s management to determine the management philosophy that guides CalTech’s oversight work. 3 Assess the adequacy of CalTech’s staffing • Interviewed CalTech’s management to determine any challenges CalTech faces in hiring for IT project oversight. qualified IPO analysts and to determine any future plans to address such challenges. • Obtained and reviewed the personnel files for the last 21 employees hired in the Information Technology Project Oversight and Consulting Division to determine the experience these employees had in IT project management and IT project oversight. 4 Assess the adequacy of CalTech’s training • Interviewed CalTech’s management to determine any challenges CalTech faces in training IPO for its IT project oversight employees. analysts and to determine any future plans to address such challenges. • Obtained and reviewed training materials for IPO analysts. 5 For a selection of IT projects, assess the • Reviewed four recent or current IT projects and obtained related reporting and effectiveness of CalTech’s oversight. oversight documents. • With the assistance of our IT expert, reviewed the IPO reports for each of the four projects for a specific period of time to determine whether oversight staff were identifying any problems and, to the extent possible, determine what actions the oversight staff or CalTech’s management took to ensure that the project corrected or mitigated the problems. Sources: California State Auditor’s analysis of the information and documentation identified in the column titled Method. California State Auditor Report 2014-602 13 March 2015 Audit Results The California Department of Technology Lacks Certain Procedures to Make Its Oversight More Effective Despite clear statutory authority to curtail troubled state information technology (IT) projects, the California Department of Technology (CalTech) faces challenges in pursuing effective project oversight. One challenge is that CalTech’s independent project oversight (IPO) analysts lack clear guidance for when to escalate problems to their managers. CalTech also lacks criteria for the conditions that will trigger it to consider suspending or terminating a project. This lack of guidance is compounded by CalTech’s failure to formally set expectations of its oversight authority to sponsoring agencies— state agencies implementing IT projects. In addition, CalTech’s IPO analysts face a potential conflict between their role as coaches to sponsoring agencies and their role in identifying problems facing IT projects and ensuring they are corrected through consistent oversight and enforcement. Without clear guidance they may not have the independence necessary for effective oversight. Finally, CalTech does not track the action items from meetings with sponsoring agencies of IT projects and it does not provide sponsoring agencies with sufficient guidance to meaningfully report their progress to date. CalTech Lacks Guidance for Using Its Statutory Oversight Powers CalTech does not have sufficient guidance for its IPO analysts to follow to help them in pursuing corrective actions that sponsoring agencies of troubled IT projects need to take. As we discussed in the Introduction, state law vests CalTech with the authority to suspend and terminate IT projects. Despite this authority, CalTech has no formal guidance that defines the conditions that would trigger it to consider using these enforcement tools to address a troubled IT project. As shown in Figure 3 on the following page, CalTech’s current practices for escalating project issues rely on professional judgment at key decision points. Although CalTech’s decision to suspend or terminate a project would rely heavily on professional judgment—based on how numerous and severe the problems are and how effectively the sponsoring agency is working to correct them—we believe that it is a good business practice to provide high‑level structure to guide that professional judgment to ensure consistency among the State’s IT projects. Further, our IT expert believes that without high‑level guidance, CalTech cannot meaningfully defend its decisions about whether and when to suspend or terminate a troubled project or whether it should allow the project to proceed. Indeed, as we discuss in a later section, without clear guidance for when to intervene in troubled IT projects, CalTech has let projects with major issues continue to consume state resources while they flounder. 14 California State Auditor Report 2014-602 March 2015 Figure 3 Practice for Addressing Project Problems Basis for Action Ongoing Independent Project Oversight (IPO) IPO analyst monitors problems and risks that could result in greater costs, delays, or incomplete functionality. California Department of Technology’s (CalTech) Information IPO Report Technology Project IPO analyst discloses problems in IPO report, which is reviewed by Oversight analyst’s manager. Report is delivered to sponsoring agency’s Framework leadership as well, including executive steering committee. ? Problems identified in IPO reports adequately YES addressed in a timely NO IPO analyst and manner by the manager judgment sponsoring agency? Escalation to CalTech’s Deputy Director In consultation with their manager, IPO analyst escalates the issue to the deputy director. Deputy director can work with sponsoring agency’s leadership to direct the CalTech’s deputy project to address IPO analyst’s concerns. director of the ? Information Does escalation to Technology deputy director YES compel project to Oversight and make corrections? Consulting Division (deputy director) NO judgment State Chief ? Does escalation to Information Briefing with State CIO State CIO compel Officer (State CIO) YES project to make IPO analyst creates a briefing document judgment corrections? to highlight unaddressed issues for State NO CIO. The State CIO can use this document to guide conversations at portfolio meetings with the sponsoring agency’s leadership. The State CIO also meets with system integration vendors to discuss ! ongoing projects and may discuss problems with them at these meetings. State CIO can require remedial measures or can suspend or terminate the project. Source: California State Auditor’s analysis of CalTech’s oversight practices. California State Auditor Report 2014-602 15 March 2015 According to the deputy director (deputy director) of the Information Technology Project Oversight and Consulting Division (oversight and consulting division), CalTech is working to identify points in a project’s life cycle where it could implement go/no‑go health checks and criteria to guide those checks; however, CalTech has no time frame for implementing these criteria. The deputy director also indicated that CalTech uses its strongest tools— suspending or terminating a project—only as a last resort when a troubled project fails to get back on course. However, our IT expert believes that the threat of suspension, if used judiciously and based on clear guidelines, could be useful leverage for CalTech to compel sponsoring agencies of troubled projects to properly address systemic problems that could lead to project failure. Without a process for when to suspend a project or a commitment from CalTech’s leadership to proactively use its authority to suspend projects, CalTech is hindered in using its full authority to pursue aggressive oversight to ensure corrective actions are promptly taken. Not only does CalTech lack guidance for suspending or terminating projects, it also lacks guidance for employing its full range of statutory oversight tools. In addition to its authority to suspend or terminate troubled IT projects, CalTech can also require sponsoring agencies to take remedial measures to achieve compliance with the project’s objectives. State law indicates that these remedial measures can include requiring an independent assessment of the project’s activities, establishing remediation plans, securing appropriate expertise, and requiring additional project reporting. Special Project Report However, CalTech lacks criteria for IPO analysts to use when deciding whether to require an IT • Provides a justification for changes from the IT project’s project to take such remedial measures, and it does original feasibility study or previously approved special not define these remedial measures any further project report (SPR). than what is written in state law. The deputy • Required when the project’s costs, benefits, or schedule director indicated that in practice CalTech can deviate by 10 percent or more from its approved level, and does impose conditions when approving a when a major revision occurs in project requirements or project’s special project report (SPR), which, as the methodology, or under certain other conditions. text box indicates, is required to justify substantial • The sponsoring agency cannot request additional changes in the project’s cost, benefits, or schedule. budget appropriations until the California Department of For example, according to the deputy director, Technology (CalTech) approves the SPR. for a current project of the California Health and • CalTech may place conditions on the IT project when Human Services Agency, CalTech insisted that the approving an SPR. project develop a cost metric report before CalTech would approve the SPR. We also noted that for Sources: The State Administrative Manual and CalTech. the Financial Information System for California (FI$Cal) Project, CalTech required the project to assess the resources needed for the number of 16 California State Auditor Report 2014-602 March 2015 departments scheduled to be included in Wave 4 of the project and develop an implementation plan as a condition of approval of its fifth SPR in January 2014.4 Because CalTech does not always However, because CalTech does not always hold projects accountable hold projects accountable for SPR for SPR conditions, using these conditions to compel sponsoring conditions, using these conditions agencies to take corrective action does not provide consistent to compel sponsoring agencies to oversight. For example, in our February 2015 report on the California take corrective action does not Department of Consumer Affairs’ (Consumer Affairs) BreEZe Project, provide consistent oversight. we found that CalTech approved the project’s third SPR in July 2014 even though Consumer Affairs had not provided CalTech with a project schedule for phase 2, which was a condition from its second SPR.5 Furthermore, CalTech could not provide any evidence that it had tracked the California State Controller’s Office’s (state controller) efforts to meet the conditions imposed on its MyCalPays Project’s fourth SPR or that CalTech had verified that those conditions had been satisfactorily met before approving the project’s fifth SPR. Further, the time between SPRs can be too long to give CalTech the opportunity to hold projects accountable for imposed conditions in a timely manner. For example, CalTech approved the MyCalPays Project’s fourth SPR in December 2009 and approved its fifth SPR more than two years later in March 2012. During this gap, CalTech might have missed multiple opportunities to intervene and help bring the project back on track. Since CalTech lacks guidance for what types of conditions to place on an SPR and what criteria should trigger those conditions, or when such conditions must be met prior to approving the SPR, imposing conditions on a project’s SPR may not be an effective oversight method. Finally, CalTech has allowed its procedures for IPO analysts to escalate issues to CalTech’s management to become out of date. Specifically, the oversight and consulting division’s internal procedures catalog includes an issue escalation process and a related one‑page template for summarizing and escalating issues to CalTech management. The template directs IPO analysts to provide a description of the issue, the issue’s impact, and recommendations to address the issue, and it provides examples of potential impacts and recommendations. According to our IT expert, these procedures and the template could provide useful guidance for IPO analysts. However, the deputy director indicated that the procedures are not currently in use and that they need updating. Moreover, the deputy director, who has been in her position since April 2014, was unaware 4 FI$Cal Status Letter (Report 2013‑039.1, February 2014). FI$Cal is a business transformation project for state government in the areas of budgeting, accounting, procurement, and cash management. 5 California Department of Consumer Affairs’ BreEZe System: Inadequate Planning and Oversight Led to Implementation at Far Fewer Regulatory Entities at a Significantly Higher Cost (Report 2014‑116, February 2015). BreEZe is an IT system that was intended to support all of the primary functions and responsibilities of 37 of Consumer Affairs’ 40 boards, bureaus, committees, and a commission. California State Auditor Report 2014-602 17 March 2015 of these particular documents until we brought them to her attention, and they were not in evidence for the four projects that we reviewed. The deputy director indicated that these procedures could serve as a starting point for updating the oversight and consulting division’s procedures. CalTech Does Not Effectively Establish the Expectations of Its Oversight CalTech does not formally set expectations of its authority and responsibilities for performing oversight of IT projects to sponsoring agencies. The deputy director noted that one of the challenges for the oversight and consulting division is that sponsoring agencies are unclear about CalTech’s authority and do not always accept guidance from its IPO analysts. Furthermore, CalTech has indicated that in the past some sponsoring agencies complained that they did not receive their time allocation for CalTech’s IPO services, which may indicate that these sponsoring agencies feel they have purchased a certain level of service from CalTech. However, as we discussed in the Introduction, CalTech’s oversight is required and primarily meant to reduce the risk that an IT project will not address identified problems or will fail. Despite acknowledging this challenge, CalTech does not formally CalTech does not formally set set expectations consistent with its authority for oversight of IT expectations consistent with its projects with sponsoring agencies. CalTech recently developed a authority for oversight of IT projects presentation for holding introductory meetings with sponsoring with sponsoring agencies. agencies to explain CalTech’s oversight function. However, this presentation includes only a high‑level overview of CalTech’s oversight role, and leaves out such information as the sponsoring agency’s responsibility to promptly respond to CalTech’s oversight recommendations or that, depending on the nature of the problems that its IPO analysts identify, CalTech may impose several increasingly severe remedial measures on the sponsoring agency. We believe that a formal communication of CalTech’s oversight role, authority, and access to project records and meetings would more clearly communicate to sponsoring agencies the expectations and responsibilities for IT project oversight. The Independence and Effectiveness of CalTech’s Oversight of IT Projects Is Challenged by Its Consulting Role CalTech’s oversight of IT projects is challenged by its conflicting role to also consult and assist sponsoring agencies on their IT projects. State law directs CalTech not only to enforce IT policies and to oversee IT projects, but also to consult with the sponsoring agencies prior to project initiation. According to the State Administrative Manual, CalTech’s oversight responsibilities include 18 California State Auditor Report 2014-602 March 2015 recommending and pursuing remedial measures and corrective actions both to minimize risk to the State of IT project failure and to help ensure that IT projects are successful. According to the State Chief Information Officer (State CIO), CalTech’s oversight has two goals: to screen out poorly planned and developed IT project proposals and to ensure that approved IT projects are implemented effectively. To achieve this second goal, which is the focus of this audit, the State CIO indicated that IPO analysts must perform two distinct roles: provide lessons learned and advice, and ensure that sponsoring agencies take proper steps to resolve risks and issues on IT projects. There is a potential conflict in However, there is a potential conflict in having CalTech’s IPO having CalTech’s IPO analysts analysts combine the role of being a coach to sponsoring agencies combine the role of being a coach and the role of overseeing IT projects by identifying risks and to sponsoring agencies and the enforcing corrective actions to mitigate those risks. According to role of overseeing IT projects by our IT expert, IPO analysts must be independent to ensure that identifying risks and enforcing they can remain objective when conducting oversight. Because corrective actions to mitigate part of their role is to ensure that projects are developed and those risks. implemented effectively, IPO analysts risk becoming overly involved in the success of the projects they oversee. The blurring of these two roles can create conflicts for IPO analysts. The State CIO believes that IPO analysts are independent because they never provide direct assistance or consulting to projects; rather, staff from CalTech’s Consulting and Planning Division fill this role. Although IPO analysts do not provide direct assistance, the risk remains of them becoming closely involved through coaching the projects they oversee, thus possibly impairing their independence in providing oversight. Moreover, CalTech’s IT project oversight framework, which CalTech expects its IPO analysts to follow, only mentions independence of IPO analysts without providing any guidance for how they should maintain their independence. Other state entities have recognized the importance of CalTech’s oversight role. For example, a 2011 report by the Little Hoover Commission characterized CalTech as capable of stepping in to force changes or stop troubled projects.6 The report also recommended that CalTech maintain aggressive oversight of IT projects. In response to this report, CalTech indicated that the initiatives it has taken since the report’s issuance—such as assuming responsibility for IT project procurement, revamping its oversight approach, and establishing its Office of Professional Development and the Consulting and Planning Division—indicate that it has 6 At that time, CalTech was known as the California Technology Agency, and the State CIO was a cabinet‑level position. California State Auditor Report 2014-602 19 March 2015 comprehensively overhauled its approach to IT projects. However, none of these actions addresses the risk that simultaneously advising and conducting oversight of IT projects could compromise CalTech’s IPO analysts’ independence. We believe this is one more reason for providing training and clear guidance to IPO analysts for when they should escalate project issues to CalTech’s management. CalTech Poorly Documents Oversight Actions Taken on IT Projects CalTech’s current practice for escalating project issues identified by its IPO analysts to executive management is poorly documented and does not adequately track the outcomes relating to these issues. The State CIO expects IPO analysts to appropriately escalate important project issues to CalTech managers and to him in a timely manner. When such escalations occur, the IPO analysts create monthly briefing documents for their respective projects that summarize the project’s status and any problems that need to be addressed. According to the deputy director, the State CIO uses these briefing documents during portfolio meetings held between CalTech’s executive management and the sponsoring agency for large, high‑criticality projects to discuss the IT project’s progress as well as to convey CalTech’s concerns and advice. However, CalTech does not document action items from these portfolio meetings and only retains the electronic briefing documents provided by its IPO analysts until their next monthly briefing document is submitted, which then overwrites the prior month’s document. As a result of this practice, there is no historical record of the issues that IPO analysts have elevated to the State CIO or their resolution. Without such a record, CalTech cannot show that its executive management takes appropriate actions on chronic project problems outside of a formal project suspension or termination. We believe that good business practices should compel CalTech to retain these documents while oversight is ongoing to serve as a historical record of the issues raised to the attention of the State CIO and to promote transparency in CalTech’s actions in response to such issues. The deputy director acknowledged that saving the briefing documents would be useful, especially in the event of staffing or leadership changes on a project. Not only does CalTech fail to retain these briefing documents, Not only does CalTech fail to retain it does not produce any other documentation to memorialize briefing documents, it does not the action items from these portfolio meetings. Because these produce any other documentation portfolio meetings occur between the State CIO and executives to memorialize the action items of different sponsoring agencies to discuss potentially critical from portfolio meetings. project issues, we expected that CalTech would have documented the issues discussed, advice and directions given, and agreements reached with sponsoring agencies. In fact, our recent audit report 20 California State Auditor Report 2014-602 March 2015 on Consumer Affairs’ BreEZe Project recommended that CalTech document key discussions with Consumer Affairs in which significant concerns raised by IPO reports are discussed.7 According to the deputy director, these portfolio meetings are primarily intended to share information between the sponsoring agency and the State CIO, and CalTech does not take minutes because doing so would discourage candid conversations that these meetings are intended to foster. However, as part of the oversight process, we believe that CalTech should document these discussions to memorialize and track the issues that it has raised and what, if any, corrective actions were proposed to help ensure that sponsoring agencies have properly addressed these issues. CalTech does not always retain Furthermore, CalTech does not always retain the status reports that the status reports that sponsoring sponsoring agencies submit for CalTech’s review and posting on agencies submit for CalTech’s its Web site. CalTech requires projects to regularly submit project review and posting on its Web site. status reports (status reports), which list information such as the project’s progress toward completion, ratings of overall project health, project costs, and status of key milestones. According to the deputy director, these status reports provide a snapshot of the project’s status according to the sponsoring agency, and CalTech posts them on its Web site to promote transparency. However, in one instance when we requested these status reports for the state controller’s MyCalPays Project, CalTech was unable to produce them. According to the deputy director, CalTech believes that the sponsoring agencies are responsible for retaining these reports. However, we believe that CalTech also should retain the reports because it reviews them in its oversight role and posts them on its Web site. The Project Status Report’s Percent Complete Metric Produces Inconsistent Information Although CalTech requires sponsoring agencies to report the percent complete for their IT projects in regular status reports that CalTech approves and posts to its Web site, we question the value that this metric provides to outside stakeholders. Specifically, CalTech directs sponsoring agencies to develop a schedule management plan and track their progress. When sponsoring agencies submit their status reports to CalTech, they include a measure of the percentage of the project that has been completed. According to the deputy director, CalTech’s IPO analysts review and approve the status reports before they are posted publicly; however, 7 California Department of Consumer Affairs’ BreEZe System: Inadequate Planning and Oversight Led to Implementation at Far Fewer Regulatory Entities at a Significantly Higher Cost (Report 2014‑116, February 2015). California State Auditor Report 2014-602 21 March 2015 the IPO analysts may not always fully resolve differences between their IPO reports and the status reports before approving and posting them. In fact, we observed that sponsoring agencies sometimes report percent complete measurements that may not accurately reflect the status of their IT projects. For example, in its December 2014 status report, the Employment Development Department reported that its Unemployment Insurance Modernization Project (UI MOD Project) was 99 percent complete. However, according to the same status report, as of that month the project had more than $53 million of project funds remaining, of which nearly $19 million was for development activities. In this case, the UI MOD Project had spent only 87 percent of its approved development funds. Furthermore, as discussed later in the report, the department does not expect to implement the external portion of its continued claims redesign module—the second half of two subprojects— until June 2015. Given these factors, we believe that reporting the status of the UI MOD Project as 99 percent complete overstates the project’s progress to outside stakeholders, since it implies that there is very minimal development work remaining on the project. Our IT expert agrees that the outstanding project funds and remaining implementation necessary to complete the project indicate that the UI MOD Project is less than 99 percent complete. Additionally, the October 2014 status report for the FI$Cal Project asserted that the project was 56 percent complete. However, in our January 2015 FI$Cal Status Letter, we noted that the FI$Cal Project would be less than 50 percent complete if CalTech required the project to use alternative metrics to measure project progress, such as the total number of current users, the total number of departments converted to it, overall expenditures, or functionality completed. It is unclear whether the inconsistencies we observed are because It is unclear whether inconsistencies CalTech was not properly reviewing the status reports before we observed are because CalTech approving and posting them, or if CalTech needs to provide more was not properly reviewing the specific guidance for sponsoring agencies to use in tracking project status reports before approving and status. Further, our IT expert questions the use of a single metric to posting them, or if CalTech needs report project progress and status. Instead, our IT expert suggests to provide more specific guidance that reporting metrics on scope, schedule, resources, issues, risks, for projects to use in tracking and changes would provide a more appropriate indication of an project status. IT project’s progress and status. Based on these observations, we believe that CalTech needs to revisit its guidance to sponsoring agencies for creating their status reports and its procedures for reviewing and approving status reports to ensure that projects present meaningful information to the public. 22 California State Auditor Report 2014-602 March 2015 Although Staffing Problems Still Pose a Risk to CalTech’s Oversight Effectiveness, It Is Taking Actions That May Reduce That Risk Frequent turnover, an inadequate state job classification, a potential shortage of resources, and inconsistent training affect CalTech’s staffing practices and create a risk to the oversight of state IT projects. Recently, the oversight and consulting division began taking steps that should help address this risk. For example, the deputy director is in the process of developing a workload analysis tool to determine whether the division needs additional resources or could use its existing resources more efficiently. Further, to attract and retain a stronger IT oversight workforce, CalTech is pursuing approval to modify an existing job classification that is more relevant to the type of IPO work done in the oversight and consulting division, and the deputy director is developing a divisionwide training plan for both new and current oversight employees. The Oversight and Consulting Division Was Affected by High Turnover in Two of the Three Years We Reviewed High turnover in CalTech’s oversight and consulting division contributes to the loss of project knowledge and perspective, which disrupts the consistency of its oversight of state IT projects. As indicated in Table 5, for the three years we reviewed, the oversight and consulting division had IPO analyst turnover as high as 81 percent. For comparison, according to the U.S. Bureau of Labor Statistics, the average turnover for state and local government staff was about 16 percent during the same period. Table 5 Turnover of Independent Project Oversight Analysts January 2012 Through December 2014 INFORMATION TECHNOLOGY PROJECT OVERSIGHT AND CONSULTING DIVISION (OVERSIGHT AND CONSULTING DIVISION) INDEPENDENT PROJECT OVERSIGHT (IPO) ANALYSTS AVERAGE NUMBER AVERAGE NUMBER AVERAGE NUMBER YEAR NUMBER THAT DEPARTED* OF POSITIONS OF VACANCIES OF POSITIONS FILLED TURNOVER PERCENTAGE 2012† 17 25 4 21 81% 2013 6 30 4 26 23 2014‡ 5 35 6 29 17 Source: California State Auditor’s analysis of the California Department of Technology’s organizational charts from January 2012 through December 2014. Note: Authorized position numbers increased due to budget change proposals. * We included IPO analysts as well as branch managers in our count; we did not include the oversight and consulting division deputy director or general support staff. † Oversight and consulting division reorganized in May 2012. ‡ Oversight and consulting division structure changed in March 2014. California State Auditor Report 2014-602 23 March 2015 For example, the state controller’s MyCalPays Project System Integrator had three IPO analysts leave the oversight and consulting division between May 2012 and A company that specializes in the development of systems February 2013. This time frame was a critical period or the customization of commercial-off-the-shelf hardware when the project experienced numerous defects and software packages to meet the functional and technical during its pilot run, which resulted in the state requirements for a sponsoring agency. controller issuing a cure notice—a formal notification Source: Catalysis Group, Inc., serving as an information that contract terms are not being met—to its technology expert to the California State Auditor. system integrator. CalTech’s July 2012 IPO report for MyCalPays illustrates the problems caused by IPO analyst turnover. In this report, the IPO analyst noted that he was not addressing several conclusions reported by former IPO analysts until he could review the basis for their conclusions. The IPO analyst’s statement highlights that there was a loss of project knowledge and perspective because he lacked historical project information. In addition, the FI$Cal Project had five different individuals serving as the IPO analyst during the 15‑month period between May 2012 and July 2013.8 As a result of the frequent turnover on the FI$Cal Project, we reported that CalTech had not always provided timely analysis of the project’s status. In fact, one of these five IPO analysts noted in the September 2012 IPO report that “without the stability of a long‑term IPO on the [FI$Cal] project, oversight of the project may not be as thorough and comprehensive as a project of this size and complexity requires.” These examples illustrate the disruption in IT project oversight that frequent turnover of IPO analysts causes. As shown in Table 5, CalTech’s oversight and consulting division lost significantly more IPO analysts during 2012 than it did in the other two years. We noted that during the three years we reviewed, there was instability in the oversight and consulting division due to organizational changes and a lack of consistent leadership. Specifically, in May 2012, CalTech combined two divisions that were formerly providing oversight into one division. Further, in March 2014, CalTech changed the division’s structure to provide the basis for a team approach to IT project oversight, discussed in a later section of the report. Moreover, between January 2012 and December 2014, the oversight and consulting division had three different deputy directors and seven months during that time when the deputy director’s position was vacant. Divisional reorganization and changes, along with frequent turnover at the deputy director level, fosters an unstable environment, which the current deputy director acknowledged may have contributed to the high turnover. The deputy director is unaware of any plans for further organizational changes, and she believes that consistent leadership from branch managers will improve division stability. 8 FI$Cal Status Letter (Report 2013‑039, September 2013). 24 California State Auditor Report 2014-602 March 2015 CalTech Is Pursuing a More Relevant Job Classification for the IPO Analyst Role To improve its workforce, CalTech is planning to modify an existing employee classification for its IPO analysts. CalTech currently uses individuals from the data processing manager job classification series, which includes four levels of increasing responsibility, to staff its IPO analyst positions. Although CalTech is generally able to hire personnel to fill its IPO analyst positions, the data processing manager classification may not attract applicants with the most relevant skills and experience required for IT project oversight. According to CalTech’s IT project oversight framework, it expects that IPO analysts will have experience as participants in and reviewers of IT projects of similar size and complexity as those it oversees and also will possess subject‑matter expertise in project management, procurement, risk management, communications, and system engineering. We reviewed the personnel files for the last 21 IPO analysts that the oversight and consulting division hired and found that the new hires averaged about one and a half years of previous IT project oversight experience—ranging from none to nearly 10 years of experience—and they averaged just over four years of IT project management experience—ranging from none to more than 14 years of experience. Therefore, we believe, and our IT expert Many of CalTech’s recent new hires concurs, that many of these new hires may not have possessed may not have possessed adequate adequate experience to oversee large and complex IT projects at experience to oversee large and the time they were hired. Moreover, only 7 of these 21 new hires complex IT projects at the time they were certified as a project management professional, which is were hired. an industry‑recognized certification for project managers and demonstrates that an individual has the education, experience, and competency to lead and direct projects. Although having this certification is not a guarantee of an individual’s expertise, it is an indication that an individual understands the fundamentals of project management and has met certain education and experience requirements. According to its deputy director, the oversight and consulting division is able to recruit and hire employees with IT project management experience; however, the scope of that experience is generally not always relevant to the oversight work that IPO analysts perform, and it requires more work for CalTech to screen for qualified candidates. In particular, the deputy director indicated that the data processing manager job requirements are too broad and do not specifically emphasize project management skills, which are necessary for IPO analysts. Further, she stated that to be effective, IPO analysts should be able to supervise, perform independent problem solving and analysis, and be the voice of authority and detailed knowledge. California State Auditor Report 2014-602 25 March 2015 To address the lack of relevant experience, CalTech, in partnership with other departments, is attempting to tailor an existing state classification—the project manager series—to hire staff to perform IPO work. CalTech management believes that this classification will better attract candidates with the skill set required for effective IPO and help it retain a higher percentage of qualified staff. As shown in Table 6, the existing project manager classification has requirements that are better suited for the IPO analyst role. For example, the project manager classification requires technical competencies in project management and IT systems performance assessment, which the data processing manager job classification does not. Table 6 Comparison of the Data Processing Manager and Project Manager Classifications DATA PROCESSING MANAGER I AND II DATA PROCESSING MANAGER III AND IV EXISTING PROJECT MANAGER (INFORMATION TECHNOLOGY) Annual Base $65,088—$94,104 $87,120—$114,216 $87,120—$103,872* Salary Range Minimum • One year of experience in state • Two years of experience as Five years of large information technology (IT) Qualifications service performing electronic a Data Processing Manager I project management experience with emphasis data processing duties, or II with at least one year in a in scheduling, risk management, and resource OR management assignment, allocation. Three of the five years must have been as a • Four to five years of experience OR full‑time project manager of a complex IT project. in system design, programming, • Three to four years of or operations with one to experience directing the two years experience in a operations of a data center. supervisory position. Key • Planning, organizing, and • Full management • Managing or overseeing all aspects of one or more Responsibilities reviewing activities of data responsibility for a medium to IT projects. processing staff. large data center. • Full responsibility for cost management, • Directing a group or unit of • Directing a complex monitoring project risks, and developing systems programmers or analysts. interdepartmental project. testing strategies. • Directing the computer • Contracting for IT services. operations of a large data center. • Making policy recommendations. • Briefing executive management and testifying before committees, control agencies, and the Legislature. Key Knowledge • Equal Employment • Principles of data • Contracting, financial management, infrastructure Requirements Opportunity policies. processing systems design, design, and performance assessment. • Project management methods programming, operations, • Planning and managing for project implementation. and techniques. and controls. • IT assessment, evaluation, and contingency planning. • IT procurement processes. • Employee supervision. • System performance measures to assess the • Project oversight principles. • Project management effectiveness of IT systems. principles. Certifications None required. None required. Project Management Professional Certificate. Required Source: California State Auditor’s analysis of the data processing manager and project manager job descriptions. * An individual in the existing project manager classification is eligible for a 7.5 percent to 15 percent monthly pay differential for overseeing or managing highly complex IT projects. 26 California State Auditor Report 2014-602 March 2015 The project manager series According to our IT expert, the project manager series may benefit may benefit CalTech because it CalTech because it emphasizes project management skills and emphasizes project management experience, whereas the data processing manager series highlights skills and experience, whereas the system design and computer operations. Our IT expert further states data processing manager series that having project management skills helps IPO analysts perform highlights system design and oversight more effectively. However, he noted that an IPO analyst computer operations. needs experience working on and leading projects, and recommends that CalTech ensure that it requires experience as a project manager on at least one large systems integration project if it uses the project manager classification. Our IT expert believes that the higher compensation from the pay differentials, as indicated in Table 6, for the project manager classification would allow CalTech to better compete with the private sector for qualified IT staff. Although our legal counsel indicates that CalTech is not required to conduct a salary survey, we believe that one may be beneficial for CalTech to determine whether the salary range is adequate. Further, CalTech has the time to conduct a study since, according to its administrative director, modifying the project manager classification is a long‑term solution and will not be finalized until the end of 2015 because of the approval process that the State requires. Although the Oversight and Consulting Division Has Filled Most of Its IPO Analyst Positions, It Is Unclear Whether the Division Is Adequately Staffed The oversight and consulting division hired additional IPO analysts between fiscal years 2011–12 and 2013–14; however, it is unclear whether the division has enough positions to effectively oversee the State’s IT projects. Until 2010 the State generally contracted with consultant firms to perform IPO services (IPO consultants). However, a 2010 CalTech policy letter halted the practice going forward, and in 2012 the state law was amended to prevent departments from procuring IPO services without CalTech’s approval. To address the increased workload that resulted from the reduced level of contracting with IPO consultants, the oversight and consulting division received funding to hire 19 additional IPO analysts between fiscal years 2011–12 and 2013–14. Although in February 2015 the oversight and consulting division had only one vacancy among its 38 authorized IPO analyst positions, its deputy director is unsure whether the division needs additional IPO analysts to oversee ongoing IT projects. To analyze the sufficiency of IPO analyst staffing levels, the deputy director is in the process of developing a mechanism for evaluating workload, which will determine whether the division could more efficiently manage its resources or if it needs additional staff. She anticipates that this evaluation should be complete during 2015. Should the analysis indicate a staffing deficiency, the deputy director plans to request additional positions rather than contract California State Auditor Report 2014-602 27 March 2015 for IPO consultants because she believes that CalTech staff can refer to lessons learned from past projects and can also leverage state resources that IPO consultants cannot access. Further, CalTech recently changed how it staffs the oversight of IT projects. Previously, CalTech assigned a single IPO analyst to oversee each IT project; however, using this staffing model, when an IPO analyst leaves the division, CalTech loses the institutional knowledge that the individual developed. To address this problem, The oversight and consulting since early 2014, the oversight and consulting division has employed division has employed an approach an approach in which one IPO analyst fills the lead role on a project in which one IPO analyst fills and is assisted by one or two IPO analysts, if needed. CalTech the lead role on a project and is believes that this approach creates a continuity of presence on assisted by one or two IPO analysts, projects, allows for staff to share knowledge, and provides for a but this approach requires IPO succession plan if an IPO analyst is reassigned or leaves the division. analysts to sometimes oversee The deputy director acknowledges that there are more projects than two high‑complexity projects at there are IPO analysts, which means that IPO analysts sometimes the same time. oversee two high‑complexity projects at the same time. In these situations, the deputy director said that CalTech will augment the projects’ oversight with additional IPO analysts as needed. Our IT expert indicated that it is difficult for an IPO analyst to effectively provide oversight on more than one complex IT project at a time. He agrees with CalTech’s current approach for staffing oversight teams, provided that CalTech continually evaluates the staffing required on each IT project to ensure it provides an adequate level of oversight, especially on high‑criticality projects. However, in using this new staffing approach, there may be situations in which CalTech determines that it has insufficient staffing or expertise to provide the oversight needed on high‑criticality projects. Therefore, in certain circumstances, we believe it would be appropriate for CalTech to contract with IPO consultants for additional staff or expertise to ensure that it provides the appropriate level of oversight. To overcome the deputy director’s concerns with contracting for IPO services, CalTech should ensure that it uses an IPO consultant only in tandem with a CalTech IPO analyst. Other benefits from using IPO consultants could include mentoring of CalTech IPO analysts on oversight practices and, because IPO consultants are hired for only the time and effort needed, increased staffing flexibility of oversight teams depending on the needs of the IT project. CalTech’s Oversight and Consulting Division Is Developing New Training Policies The oversight and consulting division lacks a training approach to ensure that its IPO analysts provide consistently effective and reliable oversight for state IT projects. The California Project 28 California State Auditor Report 2014-602 March 2015 Management Methodology (CA‑PMM) outlines basic IT project management training and qualifications for both project management and oversight teams. However, according to its deputy director, the oversight and consulting division does not require standard IT project oversight training for new employees or continuing education for current IPO analysts that is consistent across the division. Rather, training of new IPO analysts is left to the discretion of the branch managers that oversee the units within the division. The deputy director believes the frequent change of division leadership made it difficult to implement a consistent training process. She acknowledged the risks associated with inconsistent training and plans to institute a standard and repeatable training process during 2015. Our IT expert believes that training becomes more important if employees lack sufficient experience relevant to IT project oversight, which is the case for most of the division’s recent 21 IPO analysts hired, as we noted previously. Further, our IT expert observed that the current approach to training can lead to inconsistencies in how IPO analysts oversee IT projects, especially with regard to how and when IPO analysts escalate issues on a project and how effectively they employ oversight tools. To address the lack of a consistent To address the lack of a consistent training process, CalTech training process, CalTech contracted with the University of California, Davis (UC Davis) to contracted with the University provide the required training curriculum beginning in January 2015 of California, Davis to provide over a two‑year period. Such training curriculum includes the required training curriculum project risk management, vendor management, project health, beginning in January 2015 over a and portfolio management courses, among others. UC Davis two‑year period. will provide the first mandatory CA‑PMM training course in March 2015. Although such training should help CalTech to address the lack of experience that many newly hired IPO analysts face, our IT expert believes that to effectively perform oversight, IPO analysts need additional training. In particular, he believes that the oversight and consulting division should provide standard IT project oversight training that includes instruction regarding contract management, project assessment, IT systems engineering, and maintaining independence. Specifically, in light of the risk to IPO analysts’ independence previously discussed, the division should incorporate training on how to maintain independence while performing oversight of an IT project. Currently, the deputy director cannot readily provide documentation for how many IPO analysts have completed the CA‑PMM training. According to CA‑PMM requirements, CalTech must document that staff members have completed the required training. We believe that it is important for the oversight and consulting division to verify that IPO analysts have satisfied the CA‑PMM training requirements before assigning them to oversee California State Auditor Report 2014-602 29 March 2015 an IT project. The deputy director indicated that the division plans to track CA‑PMM requirements electronically, but was unable to provide a date when this tracking would begin. CalTech Allowed Significant Problems to Continue Without Correction on Two of the Four IT Projects We Reviewed We selected four IT projects for our review of CalTech’s oversight: the California Department of Motor Vehicles’ (DMV) Information Technology Modernization Project (IT Modernization Project), the state controller’s MyCalPays Project, the Employment Development Department’s UI MOD Project, and the Franchise Tax Board’s Enterprise Data to Revenue Project (Revenue Project). Our IT expert assessed at least 12 monthly IPO reports for each of the four IT projects to determine the nature and significance of oversight findings and review any evidence of CalTech’s response. Although CalTech was aware of significant problems with two of these four projects, it did not intervene to require the correction of the problems—which might have improved the projects’ outcomes—before terminating one project and suspending the other. For the two remaining projects, our IT expert concluded that, during the period reviewed, CalTech’s actions were appropriate and that there were no significant issues that the sponsoring agencies were not adequately addressing that would require CalTech’s intervention. CalTech Did Not Take Timely, Meaningful Actions to Address Systemic Problems With DMV’s IT Modernization Project Although the IPO consultant that DMV hired to oversee its IT Modernization Project identified significant ongoing project concerns, CalTech did not take substantial actions to ensure the resolution of these problems in a timely manner. Specifically, in some instances DMV did not address the IPO consultant’s concerns for more than a year. However, while it did offer guidance, CalTech CalTech terminated the did not require that the project implement certain corrective IT Modernization Project in measures until late in the project after millions had already January 2013 after millions had been spent. As shown in Table 7 on the following page, CalTech already been spent and directed terminated the IT Modernization Project in January 2013 and DMV to complete only the driver directed DMV to complete only the driver license system portion license system portion of the of the project, which was near completion. project, which was near completion. 30 California State Auditor Report 2014-602 March 2015 Table 7 Background and Timeline of Major Events for the California Department of Motor Vehicle’s Information Technology Modernization Project Cost Estimated as of January 2009: $208 million. Spent as of March 2013: $138 million. Oversight The California Department of Technology (CalTech) and an independent project oversight (IPO) consultant. Description To perform technology upgrades on the California Department of Motor Vehicles’ (DMV) driver license and vehicle registration systems. DATE MAJOR EVENT March 2006 Project approved at a cost of $242 million. December 2007 DMV selected Electronic Data Systems, LLC (Electronic Data Systems) as the system integrator. January 2009 DMV reduced the projected project’s costs to $208 million due to a significantly low bid by Electronic Data Systems. August 2010 The IPO consultant raised concerns regarding the system integrator’s staffing levels. September 2010 Hewlett‑Packard Enterprise Services, LLC (Hewlett‑Packard) acquired Electronic Data Systems and took over as the system integrator. February 2011 In addition to staffing level concerns, the IPO consultant cited the following combination of issues: inadequate scheduling practices, poor quality assurance processes for the system’s software, and a lack of rigor in resolving project risks, none of which was being effectively addressed. May 2012 DMV issued a cure notice—a formal notification that contract terms are not being met—to Hewlett‑Packard expressing concern regarding its ability to successfully complete the project. January 2013 CalTech terminated the project and directed DMV to suspend all work related to the vehicle registration system and to complete only the portion of the driver license system that was near completion. March 2013 Driver license system implemented per CalTech direction. Sources: The Legislative Analyst’s Office (LAO) Summary of LAO Findings and Recommendations on the 2013–14 Budget, April 2013; Grant Thornton’s report titled Independent Assessment of ITM Project Deliverable #1—Topics A–O, February 2014; IPO reports from the IPO consultant; and documentation provided by CalTech. DMV and the system integrator had a history of not resolving risks that occurred on the IT Modernization Project in a timely manner. DMV hired an IPO consultant for the IT Modernization Project, and CalTech’s IPO analyst provided additional oversight through the review of the IPO consultant’s work and other actions. The IPO consultant first reported inadequate staffing levels as a risk in August 2010, stating that the project had experienced turnover of key system integrator staff members. In addition, monthly IPO reports consistently identified risks associated with the project’s scheduling practices. For instance, the February 2011 IPO report found that although DMV was over halfway through the expected time needed to develop the project, it had not yet developed a complete schedule that defined the project’s scope and estimated resource allocations. As a result, the IPO consultant warned that the project was unable to track costs associated with current activities and could not estimate whether there were sufficient funds to complete the remaining work. In our IT expert’s review of IPO reports that the IPO consultant produced between January 2011 and May 2012, he identified many significant ongoing project concerns, including insufficient staffing levels, inadequate California State Auditor Report 2014-602 31 March 2015 scheduling practices, poor quality assurance processes for the system’s software, and a lax attitude with respect to the resolution of project issues. Our IT expert noted that although none of these concerns on its own indicated ineffective project management, when combined, the concerns suggest that the project had systemic problems that were likely to impact its successful completion. Although CalTech was aware of the systemic problems for almost two and a half years, it suggested only minimal corrective actions for DMV and the system integrator. For example, according to the CalTech IPO analyst who oversaw the IPO consultant, CalTech’s executive management met with the system integrator to recommend that it provide a staffing plan. Also, in October 2012, CalTech established a time frame for DMV and the system integrator to resolve outstanding issues, implement a new schedule, and a plan for completing the project. However, CalTech did not take this action until five months after DMV issued a cure notice to the system integrator. Because CalTech saw minimal subsequent progress on resolving these issues, it terminated the IT Modernization Project in January 2013. According to the State CIO, CalTech did gave DMV the opportunity to complete the driver license portion of the IT Modernization Project. He explained that had the project been shut down sooner, the State would not have upgraded either the driver license or the vehicle registration system, and the funding invested in the project would have been wasted. While we recognize that delaying the project’s termination allowed the State to complete the driver license portion of the project, our IT expert indicates that CalTech should have begun requiring corrective actions after recognizing that DMV was not resolving project problems. Moreover, in February 2014, CalTech received an independent assessment of the lessons learned from the IT Modernization Project. The independent assessment criticized An independent assessment CalTech’s oversight, stating that although CalTech assigned of lessons learned from the IT an IPO analyst to oversee the IT Modernization Project, this Modernization Project criticized individual did not regularly attend project meetings and only CalTech’s oversight, stating that became actively involved with the project approximately one year the IPO analyst did not regularly before its termination. Further, the independent assessment found attend project meetings and that even though CalTech received the IPO consultant’s monthly only became actively involved IPO reports, it did not hold DMV accountable for addressing approximately one year before the deficiencies identified. Although it is impossible to state with the project’s termination. any certainty whether earlier and more active CalTech oversight would have changed the outcome of the project, two of the risks the IPO consultant identified—inadequate staffing and lack of a schedule—ultimately contributed to the termination of the IT Modernization Project. 32 California State Auditor Report 2014-602 March 2015 CalTech’s Oversight of the State Controller’s MyCalPays Project Reported Critical Issues, but CalTech Failed to Promptly Intervene to Ensure Effective Corrective Action Was Taken CalTech did not intervene in the state controller’s MyCalPays Project despite months of IPO reports raising concerns about deficient quality assurance and testing practices, inadequate knowledge transfer practices, and the lack of contingency planning leading up to the project’s first pilot test. According to our IT expert, these issues taken together should have raised serious oversight concerns for CalTech as the MyCalPays Project neared its first pilot. The state controller’s project director asserts that there was a comprehensive and detailed process to determine that the first pilot should go live and that all key project members and stakeholders, including the MyCalPays Project executive steering committee, the IPO analyst, and the independent verification and validation (IV&V) contractor, unanimously agreed that the first pilot should go live. Nonetheless, the launch of the first pilot in June 2012 experienced significant errors including payroll overpayments, incorrect deductions, and leave balance discrepancies. In August 2012 the state controller postponed the second pilot because of recurring errors in the first pilot. As shown in Table 8, the state controller terminated its contract with its system integrator in February 2013, and CalTech suspended the project that same month. As a result, the State continues to use its aging legacy payroll system after spending $262 million to unsuccessfully develop the project. The state controller’s October 2012 cure notice cited the system integrator’s lack of expertise and strategic planning led to inadequate scheduling, staffing, knowledge transfer, deliverable management, and quality assurance. The state controller also had concerns regarding design, testing, organizational change management, and training weaknesses. The cure notice cited 13 grievances and prompted the system integrator to correct these problems by November 2012, so that the project could move forward. However, according to the state controller, the system integrator in its November 2012 response did not assume responsibility for these grievances and took no action to resolve the issues. Subsequently, in November 2013 the state controller filed a lawsuit against the system integrator for breach of contract. Months before the failed first pilot in June 2012, CalTech’s IPO analysts raised concerns about several issues that proved to be integral to the project’s failure. In the September 2011 IPO report—while the state controller and the system integrator were California State Auditor Report 2014-602 33 March 2015 Table 8 Background and Timeline of Major Events for the California State Controller’s Office’s MyCalPays Project Cost Estimated as of March 2012: $373 million. Spent as of January 2013: $262 million. Oversight The California Department of Technology (CalTech). Description To replace the existing statewide human resources management and payroll systems. DATE MAJOR EVENT May 2004 Project approved at a cost of $132 million. However, the projected project cost increased multiple times over the next several years, primarily due to schedule delays, eventually reaching $373 million. June 2006 The California State Controller’s Office (state controller) selected BearingPoint Consulting, Inc. (BearingPoint) as the system integrator. October 2007 The state controller issued a cure notice—a formal notification that contract terms are not being met—to BearingPoint, alleging a breach of contract. January 2009 The state controller terminated its contract with BearingPoint after experiencing multiple problems. February 2010 After completing a second vendor procurement, the state controller resumed the project with SAP Public Services, Inc. (SAP) as the new system integrator. Early to mid 2011 CalTech oversight staff raised issues regarding data conversion delays. August 2011 The state controller issued a cure notice to SAP due to data conversion and other issues. After negotiations with the state controller, SAP hired a subcontractor to address data conversion. June 2012 The first pilot test of the system resulted in payroll checks containing numerous errors. October 2012 The state controller issued a second cure notice requiring SAP to increase personnel, reschedule milestones, and address the pilot test’s failures. February 2013 The state controller terminated SAP’s contract and CalTech suspended the project, citing SAP’s failure to finish the project and unwillingess to remedy the issues in the cure notice. Sources: Legislative Analyst’s Office report titled The 2014–15 Budget: 21st Century Project Update, March 2014; independent project oversight reports; documentation provided by CalTech; and MyCalPays’ feasibility study report. in negotiations to resolve the first cure notice with this system integrator from August 2011—the IPO analyst noted that the project was not routinely conducting quality assurance reviews on the system integrator’s testing deliverables and that the IV&V contractor could not independently verify that the system integrator’s testing results were properly executed or successful. These issues continued to appear in future IPO reports: for example, in the April 2012 IPO report, the IPO analyst warned that the IV&V contractor was still finding testing issues that should have been addressed through quality assurance reviews and that the project was not properly recording testing results. The IPO analyst also repeated this concern in the following month’s IPO report. Moreover, the state controller’s cure notice to the system integrator in October 2012 cited testing lapses as a key factor in the payroll errors during the first pilot. In reviewing the IPO reports, 34 California State Auditor Report 2014-602 March 2015 our IT expert noted that although at first the IPO analyst was satisfied with the project’s actions to address these issues, their reemergence in later IPO reports should have been a red flag for CalTech. The IPO reports warned for months In addition, the IPO reports warned for months that the that the state controller was not state controller was not formally monitoring the progress of formally monitoring the progress of knowledge transfer from the system integrator to its staff— knowledge transfer from the system the system integrator’s training of state controller personnel integrator to its staff, which could to support the new system after it is in operation. As a result, necessitate hiring a contractor to the IPO analyst stated that the state controller was at risk of maintain the MyCalPays system needing to hire a contractor to maintain the MyCalPays system after its implementation— after its implementation, which would be more costly than a costlier alternative. using the state controller’s staff. In January 2012 the IPO report noted the state controller opened a risk log entry to track the status and mitigation of this risk. According to the IPO report, the IPO analyst raised this issue with the state controller and the MyCalPays Project executive steering committee. However, nearly three months later, in an IPO report released at the end of April 2012—only slightly more than one month before the planned first pilot—the IPO analyst warned that state controller personnel were not attending the system integrator’s training and that it was unclear to the IPO analyst how and when state controller staff would receive this training. Even after the first pilot, an IPO report noted that as of July 2012, there was no evidence that the state controller had made any substantial progress on this issue. Reflecting on the IPO analyst’s concerns, the state controller’s project director asserted that the MyCalPays Project executive steering committee understood the need for ongoing knowledge transfer was important but was not considered a critical path item, and that the system integrator’s training for the first pilot was too generic and not effective. Our IT expert indicates that knowledge transfer should be an ongoing process throughout project development, which would help ensure that the state controller’s staff learn how to maintain the system after implementation and also allow them to oversee the system integrator during project development. In addition to these serious warnings as the first pilot date approached, the IPO analyst noted concerns about the project’s contingency plans. In April 2012 the state controller opened an entry in its risk log, stating that should the initial payroll run fail, the pilot might have to be aborted, and further that the state controller was developing a mitigation plan. With less than two weeks before the first pilot, the May 2012 IPO report warned that this mitigation plan was incomplete and had not been well communicated to the state controller’s staff. California State Auditor Report 2014-602 35 March 2015 Taken individually, these issues are serious but manageable; Taken individually, these issues are however, according to our IT expert, taken together they represent serious but manageable; however, serious project risks, which should have triggered an intervention taken together they represent from CalTech. However, despite the IPO reports warning of these serious project risks, which should three risk areas beginning more than a year before the project’s have triggered an intervention suspension, there is no evidence of CalTech taking action until from CalTech. the suspension in February 2013 nor could CalTech provide any evidence of action it took to direct the state controller to resolve any of the issues identified in the IPO reports prior to that time. According to the deputy director of CalTech’s Consulting and Planning Division—who was the deputy director of the oversight and consulting division while the MyCalPays Project was experiencing these problems—there were no established processes, criteria, or time frames to help CalTech decide when to use its oversight tools, such as requiring remedial measures or suspending or terminating a project. According to the State CIO, a key consideration in determining whether and when to suspend the MyCalPays Project was the “litigation posture” of both the state controller and the system integrator. Furthermore, he believes that by taking action after the state controller exercised the process for addressing performance issues with the system integrator, CalTech avoided interfering with the dispute resolution provisions of the contract and did not damage the state controller’s “litigation position.” Although our IT expert cautioned that earlier CalTech intervention may not have made a significant difference in the MyCalPays Project’s success, he indicated that allowing these issues to persist likely contributed to the project degrading to the point that suspension or termination was the only option. The IPO Reports for the UI MOD Project Identified No Issues That Required CalTech’s Intervention In its oversight of the UI MOD Project, the IPO consultant identified only risks and issues that were typical for a high‑complexity state IT project, which the Employment Development Department addressed appropriately, based on our IT expert’s review. During the period we reviewed, our IT expert concluded that CalTech had no need to require the Employment Development Department to take any remedial measures regarding the project. As indicated in Table 9 on the following page, the UI MOD Project is nearing completion and is scheduled to be fully implemented in June 2015. Although a consultant provided IPO services for the UI MOD Project, a CalTech IPO analyst provided additional oversight by reviewing the consultant’s IPO reports, attending project 36 California State Auditor Report 2014-602 March 2015 Table 9 Background and Timeline of Major Events for the Employment Development Department’s Unemployment Insurance Modernization Project Cost Estimated as of December 2014: $246 million. Spent as of December 2014: $193 million. Oversight The California Department of Technology (CalTech) and an independent project oversight (IPO) consultant. Description To update the State’s unemployment insurance services through a call center upgrade and automated continued claims process redesign (continued claims redesign). Continued claims redesign is to be released in two stages—internally and externally. DATE MAJOR EVENT October 2003 The call center upgrade project and continued claims redesign project were approved at a cost of $38 million and $58 million, respectively. July 2005 The projects were merged into the Unemployment Insurance Modernization Project (UI MOD Project). Over the next 12 years, the projected cost increased several times primarily due to schedule delays and scope changes, and is currently at $246 million. July 2008 The Employment Development Department selected Verizon Business as the system integrator for the call center upgrade. January 2010 The Employment Development Department selected Deloitte Consulting LLP as the system integrator for the continued claims redesign. June 2011 Call center upgrade implemented. September 2013 Internal portion of the continued claims redesign implemented. September 2013 The Employment Development Department experienced a backlog in continued claims needing manual review due to the way the newly implemented internal portion of the continued claims redesign required removal of old alerts before authorizing new payments. CalTech verified that the Employment Development Department and system integrator’s approach to resolving the issue was adequate. October 2013 The Employment Development Department informed CalTech that the continued claims backlog was eliminated. June 2015 The second and final part of the continued claims redesign—the external portion—is expected to be fully implemented. Sources: UI MOD Project IPO reports from the IPO consultant, special project reports, project status reports, and documentation provided by CalTech. meetings, and, if needed, escalating issues to CalTech management. The IPO analyst indicated that he was generally comfortable with how the Employment Development Department was running the UI MOD Project. Our IT expert reviewed the monthly IPO reports for January 2013 through January 2014, which included the internal release of the continued unemployment insurance claims process redesign (continued claims redesign), and did not find any systemic problems indicative of a major setback or a troubled project that he would have expected CalTech to address. However, the UI MOD Project did encounter a significant setback after releasing the internal portion of the continued claims redesign in September 2013. Specifically, the Employment Development Department informed CalTech that the continued claims redesign required a one‑time manual removal of old “stop payment flags” on all benefit accounts—even if previously removed— California State Auditor Report 2014-602 37 March 2015 before it would allow the authorization of new payments which, according to the October 2013 IPO report, overwhelmed the Employment Development Department’s resources. As a result of this requirement, within the first two weeks of the implementation, Within the first two weeks of the about 30 percent of claimants had their benefits held for manual implementation, about 30 percent review. At that time, the Employment Development Department of claimants had their benefits held communicated to CalTech that it was aware that the continued for manual review. claims redesign would require the removal of old stop payment flags, but it believed the number of claims that would be routed for manual processing would be much less. CalTech’s IPO analyst assigned to the project stated that nothing in the IPO consultant’s reports indicated that the magnitude of the removal of old flags would be so extensive. However, he acknowledged that the Employment Development Department could have done additional analysis to better understand the magnitude of the problem before releasing the internal portion of the continued claims redesign. CalTech’s IPO analyst further stressed that at the time of the release, the testing that had been completed did not indicate a need for further testing. Our IT expert added that in his review of the IPO reports, he did not find any evidence of incomplete testing or information regarding the potential magnitude of the stop payment flag problem that arose. While the subsequent IPO report described the stop payment flag problem, the report also indicated that the Employment Development Department and system integrator were addressing it adequately. For example, the October 2013 IPO report identified that the Employment Development Department was holding twice daily meetings to discuss how defects were being prioritized, fixed, and tested. The report further stated that the level of Employment Development Department participation and processes for tracking the work indicated that the Employment Development Department and the system integrator were effectively managing the effort to resolve the problem. In addition, CalTech continued to oversee the project during this period. For example, a CalTech enterprise architect participated in a review of the system designs and provided observations and recommendations. Further, CalTech management, including the State CIO, was receiving updates from the Employment Development Department regarding the system fixes and the number of claims affected. Our IT expert concluded that the Employment Development Department was addressing the stop payment flag issue, as well as other defects, adequately, so there was no need for CalTech intervention. However, our IT expert indicates that because the project is ongoing, CalTech may still need to intervene if significant risks or issues arise. 38 California State Auditor Report 2014-602 March 2015 Although the Franchise Tax Board’s IPO Staff Identified Issues With Its Enterprise Data to Revenue Project, CalTech Does Not Believe They Are Major Risks Since CalTech assumed the IPO role on the Revenue Project in July 2014, it has not identified any significant issues with the project that the Franchise Tax Board is not adequately addressing. Between November 2011 and June 2014, the Franchise Tax Board’s in‑house project oversight bureau, which provided the IPO services for the Revenue Project during this period, highlighted three issues that are still affecting the project: insufficient staff resources to support the project, a trend of deferring the delivery of some software functionality to future releases, and a growing trend of software defects in new releases. All three issues, if not addressed by the Franchise Tax Board and the system integrator, could have a negative impact on the on‑time delivery of the final Revenue Project. However, after assuming the IPO role for the Revenue Project in July 2014, the CalTech IPO analyst found that the three issues were no longer as significant and that they did not pose major risks to the project’s scope and schedule. Specifically, the IPO analyst does not believe that Franchise Tax Board staff resources are a major risk because it has redirected additional resources to the project as needed. The IPO analyst also explained that CalTech continues to monitor the issue of deferred functionality, but she indicated that the Franchise Tax Board has a process in place to ensure that no critical functionality is being deferred. Finally, the IPO analyst said Our IT expert believes that the that the introduction of new software releases caused the trend in Franchise Tax Board’s responses increasing software defects, which is to be expected, but that most are appropriate and there are of the open defects are of low severity. Our IT expert believes that no immediate oversight issues the Franchise Tax Board’s responses are appropriate and that there requiring CalTech’s intervention are no immediate oversight issues requiring CalTech’s intervention in the Revenue Project. in the Revenue Project. While the Revenue Project has about two more years until its expected completion date, our IT expert concluded that CalTech’s oversight is ensuring that the Franchise Tax Board is adequately addressing issues as they arise. However, our IT expert indicates that because the project is ongoing, CalTech may still need to intervene if significant risks or issues arise. Finally, the State CIO indicated that the decision to allow the Franchise Tax Board to take the IPO role for the Revenue Project was made by the previous State CIO. The current State CIO indicated that CalTech is in the process of assuming the IPO role for all projects that do not currently use CalTech for IPO, which is why in April 2014 CalTech agreed to take over IPO from the Franchise Tax Board, as shown in Table 10. California State Auditor Report 2014-602 39 March 2015 Table 10 Background and Timeline of Major Events for the Franchise Tax Board’s Enterprise Data to Revenue Project Cost Estimated as of December 2014: $538 million. Spent as of December 2014: $317 million. Oversight The Franchise Tax Board and the California Department of Technology (CalTech). Description Implementation of a new personal income tax and business entity return processing system, along with a central data warehouse, a portal for taxpayers to access their records, and revenue enhancement features. DATE MAJOR EVENT January 2009 Project initially proposed at an estimated cost of $317 million. However, over the next five years, project costs increased to $538 million primarily due to the selected system integrator’s bid. June 2011 The Franchise Tax Board selected CGI Group, Inc. as the system integrator. December 2012 Personal income tax return filing and payment processing system implemented. June 2013 Internal taxpayer folder and case management system implemented. December 2013 Business enterprise tax return filing, payment processing, correspondence, and collections modeling releases implemented. April 2014 Interagency agreement signed by the Franchise Tax Board and CalTech for CalTech to take over independent project oversight (IPO) services from the Franchise Tax Board as a part of its recent effort to consolidate its ongoing oversight responsibility. July 2014 CalTech assumed the IPO role by issuing its first IPO report for the project. September 2014 External taxpayer folder implemented. December 2014 Personal income tax return analysis and noticing service implemented. December 2015 Project is expected to be fully implemented. Sources: Enterprise Data to Revenue Project IPO reports issued by the Franchise Tax Board and CalTech, feasibility study report, special project reports, and documentation provided by CalTech. The California State Auditor Will Continue to Monitor CalTech’s Oversight of State IT Projects Costly IT project failures in the past and our assessment of current issues at CalTech has led the California State Auditor to maintain IT project oversight on its list of high‑risk issues. Future audits may include IT project planning and procurement, and IT security. As we discussed previously, the State has a history of failed IT projects that have consumed significant resources. The State also has more than $4 billion invested in ongoing IT projects; given the history of project failures, this represents a high risk to the State’s fiscal health. Recommendations By December 2015 CalTech should develop and adopt criteria to guide the type and degree of intervention it will take to prevent IT projects with significant problems from continuing without correction, including the following: • When and how IPO analysts should recommend corrective action and escalate issues to CalTech’s management. 40 California State Auditor Report 2014-602 March 2015 • When and what CalTech should require that sponsoring agencies perform as remedial actions, and what sanctions CalTech will impose for noncompliance with these remedial actions. • What conditions could trigger CalTech to consider suspending or terminating an IT project. To clarify and reinforce its oversight authority with sponsoring agencies, by December 2015 CalTech should develop a method to formally document and communicate its expectations with the sponsoring agencies whose projects are under CalTech’s oversight. To help ensure the independence and objectivity of IPO analysts working in the oversight and consulting division, CalTech should do the following: • Develop a policy outlining expectations for independence and objectivity while performing oversight of IT projects. • Provide regular training regarding maintaining independence while conducting project oversight. To better track its oversight actions and sponsoring agencies’ responses to these actions, CalTech should do the following: • Retain the briefing documents created for the State CIO’s portfolio meetings and the project status reports that sponsoring agencies submit while project oversight is ongoing. • Record action items from all portfolio meetings. To ensure that the sponsoring agencies’ project status reports provide a reliable and consistent assessment of an IT project’s progress, CalTech should develop and adopt specific standards that describe how to calculate and report the project’s current status. To attract and retain employees with appropriate experience and qualifications to perform IT project oversight, CalTech should continue its efforts to gain approval to modify and use the project manager classification for the IPO analyst role. To ensure that it provides the appropriate level of oversight for IT projects under development, by December 2015 CalTech should conduct a workload assessment to determine the level of staffing and expertise required for each IT project it oversees. Using that workload assessment, CalTech should make decisions to assign staffing to oversee each IT project. This staffing could include contracted IPO consultants in those situations when CalTech staff either are unavailable or lack the expertise needed. California State Auditor Report 2014-602 41 March 2015 To improve its oversight training, by June 2015 CalTech should continue to implement a consistent and repeatable training plan for IPO analysts, which includes contract management, project assessment, IT systems engineering, and maintaining independence. By June 2015 CalTech should put in place a system to track IPO analysts’ training hours to ensure that all IPO analysts have completed the necessary CA‑PMM training curriculum. We conducted this audit under the authority vested in the California State Auditor by Section 8546.5 et seq. of the California Government Code and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives specified in the scope section of the report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor Date: March 19, 2015 Staff: John Baier, CPA, Audit Principal Jerry A. Lewis, CICA Oswin Chan, MPP, CIA Brenton Clark, MPA, CIA Joshua K. Hammonds, MPP Sara E. Noceto IT Expert: Catalysis Group, Inc. Legal Counsel: Joseph L. Porche, Staff Counsel For questions regarding the contents of this report, please contact Margarita Fernandez, Chief of Public Affairs, at 916.445.0255. 42 California State Auditor Report 2014-602 March 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2014-602 43 March 2015 * * California State Auditor’s comments begin on page 49. 44 California State Auditor Report 2014-602 March 2015 1 California State Auditor Report 2014-602 45 March 2015 2 46 California State Auditor Report 2014-602 March 2015 3 California State Auditor Report 2014-602 47 March 2015 48 California State Auditor Report 2014-602 March 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2014-602 49 March 2015 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE CALIFORNIA DEPARTMENT OF TECHNOLOGY To provide clarity and perspective, we are commenting on the California Department of Technology’s (CalTech) response to our audit. The numbers below correspond to the numbers we have placed in the margin of CalTech’s response. 1 Although CalTech asserts that it has criteria for suspending or terminating an information technology (IT) project, it chose not to share them with us during the course of our audit. We note that the criteria provided in its response are a good start; however, they only speak to circumstances where the need to intervene is apparent. We believe guidance is important in situations where professional judgment is needed—as we note on page 13—such as before IT projects reach the situations CalTech describes. Furthermore, CalTech’s response does not address our concerns discussed on page 15 that, beyond the description in state law, it has not defined the remedial measures, short of suspension or termination, that it may pursue, or the fact that CalTech lacks criteria to guide independent project oversight (IPO) analysts in recommending such measures. According to our IT expert, without such guidance, CalTech cannot meaningfully defend its decisions about whether and when to intervene in a troubled IT project. For example, two of the four IT projects we reviewed—the California Department of Motor Vehicles’ Information Technology Modernization Project and the California State Controller’s Office’s MyCalPays Project— experienced significant ongoing problems, yet CalTech was unable to provide documentation to explain why it failed to intervene in a timely manner on these IT projects. 2 CalTech’s belief that existing state policies adequately define independence for IPO analysts is incorrect. As we noted on page 18 of our report, CalTech’s IT project oversight framework—the same document as the State Information Management Manual, Section 45, that CalTech references—only mentions that IPO analysts must be independent without an explanation for how they should maintain their independence. Furthermore, as we discuss on page 24, we found that many of CalTech’s 21 most recently hired IPO analysts had little to no previous IPO experience, which is all the more reason for CalTech to provide direction through policy and training for IPO analysts to clearly understand the need for independence and objectivity in their oversight. In addition, we are concerned that CalTech does not recognize the risk to IPO analysts’ independence posed by becoming overly involved in the success of the IT projects they oversee, as we discuss on page 18 of our report. 50 California State Auditor Report 2014-602 March 2015 Mitigating this risk is one reason why we believe a policy outlining expectations for independence and regular training for IPO analysts is important for CalTech. 3 CalTech’s response does not address whether it will consider the use of contracted IPO consultants (that is, contracted consultant firms to perform IPO services). However, as noted on pages 26 and 27, if the workload assessment indicates a staffing deficiency, CalTech plans to request additional positions rather than contract for IPO consultants. Nevertheless, as we indicate on page 27, we believe that in certain circumstances it would be appropriate for CalTech to contract with IPO consultants for additional staff or expertise to ensure that it provides the appropriate level of oversight. This is especially true given that, as we note on page 24, CalTech’s 21 most recently hired IPO analysts may lack the depth of experience needed to monitor complex, high‑criticality IT projects.