HANSARD
Printed and Published by Nova Scotia Hansard Reporting Services
Ms. Maureen MacDonald (Chair)
Mr. Chuck Porter (Vice-Chairman)
Mr. Alfred MacLeod
Mr. Keith Bain
Mr. Graham Steele
Mr. David Wilson (Sackville-Cobequid)
Mr. Keith Colwell
Mr. Stephen McNeil
Ms. Diana Whalen
[Mr. Alfred MacLeod was replaced by Mr. Patrick Dunn.]
WITNESSES
Department of Finance
Ms. Vicki Harnish, Deputy Minister
Mr. Byron Rafuse, Controller
Mr. Steven Feindel, Director, Corporate Information Services
Office of Economic Development
Mr. Paul Taylor, Chief Executive Officer
Ms. Holly Fancy, Executive Director
Corporation Information Services
Ms. Miriam O'Brien, Project Director, SAP
In Attendance:
Ms. Mora Stevens
Legislative Committee Clerk
Mr. Jaques Lapointe
Auditor General of Nova Scotia
Mr. Claude Carter
Deputy Auditor General of Nova Scotia
Mr. Ron Edmonds
IT Audit Manager
[Page 1]
HALIFAX, WEDNESDAY, NOVEMBER 8, 2006
STANDING COMMITTEE ON PUBLIC ACCOUNTS
9:00 A.M.
CHAIR
Ms. Maureen MacDonald
VICE-CHAIRMAN
Mr. Chuck Porter
MADAM CHAIR: I'd like to call the committee to order, please. Today we have witnesses with respect to the implementation of the SAP program. I want to remind members that this is a shortened meeting of the committee by 15 minutes because of the changed hours of the House, the House is going in at 11:00 a.m. The second round of questioning may be quite brief.
I want, as well, because we have so many witnesses, to remind people of the problems that Hansard has in knowing where to go in terms of who is being asked a question, who will be answering a question. So I ask both the members and the witnesses - if the members would be very specific about who they're directing a question to, if you're changing from one witness to another if you would specify that you're going to make a change and go to somebody else. If the witnesses are going to refer a question to someone else, if you would preface that by saying who you're referring it to, that would very much help Hansard in knowing which microphones should be on.
We will begin in the usual manner, with introductions of everybody who's here on the floor of the Chamber, starting with the members, the Auditor General and his staff, and then the witnesses, and then there'll be an opportunity for an opening statement from both the Department of Finance and the Office of Economic Development. We will begin at this point.
[Page 2]
[The committee members and witnesses introduced themselves.]
MADAM CHAIR: Thank you, I will turn the floor over now to Mr. Taylor and Ms. Harnish.
Mr. Taylor.
MR. PAUL TAYLOR: Thank you, Madam Chair. I have a few brief opening remarks, and I will share my few minutes with Ms. Harnish from Finance.
When the Government of Nova Scotia decided a number of years ago to replace its aging technical infrastructure used to produce financial payroll and human resource functions to thousands of its employees. It decided to look beyond its own house. The idea was to try to ensure that similar IT systems were in place in government, municipalities, school boards and district health authorities across the province. All of these sectors were using different IT systems. Each had to buy their own equipment, software and service agreements. The data and information from each system could not easily be compared to any other system. There are benefits in having these sectors use the same operating system, such as efficiencies in bulk purchasing, the increased ability to link data sources, and improved planning and decision making.
The provincial government, school boards and some municipalities were already in the process of replacing their systems with SAP's financial systems. As the province moved to implement its ERP System - Enterprise Resource Planning System - using SAP tools, it decided its next step would be to implement human resource and payroll functions for the government system and the province's school boards. The assumption was to roll these projects into one and achieve efficiencies of scale.
For a number of reasons, this assumption has proven to not be well founded. It became evident that the projects were too complex and did need to be separated. One of the main reasons for this was the number and complexity of the collective agreements involved. In 2004, the projects were split. To do this, more resources were required. In 2005, the provincial government system went live and began producing payroll for its 32,000 pensioners and employees. The school board project is expected to be completed at the end of this calendar year, serving an additional 20,000 clients.
There is no question that the magnitude and complexity of these projects was underestimated in its early phases. However, Nova Scotia now has a human resource and payroll system that will provide long-term value and improve service to employees, greater efficiency for this province and school boards, and increased accountability for everyone. These systems are an investment in the future of the province, greater accountability, better service, improved efficiency, better access to timely and consistent information that will enable improved decision making.
[Page 3]
So with those brief introductory remarks, I look forward to the committee's questions, and I turn the floor over to Ms. Harnish.
MS. VICKI HARNISH: Good morning Madam Chair, members and staff. I'd like to make some brief introductory remarks to complement the comments from the Office of Economic Development. I think it is important for the committee to understand what we do at Finance to support key administrative systems like the HR financial and the HR payroll system. Our Corporate Information Systems Division, through its SAP Customer Competency Centre, provides a wide range of services to public sector clients. These include the province, school boards, municipalities, and regional housing authorities. Services range from the most technical IT, like the help desk and computer programming, to people functions such as training, change management and so on.
The recent introduction of a major new program, such as SAP HR payroll, has been a major project for us. It has been more than 15 years since a payroll and HR management system was last implemented, and the people who were here when the previous system was introduced say the experience is very similar, it takes time to get the system fully implemented. However, even though our staff in Corporation Information Systems have been extremely busy over the past two years with this and other projects, we do take our responsibility to manage risks very seriously, and have devoted significant effort to this objective, and we have made progress.
The reason we know we have made progress is we have commissioned a series of audits that have measured this progress. The ongoing audits are helping us identify things that need improvement, and certainly there are still a number of areas that we continue to work on.
Our auditors have also told us that it is very rare for service providers in this business to reach all of their goals to a 100 per cent level right off the bat. It is not uncommon to take three or four audit periods to do so. The fact is, a significant portion of implementing appropriate internal control procedures is people related.
What is expected of staff? We produce standards and policies and procedures, but it takes a while for staff to become familiar with and comfortable with what is expected of them in adhering to these standards. Certainly our management is very committed to working with our staff on an ongoing basis to reinforce the protocols that are required. All of this is underway and, as I said before, I'm confident that we will continue to make the improvements as required over the next while.
MADAM CHAIR: Mr. Steele, the floor is now yours for 20 minutes.
MR. GRAHAM STEELE: Thank you. One of the difficulties we have in approaching this topic, which I think is one of the most important ones we've had before
[Page 4]
us for awhile, is that the underlying technical complexity, it's hard to explain to people what this is about but it is about the government's central main financial management system.
The Office of the Auditor General had a good quote about what these systems are for and it is to make sure that ". . . transactions are appropriately authorized, assets are safeguarded, and financial records are properly maintained." So, by implication, if the system is not functioning properly there is a risk the transactions will not be appropriately authorized, that assets are not appropriately safeguarded, and financial records are not properly maintained. That's why we care so much about this topic and that's why you're here today.
What the Auditor General has said about this system, they have used probably the strongest language that auditors ever use. They have talked about ". . . significant persistent fundamental control weaknesses" - I'm going to repeat that because they don't use this language very often, this is not everyday stuff - "significant persistent fundamental control weaknesses" in the government's main financial management computer system. The problem here is not just the problems that they have identified, it's that the problems have been identified for many years now. The first audit of this system goes back to 1998 and some of the problems identified in the 1998 audit have, still, not been fixed. What the Auditor General is saying in this year's report, like the last report and the report the year before that, is they keep raising these issues and they keep not being fixed.
So I'm going to address my questions to Mr. Taylor, because he's the chair of the internal government committee that oversees this stuff. Mr. Taylor, if there's somebody more appropriate feel free to pass it over, but my first question is to you. Why are these significant persistent fundamental control weaknesses which have been identified over a number of years, why are they not being fixed?
MR. PAUL TAYLOR: Indeed, there is someone more capable of responding to that question and that's Vicki Harnish.
MS. HARNISH: I believe I referred to some of this in my opening statement. You must understand when I read the Auditor General's terminology, I was also quite disturbed. I went back, and I have taken a real hard look at the 2003 audit, the 2005 point-in- time audit, the 2006-07 service audit, and the financial system audit that was recently done as well, because I wanted to track, to see myself, just what was going on here. I've looked through all of the recommendations for all of these and I've looked at the progress that we have made against many of those recommendations.
I'm going to, in layperson's terms, explain to you what I've seen from the successive audits - and I can't speak to the 1998 audit, that was far before my time and
[Page 5]
I think outside of what's relevant in these times - the 2003 audit showed that we hadn't done a good job with documenting policies, procedures, standards, protocols; we had no disaster recovery plan; we didn't have business continuity plans - there were many things that were left undone. Now you have to understand that this group of folks in the Corporate Information Services Division had been basically in production. They were implementing, operating, and they hadn't stepped back to take a good hard look at something that was somewhat foreign to technical people, which was internal controls.
As a result of the 2003 audit, in particular, we in the Department of Finance started to put a very large emphasis on this area and I reviewed, again, our response to the 2003 audit, and I have to tell you, what I see is that we have now provided all the documentation required. In other words, we have produced policies and standards; we have developed business continuity plans; we have a disaster recovery system that we have put in place and tested; we have a backup system at the Abbie Lane Hospital so we have complete capability to be up and running almost immediately. We've made significant progress in many of those areas. We've reduced the number of people who have access to specific types of identification that will let them do things within this system - you keep hearing about SAP_ALL. We've gone back and we have taken a good hard look at who has access to the various user ID protocols.
[9:15 p.m.]
What I'm seeing in the 2006 audit, in particular, in many cases, is a result of the fact that staff have not completely completed the culture change required; in other words, in many fewer cases, let me tell you, but in a few cases, over a year period which this audit spanned, we would see that staff failed to complete the documentation, or the file didn't have it. We would see that in a couple of cases they hadn't used a remedy ticket to make a change. So in other words, the culture that's required to ensure that they understand that they must complete all of the checks and balances and approvals before something is done, in some cases were not completely adhered to.
MR. STEELE: Do you think the Auditor General is exaggerating?
MS. HARNISH: I would say that the language is perhaps stronger than I would personally think was warranted, but that doesn't mean that we can sit back and say everything's fine - and that's not what we're doing.
MR. STEELE: Okay, the Office of the Auditor General has advised the Public Accounts Committee that the root cause of the problem, not the only problem, but the root cause of the difficulty they have identified is the inappropriate use of powerful access privileges - as you referred to in what in the jargon is called the SAP_ALL and related issues. The Office of the Auditor General has referred to significant deficiencies in security and segregation of duties. The SAP documentation, that's the vendor's own
[Page 6]
documentation, says that these powerful access privileges should not be assigned to anyone and should be reserved only for emergencies. Will you give us the assurance today that these powerful access privileges have been ended?
MS. HARNISH: There are still times when SAP_ALL is required. We put in place significant protocols around when, in fact, they can be used. It might be helpful for you if the controller explains to you exactly when it's required and what kind of controls we've put in place, so that you understand it's not quite as simple as turning it off.
MADAM CHAIR: Mr. Rafuse.
MR. BYRON RAFUSE: Mr. Graham, just for clarification, the SAP_ALL access issue and the segregation of duty issues are separate issues. The segregation of duties is an issue concerning access for the users of the systems and where they have security profiles that may allow them to have the ability to do incompatible processes. For a point of clarification further to that, as well, nowhere does the audit say that there has been evidence that there has been inappropriate use of incompatible access privileges. It just says that within the system, although it's configured correctly, access issues are to a point that they couldn't rely on the system for the purposes of their audit and they needed to look beyond the control procedures within the system, for audit purposes . . .
MR. STEELE: There's also no evidence that it hasn't been used inappropriately, is there? I mean, isn't that the point? That the problem is the Department of Finance's answer is always well, there's no evidence it has been misused - but I would say to that there's also no evidence that it hasn't been misused, because that's precisely the security problem that's raised by this use of access privileges. But my question really - now you have to remember my time is limited and I'm not looking for a long answer to a short question - the short question was will these privileges be ended?
Now SAP is the third largest software vendor in the world. They know how to run these systems, they have tens of thousands of very large customers around the world and they say it shouldn't be used the way the Province of Nova Scotia is using it - why does the province feel that it knows better than SAP itself?
MR. RAFUSE: What I was going to say is I was going to defer the question about how our protocols are currently being used on SAP_ALL to Steve Feindel, the Director of Corporate Information Services. All I can say is that we have tightened up the controls on that to what we believe are appropriate practices for our environment.
MR. STEVEN FEINDEL: Yes, I guess the main point I would make is there's no disagreement that the use of SAP_ALL should be a very restricted emergency-use-only type access in the system, and we have moved to implement practices and procedures in the CIS division consistent with that.
[Page 7]
At this point, we now have adopted a practice where there are specific approvals required by management in the division for anyone to have that access in the production system.
MR. STEELE: For example, you're the Director of Corporate Information Services - do you have that access privilege?
MR. FEINDEL: No, I do not.
MR. STEELE: Okay. Who does?
MR. FEINDEL: At the moment, in production systems, there is no one with that access in the provincial system at the moment.
MR. STEELE: Does that mean the problem has been solved?
MR. FEINDEL: No, it takes constant monitoring to make sure, because basically our systems operations people do have the capability of adding that privilege to their profile and that's required for operational purposes, to maintain operational stability of the system that they have some of those capabilities. But what we've implemented is restricted profiles for those folks - that does not include SAP_ALL - as well as practices around if they require for specific system recovery reasons, or other special access, that they have to go through an approval process to obtain that. We've also implemented - speaking to your point around how do we know whether it's being used - we have reporting processes now in place around that.
MR. STEELE: One of the more troubling aspects of the whole audit was the fact that a senior person responsible for SAP within the government - it's not any of the people who are here before us today - gave assurances to the Office of the Auditor General that certain changes had been made. The Auditor General's Office relied on those assurances. A later audit revealed those assurances were, in fact, false - the assurances that were given, of certain changes, had not been made.
Needless to say, this creates some fairly serious implications for the ability of the Auditor General's Office to rely on assurances coming from the Department of Finance. I wonder if you could tell the committee who it was who gave those false assurances, whether that person is still working for the provincial government, and what was done about this very serious incident which undermines the integrity of the audit process?
MR. FEINDEL: I will answer that question. It was me, actually, who gave feedback to the Auditor General that we had changed our practice with regard to that. What we've been working on is instilling in the practices and procedures and culture -
[Page 8]
as Ms. Harnish was talking about - making sure there is compliance around those practices that we've put in place, so . . .
MR. STEELE: In an in-camera briefing session with the Office of the Auditor General they actually identified a different person, so I'm wondering if you are talking about the same incident. The person in the Office of the Auditor General who led the audit identified a different person - not you - as having been the person who gave these assurances.
MR. FEINDEL: I just know that in conversations that I had with the Auditor General I did provide them with information that we had changed our practices with respect to SAP_ALL and, subsequent to that, they were monitoring the system and found that we had been using that profile, or that privilege, in the system and it was around compliance, and changed procedures with respect to the way the staff had been using that access in the system.
MR. STEELE: I'm going to go to the Deputy Minister of Finance. Are you aware of the incident I'm talking about? It wasn't Mr. Feindel who was involved, it was somebody else.
MS. HARNISH: No. I'm aware of what we've done most recently, of course. Just to add to that, it goes back to what I spoke of earlier. We've actually done a lot of work around management working with staff. In many cases we now have appropriate protocols. It's when they're not completely adhered to that we sometimes have difficulty. We have not only done additional training and education of our staff, but we've built into their performance assessments the obligation to respond and to adhere to all of the policies and procedures. We also have in place some monitoring tools and are looking at some additional software right now to further our ability to continue to monitor access. I wouldn't have access, of course, to your in-camera conversations, and I'm not aware of the issue at hand.
MR. STEELE: I would suggest that all of you in the Department of Finance consult with Claude Carter from the Office of the Auditor General, because he believes this was a very serious problem, as do I. If the members of the audit team can't rely on assurances from the Department of Finance, it certainly undermines the integrity of the audit process.
MS. HARNISH: Quite frankly, I find it a little difficult that the Auditor General is indicating to others but us his concern. When we saw it in the audit report we were assuming that it referred to the incident with Mr. Feindel. So I would hope that the Auditor General would come to management first the next time.
[Page 9]
MR. STEELE: One of the key messages coming from the Office of the Auditor General in this audit report that we're examining this morning is that this system, the SAP system, should not be rolled out any further until the significant, persistent, fundamental control weaknesses are fixed. Yet, if I understand you correctly, we're only a couple of months away from a further roll-out to all of the regional school boards in the province. There's a significant issue here about whether that's a wise idea, when the Auditor General has used very strong language to describe the control weaknesses with the existing system.
What's the current status of the human resources module to be rolled out to regional school boards and district health authorities? Is it wise to do so before these problems with the existing system have been fixed?
MADAM CHAIR: Mr. Taylor, is that being referred to Ms. O'Brien or Ms. Fancy?
MR. PAUL TAYLOR: I'd ask Miriam O'Brien to respond to the first part of your question on the status of the school board project.
MS. MIRIAM O'BRIEN: The school board project is on track to be delivered at the end of December - January 1s or December 31st. I believe at the time the 2003 audit came out, the then-director of the CIS Division made a commitment that we would have external audits done prior to going live with either the provincial or the school board system to confirm the security aspects of the work that the project had done. That was done for the province, and it is currently underway for the school board implementation.
We have also had the school boards themselves come in and observe our security, and they have kicked it around to see, firstly, if it gives them enough, but also that it doesn't give them too much, depending on roles. For instance, an HR clerk would have a different access than other roles in the business units.
MR. STEELE: Now, to non-technical people, like me, who aren't involved in these systems every day, there's a certain amount of apparent wisdom in the Auditor General's idea that if there are significant, persistent, fundamental problems with the existing system, those should be fixed before the system gets bigger. Now, is that going to happen, or not? Are the problems going to be fixed before it's rolled out any further, or are we just going to roll out a system that has been identified as having fundamental flaws?
MS. O'BRIEN: I'll start, perhaps from an HR perspective. Technically speaking, the security components of SAP are subdivided by module, so the security that HR payroll provides is unique from and separate from the financial module. So the controls
[Page 10]
discussion that has been going on and that has been audited, to my knowledge, has been largely on the financial side. So, they are separated, to a degree.
MR. STEELE: Unfortunately, the Auditor General has also advised us, in the December 2006 report, which will be coming out shortly, that they are looking at the HR module, and they expect their conclusions in that audit will be very similar to the conclusions reported in the June audit. Now, we haven't seen it, so we don't know that for sure, but we were given some indication that there's no significant difference in the control weaknesses identified, needless to say, a cause for some significant concern.
MADAM CHAIR: The time has expired for the NDP caucus.
Ms. Whalen, you have until 9:49 a.m.
MS. DIANA WHALEN: Thank you very much. I would like to welcome everyone here today as we have a further chance to look at the SAP systems and controls that are in place. A big part of the Public Accounts Committee, of course, is to look at costs and spending as well as management of government. I would like to explore a little bit about the costs of implementing the SAP program. One of the comments made in the report, I believe the most recent one, was that the cost had gone up from what was originally budgeted at $5.7 million and, over time, it's up to $24.6 million. That was the school board's HR module alone, I believe. I'm not sure who could speak to this best. Would it be Mr. Taylor?
[9:30 a.m.]
MR. PAUL TAYLOR: I should begin the answer to that question. The current HR system in the provincial government and, to a large extent, in the school board system, had to be replaced. It's approximately 20 years old. The system on which the provincial system is based is disappearing, as in the mainframe system of operations of IT is disappearing. It's no longer required. So we were essentially, when we headed into this project, when the project was first put forward we were starting from square one, a brand new system, a system where there weren't very many people around who had been heavily involved in implementing the HRMS system. So the people we had dealing with this issue, and the project itself, was starting from square one.
The original budget that was brought forward, I know the figure of $5.7 million has been brought forward by the Auditor General. The realistic starting number that I'm going to use is the number of $9 million. The $5.7 million figure was a figure that was put forward before the project was even blueprinted, for example, if you put it in the context of building a house, someone had to sit down and decide how big this house was going to be and how many storeys it was going to have and, therefore, what was it going to cost. After that project was blueprinted, the number that came forward was $9 million.
[Page 11]
So that's the point that I'm going to start with for comparison purposes to the $24.6 million.
That number, at the time, was based on the best advice we could hire in the private sector and on the advice of people who had been involved in the provincial systems, but provincial systems in implementing the financial side of the SAP system in government. As I said, it was based on the best experience we had. The major assumptions that lay behind that $9 million figure in the blueprint, in looking back on those assumptions, many of them have proven to not be correct.
The major factor that has changed the cost basis of this project is the fact that we had to slow it down. We had made a decision, or an assumption, early on that we could essentially take the school board project and take the provincial government system, and remember between the two of them those two systems produce financials, HR and payroll for 52,000 people in this province, that's a huge conversion factor. It would have been one of the largest conversions that SAP has ever done.
At the time that the decision was made to blueprint, there was an assumption, a core assumption was made that we could essentially run these projects at the same time. We could combine the two of them together, we would achieve economies of scale, less people, et cetera, et cetera. That major assumption has proven to be incorrect. When we got into the systems and realized the complications of the data involved in converting these systems, for example, there's approximately 50 collective agreements involved in this system and the complexity of moving those people across from one system to the other, that complexity required us to stop the project, re-evaluate, and separate the two and start to run them consecutively rather than concurrently. When that happened, that changed the time basis of the project. It slowed down.
MS. WHALEN: If I could interrupt, could you tell me what the difference was in the original time frame that you expected to have this done by and what it actually became in reality?
MR. PAUL TAYLOR: I would ask Ms. Fancy to answer regarding the time frame.
MADAM CHAIR: Ms. Fancy.
MS. HOLLY FANCY: Certainly. We had a project kick off, which was May, 2003. We were originally going to go live with the province August 2004. We ended up going live with the province April 1, 2005. The school boards were October 2004, and we'll be going live with them the end of December of this year.
MS. WHALEN: The school boards, you kicked it off in October 2004?
[Page 12]
MS. FANCY: No, no. That's when we were going to go live, October 2004.
MS. WHALEN: So you're considerably behind on the school board one.
MS. FANCY: Basically, for the same reason that Mr. Taylor just outlined, we were doing these two sectors, 32,000 employees within the province and 20,000 within the school boards together. When we made the decision to split the projects, we also made the decision not to run them in parallel, but to run them in consecutive mode. The decision was made to do the province first, because it had less complexity, it had six collective agreements and terms and conditions, and the school boards have 30 collective agreements and terms and conditions. So because we put them out consecutively, it increased the timeline that we had this team together and, therefore, increased the cost.
The other reason why we wanted to do the province first was because we wanted to take all the lessons learned from the province and apply that to the more complicated environment, which was the school boards.
MS. WHALEN: Another question for Mr. Taylor, if I could. You indicated this was the largest conversion project that SAP had done, is that what you said? I find that hard to believe, they're a worldwide business, and we're a small province.
MADAM CHAIR: Ms. Fancy.
MS. FANCY: When we were looking at the planning stage, when we were talking about giving the estimate of $5.7 million, and we were thinking about this and saying we're going to put this together as one project, because we believe there are some economies of scale. So when we look at this at 52,000 employees and 36 collective agreements, it would have been the largest, or one of the largest in the public sector in North America, probably around the world. So a lot of the HR payroll implementations of this size were all being done around the same era. Also, I think we need to look at, from a Nova Scotia perspective, Nova Scotia is a leader with the SAP public sector program in North America. The fact that we've established this program across many sectors, and consolidated our requirements, consolidated our needs and we've increased our negotiating power, that type of broad public sector program, we're leaders. So we sometimes forge the way.
MS. WHALEN: Can I ask a little question around the support that you've needed in order to introduce this over what we've seen as a long period of time, from May 2003. This is just in that one module, because we know we started in 1997. Can we talk about, just in the last two years, the number of consultants that we would have had to have here? I know this is a very complex area and there are not many people in the world who would know how to bring this about?
[Page 13]
MS. FANCY: Certainly, the program itself, our first implementation, we started in 1996, and went live with the financial system in 1997. So when we look at the number of consultants and the type of private-sector assistance that we've had, we really have to look at it on a project-by-project basis.
MS. WHALEN: Could we look at just the HR one that's ongoing now . . .
MS. FANCY: This particular one?
MS. WHALEN: . . . which has been ongoing, from what I see, since May 2003, when you separated them, perhaps? I don't know when you decided to. Even that one, because there are a lot of modules, there have been a lot of different projects.
MS. FANCY: There have.
MS. WHALEN: I'm sure the cost has been quite enormous, but I would like to get a handle on even one of them to start, HR.
MADAM CHAIR: Ms. O'Brien.
MS. O'BRIEN: I don't have a whole stick number for you, so I'll say that up front. I can tell you, today, we have approximately 10 consultants on deck. I can also say that when we started the project in 2003 that there was also an assumption in the planning that because of our history on the financial modules and plant maintenance and other SAP techie stuff, we thought we could leverage that. We started out with a lower ratio of internal team to consultants than had been experimented with before. That was too low. We were about a ratio of 1 to 10, maybe, at the time, and the project team was - I bet we probably had six or seven consultants to start.
When we had to split the projects, we had a significant influx of consulting, and I can't speak to the number off the top of my head. The plan was to very specifically, and with discipline, knowledge transfer from them. So we implemented a knowledge transfer program that documented, on a monthly basis, what knowledge we wanted to glean from those consultants to build the independents and the long-term capacity for not only the province but the school boards.
MS. WHALEN: For a specific question, how many staff do you have working, specifically, or does government have, because it may go over a number of areas? How many people are working on the introduction of this SAP HR program?
MS. O'BRIEN: I can tell you today, on the school board project, with consultants in, we're about a team of 60.
[Page 14]
MS. WHALEN: So 1 to 6, roughly - 1 to 5, five internal staff.
MS. O'BRIEN: Yes. That's off the top of my head.
MS. WHALEN: Okay. For the people who are coming in as consultants, can you tell me, are we absorbing all of their cost to stay here?
MS. O'BRIEN: Their travel and expense, we have a fixed-price contract with our vendor, and therefore they were part of when the projects were split, and the school board project stated that was negotiated. So within that fixed-price contract their travel and living expenses are covered, we do not see specific invoices for that for the school board project.
MS. WHALEN: For the 10 consultants who are here, can you tell me how long they have been here, consecutively?
MS. O'BRIEN: The school board reactivated in November 2004 or 2005 - 2005, have I got that right? - and they have been here consistently through that period.
MS. WHALEN: Are they residents of Nova Scotia at all?
MS. O'BRIEN: One moved here, we have one from New Brunswick, and the rest are travellers.
MS. WHALEN: When we say they are travellers, does that mean they stay in hotels?
MS. O'BRIEN: They do. We have what we call a 3/4/5 model. They are here three nights, they work four days, and they put in the hours of a five-day work week - so there are three nights of accommodation.
MADAM CHAIR: Mr. Taylor.
MR. PAUL TAYLOR: Just to be clear, like many consultants the province hires, we negotiate a daily rate or an hourly rate with these consultants - that's the rate charged by their firm, and that rate is meant to cover, obviously, their costs, the firm's overhead and their profit. So we're not specifically writing cheques to hotels or restaurants, we're paying a consulting daily bill fee or monthly bill fee, or in this case a fixed price contract that has been negotiated with the firm.
MS. WHALEN: So I thought I originally heard that we were covering their travel and living, but that's not the case then? You say we cover indirectly through their daily or their hourly rates?
[Page 15]
MR. PAUL TAYLOR: We're just paying the fee that's billed to the project, i.e., the fixed-price contract that we've signed to deliver the project.
MS. WHALEN: Can you tell us how much that contract is worth today and what it was before the project split, if it is a fixed-price contract? What was the original fixed price when it was a single project and what is it when it became two?
MADAM CHAIR: Ms. Fancy.
MS. FANCY: The fixed-price contract for the school boards with the consultants is $6.5 million, and prior to the split of the project we didn't have a fixed-price contract.
MS. WHALEN: So one might assume that it's a better deal now, since it is capped?
MS. FANCY: Yes.
MS. WHALEN: Has it been opened at all during that period of time, from May 2003, to now since you split it? Did you split it in May 2003? Whenever you split it and got a fixed-price contract, have they renegotiated that at any time, has it been reopened?
MS. FANCY: Well, when we split and we were replanning for the school board project, we took all the lessons learned, refined our planning, refined our budget, we sat down and renegotiated based on our scope and inventory of work for that fixed price.
MS. WHALEN: Okay, that gives us an idea. But that hasn't been opened again? The fixed price was - you just told me . . .
MS. FANCY: It was $6.5 million for the school boards.
MS. WHALEN: . . . $6.5 million and not reopened again?
MS. FANCY: No.
MS. WHALEN: That's what I wanted to be sure of - I have been a consultant, so I know they tend to reopen things.
MS. FANCY: No, we have been able to adhere to the scope.
MS. WHALEN: I wanted to ask a little bit, or in fact go back to a comment made about the language used in the report. I found that it was very strong language and in talking to the Auditor General, I have said in fact we should be hearing more direct language in the Auditor General's Reports - I find that very often their criticisms are very
[Page 16]
veiled and require a lot of reading between the lines, and even the comment about being perhaps misled about whether or not some changes have been made was done in a very soft way. A person has to read quite carefully to look between those lines.
I believe, Ms. Harnish, you thought the language was a bit too strong, and I would want to be on record saying that I think often it's too soft for the message they want to bring forth. It's difficult, particularly for Nova Scotians to understand sometimes what's going on within the departments if we don't hear very clearly what it is, it's hard for the media to explain it or for members of the Legislature perhaps to catch on to exactly what it is that's being said. So there is a little bit of concern there as I read that report myself.
In terms of some of the criticism in - I won't call it criticism - comments, issues that are raised in the report, one of them referred to the number of high-risk weaknesses that were noted, and in fact they said that there were 5 - and this is the 2006 report - ranked as high risk, 14 moderate risk and 5 were low risk. Of those, from the 2003 report, 5 of the 24 weaknesses had been reported there. Again, from 1998, 12 of the 24 weaknesses were reported. So there's obviously a recurring theme. The problems, or the areas that could be strengthened have not been corrected, certainly not in every case. When there are still five left from 2003's report, and recognizing that there would have different things raised in 1998 and 2003, I'm wondering if you could speak to the urgency that the department is viewing this. Perhaps that's for Ms. Harnish.
[9:45 a.m.]
MS. HARNISH: First of all, when you look at the actual detail surrounding both of the reports, I think you'll see that there is a difference in the intensity of the problem. Even if it's the same problem, and I refer specifically to something like SAP_ALL .In one case, we had a large number of users with SAP_ ALL access. At this point in time, in 2006, we had tightened up considerably. We had put in place protocols to determine when SAP_ ALL was appropriate. What the report would have shown is that in all cases staff may not have adhered to the protocol and it had been enabled when it should not have been without the appropriate authorizations.
So the degree is very much different. I think Mr. Feindel just addressed the types of additional controls and process we've put in place around something like that. So the actual intensity of the issue would have been reduced significantly over time, which is why I say we've made progress. However, that's not to say that we are where we need to be. One of things that we've now done is implemented a six month - the 5,900 service audit is being done on a six-month basis, every six months now, so that much quicker we're able to determine where existing problems still remain. So every six months we'll have another report and we can continue to track what I hope will be our progress, or flag, where we still have issues that have to be addressed.
[Page 17]
We've had two audits recently, and sometimes the AG report tends to mush it all together and it's quite difficult to really determine which one is being referred to at any given point in time. However, we've had one on the financial system. One of the largest issues raised around that one was segregation of duties. However, that audit did not refer to the compensating controls that we have put in place, and at the business level, in this case. Certainly the auditor who did that audit did say at the time that the AG should also review our compensating controls to see if they are adequate and do compensate appropriately for the issues that have been raised, because in many cases it's not practical because of the way we do our business out in departments, to completely segregate duties.
We have small offices in regions where there aren't sufficient staff to draw that line between the types of access and transactions that they can perform, and have to cross-train. However, that doesn't mean that we don't have a process in place that says for any specific transaction the access cannot be used for both pieces when they're not complementary. So we do believe, in many cases, the compensating controls are adequate, but we've put together an overview group which is . . .
MADAM CHAIR: Ms. Whalen.
MS. WHALEN: Excuse me, I'd just like to interrupt for a minute, because I don't have much time left. I would like to ask the Office of the Auditor General, Mr. Edmonds, if you've done these audits, is it true that the segregation of duties issue arises only around smaller offices, or was it a problem in the central areas, as well?
MADAM CHAIR: Mr. Edmonds.
MR. RON EDMONDS: It was a more central problem in regard to the responsibilities that had been assigned to people through their access privileges. Some of it allowed them to do more things than should have been able to do, so there are a number of instances of that.
MS. WHALEN: Okay. I think we can all understand about smaller communities, perhaps, or smaller offices needing some specific exemptions or different controls, but you're saying that you did identify difficulties with the segregation of duties in large offices? Okay. I think it's important that we recognize that. (Interruption)
MADAM CHAIR: Ms. Harnish.
MS. HARNISH: I would ask the controller to talk about segregation of duties in particular.
[Page 18]
MADAM CHAIR: You have 10 seconds before we go to the PC caucus. So this is something that we can come back to, certainly. Thank you very much.
Mr. Dunn, you have until 10:09 a.m.
MR. DUNN: Thank you, Madam Chair. I'll give you the opportunity to continue with that answer, if you wish.
MR. RAFUSE: What I was going to point out was that not only in smaller offices, but even in our large central offices - and I'm going to point to departments that I've worked in - we have cross-trained people who are on the business transaction level, and to allow that to happen you have to give them access to perform different functions. You do that for reasons of vacation scheduling, EDOs, and even some centralized offices are smaller where you don't have a significant number of staff to provide complete segregation of duties. You allow them to have that type of access so your business can remain functional during periods of demand.
It doesn't mean that for any given transaction that people will use that access inappropriately, it just means that they have the ability to do it to remain functional for the speedy, timely payment of invoices, for example.
MR. DUNN: I have a question for Ms. Fancy. I believe you mentioned earlier that Nova Scotia is a leader in the SAP program, yet the Auditor General's Report suggested there appeared to be several deficiencies - would you expand on that?
MS. FANCY: Certainly. What I was referring to from being a leader with the SAP program in the public sector in North America was the fact that we have consolidated the needs for back office systems, like financial and HR payroll across many sectors, the health care sector, the school board sector, provincial sector, and municipal sector. We consolidated those needs and we purchased SAP on behalf of all public sector organizations, instead of having all the public sector organizations that needed to replace their systems go out on their own, individually negotiate and implement.
So in this sort of collaboration across public sector organizations, we are definitely a leader in Canada and in North America. In fact, Manitoba has signed a similar contract with SAP and is following Nova Scotia's lead in relation to this type of program to provide a common back office system, standardized business processes, and standardized information in their public sector.
MR. DUNN: Perhaps a question for Mr. Taylor - and again it can be passed on to anyone on the panel. The auditors said overall the control procedures included in the accompanying description were sufficient to meet the stated control objectives, and you
[Page 19]
alluded to part of this answer earlier, but I'll get you to repeat it. Are you content with the "sufficient" label, or are you working to improve the system, or basically can you explain, again, what you are doing to address the deficiencies in the CCC audits?
MR. PAUL TAYLOR: The control questions are best answered by Ms. Harnish.
MS. HARNISH: We are not content and we will not be content until we have an audit that says we have met our control objectives 100 per cent. As I've told you, we do audits regularly now, each one to help us assess where we still have weaknesses. The financial system audit that was recently completed, we've put in place, for example, a team which is chaired by one of our Finance Directors, in fact it's the Corporate Service Unit Director from the Resources CSU, who has members on it from government accounting, internal audit, and our own internal CIS Division. Many of the segregation of duty issues, for example, exist in the departments.
We run the systems internally, but the actual work is done within departments, and the management in departments would be the responsible management to ensure that the compensating controls are appropriate and are adhered to. So we have asked this team to go through every one of the audit recommendations and develop appropriate responses to assess the recommendation and to determine what our response will be. That will continue. In fact, I've also asked that Mr. Myers, who is chairing that, and his team report to me as Deputy Minister of Finance on a quarterly basis, on their progress, because I do take this very seriously.
On the service audit that we have done every six months now for the Core Competency Centre, we also have a team responsible to address each of the audit recommendations in turn. Formerly it had been completely staff within the Finance Department. We are going to be bringing into this for future audits some of our clients, as well, because we believe it's important that we have a broader perspective around these issues.
Once again, they report biweekly. Mr. Feindel reports to the controller and this comes up and is on their agenda for their standing biweekly meetings, and quarterly they will be reporting to me as the Deputy Minister of Finance. Make no mistake, we have a very firm desire to reach the point where these audits show that we are performing totally appropriately in all respects.
MR. DUNN: I would like to pass it over to Mr. Porter.
MADAM CHAIR: Mr. Porter.
MR. CHUCK PORTER: Madam Chair, I thank the panel today for coming in. My first question will be for Ms. Harnish. You talked about - and I'll use the term
[Page 20]
backup site, I guess for lack of a better term, one I'm familiar with, at the Abbie J. Lane. I would like to know a bit about the criteria for moving. At what point and how is it decided that you're going to need to move there?
MS. HARNISH: This came about, in particular, as a result of the 2003 audit and part of our disaster recovery planning effort that came about after that point in time, but Mr. Feindel can tell you a little more, and I urge him to, about this backup centre.
MADAM CHAIR: Mr. Feindel.
MR. FEINDEL: The process and the protocol used around the use of - in fact, we have two data centre locations that are in use all the time. So, in fact, we use our disaster recovery site for our development and quality assurance systems and our production systems are located at the data centre on Young Street. So effectively we're using our disaster recovery site at all times, know that it functions, and there's a protocol and a process defined in a very detailed disaster recovery plan that walks through the contacts that are done and the decision process that's required when we make the decision to activate that as a disaster recovery site.
MR. PORTER: Who has the authority to make the decision that it's going to be activated and the move is required?
MR. FEINDEL: That would be myself based on consultation with senior management in the Department of Finance and with the client stakeholder groups that we would decide to activate that plan.
MR. PORTER: My next question, I was thinking Mr. Taylor, maybe again Ms. Harnish, or either of you. There was some discussion about collective agreements both in the opening comments and during our answers today and questions. You talked about it being a bit of a deterrent. Obviously, 52,000 people, numerous collective agreements, what actually takes place to bring these people onside? Forgive my ignorance but I'm not exactly sure what's entailed in SAP, I guess, when it comes right down to it. How much information is in there, how does it get transferred over from where it was or where it is, et cetera; can you really spell that out clearly for me?
MADAM CHAIR: Mr. Taylor.
MR. PAUL TAYLOR: I'll very quickly get out of my depth on this subject so that's why I have these experts sitting to my right here, but the province is in the process of putting this SAP system in place that will link things like plant maintenance, their financial systems, their HR, the payroll, to be able to have data move from one sector to the other, to be able to manage the province's financial and human resource systems as one.
[Page 21]
In doing so, the way we have gotten to where we are now, I mean when computers first came into the government system, like they did in many other places in the private sector, they came in piecemeal. They came in, you know, some sectors were a little faster at adopting new technology than others. So we had sectors of the government with vastly different systems, vastly different in how technically proficient they were with levels of training. So you have these systems that don't talk to one another and it's hard to manage across them. So in bringing this program forward selectively across not just the provincial system but obviously the municipal system as well, we start to replace individual systems and put them on the SAP system.
To do that, one obviously has to run the old system up to the point that the conversion is made. You begin to take, in the case of these collective agreements, you have to break them down and configure the new system to be able to mirror what's in those collective agreements, all the while knowing that those collective agreements are live entities. They get renegotiated, they get changed, they get changes made to them on the fly. So the project team has to manage the new system while the CCC, in this case, or the payroll systems in Finance, runs the old system.
MR. PORTER: Sorry to interrupt, just so I'm clear, there's a duplication of the work going on? Is that the right word?
MR. PAUL TAYLOR: People have to continue to get paid. You reach a point where you've tested the new system to make sure it is producing the right results, given the data that's flowing into it. When the team is then confident that point has been reached, that the new system is ready to go live, you essentially flip the system over to the new one, begin to run the new one to produce the cheques and the HR documents, et cetera.
At the same time, I think, again - now I'm starting to get out of my depth - there is a period where you have to make sure the other one is still there just in case, to make sure the new one is running correctly. Once everybody is satisfied the new one is running correctly, the old one goes away.
[10:00 a.m.]
MR. PORTER: So you're running in parallel for a bit, actually, then, and then taking away the old one once you're comfortable. Okay.
MR. PAUL TAYLOR: I'm way over my head now.
MADAM CHAIR: Ms. O'Brien.
[Page 22]
MS. O'BRIEN: Two answers to your question. Before SAP becomes the system of record, we are running a bit of a relay race. We are running in parallel in a test environment, trying to keep our systems in sync. In that environment we're running parallel play to test and validate the results, as Mr. Taylor mentioned. That's kind of in a play environment.
Once we pass the baton and SAP becomes the system of record, right now we're discussing with the school boards whether they would like, as a business decision, to keep their current - a.k.a., old systems - running for a period of time until they get that comfort that their reliance on SAP is fully and well-founded.
To my knowledge, most of the school boards will be doing that for a period of pays just to ensure they're comfortable and they have that as their disaster recovery plan.
MR. PORTER: So they could cut back if they had to?
MS. O'BRIEN: If the worst happened, yes.
MR. PORTER: Okay. Thank you for that, it was fairly detailed and I think I understand it a little bit better now.
You talked a little bit about the system, the changeover and the training - when the SAP system was purchased - and along with that you talked about consultants, et cetera. Is it a consultant training the people on SAP or is it a train-the-trainer?
MS. O'BRIEN: The training has been seen as a real value-add piece for the province or the school board staff to run with. There is definite value in the school board staff being the pros and the gurus of the system, so as part of our knowledge transfer plans, we have built in that the development of those staff members from the school boards who will be delivering training to their people and actually are delivering training as we speak, on the system.
MR. PORTER: Not just delivery then, there's some ability there to correct problems or carry on the maintenance, et cetera?
MS. O'BRIEN: Correct. Those same people are what we call super-users and they become the first line of support once we go live and the school boards are using their systems. They truly are the gurus and almost a consulting level in some cases, with their knowledge base.
MR. PORTER: A little bit on the SAP_ALL. Ms. Harnish, I think you might have mentioned the comment "appropriate protocol". I'm just looking for a little more detail
[Page 23]
on that. When you talk about appropriate protocol, what's the protocol - I'm sorry, what's appropriate, is the question?
MS. HARNISH: Mr. Feindel can explain that to you and I would ask him to.
MR. FEINDEL: The protocol that's required now is for signature at the director level or someone who's acting on my behalf if I'm not around. The decision process we would go through is to determine whether there's an operational requirement in the system, where in some cases even SAP to come in and correct a system problem would actually require SAP_ALL to be able to correct the problem. So there's an assessment done of whatever particular issue is driving us to make that decision. As I say, there's a management decision that's required and approval before the support staff are permitted to provide themselves with that kind of access.
In addition, the monitoring we now do around access that the support staff has allows us, at the management level, to ensure it's not being granted to themselves either by mistake or on purpose, that goes around the actual approval process. We do have monitoring in place, which is an important part of the auditing process.
MR. PORTER: Just to follow that up a bit then. Yourself and other members of the senior management team would make a decision who would have that access, when they would have that access?
MR. FEINDEL: I would make that determination based on the situation that was in place if I needed to consult further with senior management about that, given the significant nature of that kind of access then we would do that.
MR. PORTER: Once you've given that access to a person to go in and do the operational requirements or whatever maintenance might be needed, is that then taken away? It is removed and given back at a later date, again, maybe a different password or a different kind of access?
MR. FEINDEL: Generally what we would do is put a time limit on that particular access, now would be our practice, so that it would automatically expire. So if they required it for a two-hour period, then that's the time period within that access would be granted.
At all times, all of this access is logged within the system, so we actually know what transactions that person is running and we're actually able to monitor down to a data change level, if we desire to do so, to be able to track the access that's used with that particular privilege that's granted.
[Page 24]
MR. PORTER: So there's really no limit then, you could set it for minutes, hours, days, access whatever you felt was appropriate.
MR. FEINDEL: We could, but our practice, as part of the approval process now, is to actually specify a limited time. So the request that would come forward to management in the CIS division would be specific around, I require this for two hours or three hours or something of that nature.
MR. PORTER: I guess that was maybe part of my follow-up, you would have an indication, based on the problem. I guess you are a specialist enough that if somebody would be to say okay, it's going to take two hours or three hours to do this job, then that's the max it should take and that's the limit you're going to give them?
MR. FEINDEL: Correct, and we would reassess that if the problem still was not corrected.
MR. PORTER: Okay. Ms. Harnish, you talked about the help desk and you didn't go into a lot of detail on your opening comments about that. I was just kind of curious. I hear help desk an awful lot in the world of IT, and I'm just kind of curious, what does the help desk do in Finance?
MS. HARNISH: Go ahead, Steve.
MR. FEINDEL: I'm sorry, would you repeat the question.
MR. PORTER: It was with regard to the help desk. I was curious as to what specifically the help desk offers for SAP, or in Finance in general.
MR. FEINDEL: The function of the help desk is there for our clients who use the SAP system. So we provide a call-based service or an e-mail-based service of all of the clients who are using the various systems, whether it be the province or the school boards or municipalities. When they have any kind of problem in using the system and being able to print files, anything of an operational business nature, they would call the help desk for that assistance, and staff would either answer the question at that first point of contact or they would refer it to someone else in the division for further assistance.
MR. PORTER: Is that a 24/7-type of service?
MR. FEINDEL: We do offer 24/7 access for significant operational purposes, but the main business hours of 8:00 a.m. to 5:00 p.m. would be the main coverage for the help desk, at the moment, for business-type questions.
[Page 25]
MR. PORTER: It was mentioned, with regard to training - and again I'll throw it back to Ms. Harnish and you can redirect it to where you think is appropriate - it may have been your comment in talking and understanding a new program being implemented, it takes awhile. My question that I wrote down at the time was, what is "awhile"? How long does it take to be comfortable with this system? I know that it's fairly high technology, but it's an everyday program that once you use it, I guess probably you should be fairly good at it. I'm just curious.
MS. HARNISH: From previous experience, when we put in place the HRMS system 15 years ago, for example, which would have been the new payroll and HR management system at the time, anecdotally from my staff, who would have been there in those days, they told me that the growing pains were tremendous, and it was a good two years before they felt comfortable with the system and stopped thinking that the old system was better.
It's kind of human nature to be very comfortable with what you have and what you are familiar with. Certainly we've had our new payroll system live since April 2005, so it's now going on 18 months. I would say that the HRCSUs, which are the folks who would actually be using the system to do the data input, are finally starting to become comfortable with it. I hear fewer growls from the HR directors and our own payroll staff - who have worked very hard over the last 18 months to keep the system running and respond to the glitches that any new system normally has - are also starting to work more regular hours. So we're hopeful that within another six months, when we're ready to take on the school board project, we'll have things running on a much smoother basis than they have for the last 18 months.
MADAM CHAIR: Thank you very much. The time has now expired. I recognize Mr. Steele. We'll have a second round, ten minutes for each caucus.
MR. STEELE: Thank you very much. Now the eMerge project is part of this whole SAP issue. The original budget allocation from the Cabinet was $5.7 million and, Mr. Taylor, you said by the time it was blueprinted, to use the technical jargon, it was up to $9 million. Today, several years later and the project still not completed, the budget is up at $24.6 million. Why was the plug not pulled on this project a long time ago?
MADAM CHAIR: Mr. Taylor.
MR. PAUL TAYLOR: This project represents two key components of a much larger system that the province is putting in place. This project will result in, for decades to come, the ability of the province to better manage its expenditures and its human resources. When the difficulties - and I'll just go back to your question, the main reason for the 24.6 number; if there is any world in which time is money, this is one of them. We had just recently moved into the world of where the Tangible Capital Assets process
[Page 26]
came into effect; whereas 10 years ago a project like this would have been all over - it wouldn't have been capitalized at all. The expenditure would have recognized the expenditure on consultants alone.
We now started to capitalize the cost of our internal staff. We slowed the project down because the data conversions, the complications in the data were saying, this project is getting into trouble and you're only going to get one chance to do this right. You cannot live with a project that doesn't work. We stopped the project. We completely re-evaluated with the consultant. We did a complete review exactly as you suggested, should this project continue, and the result of that review was, yes, absolutely you continue and the extra money was brought forward to continue the project.
MR. STEELE: The one groups that seems to have done very well in all of this, very well indeed, without dispute, is SAP itself and the consultants who bring some SAP expertise. Can you confirm for me that the original proposal, the original idea for the eMerge project came in from of an unsolicited proposal from SAP itself?
MADAM CHAIR: Ms. Fancy.
MS. FANCY: There was an unsolicited proposal received from SAP. I believe it was somewhere around 1999-2000. Basically, it wasn't related to project implementations. It was related to the broad public sector program and having the Government of Nova Scotia buy into SAP as the back office for all of the public sector organizations. So it was about the purchasing of software and we had already tendered twice. The provincial government had tendered for a financial management system and we had awarded that to SAP. The Halifax Regional Municipality had also tendered for this type of back office system. They awarded it to SAP. So from an SAP perspective, they saw an opportunity looking across the broader public sector of putting forward an unsolicited program on the software side.
MR. STEELE: And am I also correct that the increase in scope, the much broadened scope at the SAP project, was not itself tendered. SAP already had a contract and they were given the contract for the broader scope as well?
MS. FANCY: We levered the existing contract and we did increase the footprint, yes.
MR. STEELE: Out of this $26.4 million budget that this project now has. How much of that roughly do you think has gone to SAP itself?
MS. FANCY: I don't have that figure with me. A breakdown of internal staff to consultants . . .
[Page 27]
MR. STEELE: Even roughly?
MADAM CHAIR: Ms. O'Brien.
MS. O'BRIEN: The added complexity is although SAP subcontracted, like for instance, of the 10 consultant we have today, I think only one or two are SAP. We'd have to do some looking into that.
MR. STEELE: It seems odd to me - this is more of a comment than a question - that the project itself should come in the form of an unsolicited proposal from SAP, the vendor. They would then get the contract without it being specifically tendered. They already have a contract, but what they were awarded with was quite a bit broader than what they had already been awarded. Then, when the project turns out to have a magnitude and complexity - to use Mr. Taylor's words, significantly underestimated - who do we turn to to fix the problems? Well, we turn to SAP and the private sector consultants around this. It just seems odd that this is the way that this project has happened, which has not been delivered on time, not delivered on scope, and is quite vastly over-budget.
MADAM CHAIR: Mr. Taylor.
MR. STEELE: Well, that wasn't really a question, but if you want to make a short comment, you can.
[10:15 a.m.]
MR. PAUL TAYLOR: Two quick comments on that. To pull SAP off the project in the middle of the project would have done nothing more than increase the cost even further, because we would have been back to square one with a brand new company starting up the learning curve. So that's certainly something that had to be factored into the decision at the time.
Secondly, we have done some benchmarking on this system since it has been - well, now, in another two months, it will have been completed from a development point of view. We have benchmarked it against other projects in the public sector across this country and across North America to find out, did we land in the right place? Is $24.6 million an unreasonable number? And we're quite confident where we've landed, the capital cost of this project compares quite favourably with similar implementations of a smaller nature in the public sector elsewhere in this country.
MR. STEELE: Of course I wasn't suggesting that SAP should have been pulled off the contract, but what strikes me is that these projects by their nature get to a certain point where no matter how badly they're going off the rails, it's too late to turn back. So
[Page 28]
SAP, whose idea it was and who was supposed to help us deliver it on time, on scope, on budget, ends up making more money because it's not on time, it's not on scope, it's not on budget, and they're the ones who end up profiting from that.
Anyway, let me move on to another point that I find curious. I couldn't help but notice that SAP Canada Incorporated made a substantial donation to the Progressive Conservative Party in 2005. To be exact, $4,118, which in Nova Scotia terms is a large donation. Now, that sounds to me like a table for 10 at a $500-a-plate fundraising dinner, with the cost of the meal deducted. I was intrigued with this notion that SAP Canada, which is part of a very large global company, and which has a very substantial contract with the provincial government, would see the need to give back a little. Not to the government or to the taxpayers, but to the governing party.
So my question is this, in your presence, either Mr. Taylor or Ms. Harnish or anybody, any of the six witnesses we have today, in your presence or to your knowledge, has anyone representing the Conservative Party approached SAP officials to make a donation to the Conservative Party?
MR. PAUL TAYLOR: I have no knowledge of it whatsoever.
MR. STEELE: You'll recall the incident a number of years ago where a Conservative-leaning civil servant passed a government business tax list with names and addresses over to the Party for use for fundraising purposes. In your presence, any of the six of you, in your presence or to your knowledge, has anyone representing the Conservative Party asked for or received a list of suppliers to the government?
MR. PAUL TAYLOR: No.
MR. STEELE: Okay, all the witnesses are saying no. I just want to note that I think this is a subject that could stand some further inquiry. I know that you're all civil servants and you're not directly involved in this, but I have to say, Madam Chair, it causes me a great deal of concern. Just the very idea of the possibility that people who are supplying services to the government are approached by fundraisers acting on behalf of the governing Party where the message is, directly or indirectly, you've done well by us, now we expect you to give a little back.
I cannot think of any other reason why a large, sophisticated, global company like SAP would feel the need to donate over $4,000 to the Conservative Party of Nova Scotia. If they felt the need to give something back, out of the many millions of taxpayers' dollars that they've received here in Nova Scotia, then I would think they would want to give it back to the taxpayers and not to the Conservative Party.
[Page 29]
MADAM CHAIR: Thank you, your time has now expired. I recognize Ms. Whalen. You have until 10:29 a.m.
MS. WHALEN: Thank you. I guess we could start back at the segregation of duties, if you wanted to go there, as one of the major control weaknesses that were noted again in 2006. I know, Ms. Harnish, you wanted to hear more, either from the Auditor General, perhaps you want to say more yourself.
MS. HARNISH: I did want to ask the controller to explain to the members exactly what we mean by compensating controls related to segregation of duties because we've done significant work around that. Maybe Mr. Rafuse would address that.
MADAM CHAIR: Mr. Rafuse.
MR. RAFUSE: Yes. When the report talks about having segregation of duties' issues, it's referring to the fact that people's access privileges can allow them to do incompatible activities. The reason why that occurs is that in smaller offices that could be centralized or decentralized, where they need to remain functional, they need to have the ability to perform different activities to remain functional. That occurs when people go on vacations or sick times. Even with some larger government departments, you may have only two people who have release access privileges or do that on an ongoing basis, and two people who have purchase requisition ability to post. So to be able to remain functional, if one of your persons is off, you generally cross-train those groups of people.
Therefore, by looking at just their access privileges, it would mean they have incompatible functions from a segregation of duty perspective. What has been put in place is cross-training; also, managers are told and asked to monitor activities to ensure that one individual does not provide the posting and the release of one individual transaction. That's part of the training activities associated with giving that type of access.
MS. WHALEN: If I could, then you're telling us that you've put in some controls around the management taking greater oversight in those instances?
MR. RAFUSE: Certainly, there is what we talk about compensating controls. That's part of the compensating controls that are outside of the system, including such things as the requirement to have things signed off, either by a budget manager or a cost centre manager or director of finance. That's all part of the compensating control system that's outside of the system which we asked the Auditor General to look at before forming an opinion about our controls overall.
MS. WHALEN: Okay, that's very good. I know I don't have much time so I wanted to ask another question around the cost of the whole system. We started with $5.7
[Page 30]
million, and you say it was probably more accurately $9 million in the first instance. But when the project split in two and we're now talking about $24.6 million as being an acceptable amount, are you including the first project which brought it in with the provincial government prior to the school boards and health? That is a total cost - that's really what I want to be sure of. Thank you, Mr. Taylor, that's good.
What it does suggest though is not very good budgeting in the first instance and I think you would agree with me on that. Even at $9 million, we're well below even one-third of the cost of what you say now is considered to be comparing favourably to similar projects in other places.
MR. PAUL TAYLOR: Not to put too fine a point on it, but I think due diligence done at the time was right. The budgeting was right. The assumptions behind that budgeting was where the project got in trouble. It assumed that, for example, wading into the school board system, that with eight school boards, a school board is a school board is a school board and that there would be economies of scale inside that system.
When the project was actually being constructed and you get into the school boards' data and start learning the differences between the collective agreements, that leads to more time to do the data conversions all individually - there was really eight projects inside the school board system instead of one or even three-quarters of one that could be combined with the provincial system.
MS. WHALEN: You're saying it was more complex than you originally expected?
MR. PAUL TAYLOR: Much more complex than originally thought. Remember, these things hadn't been put in place for 20 years and the collective agreements . . .
MS. WHALEN: I understand that, but I would have thought that a quick scan of the eight school boards would have indicated that there was a level of complexity there that should have been budgeted for. We do look for proper budgeting which comes through the estimates which allows us to evaluate whether we're on track. So coming in that much below is a concern. I realize it's often the case with IT projects, that the costs escalate, so I know there's a pattern with that - not just in Nova Scotia, but everywhere.
Nevertheless, I think there's a real need as we go forward to always be doing better budgeting that we can rely upon.
MR. PAUL TAYLOR: I don't want to use up your time, but if Ms. Fancy could take a minute to just talk about the lessons learned in this project and how they're going to be applied elsewhere.
[Page 31]
MS. WHALEN: Maybe briefly.
MS. FANCY: Just very quickly, then. I would definitely agree with what you're saying, and I think the lessons learned that we've had and the changes that we're making with these SAP projects, and we'll see as the health project moves forward that we've actually separated these projects into two sections now. So we have a planning and scoping, very detailed blueprinting requirements piece, which we look at data conversion strategies, training strategies, various other strategies, and we go forward and we estimate what it's going to take to do all of that planning - it could be over a six-month period or a year period, and we get funding for that.
Once all that planning is done, then we come forward with our estimate as to what it will be to actually realize and bring this system into production. So we've broken it up into two phases to avoid this happening again . . .
MS. WHALEN: Well, that's good.
MS. FANCY: . . . and we are continuing with fixed price and tendering on all of our SAP projects.
MS. WHALEN: I think that's a good idea, too. I wanted to talk briefly about the structure of how we manage all of these SAP-related activities within government; frankly, it's kind of confusing. In our briefing in the last meeting when we dealt with this, we were given a flow chart showing the government and the various departments and who's doing what. Just even reviewing the transcript there, there were four different areas that I noted: we have BTAC, which seems to be deputy ministers; the Office of Economic Development, which it says does IT procurement - and I'm not sure what else; the Transportation and Public Works Department has a group called CITO, Corporate Information and Technology Operators - and I'm not sure how involved they are, but they're identified; and then the Finance Department, which seems to be your day to day.
Looking at that from a distance, it looks really convoluted. It does not look like a good, streamlined way to assign responsibilities. I wonder if perhaps, Mr. Taylor, you could speak to that - I don't know if you chair BTAC, but I think you may. So why have we gone this route, which seems so top-heavy and complicated? I want good governance, but it seems a bit much.
MR. PAUL TAYLOR: I can certainly speak to it from my three years of actually chairing BTAC. Yes, it is a committee of deputy ministers. It reports to the Deputy Minister of Treasury and Policy Board. That committee, being involved in the SAP project, it monitors the development of these projects and it monitors, in particular, the development of the projects as they're going through their construction phase, if you will. The information that comes out of BTAC, for instance, would go through the TCA
[Page 32]
process to get funding for these projects. It reports on the progress of the projects to the Treasury and Policy Board Minister.
So if you look at BTAC, it's a mechanism of reporting on these projects corporately, because it involves 12 or 13 deputy ministers.
MS. WHALEN: Could I ask a question, will this committee's need disappear after we have all the projects up and running?
MR. PAUL TAYLOR: No. It has oversight of corporate IT and information management in the province.
MS. WHALEN: Okay, so it's more than just rolling out new projects?
MR. PAUL TAYLOR: Much more than the SAP system. The Office of Economic Development is the corporate IT entity in government. We have included in the Office of Economic Development the SAP Projects Office. We have pre-purchased a lot of SAP software here at a great saving. I think the figure that's in the books, because of the way we purchased the software, we saved off-the-rack price, if you will, approximately $43 million in buying the software. The SAP Projects Office designs where the SAP implementation should go next. We have this SAP program, where we're trying to put these systems, financial management, HR, payroll, plant maintenance, et cetera, in place. So that's the role of the Office of Economic Development in this system.
MS. WHALEN: I'd like to just interrupt, if I could, for a minute, because I know our time is just flying. What I'd like to ask is whether you could provide for the committee the costs that are involved in each area directly related to SAP and the management of IT. I wonder if you could include - well, I see four departments directly involved, you have 60 staff, maybe spread over more than one area, I don't know, and you also have operating costs that are directly in each department, as I would understand, because each department has an IT section . . .
MADAM CHAIR: Time.
MS. WHALEN: Is it possible to get a complete list?
MR. PAUL TAYLOR: I'd need a little bit more specifics as to - that involves the operations of the Department of Transportation and Public Works, the operations of the Department of Finance . . .
MADAM CHAIR: The time has now expired. We will explore that following the meeting. Thank you very much.
[Page 33]
Mr. Bain.
MR. KEITH BAIN: Thank you, Madam Chair. I would like to follow up on the school board project, I guess. It's going to be implemented by year end. Do you feel confident that the weaknesses identified in the first audit have been addressed and won't be occurring in this project? If so, what steps did you take to identify the weaknesses, and here's what we're going to do to correct them?
[10:30 a.m.]
MADAM CHAIR: Mr. Rafuse.
MR. RAFUSE: Certainly, if you look at the two audits that were conducted, they were actually application control audits, and also look at their Core Competency Centre as required, as any service provider.
In regard to the payroll system, all the lessons learned and the findings of those audits were incorporated into the school board project, but more germane for those audits is what we've done internally at the Department of Finance. As far as the 5,900 audit goes, of all those findings, we haven't a task team established that's looking at each one of those findings and addressing them. That will benefit the school board projects, because that will be housed out of the CCC, and we will provide customer service to the school boards there.
Likewise, on the lessons learned on the applications control of the findings from that, that will be extended out into the school boards projects both through the financial system but, as well, the security access profiles that talked about access issues have been better defined and actually using, if I understand correctly, a different security updated profile of the HR module that's more robust on the financial side that the province uses.
So I don't expect there'll be a detriment to the school board project. There are still things we will be working on when we go live, but it won't have what I would refer to as an impact on internal controls of the payroll system for school boards.
MR. BAIN: Was I correct in understanding that you said that each school board would have a lead team, for the sake of a better name, that will train their own staff in the implementation of the . . .
MR. RAFUSE: As part of the project implementation, there are school board representatives at the project now, as they're building the system, and they refer to them as super users, and Miriam could expand on that.
[Page 34]
As well, we have staff from our department on that team as well, and they'll come back and provide support. So there will be centralized support, but also users of the system that were part of the build of the system, there will be resources at the school board level that allow them to not only train-the-trainer but to problem solve as they move forward. Ms. O'Brien, I'm not sure, is there anything you want to expand on?
MADAM CHAIR: Ms. O'Brien.
MS. O'BRIEN: Enough said.
MR. BAIN: Enough said, okay. I guess this training that has been taken, this school board involvement that has been going on, it has been going on for awhile now, I think, a year and a half or somewhere around that, where there have been people from each board who have been trained or introduced to the system and everything else. I guess where I'm going and it might be a little bit off base, the school boards have incurred a cost, over time, as a result of this. Is the school board reimbursed for the lost people hours, as a result of the training, or is it coming out of their budget?
MS. O'BRIEN: As part of the TCA rules, any employee or staff member who contributes to the building of the asset is capitalized. So yes, we have all of those people on our payroll, and the boards are reimbursed for their salary and we pay their living expenses so that they can either back-fill or make their own business decisions around that.
MR. BAIN: So both sides are covered.
MS. O'BRIEN: Correct.
MR. BAIN: The replacement is being looked after by the project, the funding of the project . . .
MS. O'BRIEN: Correct. I do want to add there is an element of business ownership to this system, it is a business initiative, so there are many, many meetings that people come into the project for that are not part of project expenses. So I am respectful that the school boards are spending some money towards the successful completion of the project, but it's not, per se, a project cost, it's their own internal business expenses.
MR. BAIN: Madam Chair, I think that covers any questions that I might have. I don't know if any of my colleagues would have any or not.
MADAM CHAIR: Mr. Porter.
[Page 35]
MR. PORTER: I just really want to ask maybe one more question of Ms. Harnish, and anyone on the panel is certainly free to comment on it. I know we talked about it maybe being $9 million early on, assumed budget, and it ended up at $24 million or $25 million, at this point. My biggest question is, do you think with all of the road that we've travelled so far that the problems that we may have foreseen, have gone through the lessons learned and all of the above - anything you can put in there - is Nova Scotia benefiting from this system?
MS. HARNISH: Well, to the extent that we had to have a system that would run payroll and had an existing system that would no longer be supported by the mainframe, immediately we had to have an alternative. So to the extreme, had we not done anything, we wouldn't have been able to run payroll for 52,000 people. That being said, what we now have in place is a backbone that we can use to build on to do many more things than we would ever have been able to do with existing systems. The functionality that this system provides is very large.
At the present time, the amount that we have actually enabled is not nearly up to the full extent of the capability of this system. So we're running payroll right now. We're doing attendance reporting. We're doing some modules. We're going to soon be at the point that we have an interface with our financial system so that changes made to payroll will automatically flow through to the financial monitoring system that we have. We have the capability down the road, with this backbone, to do on-line application tracking, to do recruitment and retention succession management, a whole host of other functions that are going to be critical as we move down the road to ensuring that we have an adequate and competent Public Service.
MR. PORTER: We talk a lot about technology. I know from having worked in technology for quite a few years now, and I may have referred to it in other meetings, that the way things are today, it is changing rapidly. It's changing almost daily. Things are becoming outdated. What is the lifespan of this SAP program? Do you have any idea what it might be, or how long this program is going to take us before there's another new mainframe, I guess, if you will?
MADAM CHAIR: Ms. Fancy.
MS. FANCY: Basically, when we looked at developing the standard across the broader public sector, and we looked at the vendors that were out there at the time, there were various enterprise resource planning vendors, and we went through the tendering process and chose SAP. A lot of why we chose SAP was around the dollars they spent on research and development. We're looking at a lot of research firms that have said that they're usually first or second in their vision and their ability to execute on that vision. So we saw that as the province was going to make considerable investments in implementing this standard back office across public sector organizations, so, firstly, we
[Page 36]
wanted to make sure that we had chosen the right vendor, because from a length-of-time perspective, as we mentioned, it was close to 20 years before we replaced the last HR payroll system, so we're expecting to be working with this for at least 20 years.
MR. PORTER: What about the program, now, we're going into the school boards, and maybe with their knowledge, is there an acceptance there? Are they happy that this is coming to get on line with the program?
MS. FANCY: I'll pass that to Miriam, because she's working with them directly on a daily and weekly basis.
MADAM CHAIR: Ms. O'Brien.
MS. O'BRIEN: I'm delighted to say yes, they are pleased it's coming. We have reinvested our own lessons learned, and we've been very transparent with the school boards. They've been very involved. We have demo'd the end product to them, because it is ready. I will say, at certain points, they applauded. So that felt great for the team that has been working so hard. We really have some incredibly dedicated people working on this for the school boards in the province.
I would also say that the parallel pay results, which are currently our last piece of testing, are encouraging, and they are very much in the head space now from the school board perspective of getting ready and focusing on their own readiness in getting their people aligned and their processes now down so that we all hit the finish line together.
MADAM CHAIR: Thank you very much. The time has now expired for the questioning portion of today's meeting. I would like to offer an opportunity for some closing remarks to both Mr. Taylor and Ms. Harnish. Perhaps, at that time, the requests for additional information could be addressed, as well. Thank you.
Mr. Taylor.
MR. PAUL TAYLOR: I'll actually take the 30 seconds. I didn't answer that question very well. I want to give you a snapshot of what those four organizations do, Ms. Whalen. OED basically plans and oversees the construction of these projections. CITO in the Department of Transportation and Public Works, runs the mainframe and basically the boxes that we see in government departments, the systems that we use. The CCC operates the SAP, HR and financial systems that we are building here, and BTAC is a committee of deputy ministers that oversees, in a general way, the operations of the systems that I just talked about. So that is basically how we are put together.
[Page 37]
Other than that, I would thank the committee for their questions. I certainly do have confidence that the people who made the decision a number of years ago to go down this road, although these systems are going to cost money to put in place, these are systems that are going to serve decision-makers in this province very well for a long time to come. They are going to have tools that basically almost all other jurisdictions in North America will not have to manage their systems. Thank you.
MADAM CHAIR: Well, thank you very much. That concludes today's meeting. Is there any other item of business? Ms. Whalen.
MS. WHALEN: Yes, I would like to return to the request for some further information on costing, if we could. I asked a very broad one, I didn't have much time there, but what I am really looking for is the fact that each department has an IT section which would be managing, I guess, a component of SAP, maybe that is what they do - no? Not at all?
I really want to know whether there are SAP costs buried in every department, that is what I really want to know. I want to get a total list of the costs associated with implementing SAP and running SAP, and however you want to present it to us, that would be fine.
MADAM CHAIR: I think the best way to handle this would be to make a written request and the Subcommittee on Public Accounts will deal with this and we'll follow up on your concerns. Would that be acceptable to members of the committee?
MS. WHALEN: That's fine, I simply would like to have that.
MADAM CHAIR: We definitely can deal with that. Thank you very much.
I want to thank the witnesses.
We now stand adjourned.
[The committee adjourned at 10:42 a.m.]
