Language selection

Government of Canada / Gouvernement du Canada

Search

Audit of Information Management / Information Technology Governance and Integrated Planning

Audit of Information Management / Information Technology Governance and Integrated Planning audit report
(PDF, 441 KB)

Project 2020-6B306
May 2020

On this page

Introduction

The Internal Audit Directorate (IAD) conducted an audit to examine information management and information technology (IM/IT) governance, project management and integrated planning in accordance with Fisheries and Oceans Canada's (DFO) 2019-2021 Risk-Based Audit Plan.

Information Management and Information Technology (IM/IT) play a vital role within the Government of Canada by supporting efficient service delivery, enabling communication, encouraging openness and transparency, and increasing the accessibility of programs and services to Canadians.

Federal Departments must adhere to and comply with the expectations as defined by Treasury Board policy frameworks. On April 1, 2020, the Treasury Board Policy on Service and Digital will replace the existing IM/IT and service policy frameworks. The objective of the Policy is to improve the client service experience and government operations through digital transformation approaches. One of the expected results of the Policy is to ensure that integrated decision-making is supported by enterprise governance, planning and reporting. The Policy and its related Directive on Service and Digital establish objectives and expected results that departments must comply with, as well as specific responsibilities for Deputy Ministers and Chief Information Officers (CIO).

Why this audit is important

Having effective governance, integrated planning and project management processes are fundamental to the successful achievement of the Department's mandate through its strategic objectives, financial and operational priorities and through delivery of its programs. The transformational implications of the Policy on Service and Digital and its related Directive are important for the Department because they define expected results and accountabilities for the Deputy Minister and the Chief Information Officer (CIO).

The audit is important for the Department because its IM/IT environment is complex due to its size, the broad nature of its mandate and the extent to which multiple sectors and the Canadian Coast Guard rely on enabling technology to support the delivery of national and region-specific programs.

The DFO Chief Information Officer is accountable for the achievement of all Departmental IM/IT projects across multiple national and regional sectors, as well as the IM/IT projects for the Canadian Coast Guard. In FY 2018-2019, the Department spent $83.6 million on IM/IT projects.

Audit objective

The purpose of this audit was to determine whether DFO has governance structures and processes in place to manage IM/IT projects and to integrate IM/IT into planning decisions.

Audit scope and approach

The audit examined the departmental governance structures and project management processes in place over IM/IT projects, and the processes and practices for the planning and development of the Department's Memoranda to Cabinet (MC) and Treasury Board (TB) submissions. The audit focused specifically on how effective these governance structures are at prioritizing, monitoring and reporting on projects throughout their lifecycle. It also assessed whether project management processes are in line with Treasury Board directives and guidance, and best practices, and are being implemented. Finally, the audit examined how well IM/IT is aligned with and integrated into the Department's MC and TB submission process to ensure that IM/IT requirements are included. The audit scope covered activities from April 1, 2017 to July 31, 2019.

The audit conducted:

Audit findings

Integrated Planning

Departmental IM/IT planning is aligned with government-wide strategic direction.

The audit examined whether the Department is integrating IM/IT plans into corporate planning processes and whether IM/IT planning is aligned to support both Departmental business and government-wide IM/IT strategic direction. The audit found that, through its annual IM/IT Plan, DFO is integrating IM/IT plans into corporate planning processes. The IM/IT Governance and Planning group develops the IM/IT Plan in consultation with the Client Portfolio Management (CPM) team within the IM&TS Business Line Support Services group. CPM is responsible for communication and engagement with Departmental sectors and regions to determine IM/IT requirements.

The audit also found that the Departmental IM/IT Plan aligns with government-wide strategic directions, notably through inclusion of strategic IM/IT priorities outlined by Treasury Board's Office of the Chief Information Officer of Canada. For example, the audit found that the DFO IM/IT Plan aligned with the Government of Canada strategic plan for IM/IT, inclusive of the following initiatives: modernizing workplace technology; cloud computing; innovation; digital tools; and agile approaches to implement IT solutions.

The accuracy and completeness of IM/IT project costing estimates is improving.

The audit examined whether the Department integrates IM/IT requirements into the planning and development of Memoranda to Cabinet (MC) and Treasury Board (TB) submissions. The audit found that the Department was not initially integrating IM/IT requirements into MCs and TB submissions in a manner to help ensure all potential needs and costs were considered. The CPM group is responsible for relationship and demand management functions between IM&TS and DFO regions and sectors.

Through review of MCs and TB submissions related to four IM/IT initiatives, the audit found that CPM was not engaged in a timely manner by program leads in three of four initiatives, resulting in IM/IT requirements not being defined nor costed accurately or completely. The cause of this finding was attributed to the MC and TB submission processes having been decentralized prior to October 2019 and January 2020, respectively. This resulted in limited collaboration and communication between project stakeholders. However, the audit found that both processes have been centralized – the MC process within the Strategic Policy sector (October 2019) and the TB submission process within the CFO sector (January 2020). Through this process centralization under the Strategic Policy sector and the CFO sector, the MC and TB submission processes has been formalized to involve all enabling function, the lead program group, IM&TS and the CPM group with the goal of helping ensure that IM/IT needs are identified, considered and costed in a more accurate and complete manner.

This finding is important because centralized MC and TB submission processes will reduce the risk that IM/IT initiative needs and costs are not considered, resulting in incomplete and inaccurate MC and TB submissions.

Governance

The Department's governance is not mandated to exercise a formal oversight role over Departmental IM/IT projects.

The audit examined whether there is a governance structure in place to oversee the prioritization process for IM/IT projects to help ensure that projects align with Departmental objectives. The audit found that the Department has established governance mechanisms to discuss and make strategic decisions related to IM/IT, including the following:

A review of FIMC meeting minutes from the past year found that IM/IT related items have been presented for discussion, including the 2019-2022 DFO IM/IT Plan and DFO IM/IT strategic initiatives. A review of NIAC meeting minutes from the past year found that strategic Departmental IM/IT priorities and initiatives and their alignment with Government of Canada IM/IT strategic direction are discussed, including:

For a governance structure to operate effectively and provide value to an organization, it should be mandated to exercise an oversight function. The audit found that there were quarterly DFO sector IM/IT project portfolio presentations at NIAC, including updates on project timelines, budget, scope, performance, risks and challenges.
However, the review of NIAC minutes found limited evidence of a challenge function by members on the information presented. Through interviews with DFO and Coast Guard IM/IT staff and a review of committee meeting minutes, attendance at NIAC meetings, a sample of seven DFO IM/IT projects and monthly project dashboard reports, the audit found the following limitations within current governance processes:

The audit found that, from a governance best practice perspective, the effectiveness of NIAC and Sub-NIAC is limited by not having a formal oversight role over IM/IT projects. The audit also found that these committees have not consistently received timely, accurate or complete information on DFO and Coast Guard IM/IT project costs, timelines and risks through monitoring and reporting processes (see Project Management findings).

These findings are important because a governance committee must have timely, accurate and complete project information to effectively provide strategic advice and make informed decisions to help ensure the successful achievement of project objectives, as well as ensuring achievement of the Department's strategic IM/IT objectives and ultimately its mandate.

The audit found that the Department has made efforts to improve IM/IT project monitoring and reporting through the establishment in May 2019 of the Project Review Committee (PRC) and the Gate Review Committee (GRC). Both committees were created by IM&TS to support IM/IT governance under the Project Management Framework (PMF).

However, the audit also found that neither PRC or GRC have approved terms of reference. The PRC has begun to meet on a monthly basis while the GRC has not yet started.

Collaboration between DFO and the Canadian Coast Guard requires improvement to better support governance and oversight over the management of IM/IT projects and to comply with Treasury Board policy.

Both Treasury Board and the Department define responsibilities for results delivery for the Deputy Minister and CIO with regards to IM/IT. As of April 1, 2020 when the new Policy on Service and Digital comes into effect, the Deputy Minister will be responsible for, among other things, establishing governance to ensure the integrated management of service, information and IT; ensuring that departmental responsibilities and accountability structures are clearly defined; and approving an annual forward looking three-year departmental plan which aligns to the Chief Information Officer of Canada's enterprise-wide integrated plan. Under the Directive, the CIO is responsible for, among other things, participating as a service provider or as a service client in the conception, planning, evolution and oversight of enterprise-wide IT services and solutions.

Fisheries and Oceans Canada's current Directive on the Management of IM/IT Projects establishes the standards and project management requirements for all IM/IT projects within the Department, including Coast Guard. Per the Directive, the CIO is the senior executive designated as lead for IM/IT and is responsible for ensuring appropriate governance, controls and processes are in place so that an efficient and effective IM/IT project management function delivers clear business outcomes and value for the Department. As such, the CIO, who reports to the Assistant Deputy Minister of Human Resources and Corporate Services, is accountable for all DFO IM/IT and all Coast Guard administrative IM/IT projects. The CIO is not responsible for Coast Guard technical systems that support operations, including fleet systems and Marine Communications and Traffic Services (MCTS).

The audit examined whether there was an integrated governance approach between DFO and the Coast Guard for the oversight of IM/IT projects, specifically those of an administrative nature. The audit found that DFO and the Coast Guard are managing IM/IT projects through different frameworks and committee structures, which has limited effective collaboration and integration of IM/IT governance, oversight, monitoring and reporting. In addition, examples were cited where IM&TS was not always aware in a timely manner of some Coast Guard IM/IT activities and projects such as the hiring of CS staff, TB submissions, IT expenditures, through existing planning, monitoring and reporting processes. As a result, IM/IT projects for Coast Guard, regardless of dollar value and technical complexity, may not be receiving an appropriate level of oversight through IM&TS, NIAC or Sub-NIAC in order to effectively manage and mitigate IM/IT project risks.

These audit findings were primarily attributed to existing governance structures not being mandated to provide oversight on DFO or Coast Guard IM/IT projects. These findings are important because an integrated framework is a requirement under the DFO Directive on the Management of IM/IT Projects, the current Treasury Board Policy Framework for Information and Technology, and the forthcoming TB Policy on Service and Digital and its related Directive. The lack of integration is also not consistent with Treasury Board expectations for IM/IT governance, nor industry best practices such as the Control Objectives for Information and Related Technology (COBIT) with regard to framework integration and meeting stakeholder needs through the provision of quality, reliable information.

These findings are also important because there are risks that the Deputy Minister and the CIO may not be supported in meeting their IM/IT accountabilities under the TB Policy on Service and Digital and its related Directive. Moreover, the inability to make informed decisions could place at risk the achievement of strategic departmental IM/IT objectives, and ultimately the Department's mandate.

Recommendation:

  1. The Assistant Deputy Minister of Human Resources and Corporate Services should modernize existing governance structures and accountability mechanisms over IM/IT to be aligned with the Treasury Board Policy on Service and Digital. This should be done in consultation and collaborations with DFO and Coast Guard IM/IT stakeholders.

Project Management

Departmental IM/IT project management practices and processes align with TB policies and industry best practices. However, they are not consistently applied.

The audit examined whether the Department's IM/IT project management processes and procedures are in line with TB requirements and industry best practices. The audit found that the Department has:

The audit found evidence of practice and process inconsistencies related to compliance with PMF requirements, which may be limiting NIAC's ability to make informed, risk-based and timely decisions through monitoring and reporting activities. Specifically, the audit found:

The review and oversight of IM/IT projects between the PMO and project manager was found to be ad hoc and there is no process or tracking method to ensure the completion or verify the quality of information contained in required key project documents used for monitoring and reporting.

IM/IT project monitoring and reporting tools may not be providing relevant, accurate and timely information for decision-making.

The audit examined whether key stakeholders are provided with relevant, timely and accurate information for decision-making. The audit found that through interviews, Monthly Executive Project health dashboards may not be providing relevant, accurate and timely information to support monitoring and reporting. Clients expressed difficulty interpreting dashboards to identify issues and risk areas. Through a review of sampled projects, the audit found the use of three different dashboard templates. For one sampled project, the status changed from “progressing well” to “failing” the next month, thereby highlighting the risk that reporting may not provide an actual representation of a project's status and risks.

These findings were primarily attributed to the DFO Directive on the Management of IM/IT Projects not being aligned to the updated PMF, which may have led to unclear expectations regarding project documentation and information requirements. This finding is important because existing IM/IT project monitoring and reporting activities and information tools may not be meeting project stakeholder needs or helping ensure accountability for outcomes. Potential impacts include the inability to undertake timely risk-based decision-making on Department-wide IM/IT projects, which could result in significant cost increases, delays in critical project timelines and impact the achievement of strategic IM/IT priorities.

Recommendation:

  1. The Assistant Deputy Minister of Human Resources and Corporate Services, through the Chief Information Officer, should ensure:
    1. DFO IM/IT policies and the Project Management Framework are aligned with the forthcoming Treasury Board Policy on Service and Digital and its related Directive (April 1, 2020);
    2. There is a process to monitor compliance with PMF requirements, inclusive of project gating and project documentation; and
    3. There is a process to hold project managers accountable for ensuring that key project documents are completed and contain accurate information to support timely monitoring and reporting.

Conclusion

Overall, the audit concluded that Fisheries and Oceans Canada has implemented some elements of governance and some processes to manage IM/IT projects and to integrate IM/IT into planning decisions. However, the audit identified areas for improvement with regard to committee oversight practices and adherence to the Department's project management framework to better support IM/IT project monitoring, reporting and information decision-making.

Statement of conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing as supported by the results of the Quality Assurance and Improvement Program of Fisheries and Ocean Canada's Internal Audit Directorate.

Approvals

The Internal Audit Report “Audit of Information Management / Information Technology Governance and Integrated Planning” was approved by the Deputy Minister at the Departmental Audit Committee (DAC) meeting on May 14, 2020, pending modifications. The revised report was subsequently approved by the external DAC members via secretarial distribution on July 5, 2020.

Appendix A: Lines of enquiry and audit criteria

The audit criteria were developed based on the following sources:

Line of Enquiry 1 – Governance Criteria Met
The Department has governance structures in place and working to prioritize, monitor and report on IM/IT projects throughout their life cycle. Partially met
Line of Enquiry 2 – Project management
The Department’s IM/IT project management processes are in line with Treasury Board requirements and best practices and are being implemented. Partially met
Line of Enquiry 3 – Integrated planning
The Department integrates IM/IT into its’ planning processes and IM/IT planning is aligned to support both Departmental business and government-wide strategic directions by communicating with and engaging Departmental and external stakeholders, as appropriate. Met

Appendix B: Recommendations and Management Action Plans

Recommendation Management action plan
Recommendation 1: The Assistant Deputy Minister of Human Resources and Corporate Services should modernize existing governance structures and accountability mechanisms over IM/IT to be aligned with the Treasury Board Policy on Service and Digital. This should be done in consultation and collaboration with DFO and Coast Guard IM/IT stakeholders.

Management agrees with the recommendation.

To modernize existing governance structures and accountability mechanisms over IM/IT, the ADM-HRCS will, in consultation and collaboration with DFO and Coast Guard IM/IT stakeholders:

  • 1a) Strengthen the NIAC reporting to DMC for all IM/IT investments and revise the NIAC Terms of Reference (ToR) to highlight the members accountabilities, to align with the new Treasury Board Policy on Service and Digital and to mandate an oversight role over DFO and Canadian Coast Guard IM/IT projects.
  • 1b) Require that quorum is achieved prior to any items related to IM/IT projects being presented for endorsement at NIAC. This will ensure accountability for all NIAC members allowing for informed decisions on IM/IT projects.
  • 1c) Update Sub-NIAC ToR related to all IM/IT projects to be presented for information to sub-NIAC in order to bring awareness to the sectors.
  • 1d) Present project management dashboards regularly to DMC (quarterly base).
  • 1e) Revise NIAC ToR to adopt the mandate to apply corrective measures to Project Managers, Project Directors and Project Sponsors, based upon the Quarterly Compliance Reports. In addition ensure that NIAC ToR reflect its obligations to review projects status and projects compliance based upon the quarterly reporting from the IM/IT Project Management.

Target date: July 2020
Recommendation 2: The Assistant Deputy Minister of Human Resources and Corporate Services, through the Chief Information Officer, should ensure:
  1. DFO IM/IT policies and the Project Management Framework are aligned with the forthcoming Treasury Board Policy on Service and Digital and its related Directive (April 1, 2020);
  2. There is a process to monitor compliance with PMF requirements, inclusive of project gating and project documentation; and
  3. There is a process to hold project managers accountable for ensuring that key project documents are completed and contain accurate information to support timely monitoring and reporting.

Management agrees with the recommendation.

2a) The ADM-HRCS and the CIO will:

  • Review the Policy on Service and Digital, and its related Directive with the purpose of developing a gap analysis relative to the IM/IT Project Management Framework, and the CIOs Directive on the Management of IM/IT Projects.
  • Revise the CIOs Directive on the Management of IM/IT Projects to address gaps.
  • Consult on changes with IM/IT project stakeholders, and seek NIAC endorsement.

Target date: December 2020

2b) The ADM-HRCS and the CIO will:

  • Establish a process to support and monitor compliance with the IM/IT Project Management Framework. This will include implementing firm Project Gating as a control and hard pause on projects before advancing, and formally establishing the Gate Review Committee as a means to validate projects compliance prior to moving through a Gate. Terms of Reference for both the Gate Review Committee and the Projects Review Committee will also be formally approved by NIAC as the IM/IT Governance body. Report compliance for all projects to NIAC on a quarterly basis.

Target date: October 2020

2c) The ADM-HRCS and the CIO will:

  • Ensure that NIAC establishes clear processes allowing project managers and executives to understand their accountability of non-compliance or inaccurate reporting of projects for Project Managers, Project Directors and Project Sponsors.
  • Establish a process which brings forward Quarterly Compliance Reports to NIAC.

Target date: November 2020
Date modified: