EDC Internal Audit Driving Excellence in EDC through Assurance and Advice CRM Project Management Audit Final Audit Report Report Nr. 8/08 November 5, 2008 Distribution: To: President & CEO Senior Vice President & Chief Financial Officer Senior Vice President Business Development Senior Vice President Business Systems & Technology Vice President & Corporate Controller Vice President, Marketing Vice President Channel Management & Strategic Programs Vice President Project Delivery & Infrastructure Vice President & Chief Information Officer Director, CRM Project Team Program Delivery Manager, CRM Project Team CC: Senior Vice President, Corporate Secretariat & Legal Services Senior Vice President, Human Resources Senior Vice President, Insurance Senior Vice President, Financing Products Group Vice President, Strategic Planning & Corporate Communications Director, Enterprise Portfolio Management Director, Planning & Government Relations Principal, Office of the Auditor General Audit Team: Vice President Internal Audit A. Lowe Monica Ryan S. Good EDC Internal Audit November 5, 2008 CRM Project Management Audit Page 2 of 5 Report # 08/08 Introduction In accordance with our FY2008 Audit Plan, EDC Internal Audit (IA) performed an audit of Phase 1 of the Customer Relationship Management (CRM) Program. The success of the CRM Program will be a key enabler in continuing EDC's transition to a more customer-centric organization. CRM will provide EDC with a corporate wide system that will track business opportunities from their inception through to their conclusion. It will provide full reporting and analytics for all products and customer segments. The CRM program was initiated in Q1 2007 with the launching of a Discovery Phase. In Q2 2007, Phase 1 of the project was launched. Phase 1 consists of two distinct releases, Phase 1A and Phase 1B. Phase 1A was delivered into production in June 2008. Phase 1B is currently nearing the completion of the Design Phase. Audit Objectives & Scope The overall objective of this audit was to assess the project management controls surrounding Phase 1 of the CRM project. As such the audit included an examination of: The existence of, and adherence to a defined systems development life cycle; Project governance control, design, and execution; Project planning and reporting controls; and Project Financial Controls (Budgeting, Cost Control & Forecasting). Internal Audit Opinion In our opinion, Opportunities Exist to Improve Controls1 with respect to the project management of the CRM program. Of particular importance, is the need to update the integrated project plan for Phase 1B to ensure there is a realistic plan from which both the budget and schedule can be baselined. Responsibility for the CRM Project Management Office (PMO) needs to be aligned with the Enterprise Portfolio Management Office in order to allow the delivery team to focus on operational issues. Additional resources need to be added to the CRM PMO in order to implement monitoring and reporting controls more suited to the complexity and size of the CRM project. The implementation of enhanced monitoring and reporting will allow the CRM Steering Committee to transition from its operational focus to consideration of project trends and their potential impact on the future direction and strategy of the project. Audit Findings & Recommendations 1. Scope Definition At the time of our audit, the baseline scope for Phase 1B of the CRM Project had not been formally documented and approved. As Phase 1B was well into the Design Phase, there was a risk 1Our standard audit opinions are as follows: - Strong Controls: Key controls are effectively designed and operating as intended. Best in class internal controls exist. Objectives of the audited process are most likely to be achieved. - Well Controlled: Key controls are effectively designed and operating as intended. Objectives of the audited process are likely to be achieved. - Opportunities Exist to Improve Controls: One or more key controls do not exist, are not designed properly or are not operating as intended. Objectives of the process may not be achieved. The financial/reputation impact to the audited process is more than inconsequential. Timely action is required. - Not Controlled: Multiple key controls do not exist, are not designed properly or are not operating as intended. Objectives of the process are unlikely to be achieved. The financial/reputation impact to the audited process is material. Action must follow immediately. EDC Internal Audit November 5, 2008 CRM Project Management Audit Page 3 of 5 Report # 08/08 that current activities may require re-work in the absence of a formally defined and approved scope document. We understand that the scope of Phase 1B is being documented as part of the Project Initiation Plan and will be approved by the CRM Steering Committee. We recommend that management continue to make the completion and sign off of this formal scope statement a priority to avoid risk of re-work. Rating of Audit Finding - Moderate2 Action Owner - CRM Program Director Due Date - Implemented 2. Requirements Management Opportunities exist to strengthen control processes around requirements management. For example, business requirements are maintained in multiple files versus a single repository. This makes it challenging for the project team to quickly identify the business driver behind a given functionality. We also noted that not all requirements were documented and/or approved prior to entering the Design Phase of Phase 1B which could create re-work. Finally, although our interviews confirmed that Phase 1A requirements were traced through testing, documented evidence of this traceability does not exist. We recommend that all requirements for Phase 1B be documented in a single repository and approved before starting configuration activities. We also recommend that documented traceability be implemented from requirements through testing. Rating of Audit Finding - Moderate Action Owners - CRM Program Delivery Manager Due Date - Q4 2008 3. Change Control Process The CRM program governance document includes a well defined change control process. However, during our audit we noted that the process was not consistently followed. Specifically, the impact of scope changes on the project budget and schedule were not always clearly defined for those approving the change requests for Phase 1A. This had a negative impact on the predictability of both the project schedule and budget. We recommend that change requests clearly identify the impact on both the project schedule and budget and that the project schedule and budget be updated as required. Rating of Audit Finding - Moderate Action Owners - CRM Program Director Due Date - Q4 2008 2 The ratings of our audit findings are as follows: Major - a key control does not exist, is poorly designed or is not operating as intended and the financial and/or reputation risk is more than inconsequential. The process objective to which the control relates is unlikely to be achieved. Corrective action is needed to ensure controls are cost effective and/or process objectives are achieved. Moderate - a key control does not exist, is poorly designed or is not operating as intended and the financial and/or reputation risk to the process is more than inconsequential. However, a compensating control exists. Corrective action is needed to avoid sole reliance on compensating controls and/or ensure controls are cost effective. Minor - a weakness in the design and/or operation of a non-key process control. Ability to achieve process objectives is unlikely to be impacted. Corrective action is suggested to ensure controls are cost effective. EDC Internal Audit November 5, 2008 CRM Project Management Audit Page 4 of 5 Report # 08/08 4. Project Planning Opportunities exist to strengthen control processes around the development and maintenance of the Integrated Project Plan. Specifically, we noted that the timelines and resource estimates provided by various project leads for Phase 1B were not supported by a consistent level of analysis. In addition, resource estimates for some project activities had not yet been prepared and incorporated into the plan. As a result, the current schedule and budget is unlikely to be achieved. We recommend that the project schedule and budget for Phase 1B be re-baselined. As part of this process, guidance should be given to all project leads regarding the level and type of detail needed to support their resource and time estimates. A session should be held with all project leads to challenge/validate their input and the integrated project plan prior to establishing the baseline. Finally, schedule contingencies should be built into the project plan. Rating of Audit Finding - Major Action Owners - CRM Program Director Due Date - Implemented 5. Project Budgeting & Forecasting Detailed budgets and forecasts have been maintained for the CRM Program by nature of expenditure (e.g. software licences, consulting fees, etc). However, a work breakdown structure (WBS) derived from the integrated project plan has not yet been created for recording project time. As a result, actual effort by project activity cannot easily be tracked and used to improve financial and schedule predictions. We recommend that a WBS, derived from the integrated project plan, be created for the purpose of recording time. The analysis of actual versus planned effort by activity should then be used as an input into the project budgeting and forecasting process. Rating of Audit Finding - Moderate Action Owners - CRM Program Director Due Date - Implemented 6. Project Reporting & Monitoring At the time of our audit, the design and implementation of project reporting and monitoring controls was the responsibility of the project delivery team. The delivery team established a project management office (PMO) who did implement various reporting and monitoring controls. However, the level of resourcing within the PMO did not allow it to design and implement processes and controls suited to the complexity and size of the CRM project. Limited resourcing also meant that PMO type work was performed by the delivery team. Not surprisingly, adherence to these controls became less rigorous as the project advanced and the delivery team was focused on resolving issues. We recommend that additional resourcing be provided to establish reporting and monitoring controls commensurate with the size and complexity of the CRM project. The scope of the CRM PMO should include project reporting, scheduling, risk, issue, and change control processes. Project metrics should be implemented as the basis for assessing progress. At a minimum, these metrics should include: schedule performance index (SPI), cost performance index (CPI), earned value (schedule and deliverables) and change request impact. We also recommend that the CRM PMO be functionally aligned with the Enterprise Portfolio Management Office (EPMO) in order to allow the CRM delivery team to focus on project management and delivery. Alignment with the EDC Internal Audit November 5, 2008 CRM Project Management Audit Page 5 of 5 Report # 08/08 EPMO will also ensure that reporting and monitoring controls developed for the CRM project are leveraged on other EDC projects. Rating of Audit Finding - Major Action Owners - VP, Project Delivery and Infrastructure Due Date - Q4 2008 7. Execution of Project Governance The CRM Steering Committee is a key element of the overall governance framework surrounding the CRM program. However, we found that Steering Committee meetings focused primarily on resolving day to day operational issues with limited consideration of more strategic issues such as trends, key risks, issues, scope changes, future phases, etc. The tendency to focus on day to day operational issues was likely a result of the number of operational team members who attended each meeting on a regular basis and the absence of a metrics dashboard highlighting project trends. We recommend that attendance at the CRM Steering Committee be restricted to core members plus a limited number of invited guests based on the agenda items of a given meeting. Consideration should also be given to expanding the number of core members to include additional representation from future business users. Finally, the Steering Committee agenda should be refocused away from day to day operational issues in favour of a discussion of trends as observed through a metrics dashboard, risks, issues, scope, future phases. etc Rating of Audit Finding - Major Action Owners – CRM Program Sponsor Due Date - Q4 2008 Conclusion The audit findings and recommendations have been communicated to and agreed by management, who have developed action plans that are scheduled for implementation no later than Q4 2008. We would like to thank management for their support throughout the audit.
Pages to are hidden for
"EDC Internal Audit Driving Excellence in EDC through Assurance and Advice"Please download to view full document