Your Federal Quarterly Tax Payments are due April 15th Get Help Now >>

EDC Internal Audit Driving Excellence in EDC through Assurance and Advice by wxz21301

VIEWS: 163 PAGES: 5

									                                                                 EDC Internal Audit
                                            Driving Excellence in EDC through Assurance and Advice




                     CRM Project Management Audit
                           Final Audit Report
                            Report Nr. 8/08
                          November 5, 2008

Distribution:

To:    President & CEO
       Senior Vice President & Chief Financial Officer
       Senior Vice President Business Development
       Senior Vice President Business Systems & Technology
       Vice President & Corporate Controller
       Vice President, Marketing
       Vice President Channel Management & Strategic Programs
       Vice President Project Delivery & Infrastructure
       Vice President & Chief Information Officer
       Director, CRM Project Team
       Program Delivery Manager, CRM Project Team


CC:    Senior Vice President, Corporate Secretariat & Legal Services
       Senior Vice President, Human Resources
       Senior Vice President, Insurance
       Senior Vice President, Financing Products Group
       Vice President, Strategic Planning & Corporate Communications
       Director, Enterprise Portfolio Management
       Director, Planning & Government Relations
       Principal, Office of the Auditor General




Audit Team:                                    Vice President Internal Audit
A. Lowe                                                         Monica Ryan
S. Good
EDC Internal Audit                                                                                   November 5, 2008
CRM Project Management Audit                                                                         Page 2 of 5
Report # 08/08



Introduction

In accordance with our FY2008 Audit Plan, EDC Internal Audit (IA) performed an audit of Phase 1
of the Customer Relationship Management (CRM) Program. The success of the CRM Program will
be a key enabler in continuing EDC's transition to a more customer-centric organization. CRM will
provide EDC with a corporate wide system that will track business opportunities from their
inception through to their conclusion. It will provide full reporting and analytics for all products
and customer segments.

The CRM program was initiated in Q1 2007 with the launching of a Discovery Phase. In Q2 2007,
Phase 1 of the project was launched. Phase 1 consists of two distinct releases, Phase 1A and
Phase 1B. Phase 1A was delivered into production in June 2008. Phase 1B is currently nearing
the completion of the Design Phase.

Audit Objectives & Scope

The overall objective of this audit was to assess the project management controls surrounding
Phase 1 of the CRM project. As such the audit included an examination of:
   The existence of, and adherence to a defined systems development life cycle;
   Project governance control, design, and execution;
   Project planning and reporting controls; and
   Project Financial Controls (Budgeting, Cost Control & Forecasting).

Internal Audit Opinion

In our opinion, Opportunities Exist to Improve Controls1 with respect to the project
management of the CRM program. Of particular importance, is the need to update the
integrated project plan for Phase 1B to ensure there is a realistic plan from which both the
budget and schedule can be baselined. Responsibility for the CRM Project Management Office
(PMO) needs to be aligned with the Enterprise Portfolio Management Office in order to allow the
delivery team to focus on operational issues. Additional resources need to be added to the CRM
PMO in order to implement monitoring and reporting controls more suited to the complexity and
size of the CRM project. The implementation of enhanced monitoring and reporting will allow
the CRM Steering Committee to transition from its operational focus to consideration of project
trends and their potential impact on the future direction and strategy of the project.

Audit Findings & Recommendations

1. Scope Definition

At the time of our audit, the baseline scope for Phase 1B of the CRM Project had not been
formally documented and approved. As Phase 1B was well into the Design Phase, there was a risk


1Our standard audit opinions are as follows:
- Strong Controls: Key controls are effectively designed and operating as intended. Best in class internal controls exist.
  Objectives of the audited process are most likely to be achieved.
- Well Controlled: Key controls are effectively designed and operating as intended. Objectives of the audited process are
  likely to be achieved.
- Opportunities Exist to Improve Controls: One or more key controls do not exist, are not designed properly or are not
  operating as intended. Objectives of the process may not be achieved. The financial/reputation impact to the audited
  process is more than inconsequential. Timely action is required.
- Not Controlled: Multiple key controls do not exist, are not designed properly or are not operating as intended. Objectives
  of the process are unlikely to be achieved. The financial/reputation impact to the audited process is material. Action
  must follow immediately.
EDC Internal Audit                                                                                      November 5, 2008
CRM Project Management Audit                                                                            Page 3 of 5
Report # 08/08

that current activities may require re-work in the absence of a formally defined and approved
scope document. We understand that the scope of Phase 1B is being documented as part of the
Project Initiation Plan and will be approved by the CRM Steering Committee. We recommend
that management continue to make the completion and sign off of this formal scope statement a
priority to avoid risk of re-work.

Rating of Audit Finding - Moderate2
Action Owner - CRM Program Director
Due Date - Implemented


2. Requirements Management

Opportunities exist to strengthen control processes around requirements management. For
example, business requirements are maintained in multiple files versus a single repository. This
makes it challenging for the project team to quickly identify the business driver behind a given
functionality. We also noted that not all requirements were documented and/or approved prior
to entering the Design Phase of Phase 1B which could create re-work. Finally, although our
interviews confirmed that Phase 1A requirements were traced through testing, documented
evidence of this traceability does not exist. We recommend that all requirements for Phase 1B
be documented in a single repository and approved before starting configuration activities. We
also recommend that documented traceability be implemented from requirements through
testing.

Rating of Audit Finding - Moderate
Action Owners - CRM Program Delivery Manager
Due Date - Q4 2008


3. Change Control Process

The CRM program governance document includes a well defined change control process.
However, during our audit we noted that the process was not consistently followed. Specifically,
the impact of scope changes on the project budget and schedule were not always clearly defined
for those approving the change requests for Phase 1A. This had a negative impact on the
predictability of both the project schedule and budget. We recommend that change requests
clearly identify the impact on both the project schedule and budget and that the project
schedule and budget be updated as required.

Rating of Audit Finding - Moderate
Action Owners - CRM Program Director
Due Date - Q4 2008




2 The ratings of our audit findings are as follows:
Major - a key control does not exist, is poorly designed or is not operating as intended and the financial and/or reputation
risk is more than inconsequential. The process objective to which the control relates is unlikely to be achieved. Corrective
action is needed to ensure controls are cost effective and/or process objectives are achieved.
Moderate - a key control does not exist, is poorly designed or is not operating as intended and the financial and/or
reputation risk to the process is more than inconsequential. However, a compensating control exists. Corrective action is
needed to avoid sole reliance on compensating controls and/or ensure controls are cost effective.
Minor - a weakness in the design and/or operation of a non-key process control. Ability to achieve process objectives is
unlikely to be impacted. Corrective action is suggested to ensure controls are cost effective.
EDC Internal Audit                                                               November 5, 2008
CRM Project Management Audit                                                     Page 4 of 5
Report # 08/08

4. Project Planning

Opportunities exist to strengthen control processes around the development and maintenance of
the Integrated Project Plan. Specifically, we noted that the timelines and resource estimates
provided by various project leads for Phase 1B were not supported by a consistent level of
analysis. In addition, resource estimates for some project activities had not yet been prepared
and incorporated into the plan. As a result, the current schedule and budget is unlikely to be
achieved. We recommend that the project schedule and budget for Phase 1B be re-baselined. As
part of this process, guidance should be given to all project leads regarding the level and type of
detail needed to support their resource and time estimates. A session should be held with all
project leads to challenge/validate their input and the integrated project plan prior to
establishing the baseline. Finally, schedule contingencies should be built into the project plan.

Rating of Audit Finding - Major
Action Owners - CRM Program Director
Due Date - Implemented


5. Project Budgeting & Forecasting

Detailed budgets and forecasts have been maintained for the CRM Program by nature of
expenditure (e.g. software licences, consulting fees, etc). However, a work breakdown structure
(WBS) derived from the integrated project plan has not yet been created for recording project
time. As a result, actual effort by project activity cannot easily be tracked and used to improve
financial and schedule predictions. We recommend that a WBS, derived from the integrated
project plan, be created for the purpose of recording time. The analysis of actual versus planned
effort by activity should then be used as an input into the project budgeting and forecasting
process.

Rating of Audit Finding - Moderate
Action Owners - CRM Program Director
Due Date - Implemented



6. Project Reporting & Monitoring

At the time of our audit, the design and implementation of project reporting and monitoring
controls was the responsibility of the project delivery team. The delivery team established a
project management office (PMO) who did implement various reporting and monitoring controls.
However, the level of resourcing within the PMO did not allow it to design and implement
processes and controls suited to the complexity and size of the CRM project. Limited resourcing
also meant that PMO type work was performed by the delivery team. Not surprisingly, adherence
to these controls became less rigorous as the project advanced and the delivery team was
focused on resolving issues.

We recommend that additional resourcing be provided to establish reporting and monitoring
controls commensurate with the size and complexity of the CRM project. The scope of the CRM
PMO should include project reporting, scheduling, risk, issue, and change control processes.
Project metrics should be implemented as the basis for assessing progress. At a minimum, these
metrics should include: schedule performance index (SPI), cost performance index (CPI), earned
value (schedule and deliverables) and change request impact. We also recommend that the CRM
PMO be functionally aligned with the Enterprise Portfolio Management Office (EPMO) in order to
allow the CRM delivery team to focus on project management and delivery. Alignment with the
EDC Internal Audit                                                            November 5, 2008
CRM Project Management Audit                                                  Page 5 of 5
Report # 08/08

EPMO will also ensure that reporting and monitoring controls developed for the CRM project are
leveraged on other EDC projects.

Rating of Audit Finding - Major
Action Owners - VP, Project Delivery and Infrastructure
Due Date - Q4 2008


7. Execution of Project Governance

The CRM Steering Committee is a key element of the overall governance framework surrounding
the CRM program. However, we found that Steering Committee meetings focused primarily on
resolving day to day operational issues with limited consideration of more strategic issues such
as trends, key risks, issues, scope changes, future phases, etc. The tendency to focus on day to
day operational issues was likely a result of the number of operational team members who
attended each meeting on a regular basis and the absence of a metrics dashboard highlighting
project trends. We recommend that attendance at the CRM Steering Committee be restricted
to core members plus a limited number of invited guests based on the agenda items of a given
meeting. Consideration should also be given to expanding the number of core members to
include additional representation from future business users. Finally, the Steering Committee
agenda should be refocused away from day to day operational issues in favour of a discussion of
trends as observed through a metrics dashboard, risks, issues, scope, future phases. etc

Rating of Audit Finding - Major
Action Owners – CRM Program Sponsor
Due Date - Q4 2008


Conclusion

The audit findings and recommendations have been communicated to and agreed by
management, who have developed action plans that are scheduled for implementation no later
than Q4 2008. We would like to thank management for their support throughout the audit.

								
To top