Docstoc

sms-sgs

Document Sample
sms-sgs Powered By Docstoc
					                                                TABLE OF CONTENTS


LIST OF ACRONYMS ................................................................................................................. i 
STATEMENT OF ASSURANCE .............................................................................................. iii 
EXECUTIVE SUMMARY .......................................................................................................... v 
OVERALL MANAGEMENT RESPONSE .............................................................................. xi 
1.  INTRODUCTION ................................................................................................................. 1 
      1.1  Background ..................................................................................................................... 1 
      1.2  Audit Objectives and Scope ............................................................................................ 2 
2.  OBSERVATIONS – MANAGEMENT FRAMEWORK................................................... 5 
      2.1     Responsibilities and Organization .................................................................................. 5 
      2.2     System Management Reports ......................................................................................... 7 
      2.3     Resources ........................................................................................................................ 8 
      2.4     Procedures, Documentation, and Training.................................................................... 10 
      2.5     Communicating ............................................................................................................. 12 
      2.6     Previous SMS Reviews ................................................................................................. 14 
3.  USE OF SMS ........................................................................................................................ 15 
      3.1     Overall Process ............................................................................................................. 15 
      3.2     User Satisfaction ........................................................................................................... 16 
      3.3     Data Integrity ................................................................................................................ 18 
      3.4     User Support ................................................................................................................. 21 
      3.5     SMS and IFMS Interfaces............................................................................................. 22 
4.  TECHNICAL AND INTEGRATION ASPECTS............................................................. 25 
      4.1  SMS Architecture.......................................................................................................... 25 
      4.2  Information Technology Security ................................................................................. 26 
      4.3  SMS Stability and Maintenance.................................................................................... 28 
5.  OBSERVATIONS, RECOMMENDATIONS, AND MANAGEMENT RESPONSES 31 
APPENDIX A – METHODOLOGY ......................................................................................... 41 
APPENDIX B – SMS PROCESS............................................................................................... 43 
APPENDIX C – USER ISSUES AND REQUIREMENTS ..................................................... 45 
                              LIST OF ACRONYMS


BCP     Business Continuity Plan
CIPSP   Citizenship, Immigration and Public Safety Portfolio
COTS    commercial-off-the-shelf
FSR     Financial Situation Report
FTE     full-time equivalent
IFMS    Integrated Financial and Materiel System
IMB     Information Management Branch
IT      information technology
JV      journal voucher
LSU     Legal Services Unit
PIA     Privacy Impact Assessment
PPSC    Public Prosecution Service of Canada
PRI     personal record identifier
PWGSC   Public Works and Government Services Canada
RO      Regional Office
SMS     Salary Management System
TBS     Treasury Board Secretariat
TRA     Threat and Risk Assessment




                                            i
                            STATEMENT OF ASSURANCE


We have completed the internal audit of the Salary Management System (SMS). The overall
objectives of the audit were:

a)     to review and assess the integrity and utility of information produced by the SMS
       including the accuracy of information entered into the SMS, the procedures in place for
       ensuring data integrity, and the reconciliation between the IFMS and the SMS;
b)     to review the suitability of functional and technical support for users including
       monitoring of the salary management process, training on the SMS, the safeguarding of
       SMS information, and the extent to which user requirements are met.

The internal audit was conducted in accordance with the Treasury Board Secretariat (TBS)
Policy on Internal Audit and the Institute of Internal Auditors Standards for the Professional
Practice of Internal Auditing.

The audit team assessed:

a)     the management control framework against criteria documented in TBS and departmental
       policies and against criteria derived from the TBS 2007 Management Accountability
       Framework as well as TBS audit guides;
b)     the extent to which SMS-related operations, procedures, and enhancements are managed
       with due regard to economy, efficiency, and effectiveness;
c)     the level of user satisfaction with the SMS.

In our professional judgment, sufficient and appropriate audit procedures have been conducted
and evidence gathered to support the accuracy of the conclusions reached and contained in this
report. The conclusions were based on a comparison of the situations, as they existed at the time
of the audit, against the audit criteria. It should be noted that the conclusions are only applicable
for the areas examined.




                                                 iii
                                EXECUTIVE SUMMARY


The Salary Management System (SMS) is designed to help managers better control their salary
budgets. The system provides financial information related to salary budgets and salary forecasts,
and reports full-time equivalent (FTE) employee utilization by position, financial coding, or
employee name or personal record identifier (PRI). Administrative and Finance Branch staff
enter information into the SMS, which then integrates this information with information from the
Integrated Financial and Materiel System (IFMS), which is the Department’s financial system,
and with actual salary-expenditure data provided by the Regional Pay System operated by Public
Works and Government Services Canada (PWGSC).

Portfolios use the SMS to recover salary expenses from client departments. The Resource
Management Division in the Finance Branch uses the information on salary expenses as well as
monthly forecasts provided nine times a year by various portfolios/sectors/regions to prepare a
total departmental Financial Situation Report (FSR). This report includes salary expenses for the
year to date and a salary forecast. SMS data is also compared with timekeeping data in iCase in
order to assess lawyers’ average annual number of billable hours for cost recovery purposes, and
is used to forecast revenues (recovered salaries). SMS data is also compared with information in
PeopleSoft, the human resources management system.

This audit reviewed and assessed the management framework for the SMS. The planning and the
on-site examination for the audit were carried out between September and December 2008.

Responsibilities and Organization

Finance Branch has the leadership role with regard to the SMS. Its Policy, Systems and
Corporate Accounting Division manages and supports SMS by establishing and managing SMS
user accounts; providing training on the system; answering user questions; resolving issues;
implementing system updates; and operating the interfaces between the SMS, the Regional Pay
System, and the IFMS. The Resource Management Division reviews FSRs provided by the
portfolios/sectors/regions and questions any significant differences between the year-to-date


                                                v
Internal Audit Branch




salary amounts calculated from the data received from the PWGSC's Regional Pay System and
that calculated from the employee’s record in the SMS.

We found that responsibilities need to be defined and documented in more detail, particularly
those involving the reconciliation of the calculated and actual year-to-date salary expenses. The
leadership role of the Finance Branch is not clearly defined and needs improvement. We also
found that the Finance Branch needs to increase its monitoring of the accuracy of the data
contained in individual personal records in the SMS and needs to improve monitoring of whether
users are appropriately using the SMS. The SMS users we interviewed stated that they received
little or no direction from the Finance Branch on how they should use the SMS.

In addition, there is a need to consider assigning responsibility for certain non-technical activities
of a routine nature to a group other than the Systems Section. These routine reconciliation
activities detract from the Systems Section’s primary focus of providing application support,
providing training, assisting users, and resolving issues. In our opinion, the responsibility for
these activities would be better located in another section, such as the Corporate Accounting and
Reporting Section.

System Management Reports

Currently there are 533 user accounts in the SMS. However, the system does not produce reports
to measure user activity or provide information on its technical performance and operation.

Resources

The support provided by the Systems Section is key to the success of the SMS. The Manager and
the other three staff in the Systems Section who support the SMS have all joined the team since
2007. Although the team is supporting the SMS and data to the IFMS is updated on time, we
found that activities such as training and appropriate tracking and answering of user questions
are not being undertaken. In our opinion, the Systems Section requires a stable complement of
qualified personnel to appropriately support the SMS.

Procedures, Documentation, and Training

We found that there is a need to develop documented procedures on some standard business
processes. Also, some ROs and portfolios/sectors have developed notes and checklists to assist
staff in their use of the SMS and these local procedures should be shared with other
portfolios/sectors/regions.


                                                 vi
                                                                                Salary Management System
                                                                                       Executive Summary



System documentation also needs improvement. The Systems Section has prepared a useful User
Manual, but it requires updating. Also, users find the Help function confusing and it should be
improved.

A training strategy should be developed and improved and more frequent training provided.
Users advised the audit team that they require specific courses aimed at data entry,
reconciliation, and reporting, and courses offered at different levels—basic for new users and
advanced for those who have some experience using the SMS. Many users have not received any
training and have learned from colleagues and by trial and error. These users have not been
informed of best practices or the most efficient ways to use the SMS.

Communicating

Users we interviewed did not recall receiving any directives concerning the SMS. We found that
users do not know the Finance Branch’s data integrity expectations for the SMS and therefore
maintain data integrity of the system as they see fit. We also found that the Systems Section has
not sufficiently solicited user input on user requirements for using and managing the SMS, nor
has it established a forum for discussion of SMS issues with user representatives. Also, users we
interviewed did not recall receiving information on the SMS at conferences or in working
groups. In our opinion, Systems Section staff should periodically contact SMS user
representatives to solicit feedback on issues and share information on the SMS, and should
establish regular group discussions.

We also found that more information on the SMS is required on the Finance Intranet site. The
SMS User Manual is not posted on the site nor is there any description of SMS processes or
responsibilities.

Previous SMS Reviews

The Documentation of Information Technology General Controls and Application Controls
report, June 26, 2007, contains several recommendations to improve the SMS. We found that
several recommendations in the report were not implemented.

Overall Process

Overall the SMS appropriately supports the salary management function. However, there are
some issues with the special processes for entering data in the SMS at year-end. These should be
reviewed and addressed as required.


                                               vii
Internal Audit Branch




User Satisfaction

We found that administrators differ in their degree of knowledge of the SMS and often their
knowledge is insufficient. Frequent users of the SMS told the audit team that the system needs to
be more efficient and have a faster system response time. They also stated that entering a
complete transaction takes too many steps using multiple windows. Users located in the British
Columbia RO told the audit team that the SMS is always slow in the afternoon (Pacific Time).

The system has a Scenario feature that allows users to modify a copy of their data for analyzing
results of different planning assumptions. We found that some users have no knowledge of
scenarios or do not use them because inaccuracies in SMS data limit their usefulness. In our
view, more training is needed on this feature.

We found that six LSUs in the Citizenship, Immigration and Public Safety Portfolio (CIPSP) do
not have access to the SMS, while two others, plus those in the Tax Law Portfolio, have access.
For those that do not have access, it is a complex and time-consuming process to update the
SMS.

Data Integrity

Some administrators need to improve data entry and reconciliation to ensure that SMS records
are accurate. Administrators perform regular reconciliations of the actual year-to-date salary
amount to the calculated year-to-date salary amount according to employee data in the SMS. In
performing these reconciliations, different administrators conduct different checks of the SMS
data. Most administrators we interviewed reconcile the amounts only at the global level and
make changes to employee data only until the total difference between the actual and calculated
year-to-date salary amount is small. They do not go through all the detailed employee data to
make the necessary corrections to ensure that individual differences at the employee level are
corrected. There is no requirement that errors in these details be corrected unless they
significantly affect the overall totals. As a result, the reconciliation process contributes to an
accurate overall total, but it does not sufficiently correct the SMS so that the forecast will be
accurate. Administrators rarely reconcile the Positions Report from the SMS to the organization
charts. More reconciliation of positions’ information is required to improve SMS data accuracy.

It is our view that the reconciliation between the actual and calculated year-to-date salary
expenses should be performed monthly, but because of staff shortages, not all administrators
update the SMS on a timely basis and not all reconcile monthly. In our opinion, timely data entry
and detailed reconciliation are two of the key requirements for improving SMS data accuracy.


                                               viii
                                                                                Salary Management System
                                                                                       Executive Summary



We found that not all administrators enter global costs. Incomplete global costs affect the
accuracy of SMS reports.

User Support

Users who need assistance with the SMS can contact the IMB Help Centre or a member of the
Systems Section. The IMB Help Centre resolves most issues related to the departmental IT
infrastructure. Issues related to SMS functionality or application software are forwarded to the
Systems Section.

The Systems Section’s capacity to provide appropriate user support has suffered because of staff
shortages and turnover. User support provided by the Systems Section requires improvement.

SMS and IFMS Interfaces

There is an appropriate process to interface the Regional Pay System, the SMS, and the IFMS for
salary data. However, records need improvement. We found records of the various steps in the
interfaces and of changes made to pay records containing errors. In our opinion, the records need
to be supplemented with a summary of the actions taken for each update or data transfer. A
second individual or supervisor needs to review the summary records of each data transfer to
decrease the risk of errors.

SMS Architecture

We noted and received comments that there is duplication of data between the IFMS, the SMS,
iCase, and PeopleSoft. Analyzing these four systems is beyond the scope of this audit.
Nonetheless, future system selection or design should aim to integrate data between systems
more effectively.

Information Technology Security

A Threat and Risk Assessment (TRA) and a Certification and Accreditation (C&A) were
prepared and approved in 2006 and the SMS was accredited for operation until December 2007.
We found that the SMS password needs stricter control. A new TRA and C&A should be
prepared.

User accounts provide appropriate segregation of duties. Only the Systems Section can set up
user accounts. The Systems Section has access to all data. Other users can only view data for
employees under their area of administration, and data entry rights are only given to authorized
                                               ix
Internal Audit Branch




administrators. Other staff members who need to work with the data can only view it or produce
reports. These are appropriate controls.

An appropriate process was followed in deciding on the need for a Business Continuity Plan.

SMS Stability and Maintenance

The SMS has a stable operation. We were told that the Policy, Systems and Corporate
Accounting Division is considering changing to a salary management system other than the SMS
and has therefore suspended upgrades and enhancements to the SMS.

We found no records of testing of SMS version implementations. Such documentation is
important because it permits a review of what was tested and serves as a reference when trying to
resolve new technical problems. The information is also useful when considering how to test
new versions of the current or new system.

The management responses to the recommendations contained in this report were provided by
the Chief Financial Officer, Chief Financial Officer Branch.




                                               x
                       OVERALL MANAGEMENT RESPONSE


The Chief Financial Officer Branch (CFOB) at the Department of Justice has been considering
the eventual replacement of its Salary Management System (SMS) for a number of years. Since
the development of the Salary Forecasting Tool (SFT) at the IFMS Cluster Program Office in
2007, the Department has been following its development and progress as to the functionality
being introduced.

At the time of this audit (September to December 2008), the Financial Systems Section of the
Department of Justice was also going through a Risk Assessment of its financial systems which
included two main goals: 1) identify functional gaps between the Department’s financial systems
and Treasury Board’s Financial Management Policy Framework (FMPF) and suite of financial
management policy instruments; and 2) obtain inputs from Corporate and Operational personnel
related to existing and future functional requirements for financial systems.

This Assessment also indicated a high risk associated with the SMS. The summary of findings
stipulated “Salary Management information, a material component in financial forecasting, is not
integrated. A complex and inconsistently applied/followed reconciliation process makes salary
forecast information unreliable.” It was recommended in the ensuing Roadmap to implement the
SFT module available from our IFMS Program Office.

The Salary Forecasting Tool (SFT) project was started in November 2009. This project is
scheduled to replace the current SMS and deliver an integrated tool to the user community for
July 1, 2010. We have already received the standardized configurations and processes from our
IFMS Program Office and are reviewing these in comparison to the Department’s processes. The
project itself will include full analysis in regard to the most efficient organizational structures to
support and maintain the module and to follow up with compliance and quality of forecasted
data.

Our responses to the recommendations of this internal audit report are based upon the expected
replacement of SMS by SFT on July 1, 2010.


                                                 xi
                                 1.      INTRODUCTION


1.1   Background

The Salary Management System (SMS) is designed to help managers better control their salary
budgets. The system provides financial information related to salary budgets, salary actuals, and
salary forecasts, and reports full-time equivalent (FTE) employee utilization by position,
financial coding, or employee name or personal record identifier (PRI). Administrative and
Finance Branch staff enter information into the SMS. The SMS integrates this information with
information from the Integrated Financial and Materiel System (IFMS), which is the
Department’s financial system, and actual salary-expenditure data provided by the Regional Pay
System operated by Public Works and Government Services Canada (PWGSC).

SMS has 533 departmental users, which include administrators, business managers, financial
officers, and responsibility centre managers. Its reports are used to manage more than 50% of
departmental expenses.

Portfolios use the SMS to recover salary expenses from client departments. At the start of the
fiscal year, they also use the system to provide expense estimates for client departments to use in
their budget process. The Aboriginal Affairs and Tax Law portfolios use the SMS to calculate
billing amounts based on FTE utilization and in accordance with Memoranda of Understanding
entered into with their clients. In addition, SMS information is used to estimate some O&M
expenses.

The Resource Management Division in the Finance Branch uses the information on salary
expenses as well as monthly forecasts provided nine times a year by various
portfolios/sectors/regions to prepare a total departmental Financial Situation Report (FSR). This
report includes salary expenses for the year to date and a salary forecast. The Division also
monitors and analyzes the information on salary expenses. In addition, the Resource
Management Division uses SMS data to identify which staff are legal practitioners, establish
rates for these legal practitioners, and measure FTE growth in departmental organizations and the
Department overall. SMS data is also compared with timekeeping data from iCase in order to

                                                1
Internal Audit Branch




assess lawyers’ average annual number of billable hours for cost recovery purposes, and is used
to forecast revenues (recovered salaries).

The Manager, Costing and Charging, also compares the SMS data with information in
PeopleSoft, the human resources management system. The Human Resources (HR) Directorate
at headquarters (HQ) processes staffing actions for headquarters staff and manages the
PeopleSoft system. Each regional office (RO) has a human resources section that reports to the
Director, HR, in the RO; processes regional staffing actions; and enters its own data into
PeopleSoft.

Developments currently under way in the Department that will affect SMS include the following:

•           The Finance Branch is conducting a risk management project to assist with preparing a
            plan of its functions and to decide on its reorganization.
•           As required by TBS, the Finance Branch will be implementing a new financial system.
            The current SMS has been used for more than 10 years and is outdated. The Systems
            Section within the Finance Branch is working on a three-year systems plan for financial
            systems.
•           TBS is developing new financial policies to be approved by April 2009. One of these
            policies deals with financial systems and will have an impact on financial systems such as
            the SMS.

The key risk factors that were considered in relation to this audit engagement included accuracy
of data entry, timeliness and integrity of information for financial reporting, impact on decision
making, appropriateness of key financial controls, and security of data.

It should be noted that effective July 2009 the Chief Financial Officer (CFO) Branch was
established. Recommendations are therefore addressed to the CFO, who reports to the Deputy
Minister.

1.2      Audit Objectives and Scope

The audit team examined and assessed the management framework for the SMS including:

•           the accuracy of information entered into the SMS;
•           the integrity and utility of information produced for financial reporting;
•           the adequacy and appropriateness of procedures in place for ensuring data integrity;
•           the extent and appropriateness of the reconciliation between the IFMS and the SMS;

                                                    2
                                                                                 Salary Management System
                                                                                            1. Introduction



•      the capacity and mix of resources to maintain, support, and monitor the salary
       management process;
•      the suitability of functional and technical support for users;
•      the adequacy of security measures for safeguarding information;
•      the extent to which user requirements are met;
•      the adequacy of SMS training.

The scope of the audit included all activities related to the SMS at headquarters, in the Prairie
and British Columbia regional offices, and in the Canada Revenue Agency and Citizenship,
Immigration and Public Safety Portfolio legal services units (LSUs). The audit excluded
activities related to the support of the Public Prosecution Service of Canada (PPSC) in its use of
the SMS.

The planning and the on-site examination for this audit were carried out between September and
December 2008.




                                                3
          2.      OBSERVATIONS – MANAGEMENT FRAMEWORK

2.1    Responsibilities and Organization

Responsibilities for managing and supporting the SMS and ensuring that the
system is used appropriately need to be more clearly defined and understood.

The Information Management Branch (IMB) provides the hardware and departmental network
for the SMS, operates the system (including conducting backups), and assigns an employee to
resolve technical issues related to the information technology (IT) infrastructure. IMB’s role is
limited with regard to the SMS, and we found no issues with its responsibilities.

The Finance Branch has a leadership role in ensuring that data in the SMS is accurate and that
staff use the SMS appropriately to manage salaries. The Policy, Systems and Corporate
Accounting Division, Finance Branch, manages and supports the SMS by establishing and
managing SMS user accounts; providing training on the system; answering user questions;
resolving issues; implementing system updates; and operating the interfaces between the SMS,
the Regional Pay System, and the IFMS. The SMS is a commercial off-the-shelf (COTS)
software product, and there is a maintenance contract in place with the COTS supplier for
technical support related to software issues. The Policy, Systems and Corporate Accounting
Division manages this contract with the supplier.

Each portfolio/sector/region provides the Resource Management Division with a monthly
Financial Situation Report (FSR) that includes salary expenses and a forecast. The Resource
Management Division reviews the FSRs prepared by the various portfolios/sectors/regions and
questions any significant differences between the actual year-to-date salary amounts obtained
from the data received from the PWGSC's Regional Pay System and that calculated from the
employee’s record in the SMS.

In each portfolio/sector/region:

•      administrators enter data and reconcile the calculated salary expenses to the actual year-
       to-date expenses;
                                               5
Internal Audit Branch




•           business managers and financial officers use the SMS information to prepare reports for
            their respective responsibility centre managers and for the FSR for the Resource
            Management Division;
•           responsibility centre managers use reports produced with SMS information to manage
            salary expenses and budgets.

We found that the leadership role of the Finance Branch is not clearly defined and needs
improvement. The responsibilities above are defined only at a general level in job descriptions.
These responsibilities need to be defined and documented in more detail, particularly those
involving the reconciliation of the calculated and actual year-to-date salary expenses, and the
monitoring of data accuracy in the SMS. We found that the Finance Branch needs to increase its
monitoring of the accuracy of the data contained in individual personal records in the SMS. This
monitoring is now limited to questioning significant differences between the calculated and
actual year-to-date expenses. Finance also needs to increase its monitoring of whether users are
appropriately using the SMS. The SMS users we interviewed stated that they received little or no
direction from the Finance Branch on how they should use the SMS.

Recommendation and Management Response

1.          It is recommended that the Chief Financial Officer ensure that:

            a)          responsibilities for managing and supporting the SMS and ensuring that the
                        system is used appropriately are defined and documented;
            b)          the Finance Branch increase its monitoring of SMS use by users and of the
                        accuracy of SMS data.

            Agree. The Chief Financial Officer Branch, through the Salary Forecasting Tool project,
            will better define its leadership role and ensure that roles and responsibilities are well
            defined and documented for the Finance divisions, business units, and administrators.
            Monitoring and ongoing support functions associated with the maintenance and quality of
            data being captured will also be defined and developed. These will be reviewed and
            addressed as part of the SFT project, which is scheduled for implementation on July 1,
            2010.

There is a need to consider assigning responsibility for non-technical activities of
a routine nature to a group other than the Systems Section.

The Policy, Systems and Corporate Accounting Division has three sections: Corporate
Accounting and Reporting; Policies, Procedures and Training; and Systems. Two of these
                                           6
                                                                                         Salary Management System
                                                                          2. Observations – Management Framework



sections are involved in the SMS. The Systems Section supports the financial systems and the
Corporate Accounting and Reporting Section performs accounting tasks. The Systems Section
currently processes the interfaces between the Regional Pay System, the SMS, and the IFMS.
This responsibility involves non-technical activities of a routine nature such as running computer
jobs, reconciling data transfers, and clearing transaction errors resulting from this process. These
routine reconciliation activities detract from the Systems Sections’ primary focus of providing
application support, providing training, assisting users, and resolving issues. In our opinion, the
responsibility for these activities would be better located in another section, such as the
Corporate Accounting and Reporting Section. This section is currently responsible for
reconciling the IFMS salary entries to the total control amounts received from the Receiver
General.

Recommendation and Management Response

2.     It is recommended that the Chief Financial Officer consider assigning responsibility
       for non-technical activities of a routine nature to a section other than the Systems
       Section.

       Agree. Salary management non-technical activities of a routine nature will be assigned to
       Corporate Accounting and Reporting as part of the revised process to be adopted with the
       implementation of the new Salary Forecasting Tool within IFMS. Non-technical
       activities are defined as reconciliation of control accounts, and clearing of suspense
       accounts through correction facility programs which assign outstanding postings to
       correct accounts. Technical activities will comprise of maintaining the ongoing
       interfaces (file transfers) between the Receiver General and the Department’s financial
       system (IFMS), and will continue to be administered through our Systems Section.

2.2    System Management Reports

More reports that will assist in monitoring and analyzing the usage and technical
performance of the system are required.

Currently there are 533 user accounts in the SMS, of which 401 are active. The users we
interviewed told us that they spend a significant amount of time on data entry, reconciliation, and
reporting. However, the system does not produce reports to measure user activity (e.g. the
number of active users, the extent of their use, and the functions they use).



                                                 7
Internal Audit Branch




Furthermore, the system does not produce any reports that provide information on its technical
performance and operation. Some users we interviewed indicated that the system is slow, while
others were satisfied with its processing speed. There are no reports that provide information on
the extent and frequency of downtime. Some users reported that the system is periodically down,
which affects data entry and reconciliation for heavy users. There are also no statistical reports
available on the number and type of calls/e-mails received by the IFMS Help Desk and the
Systems Section.

Recommendation and Management Response

3.          It is recommended that the Chief Financial Officer ensure that SMS reports on
            monitoring the usage and technical performance of the system are produced.

            Agree. With the implementation of SFT on July 1, 2010, reports on monitoring the usage
            and technical performance of the system will be available as standard reports from SAP.

2.3         Resources

There is a need to provide the Systems Section with a stable complement of
qualified personnel to support the SMS.

The support provided by the Systems Section of the Policy, Systems and Corporate Accounting
Division is key to the success of the SMS. At the time of the audit, the Systems Section had four
staff members assigned to the SMS. They included the Manager, Systems Section, who is
responsible for all financial systems; a team leader (FI3) who started in August 2007; a financial
officer on rotation under the FORD (Financial Officer Recruitment and Development) program
from September 2008 to February 2009; and a second financial officer (FI2), who started in
October 2008. The Manager spends five percent to ten percent of his time on SMS, while the
other members are assigned on a full-time basis.

The Manager and the other three staff in the Systems Section who support the SMS have all
joined the team since 2007. During 2007-08, the three staff members who were previously
supporting the SMS left the section within a few months of each other. It took a number of
months to replace these staff with the current staff members. There was no knowledge transfer to
the new employees. Since the staff on this team are relatively new and require experience and
further training on the SMS, they have not reached their full potential to provide system support.
We were told that a team of four staff members is sufficient to support the system. We note that
the team is supporting the SMS and that data to the IFMS is updated on time. However, we
found that other activities are not being undertaken, such as training, development of user
                                                 8
                                                                                     Salary Management System
                                                                      2. Observations – Management Framework



procedures, definition of responsibilities, and appropriate tracking and answering of user
questions. In our opinion, the Systems Section requires a stable complement of qualified
personnel.

Recommendation and Management Response

4.     It is recommended that the Chief Financial Officer ensure that the Systems Section
       is provided with a stable complement of qualified personnel to support the SMS.

       Agree. A request has been submitted through the departmental footprint exercise for one
       resource in Corporate Accounting and Reporting. The SFT project team has two
       resources from the Systems Section who will be responsible for the ongoing maintenance
       and support of SFT after the July 1, 2010 implementation. Since the SFT module is built
       within the IFMS environment, we will also be able to benefit from the expertise and
       support of the IFMS Program Office and the IFMS shared systems community.

Administrators’ use of SMS varies.

The accuracy of SMS data depends on the quality of data entry and reconciliation activities
performed by administrators. The administrators we interviewed varied in the frequency and
extent to which they use the SMS. Some administrators use the SMS a few hours a month
because few changes to employee salary data are required or they are administratively
responsible for a small number of employees. Other administrators work on a full-time basis on
the SMS. We found that most administrators do not have the time to appropriately update and
reconcile the SMS. Some administrators update the SMS immediately when changes occur,
while others update the SMS monthly and reconcile quarterly. Some administrators are one to
three months behind in updating the SMS because of staff shortages. Inaccurate data affects the
forecast, as we will discuss later.

In this report we have recommended that monitoring of SMS data needs to be improved to
ensure accuracy. Improved monitoring will assist in identifying issues and improving processes
and determining the required level of resources for the SMS.

There is appropriate IT support.

IMB has assigned a staff member (CS1) who works an average of approximately three hours per
week providing technical support to the SMS. This support includes addressing issues related to


                                              9
Internal Audit Branch




IT equipment and infrastructure, and installing SMS software. Users informed us that they
receive appropriate IT support.

2.4      Procedures, Documentation, and Training

Written procedures are required and system documentation needs improvement.

Procedures on some standard business processes have not been developed and documented.
These include, for example, procedures on consistent terminology in the SMS, consistent SMS
data, assessing SMS data integrity, and assuring accuracy of SMS data. Most staff we
interviewed wanted documented procedures (e.g. on when to enter staffing actions in the
system), and staff who use SMS information requested more consistency, for example, in the
terminology used. These types of written procedures provide useful information for current and
new staff. We found that some ROs and portfolios/sectors have developed notes and checklists to
assist staff in their use of the SMS. These local procedures should be shared with other
portfolios/sectors/regions.

The Systems Section has prepared a useful User Manual that explains how to use SMS features.
However, the contents of the manual have not been updated in more than six years, even though
the date on the manual has been changed to 2008/09. Also, there are no written procedures for
the tasks performed by the Systems Section, such as the updating of tables and salary amounts.

The Systems Section is preparing a manual to document the interface processes between the
SMS and the Regional Pay System, as well as between the SMS and the IFMS. This manual will
be a useful reference.

Although the SMS has a Help function available, users told us they do not use it and that it needs
improvement. For example, we found that the Help function is confusing for users because it
contains technical information that is not pertinent to administrators’ responsibilities.




                                               10
                                                                                        Salary Management System
                                                                         2. Observations – Management Framework



Recommendation and Management Response

5.     It is recommended that the Chief Financial Officer ensure that:

       a)      written procedures on standard business processes are developed and local
               procedures are shared, as appropriate;
       b)      system documentation is improved.

       Agree. A set of standardized business processes and procedures will be developed and
       communicated as part of the July 1, 2010 SFT implementation. These will also address
       the roles and responsibilities of the users involved in the data capture and maintenance of
       various assignments relating to salary management detail events. The SFT
       implementation will also provide the opportunity to ensure systems documentation is
       updated.

There is a need to develop a training strategy and provide improved and more
frequent training.

There is no strategy for providing training to users. For example, no information is available on
which users should receive training and what type of training is required. Users advised the audit
team that they require specific courses aimed at data entry, reconciliation, and reporting, as well
as courses offered at different levels—basic for new users and advanced for those who have
some experience using the SMS. We found that the reconciliation process between actual year-
to-date and calculated salary expenses is not well understood. Moreover, the provision of
training to staff located in LSUs and ROs requires specific attention. These staff cannot readily
come to HQ to receive training. We found that training is locally provided in the two ROs we
visited. However, trainers in ROs require training and monitoring by HQ and should be provided
with appropriate training aids.

Training sessions on the SMS were available before March 2008 but were suspended when the
trainers left the Systems Section. Training was restarted in November 2008 with mixed results.
The training covered primarily data entry and the preparation of SMS reports, and since
November 2008, only six users have received this training. Of these, only two stated that the
training was sufficient. The training presentation contained erroneous information. For example,
it indicated that budgets are updated in the SMS when in fact they are updated in the IFMS and
copied to the SMS. We were told that different training modules would be prepared in the near
future. In the meantime, there is no training on reconciliation and responsibilities.


                                                11
Internal Audit Branch




Most of the staff we interviewed requested more frequent training. Many users have not received
any training; they have learned from colleagues or by trial and error. These users have not been
informed of best practices or the most efficient ways to use the SMS. For example, most users
did not know that the default menu for selecting reports does not contain all reports, and that
more reports are available on another menu.

Recommendation and Management Response

6.       It is recommended that the Chief Financial Officer ensure that a strategy for training
         users is developed and that training is improved and provided more frequently.

         Agree. As part of the SFT project rollout, a massive training exercise will be delivered
         based on a proven training strategy used by other departments that have gone through this
         implementation. A training consultant has been engaged to assist in the delivery of the
         training phase, which will commence in June 2010. Regarding user training on a continuing
         basis after the July 1, 2010 SFT implementation, the CFOB Strategic Plan for the
         upcoming three to five years recently identified the need for a training strategy to deal with
         financial matters with a focus on priorities (of which SFT is one) and areas of need, and
         with pre-determined timelines. Ongoing SFT training will be incorporated into this overall
         CFOB training strategy.

2.5         Communicating

Communications with users need improvement.

We interviewed users on the extent of information that the Systems Section provides with respect
to the SMS. We were told that the Systems Section has sent a few e-mail messages that provided
information on year-end processes, SMS downtime, and system issues with respect to the
separation of the PPSC. Users we interviewed did not recall receiving any other directives
concerning the SMS. We were also told that the Systems Section has visited user groups. We
found that users do not know the Finance Branch’s data integrity expectations for the SMS. As a
result, users maintain data integrity of the SMS as they see fit. We also found that the Systems
Section has not sufficiently solicited user input on user requirements in relation to the SMS. In
our opinion, Systems Section staff should periodically contact SMS user representatives to solicit
feedback on issues and share information on the SMS (e.g. on features and functions, issues,
procedures, and data integrity expectations).

The Systems Section has not established a forum for discussion of SMS issues with user
representatives. A User Group of Financial Systems was established in 2002 but none of the
                                                   12
                                                                                       Salary Management System
                                                                        2. Observations – Management Framework



users interviewed could recall whether any of its activities pertained to the SMS. Users we
interviewed also did not recall receiving information on the SMS at conferences or in working
groups. In our opinion, there is a need for regular group discussions with SMS users on such
issues as system problems, user requirements, opportunities for improvement, best practices,
status of problem resolutions, and plans for system changes. The discussion could take the form
of a teleconference dedicated to the SMS or a session dedicated to the SMS as part of a larger
administrators’ conference.

We examined the Finance Intranet site and determined that more information on the SMS is
required. The Finance site refers to interfaces between the SMS and the IFMS and includes a
training schedule for the IFMS/SMS with a brief description of the SMS course. The SMS User
Manual is not posted on the site, nor is there any description of SMS processes or
responsibilities.

Recommendation and Management Response

7.     It is recommended that the Chief Financial Officer ensure that:

       a)     group discussions involving the Systems Section and user representatives are
              conducted regularly and that Systems Section staff periodically contact SMS
              user representatives;
       b)     users are kept informed of plans for changes to the SMS, best practices, and
              requirements from the Chief Financial Officer Branch;
       c)     information on the SMS is improved on the Finance Intranet site.

       Agree. A communication strategy will be developed not only for the initial introduction
       of the new SFT on July 1, 2010 but also to address continued information sharing with
       the user community.

       As part of the project plan for SFT, the Systems Section has established a working group
       consisting of Business and Finance Directors, Financial Management Advisors, and SMS
       users to review and validate existing processes including the reporting requirements. It is
       also an opportunity to realize and inform the community that this new module is a
       standardized application that was developed based on requirements gathered by an
       interdepartmental working group.

       As part of the SFT project, the Systems Section will maximize the use of the Intranet site
       to communicate plans, processes, roles and responsibilities, and various updates.


                                               13
Internal Audit Branch




2.6         Previous SMS Reviews

There is no follow-up on the recommendations relating to SMS identified in the
Documentation of Information Technology General Controls and Application
Controls report, a 2007 review of financial systems controls.

The Documentation of Information Technology General Controls and Application Controls
report, June 26, 2007, contains several recommendations to improve the SMS. Systems Section
staff we interviewed did not recall the SMS recommendations in the report. We found that
several recommendations in the report were not implemented, such as those regarding
deficiencies in:

•           passwords
•           document controls
•           established IT reporting and monitoring by administrators
•           established functional reporting and monitoring by administrators
•           policies and procedures for end-users

In this report we have included recommendations for resolving some of the issues mentioned in
the Documentation of IT General Controls and Application Controls report (e.g. passwords,
document controls, and policies and procedures for end-users).

Recommendation and Management Response

8.          It is recommended that the Chief Financial Officer ensure that there is a formal
            follow-up review of the issues relating to SMS identified in the Documentation of
            Information Technology General Controls and Application Controls report, June
            2007.

            Agree. The observations highlighted in the June 2007 report will be reviewed for
            applicability and addressed during the July 1, 2010 SFT implementation.




                                                   14
                                    3.      USE OF SMS

3.1    Overall Process

Overall the SMS appropriately supports salary management.

The SMS application software provides the necessary functions to support salary management in
the Department of Justice. Below we provide a summary of some aspects of the SMS. Further
details on the system’s processes are found in Appendix B.

The SMS is complex because of its interfaces with other systems and the need to record pertinent
employee and assignment information that determines salary expenses. The SMS contains actual
and calculated year-to-date salary expenses. Actual year-to-date salary expenses are updated with
the pay records received from the PWGSC’s Regional Pay System. The calculated year-to-date
salary expenses are derived from data contained in the SMS.

SMS information is used to prepare the FSRs used by responsibility centre managers.
Furthermore, the Aboriginal Affairs and Tax Law portfolios use the SMS reports to invoice
clients to recover salary costs based on staff utilization by their clients.

Administrators initiate staffing actions and update the SMS at various times. PWGSC prepares
salary payments according to data entered by HR into the PWGSC’s Regional Pay System. The
Systems Section updates SMS tables used for both data entry in the SMS and for calculation of
salary forecasts. These include financial codes, employee classification, and salaries.

In our opinion, overall the SMS appropriately supports the salary management function.

There are some issues with the special processes for entering data in the SMS at
year-end.

Users must use special processes for entering data in the SMS at year-end. At all times, users can
view all the information in the SMS for which they are responsible, including information from
prior years. However, they can enter data only for the current year. In March users can enter data
                                               15
Internal Audit Branch




for both the current year and the next year. On April 1, it is no longer possible to enter data for
the prior year. Users advised the audit team of a number of issues with the year-end process:

•           The SMS sometimes drops certain assignments. Therefore, some administrators take the
            time to check all assignments with end dates in the new year.
•           Saved reports are not carried forward to the new year.
•           Access to the current year and the next year are required earlier than March so that data
            for the next year can be updated immediately.
•           Assignments for temporary staff with an end date of March 31 are not carried forward to
            the new year, even though administrators know the staff will remain in place. Some
            administrators use the April 1 end date to avoid this problem and change the end date
            later.
•           Vacant positions with end dates of March 31 are not rolled over to the new year even
            though the positions continue to exist.
•           Comments that can be entered against assignments are not carried forward to the next
            year.
•           Some administrators make the forecast for the next year on spreadsheets, usually based
            on a count of all positions, because it is too much work to correct all the assignments in
            the SMS.

Recommendation and Management Response

9.          It is recommended that the Chief Financial Officer ensure that issues related to the
            special processes for entering data in the SMS at year-end are reviewed and
            addressed as required.

            Agree. Documentation has been distributed to inform users regarding the 2009-10 fiscal
            year-end issues with SMS. As well, future fiscal year ends will be addressed as part of the
            documentation and training provided with the July 1, 2010 implementation of SFT.

3.2         User Satisfaction

The SMS does not meet the requirements of all users.

Administrators are the main users of the SMS. Some administrators have a relatively low number
of employees who have few assignment changes. Other administrators are responsible for a large
number of employees or the employees’ assignments require frequent changes. We found that


                                                    16
                                                                                   Salary Management System
                                                                                              3. Use of SMS



administrators differ in their degree of knowledge of the SMS and their knowledge is often
insufficient.

User satisfaction with the SMS varies. Frequent users of the SMS told the audit team that the
system requires improvement. They indicated that the system needs to be more efficient and
have a faster system response time. They also stated that entering a complete transaction takes
too many steps using multiple windows. Users located in the British Columbia RO told the audit
team that the SMS is always slow in the afternoon (Pacific Time). Users also identified a number
of other issues with the system and indicated improvements that they would like implemented
(e.g. more extensive use of order numbers, keystroke shortcuts, some visual indicator of
comments on assignments). These issues and suggested improvements are set out in detail in
Appendix C.

Users can produce reports at any time. Users can select SMS reports from a menu and specify
report options, such as which cost centres to include and which columns to display. The reports
can be printed or exported to Excel. Users can save a report profile so that they can later recreate
the same report. We found that the reports provide the required information, but some users
requested improved report formats and more flexibility. See Appendix C for details.

The system has a Scenario feature that allows users to modify a copy of their data to analyze the
results of different planning assumptions. Some users use the Scenario feature from December
until February when planning for the next year. Other users indicated that although they would
like to use the Scenario feature, the Systems Section has instructed them not to use scenarios. We
found that some users have no knowledge of scenarios or do not use them because SMS data
inaccuracies limit their usefulness. We were told that when SMS data is fairly accurate, using the
Scenario feature is better and easier than using Excel to test planning assumptions. In our view,
more training is needed on this feature. Some users have been granted access to this feature by
the Systems Section.

We found that six LSUs in the Citizenship, Immigration and Public Safety Portfolio (CIPSP) do
not have access to the SMS, while two others, plus those in the Tax Law Portfolio, have access.
For those that do not have access, it is a complex and time-consuming process to update the
SMS. The LSU administrators must send documents containing staff changes to a central
administrator who does all the data entry for the Portfolio. The central administrator then
exchanges reports and messages with the LSU administrators to reconcile the SMS.




                                                17
Internal Audit Branch




Recommendation and Management Response

10.         It is recommended that the Chief Financial Officer ensure that:

            a)          the response speed of the SMS is monitored and improved where warranted;
            b)          noted SMS issues are investigated and resolved where warranted;
            c)          new user requirements are considered and met where cost-effective;
            d)          reports are improved where cost-effective;
            e)          scenarios are made available to users where required;
            f)          LSUs are provided access to the SMS when required.

            Agree. The Department’s move to SFT on July 1, 2010 will consider these components.
            The implementation team will work with the user community to consider user
            requirements and reporting needs, and identify improvements where cost effective and
            within established business standards and controls. On an ongoing basis after
            implementation, SFT issues will be investigated and resolved where warranted.
            Accordingly, we anticipate that user satisfaction will increase with SFT.

            We are confident that users are satisfied with the system response times and performance
            of the current IFMS, and because SFT will be part of IFMS, we expect user satisfaction
            with system response speed to improve.

            The scenario feature used by a limited audience was one of the causes of system
            performance issues. This is one of the reasons why the scenario feature was not
            promoted, as it would have brought the system response speed down even further.

            As we understand it, the issue related to LSUs not having access to SMS results from
            security access constraints within those host organizations. We are hoping that, by using
            IFMS as the main application for the use of SFT, access will be simplified and less
            laborious. This will be tested as part of the technical rollout of SFT.

3.3         Data Integrity

There are appropriate source records for updating the SMS.

Responsibility centre managers initiate the process for updating the SMS by adding or revising
positions and staffing actions. Approval of these changes involves Human Resources.
Administrators keep records of source documents used to update positions and staffing actions.
In our opinion, source records for updating the SMS are appropriate.
                                                    18
                                                                                  Salary Management System
                                                                                             3. Use of SMS




There is a need to define and implement minimum requirements for data entry and
reconciliation to ensure the accuracy of SMS data.

Administrators do regular reconciliations of the actual year-to-date salary amount to the
calculated year-to-date salary amount according to employee data in the SMS. In performing
these reconciliations, different administrators conduct different checks of the SMS data. For
example, those administrators with responsibilities for a whole portfolio/sector/region may
compare the number of employees to the FTEs and the number of employees on strength; they
may review the number of employees by division and level; or they may challenge increases in
utilization. Most administrators we interviewed reconcile the salary amounts only at the global
level and make changes to employee data only until the total difference between the actual and
calculated year-to-date salary amount is small. They do not go through all the detailed employee
data (e.g. assignments, leave, bonuses, start and end dates) to make the necessary corrections to
ensure that individual differences at the employee level are accurate. There is no requirement
that errors in these details be corrected unless they significantly affect the overall totals. As a
result, the reconciliation process contributes to an accurate overall total, but it does not
sufficiently correct the SMS so that the forecast will be accurate.

Different administrators perform the reconciliations using different reports. Report 17
“Expenditures Reconciliation” and Report 14 “Overlap and Gap by Position”, which list
differences at the employee and position level respectively, are used by only a few
administrators. Most administrators use other reports to reconcile, or information is adjusted
when preparing the FSR. Our tests showed that both Report 14 and Report 17 allow easy
identification of differences.

Administrators rarely reconcile the Positions Report from the SMS to the organization charts.
More reconciliation of positions’ information is required to improve the accuracy of SMS data.

Because of staff shortages, not all administrators update the SMS on a timely basis and not all
reconcile monthly. It is our view that the reconciliation between the actual and calculated year-
to-date salary expenses should be performed monthly.

In our opinion, timely data entry and detailed reconciliation are two of the key requirements for
improving the accuracy of SMS data.




                                                19
Internal Audit Branch




Recommendation and Management Response

11.         It is recommended that the Chief Financial Officer ensure that minimum
            requirements for data entry and reconciliation are defined and implemented.

            Agree. Salary information represents a significant portion of the Department’s operating
            resources; therefore, it is critical to ensure their effective management. Standard
            procedures and practices as well as enhanced monitoring derived from the July 1, 2010
            implementation of SFT will assist in these aspects. The Department will also capitalize
            on the financial management advisory function to assist with ensuring the accuracy of the
            financial information incorporated within our financial systems. The implementation of
            the SFT, the engagement of staff (finance, administration, and management), an
            appropriate level of resources, effective documentation and guidelines, and greater
            communication of departmental standards to end-users will all contribute to increased
            data integrity.

There is a need for administrators to always enter global costs in the SMS.

Administrators can enter global costs in the SMS for estimated expenses against a cost centre
that is not related to employee assignments. Global cost entries can be made to forecasted costs
such as overtime, performance pay, bonuses, senior management parking, and back pay. These
are usually made at the beginning of the fiscal year and can be updated as required. This data is
only used in the SMS for forecasting and not for updating the IFMS actuals. We found that not
all administrators enter global costs. Incomplete global costs affect the accuracy of SMS reports.

Recommendation and Management Response

12.         It is recommended that the Chief Financial Officer ensure that all administrators
            enter global costs in the SMS.

            Agree. Communications through a variety of means, such as the Financial Situation
            Report call letter, convey to administrators the need to ensure salary forecast information
            is updated and reviewed, including the need to enter global costs. One of the
            responsibilities of the financial management advisory (FMA) function is to monitor and
            challenge financial information, including salaries and associated costs. The creation of
            the FMA function as part of the CFO model, along with the implementation of the SFT,
            will provide the opportunity for improvement and greater diligence over the next fiscal
            year.

                                                    20
                                                                                                       Salary Management System
                                                                                                                  3. Use of SMS



Salary forecast information is reviewed and updated when the departmental
financial forecast is prepared.

As an additional control, the Resource Management Division reviews the amounts in the FSRs
sent from the portfolios/sectors/regions and may challenge some salary forecasts if these
amounts appear incorrect. This is an indirect review of SMS data. Staff in the Division use data
on salary expense trends to review the current forecast. Based on their experience staff are able
to judge whether the forecasts are too high. In September of each year, they reduce the forecast
for newly hired employees by 25 percent. Staff reconciling the SMS to PeopleSoft for 2007/08
found that the difference in total FTEs for the Department for a completed year was small. In our
opinion, the review conducted by the Resource Management Division is necessary for improving
the departmental salary forecast. However, the risk of an inaccurate forecast would be decreased
if SMS data were more accurate.

There is appropriate reconciliation of salary expenses to control salary expense
totals.

On a bi-weekly basis, the Corporate Accounting Operations Section of the Policy, Systems and
Corporate Accounting Division reconciles the actual salary expenses posted to the IFMS to
equivalent totals received from the Receiver General. The totals reconcile except for minor
errors, which are held in a suspense account 1 and are quickly corrected. At the time of the audit,
only approximately four items were in the suspense account for each main pay process. The
suspense items include invalid PRIs and cost centres, which can be due to errors or timing
differences between the updating of the IFMS and the SMS. The reconciliation performed by the
Corporate Accounting Operations Section is appropriate.

3.4      User Support

User support provided by the Systems Section requires improvement.

Users who need assistance with the SMS can contact the IMB Help Centre or a member of the
Systems Section via the IFMS Help Desk or directly. The IMB Help Centre resolves most issues
related to the departmental IT infrastructure. Issues related to SMS functionality or application
software are forwarded to the Systems Section.



1
  In accountancy, a suspense account is an account used temporarily to record doubtful transactions or discrepancies pending
their analysis and resolution.
                                                            21
Internal Audit Branch




As we explained earlier, the Systems Section’s capacity to provide appropriate user support has
suffered because of staff shortages and turnover. Most users told us that they would ask for help
from the Systems Section only if the SMS stopped working entirely, because the Systems
Section lacks the experience and expertise to provide the required assistance. Furthermore,
representatives of the western regional offices we interviewed indicated that because of time
zone differences there is no one available in the Systems Section to assist them during the
afternoon.

The IFMS Help Desk has a formal tracking system but the Systems Section does not. User
requests need to be tracked to ensure that all requests are addressed. We found that only one
employee is assigned to answer user calls or e-mails. The Systems Section needs to establish a
procedure so that more than one employee can perform this task.

Those users we interviewed in headquarters told us that they received appropriate help for
departmental IT infrastructure issues from the IFMS Help Desk.

Recommendation and Management Response

13.         It is recommended that the Chief Financial Officer ensure that user support in the
            Systems Section is improved.

            Agree. Following the staff turnover, we recruited a financial officer to perform the
            support function. Furthermore, we retained the services of the company owning the rights
            to our SMS application to provide knowledge transfer and training to the team lead and
            financial officer. As we are now moving towards the replacement of SMS with the new
            SFT module, we are also implementing a new change management tool, “Solution
            Manager”, which will introduce functionality for issue tracking, resolution, and reporting.
            This new process is scheduled to be in place by June 2010. User support will also be
            improved as addressed as part of our response to recommendations 1 and 4.

3.5         SMS and IFMS Interfaces

There is an appropriate process to interface the Regional Pay System, the SMS,
and the IFMS for salary data, but records need improvement.




                                                    22
                                                                                   Salary Management System
                                                                                              3. Use of SMS



There is verification at each step of the systems interface:

•      There are separate control totals for each file obtained from the Regional Pay System.
       These totals are appropriately reconciled before and after using the data to update the
       records in the SMS.
•      Data is validated (must match assignments by PRI), and required corrections or changes
       are made in accordance with predetermined rules before the data is used to update the
       IFMS. The SMS assigns the financial codes to the pay records to update the IFMS.
•      There are appropriate controls for obtaining data from the IFMS to update the budgets
       and the actual salary expenses in the SMS.

There are records of the various steps in the interfaces described above and of changes made to
pay records containing errors. The records are kept in various documents and computer files. In
our opinion, the records need to be supplemented with a summary of the actions taken for each
update or data transfer. A second individual or supervisor needs to review the summary records
of each data transfer to decrease the risk of errors.

There are separate interfaces to extract the list of valid financial codes and relevant JVs from the
IFMS and to use them to update the SMS. Users mentioned that the update of the JVs was not
prompt (the expected time is within a week). However, we were told by the Systems Section that
cost centre tables in the SMS are now updated each day. The Systems Section is in the process of
automating the scheduling of interfaces.

The various automated interfaces appear to have no automated audit trail. Finance has requested
that the supplier provide information on the audit trail for the interfaces.

Recommendation and Management Response

14.    It is recommended that the Chief Financial Officer ensure that records and audit
       trails of the interface processes are improved.

       Agree. With the July 1, 2010 SFT implementation, standard reports and audit trails in
       IFMS/SAP will be available for the interface process. Data will be interfaced directly
       from the Regional Pay System through the SFT utility to post expenditures in IFMS.




                                                 23
              4.      TECHNICAL AND INTEGRATION ASPECTS

4.1   SMS Architecture

Improved integration of data between systems is required.

While the SMS is the only system that records salary forecast, we noted and received comments
that there is duplication of data between the IFMS, the SMS, iCase, and PeopleSoft. For
example:

•      financial codes and PRIs are recorded in the four systems;
•      position, employee, and salary data are entered in both the SMS and PeopleSoft;
•      staffing actions are entered in both the SMS and PeopleSoft;
•      salary costs and budgets are recorded in the SMS and the IFMS.

These systems have three different owners, different users, and different requirements for the
timing of data entry. Analyzing these four systems is beyond the scope of this audit. Nonetheless,
future system selection or design should aim to integrate data between systems more effectively.

Recommendation and Management Response

15.    It is recommended that the Chief Financial Officer work with system owners and
       the CIO to consider improving integration of data between the four systems.

       Agree. Between October 2007 and June 2008, the Financial Systems Authority of the
       Office of the Comptroller General established the Control Framework for Human
       Resources/Finance Interactions project to improve horizontal linkages and controls
       between Human Resources (HR) and Finance to support the accuracy, reliability, and
       relevance of shared compensation and financial management data and processes. The
       project focused on identifying common HR/Finance processes, data, and authoritative
       sources. The determination of the roles and responsibilities of key functional owners and
       stakeholders involved in pay-related functions was a critical component of the analysis,
       which led to the creation of a Pay Administration Control Framework tool.
                                               25
Internal Audit Branch




         The Systems Section will use the deliverables of this project to improve the accuracy and
         quality of employee transactions and management reporting by working with our IM/IT
         Branch along with the HR organization to minimize the duplication of effort in maintaining
         required data for efficient Salary Management Reporting.

         We will also rely on direction from the Chief Information Officer Branch at Treasury
         Board Secretariat which will use the deliverables of this project as inputs to the service-
         oriented architecture initiatives between corporate, administrative, financial, and HR
         systems.

         As part of an integrated project strategy that addresses the upgrade of IFMS and iCase as
         well as Information Management technology and processes, the CFOB and Law Practice
         Management Directorate are currently working together in minimizing any duplication of
         data between IFMS and iCase.

         It should also be noted that, with the implementation of SFT on July 1, 2010, the number of
         systems will be reduced from four to three, as SFT is an integrated system within IFMS.

4.2         Information Technology Security

Required security documents have been prepared, but recommendations have not
yet been implemented.

A Threat and Risk Assessment (TRA) and a Certification and Accreditation (C&A) were
prepared in 2006 as required by the Treasury Board Government Security Policy. The
recommendations included in the documents regarding transaction tracking and history have not
been implemented. These documents were approved and the SMS was accredited for operation
until December 2007. A new TRA and C&A should be prepared.

Recommendation and Management Response

16.         It is recommended that the Chief Financial Officer request that the CIO prepare a
            new TRA and C&A.

            Agree. A new TRA and C&A will be prepared as part of the implementation of SFT on
            July 1, 2010.

User accounts provide appropriate segregation of duties.

                                                  26
                                                                                  Salary Management System
                                                                          4. Technical and Integration Aspects



Only the Systems Section can set up user accounts. This represents an appropriate control. The
Systems Section has started to periodically review the list of user accounts in order to delete
unnecessary ones or to make required changes.

The Systems Section has access to all data. Other users can only view data for employees under
their area of administration, and data entry rights are only given to authorized administrators.
Other staff members who need to work with the data can only view it or produce reports. These
are appropriate controls.

The SMS password needs stricter controls.

We noted that the SMS password does not meet industry standards and should be reviewed when
the new TRA and C&A are prepared. The password is entered after a user has gained access to
the departmental network, but there is no requirement for the user to change the password. The
length of the password need only be three characters (which is too short); it is not required to
contain a complex mix of characters (a strong password); and temporary passwords do not have
to be changed. Also, after three failed attempts to sign on, the user account is not locked or
inactivated. These issues should be addressed as part of the new TRA and C&A.

An appropriate process was followed in deciding on the need for a Business
Continuity Plan.

The Information Management Branch - National Capital Region - Business Continuity Plan,
October, 2007 documents the SMS as a non-critical system. Non-critical systems are not
considered essential to the ongoing operations of the Department and the fulfilment of its
mandated responsibilities. Therefore, there is no specific Business Continuity Plan for the SMS.
In case of a disaster affecting the SMS operation, it would be restored once normal operations
had been resumed by the Department, unless otherwise directed by the Emergency Measures
Committee.

The SMS audit trail of record changes needs improvement.

The SMS keeps track of the last date a record was modified by a user and their user ID.
However, the system does not record changes made by other persons or a history of who
modified the record.




                                              27
Internal Audit Branch




Recommendation and Management Response

17.         It is recommended that the Chief Financial Officer ensure that the audit trail of
            record changes is improved.

            Agree. With the replacement of SMS by SFT on July 1, 2010, a full audit trail of changes
            made to SFT records will be available.

4.3      SMS Stability and Maintenance

The SMS has a stable operation.

The SMS is rarely down. An error occurred in October 2008 that caused users to believe that the
system was frozen, when in fact it was taking a long time to run reports. The error was resolved.
An additional SMS software program has been running periodically so that this error will not
reoccur.

The Systems Section is in the process of implementing automatic overnight runs of certain
computer jobs, such as table updates and interfaces. This should improve system response time
during the day.

Enhancements and upgrades have been suspended.

We were told that the Policy, Systems and Corporate Accounting Division is considering
changing to a salary management system other than the SMS, and has therefore suspended
upgrades and enhancements to the SMS. We were also told that software problems that cause the
SMS to malfunction will be resolved. The last major change to the SMS was the separation of
the PPSC and the Department of Justice into two separate databases. The Department currently
uses Version 4 of the SMS. The upgrade to Version 6, which would be an extra cost, has been
suspended. In our view, this is a reasonable approach.

Testing of SMS version implementations is not documented.

We found no records of testing of SMS version implementations. Such documentation is
important because it permits a review of what was tested and serves as a reference when trying to
resolve new technical problems. The information is also useful when considering how to test
new versions of the current or new system.


                                                   28
                                                                                  Salary Management System
                                                                          4. Technical and Integration Aspects



SMS technical documentation could not be found.

The staff of the Systems Section told us that they have been unable to find technical
documentation on the SMS. This documentation would provide explanations of the software
design and serve as a reference for IMB and the Systems Section to better understand the system
and to avoid or resolve technical problems. The SMS is a COTS system. COTS systems usually
provide purchasers with technical documentation.

Recommendation and Management Response

18.    It is recommended that the Chief Financial Officer ensure that the missing SMS
       technical documentation is obtained.

       Agree. With the implementation of SFT on July 1, 2010, technical documentation will be
       obtained.




                                              29
 5.     OBSERVATIONS, RECOMMENDATIONS, AND MANAGEMENT
                         RESPONSES

Responsibilities for managing and supporting the SMS and ensuring that the
system is used appropriately need to be more clearly defined and understood.

1.    It is recommended that the Chief Financial Officer ensure that: ................................6



      a)         responsibilities for managing and supporting the SMS and ensuring that the
                 system is used appropriately are defined and documented;
      b)         the Finance Branch increase its monitoring of SMS use by users and of the
                 accuracy of SMS data.

      Agree. The Chief Financial Officer Branch (CFOB), through the SFT project, will better
      define its leadership role and ensure that roles and responsibilities are well defined and
      documented for the Finance divisions, business units, and administrators. Monitoring and
      ongoing support functions associated with the maintenance and quality of data being
      captured will also be defined and developed. These will be reviewed and addressed as
      part of the SFT project, which is scheduled for implementation on July 1, 2010.

There is a need to consider assigning responsibility for non-technical activities of
a routine nature to a group other than the Systems Section.

2.    It is recommended that the Chief Financial Officer consider assigning responsibility
      for non-technical activities of a routine nature to a section other than the Systems
      Section. ...............................................................................................................................7

      Agree. Salary Management non-technical activities of a routine nature will be assigned
      to Corporate Accounting as part of the revised process to be adopted with the
      implementation of the new Salary Forecasting Tool within IFMS. Non-Technical


                                                                  31
Internal Audit Branch




            activities are defined as reconciliation of control accounts, clearing of suspense accounts
            through correction facility programs assigning outstanding postings to correct accounts.

            Technical activities will comprise of ongoing interfaces (file transfers) between Receiver
            General and our Departmental Financial System, IFMS and will continue to be
            administered through our Financial Systems Division.

More reports that will assist in monitoring and analyzing the usage and technical
performance of the system are required.

3.          It is recommended that the Chief Financial Officer ensure that SMS reports on
            monitoring the usage and technical performance of the system are produced. ..........8

            Agree. With the implementation of SFT on July 1, 2010, reports on monitoring the usage
            and technical performance of the system will be available as standard reports from SAP.

There is a need to provide the Systems Section with a stable complement of
qualified personnel to support the SMS.

4.          It is recommended that the Chief Financial Officer ensure that the Systems Section
            is provided with a stable complement of qualified personnel to support the SMS. ....9

            Agree. A request has been submitted through the departmental footprint exercise for one
            resource in Corporate Accounting and Reporting. The SFT project team has two
            resources from the Systems Section who will be responsible for the ongoing maintenance
            and support of SFT after the July 1, 2010 implementation. Since the SFT module is built
            within the IFMS environment, we will also be able to benefit from the expertise and
            support of the IFMS Program Office and the IFMS shared systems community.

Administrators’ use of SMS varies.

There is appropriate IT support.

Written procedures are required and system documentation needs improvement.

5.          It is recommended that the Chief Financial Officer ensure that: ..............................11


                                                      32
                                                                                                                   Salary Management System
                                                                                  5. Observations, Recommendations and Management Responses



     a)         written procedures on standard business processes are developed and local
                procedures are shared, as appropriate;
     b)         system documentation is improved.

     Agree. A set of standardized business processes and procedures will be developed and
     communicated as part of the July 1, 2010 SFT implementation. These will also address
     the roles and responsibilities of the users involved in the data capture and maintenance of
     various assignments relating to salary management detail events. The SFT
     implementation will also provide the opportunity to ensure systems documentation is
     updated.

There is a need to develop a training strategy and provide improved and more
frequent training.

6.   It is recommended that the Chief Financial Officer ensure that a strategy for
     training users is developed and that training is improved and provided more
     frequently. ........................................................................................................................12

     Agree. As part of the SFT project rollout, a massive training exercise will be delivered
     based on a proven training strategy used by other departments that have gone through this
     implementation. A training consultant has been engaged to assist in the delivery of the
     training phase, which will commence in June 2010. Regarding user training on a
     continuing basis after the July 1, 2010 SFT implementation, the CFOB Strategic Plan for
     the upcoming three to five years recently identified the need for a training strategy to deal
     with financial matters with a focus on priorities (of which SFT is one) and areas of need,
     and with pre-determined timelines. Ongoing SFT training will be incorporated into this
     overall CFOB training strategy.

Communications with users need improvement.

7.   It is recommended that the Chief Financial Officer ensure that: ..............................13

     a)         group discussions involving the Systems Section and user representatives are
                conducted regularly and that Systems Section staff periodically contact SMS
                user representatives;
     b)         users are kept informed of plans for changes to the SMS, best practices, and
                requirements from the Finance Branch;
     c)         information on the SMS is improved on the Finance Intranet site.

                                                                33
Internal Audit Branch




            Agree. A communication strategy will be developed not only for the initial introduction
            of the new SFT on July 1, 2010 but also to address continued information sharing with
            the user community.

            As part of the project plan for SFT, the Systems Section has established a working group
            consisting of Business and Finance Directors, Financial Management Advisors, and SMS
            users to review and validate existing processes including the reporting requirements. It is
            also an opportunity to realize and inform the community that this new module is a
            standardized application that was developed based on requirements gathered by an
            interdepartmental working group.

            As part of the SFT project, the Systems Section will maximize the use of the Intranet site
            to communicate plans, processes, roles and responsibilities, and various updates.

There is no follow-up on the recommendations relating to SMS identified in the
Documentation of Information Technology General Controls and Application
Controls report, a 2007 review of financial systems controls.

8.          It is recommended that the Chief Financial Officer ensure that there is a formal
            follow-up review of the issues relating to SMS identified in the Documentation of
            Information Technology General Controls and Application Controls Report, June
            2007. ..................................................................................................................................14

            Agree. The observations highlighted in the June 2007 report will be reviewed for
            applicability and addressed during the July 1, 2010 SFT implementation.

Overall the SMS appropriately supports salary management.

There are some issues with the special processes for entering data in the SMS at
year-end.

9.          It is recommended that the Chief Financial Officer ensure that issues related to the
            special processes for entering data in the SMS at year-end are reviewed and
            addressed as required. ....................................................................................................16




                                                                         34
                                                                                              Salary Management System
                                                             5. Observations, Recommendations and Management Responses



      Agree. Documentation has been distributed to inform users regarding the 2009-10 fiscal
      year-end issues with SMS. As well, future fiscal year ends will be addressed as part of the
      documentation and training provided with the July 1, 2010 implementation of SFT.

The SMS does not meet the requirements of all users.

10.   It is recommended that the Chief Financial Officer ensure that: ..............................18

      a)     the response speed of SMS is monitored and improved where warranted;
      b)     noted SMS issues are investigated and resolved where warranted;
      c)     new user requirements are considered and met where cost-effective;
      d)     reports are improved where cost-effective;
      e)     scenarios are made available to users where required;
      f)     LSUs are provided access to the SMS when required.

      Agree. The Department’s move to SFT on July 1, 2010 will consider these components.
      The implementation team will work with the user community to consider user
      requirements and reporting needs, and identify improvements where cost effective and
      within established business standards and controls. On an ongoing basis after
      implementation, SFT issues will be investigated and resolved where warranted.
      Accordingly, we anticipate that user satisfaction will increase with SFT.

      We are confident that users are satisfied with the system response times and performance
      of the current IFMS, and because SFT will be part of IFMS, we expect user satisfaction
      with system response speed to improve.

      The scenario feature used by a limited audience was one of the causes of system
      performance issues. This is one of the reasons why the scenario feature was not promoted
      as it would have brought the system response speed down even further.

      As we understand it, the issue related to LSUs not having access to SMS results from
      security access constraints within those host organizations. We are hoping that, by using
      IFMS as the main application for the use of SFT, access will be simplified and less
      laborious. This will be tested as part of the technical rollout of SFT.

There are appropriate source records for updating the SMS.



                                                35
Internal Audit Branch




There is a need to define and implement minimum requirements for data entry and
reconciliation to ensure the accuracy of SMS data.

11.         It is recommended that the Chief Financial Officer ensure that minimum
            requirements for data entry and reconciliation are defined and implemented. .......20

            Agree. Salary information represents a significant portion of the Department’s operating
            resources; therefore, it is critical to ensure their effective management. Standard
            procedures and practices as well as enhanced monitoring derived from the July 1, 2010
            implementation of SFT will assist in these aspects. The Department will also capitalize
            on the financial management advisory function to assist with ensuring the accuracy of the
            financial information incorporated within our financial systems. The implementation of
            the SFT, the engagement of staff (finance, administration, and management), an
            appropriate level of resources, effective documentation and guidelines, and greater
            communication of departmental standards to end-users will all contribute to increased
            data integrity.

There is a need for administrators to always enter global costs in the SMS.

12.         It is recommended that the Chief Financial Officer ensure that all administrators
            enter global costs in the SMS. ........................................................................................20

            Agree. Communications through a variety of means, such as the Financial Situation
            Report call letter, convey to administrators the need to ensure salary forecast information
            is updated and reviewed, including the need to enter global costs. One of the
            responsibilities of the financial management advisory (FMA) function is to monitor and
            challenge financial information, including salaries and associated costs. The creation of
            the FMA function as part of the CFO model, along with the implementation of the SFT,
            will provide the opportunity for improvement and greater diligence over the next fiscal
            year.

Salary forecast information is reviewed and updated when the departmental
financial forecast is prepared.

There is appropriate reconciliation of salary expenses to control salary expense
totals.

User support provided by the Systems Section requires improvement.
                                                                 36
                                                                                                            Salary Management System
                                                                           5. Observations, Recommendations and Management Responses




13.   It is recommended that the Chief Financial Officer ensure that user support in the
      Systems Section is improved. .........................................................................................22

      Agree. Following the staff turnover, we recruited a financial officer to perform the
      support function. Furthermore, we retained the services of the company owning the rights
      to our SMS application to provide knowledge transfer and training to the team lead and
      financial officer. As we are now moving towards the replacement of SMS with the new
      SFT module, we are also implementing a new change management tool, “Solution
      Manager”, which will introduce functionality for issue tracking, resolution, and reporting.
      This new process is scheduled to be in place by June 2010. User support will also be
      improved as addressed as part of our response to recommendations 1 and 4.

There is an appropriate process to interface the Regional Pay System, the SMS,
and the IFMS for salary data, but records need improvement.

14.   It is recommended that the Chief Financial Officer ensure that records and audit
      trails of the interface processes are improved. .............................................................23

      Agree. With the July 1, 2010 SFT implementation, standard reports and audit trails in
      IFMS/SAP will be available for the interface process. Data will be interfaced directly
      from the Regional Pay System through the SFT utility to post expenditures in IFMS.

Improved integration of data between systems is required.

15.   It is recommended that the Chief Financial Officer work with system owners and
      the CIO to consider improving integration of data between the four systems. .........25

      Agree. Between October 2007 and June 2008, the Financial Systems Authority of the
      Office of the Comptroller General established the Control Framework for Human
      Resources/Finance Interactions project to improve horizontal linkages and controls
      between Human Resources (HR) and Finance to support the accuracy, reliability, and
      relevance of shared compensation and financial management data and processes. The
      project focused on identifying common HR/Finance processes, data, and authoritative
      sources. The determination of the roles and responsibilities of key functional owners and
      stakeholders involved in pay-related functions was a critical component of the analysis,
      which led to the creation of a Pay Administration Control Framework tool.



                                                           37
Internal Audit Branch




            The Systems Section will use the deliverables of this project to improve the accuracy and
            quality of employee transactions and management reporting by working with our IM/IT
            Branch along with the HR organization to minimize the duplication of effort in
            maintaining required data for efficient Salary Management Reporting.

            We will also rely on direction from the Chief Information Officer Branch at Treasury
            Board Secretariat which will use the deliverables of this project as inputs to the service-
            oriented architecture initiatives between corporate, administrative, financial, and HR
            systems.

            As part of an integrated project strategy that addresses the upgrade of IFMS and iCase as
            well as Information Management technology and processes, the CFOB and Law Practice
            Management Directorate are currently working together in minimizing any duplication of
            data between IFMS and iCase.

            It should also be noted that, with the implementation of SFT on July 1, 2010, the number
            of systems will be reduced from four to three, as SFT is an integrated system within
            IFMS.

Required security documents have been prepared, but recommendations have not
yet been implemented.

16.         It is recommended that the Chief Financial Officer request that the CIO prepare a
            new TRA and C&A. ........................................................................................................26

            Agree. A new TRA and C&A will be prepared as part of the implementation of SFT on
            July 1, 2010.

User accounts provide appropriate segregation of duties.

The SMS password needs stricter controls.

An appropriate process was followed in deciding on the need for a Business
Continuity Plan.

The SMS audit trail of record changes needs improvement.


                                                                  38
                                                                                                             Salary Management System
                                                                            5. Observations, Recommendations and Management Responses



17.   It is recommended that the Chief Financial Officer ensure that the audit trail of
      record changes is improved. ...........................................................................................28

      Agree. With the replacement of SMS by SFT on July 1, 2010, a full audit trail of changes
      made to SFT records will be available.

The SMS has a stable operation.

Enhancements and upgrades have been suspended.

Testing of SMS version implementations is not documented.

SMS technical documentation could not be found.

18.   It is recommended that the Chief Financial Officer ensure that the missing SMS
      technical documentation is obtained. ............................................................................29

      Agree. With the implementation of SFT on July 1, 2010, technical documentation will be
      obtained.




                                                           39
                         APPENDIX A – METHODOLOGY


The audit methodology consisted of:

•      an analysis of the management control framework in place using a risk-based approach
       related to key elements of the framework;
•      a review, analysis, and discussion with stakeholders of processes pertinent to the
       operation of the Salary Management System;
•      interviews with management and staff in the Financial Management and Resource
       Management divisions of the Finance Branch, and the Business Support, Applications
       and Services Division, Information Management Branch;
•      interviews with users of the system in headquarters; Prairies Region and British
       Columbia regional offices; and Canada Revenue Agency and Citizenship, Immigration
       and Public Safety Portfolio LSUs.
•      a review, analysis, and testing of the processes regarding system data integrity;
•      a review of documentation including responsibilities, procedures, SMS web site, work
       plans, and management reports;
•      a review and analysis of functional and technical support for users;
•      a review and analysis of security measures for safeguarding information;
•      a review and analysis of the extent to which user requirements and training needs are met.

The audit was undertaken in a manner consistent with the Treasury Board Policy on Internal
Audit and related guidelines and procedures, and with generally accepted auditing standards.




                                              41
                            APPENDIX B – SMS PROCESS


SMS reports are used by departmental staff to prepare salary expense forecasts. Calculating an
accurate full-year forecast for an employee requires detailed assignment information for that
employee for that fiscal year. An assignment is the link between an employee and a position. An
employee may have a number of different assignments (there are 243 types) that can affect salary
expenses and forecasts. In the SMS, assignment records contain detailed information on an
employee’s status, such as full-time and part-time, as well as classification changes, leave, and
secondments. An employee may also work for more than one cost centre. The records of an
employee’s assignments are used to split costs among different cost centres for departmental cost
accounting or for billing clients.

The SMS contains actual and calculated year-to-date salary expenses. Actual salary expenses to
date are updated with the actual pay records originally received from the PWGSC’s Regional
Pay System. They are also updated with the amounts resulting from direct updates made to the
IFMS using journal vouchers (JVs). Calculated expenses to date are calculated by the SMS based
on the information relating to assignments and other information from SMS records.

The forecasted salary expense reports produced by the SMS are based on employee assignments
and other data. For example, the forecast includes current and planned changes to assignments
and dates of changes. In addition, the SMS calculates a monthly salary cost for each employee to
account for the differences between the dates of the monthly financial reports and the date of the
last salary payment to the employee. Salaries are paid every second Wednesday.

The salary expenses and forecast reports are inputs to the FSRs used by responsibility centre
managers. The FSRs are reviewed in each portfolio/sector/region before they are submitted to
senior management. The FSRs are also sent to the Resource Management Division according to
established deadlines, where a departmental report is produced on expenses, forecasts, and
budgets.

Administrators initiate staffing actions and update the SMS at various times. Sometimes the SMS
is updated when information is received from HR on the status of staffing actions and letters of

                                               43
Internal Audit Branch




offer. Other administrators update the SMS as they send information to HR or obtain it from
other sources.

PWGSC prepares salary payments according to data entered by HR into the PWGSC’s Regional
Pay System. The Systems Section regularly obtains electronic files of salary data from PWGSC.
Although the principal pay period is every two weeks, there are three or four small
supplementary pay files for each principal pay period. The data is processed by the SMS in order
to assign financial codes based on the SMS employee assignment records and is then used to
update the IFMS. Pay that does not apply to assignment records is posted to global cost centres
in the SMS.

JVs are used to make corrections in the IFMS and account for special entries such as paid
overtime, retroactive pay, and bonuses. A software program regularly collects the new JVs from
the IFMS and posts the revised totals in the SMS actual amounts, so that both the IFMS and the
SMS contain the same actual totals.

The Systems Section updates tables used for data entry in the SMS and for calculation of costs.
These include financial codes, employee classification, and salaries.




                                              44
             APPENDIX C – USER ISSUES AND REQUIREMENTS


Some of the issues with the SMS that users noted include the following:

•      Only the person who created a position or assignment can delete it, which is a problem if
       the person leaves.
•      None of the users interviewed knew how to use the preferences menu. A few complained
       that they could view only 25 lines on lists appearing in the window and therefore were
       required to use multiple steps to locate a record when there were more than 25 lines.
       They were not aware that the number of lines displayed in the window can be set in the
       preferences menu.
•      When a secondment is assigned to another organizational unit, the pay reverts to the
       original unit for one or two random pay periods in the IFMS but not in the SMS. This
       problem has to be resolved with a JV.
•      When an employee is transferred, the receiving unit can create a new assignment and
       change the end date on the previous assignment in the original unit. The administrator of
       the original unit loses control of the data for updating the resulting vacant position. The
       receiving unit has the option of rejecting the change made by the system to the record of
       the old unit, but this is not always done.
•      The view of assignments by position does not list assignments in chronological order.
•      There is a reporting error. If a person is transferred to a different portfolio, the person
       erroneously appears in two places in the original section. The data shows correctly on the
       SMS screens but not on the SMS reports.

In our interviews, users requested the following new requirements:

•      the addition of program activity, which is part of the IFMS financial codes, to
       assignments;
•      more extensive use of order numbers to be able to compile time for special projects such
       as inquiries (Users commented that the difficulty with this is that more assignments
       records could be required. Many staff may work on a project, but a large portion of them

                                               45
Internal Audit Branch




            would only work on it for a short time. Currently this cost accounting is done using JVs,
            but only for a few projects.);
•           the flexibility to differentiate managers from legal practitioners who are cost-recoverable;
•           keystroke shortcuts for more efficient data entry to minimize user hand movements from
            the keyboard to the mouse;
•           a visual sign to indicate that there are comments on an assignment;
•           a method to accurately reflect departmental organization, even in the case of assignments
            splitting FTEs to accommodate billing. (Staff in the Resource Management Division told
            us that they encounter difficulties in using the SMS because the SMS does not accurately
            reflect the departmental organization in this situation. There are SMS reports by position
            that should reflect the organization, but often administrators do not enter vacant
            positions.)

Some users noted the following issues with SMS reports:

•           Some reports do not present data as required, and data users spend excessive time
            manipulating data in spreadsheets. Users would like the ability to select data elements
            and the sequence of records. Several reports present the information for one record in
            multiple lines, which is difficult to work with. For example, Report 6 “Expenditures and
            Forecast” shows information on three lines.
•           The report selection criteria need improvement. For example, users must select each
            position classification, and if one is omitted, the report is incorrect. It is not possible to
            select all LA classifications in one action.
•           The forecast does not make an allowance for attrition (unscheduled staff departures).




                                                     46

				
DOCUMENT INFO