ADMINISTRATIVE REPORT

Date: March 9, 1998

Author/Local:S. Kuzmick 7220

CC File No. 1372

TO:	Vancouver City Council
FROM:	Director of Operations Support, Corporate Services
SUBJECT:	Design and Management of Control Processes - SAP Software

---

RECOMMENDATION

THAT Council approve the establishment of a regular-full time position to be responsible for control design and management, subject to job evaluation by the Director of Human Resource Services, at an estimated annual cost of $75,000; with funds to be provided from within the existing departmental operating budget.

GENERAL MANAGER'S COMMENTS

The General Manager of Corporate Services RECOMMENDS approval of the foregoing recommendation.

COUNCIL POLICY

Establishment of regular full-time position requires approval from Council.

BACKGROUND

As part of the 1994 - 1996 Budget Management Program, Council approved the elimination of six staff positions in the Internal Audit Division. The Internal Audit function was to continue on a scaled down basis with operating departments assuming adequate internal control procedures over their financial operations. Work programs were re-focused to conduct special investigations, handle certain day-to-day policy and procedure issues, and provide direction and assistance to departments on control issues related to their financial systems.

On February 20, 1997, Council approved the adjustments to the 1997 Operating Budget to compensate for the reduction in funding transferred from the Provincial Government. The remaining small core of Internal Audit staff was eliminated. Funding was set aside to engage the External Auditors to expand their scope in critical areas, with the remaining net funding retained for consultant services to deal with specific issues and reviews.

It was understood that the re-engineering work coming out from the Better City Government program, along with the selection and implementation of new financial software packages, coupled with contemporary risk management techniques would change the landscape on the methodology employed by the City to manage control activities. Therefore, it was determined that it was in the City’s best interest to wait until a clearer picture of the City’s direction on system work has emerged before taking on the next step to deal with the control issues. Now that the implementation of the new systems is underway, the requirements for dealing with this issue have become clear. A full time position is required to ensure that an adequate framework of controls has been designed into the new systems, and also to ensure that these controls are in operation. This role would have been performed as a part of the internal audit function in the past, but the new position required should not be confused with internal audit, as the role will be focused on design and maintenance of control frameworks and processes.

DISCUSSION

After 18 months of intensive work by staff to evaluate a number of software packages, City Council, on September 9, 1997, approved a project for the purchase and implementation of a new financial and HR/Payroll system under the partnership of SAP Canada with Ernst and Young Consulting. The first phase of the project, the delivery of the blue print and other related documents, was completed on time and on budget in late January 1998. The project team has started on the second phase of the project which includes prototyping, configuration, and testing of the SAP package for implementation at the start of 1999. This work includes setting up control systems and procedures.

This project is vastly different from a traditional information system project. SAP is the system of choice for the City. Phase I of the project deals implementing the foundation of the package: financial and HR/Payroll. Staff is currently exploring the use of SAP to replace or integrate other corporate systems such as the Fleet and Facility Management Systems in Engineering and Park Board, the Property Management System in Corporate Services and the Event Business Management System in Civic Theaters in the next phase. It is envisioned that when the package is implemented to its fullest extent in the City, most of the decision making and data collection processes will rest with the staff at the operation level. Duplication in processes and systems will be eliminated, and service to the public and internal management will improve.

The introduction of corporate wide systems of this size will also bring along risks which are not covered by the traditional financial audit. Risks with the integrity of the business systems, security of the SAP software package and the information infrastructure structure supporting the systems have to be managed in a different way. Because the new systems are fully integrated, the control framework also is a unified structure that spans all business processes. For this reason, it is not possible to manage this framework with ad hoc external support, or by relying on individual business units operating in isolation.

As a part of the implementation of the new financial systems, there will be control assurance review to deal with applications that are significant to the City to ensure that the applications meet business purposes and have an adequate control framework. However, this review process only captures one point in time while there is a need for ongoing management of the control systems to ensure they are well designed, in place and operating properly. As additional processes are subsequently developed in the new financial software there will be a need to provide ongoing design and evaluation of controls, as well as an ongoing need to educate staff and to check on the health of the overall control framework. Further, this cannot be done on a casual ad hoc basis, as in depth knowledge of both City business processes, and the SAP software product are required.

ALTERNATIVES/OPTIONS

There are three options to deal with the on-going need to support ongoing internal control design and management:

A. Use of consultant on an ad hoc basis with no city staff involvement, as is the current model. With the current City systems, and while the City is in transition, this is a reasonable solution, but with the new SAP systems, it is an expensive proposition and relies on the availability of the consultants in a competitive market. Furthermore, proper design and review would require extensive knowledge of the SAP product, City business processes, and specific designs of processes within the SAP system. It is highly unlikely that an outside consultant could provide this service efficiently. Because of the high costs, and limitations described above, this is not a recommended approach.

B. Establish a team of City staff to undertake this process. At this time there is no desire to resurrect the internal audit function. Furthermore, with the rapidly changing information technology , it will be extremely difficult and expensive to keep a team of staff trained to keep abreast of the changes to enable them function effectively. Inevitably, the City would wind up with a group of staff with out of date skills, or not enough work to do. Clearly, this is not a recommended solution.

C. Use of a combination of external consultant services managed and supplemented by one regular full-time city staff position with expertise in control design and management. The establishment of one additional regular full time position will offer the opportunity for proper knowledge transfer during the design and implementation phase of the SAP project, and a single point of reference to deal with control design and review. As is current practice, additional external resources would be brought in as required for audit purposes or special reviews. This single focus for internal control issues will provide much better assurance that the City has an effective control framework in place. This alternative is recommended by staff.

PERSONNEL IMPLICATIONS

Approval by Council of this report will involve the establishment of one additional regular full time exempt position.

FINANCIAL IMPLICATIONS

With the final elimination of the Internal Audit Division in 1997, a net saving of $104,000 was left to fund additional external audit procedures that were previously provided by internal audit, and to fund ad hoc investigations, design and evaluation, and other control related initiatives. It was always understood that eliminating the internal audit group would require a new framework for designing, maintaining and managing internal control within the City. Now that the new financial systems are in implementation, the needs in this area have become clear. Funding for the new position, estimated to be $75,000, will be funded from the remaining internal audit funding without addition cost to the operating budget. The balance of this funding will still be needed for ad hoc reviews, forensic investigations, additional year end work for external audit purposes and other related work left behind when the Internal Audit group was eliminated.

IMPLEMENTATION PLAN

The program will be undertaken as soon as the position has been classified and filled.

CONCLUSION

With the elimination of the Internal Audit Division in 1997, the City currently has no staff dedicated to manage internal control issues. The need for such on-going management has become very apparent during the first phase of the SAP project, and is critical to ensure the integrity of the business processes, and manage control risk. The use of external consultant services to serve this purpose has been effective during transition from old systems to new, but now that the control needs are more clearly defined, it is recommended that the most efficient and effective way to satisfy this need is through a regular full-time position funded from within departmental budget.

* * * * *

(c) 1998 City of Vancouver