MEMORANDUM
TO: James M. Eagen III
Chief Administrative Officer
FROM: Steven A. McNamara
Inspector General
DATE: July 24, 2001
SUBJECT: The House Procurement Desktop System Is
Effective And Users Are
Generally
Satisfied (Report No. 01-CAO-03)
This is our final report on the review of the Office of Procurement’s Procurement Desktop System (PD). The objective of this audit was to evaluate the effectiveness of PD in meeting the purchasing needs of the House. We focused on the (1) effectiveness of management and internal controls in PD, (2) accuracy, completeness, reliability, and timeliness of data created, processed, and reported by PD, and (3) adequacy of current system performance and availability of PD, including identifying system improvements and future enhancements.
In this report, we found that PD operations were effective in meeting the purchasing needs of the House and that PD users were satisfied. Based on the results of our audit work, we found that management and internal controls (e.g., standards, policies, and procedures; problem management; and information security management) were adequate. However, we noted that operational controls could be strengthened through segregating duties associated with the Oracle database administration and AIX operating system functions. Also, based on the results of our satisfaction questionnaire of PD users, we found that respondents were generally satisfied with PD. The report addressed potential opportunities for improving PD users’ satisfaction with the PD system.
In
response to our May 1, 2001, draft report, your office concurred with our
findings and recommendations. The May
14, 2001, management response is incorporated in this final report and included
in its entirety as an appendix. The corrective
actions taken and planned by your office are appropriate and, when fully
implemented, should adequately respond to the recommendations. Further, the milestone dates provided for
implementing corrective actions appear reasonable.
We appreciate the courtesy and cooperation extended to us by your staff. If you have any questions or require additional information regarding this report, please call Chris Hendricks or me at (202) 226-1250.
cc: Speaker of the House
Majority Leader of the House
Minority Leader of the House
Chairman, Committee on House Administration
Ranking Minority Member, Committee on House Administration
Members, Committee on
House Administration
The House Procurement Desktop System
Is Effective And Users Are Generally Satisfied
I. INTRODUCTION
Summary Of Findings
The results of the Procurement Desktop System
(PD) audit showed that PD operations were effective in meeting the purchasing
needs of the House and users were satisfied.
Based on the results of our audit work, we found that management and
internal controls (e.g., standards, policies, and procedures; problem
management; and information security management) were adequate. However, we found that operational controls
can be strengthened through segregating duties associated with the Oracle
database administration and AIX operating system functions. Additionally, based on the results of our
satisfaction questionnaire of PD users, we found that respondents were
generally satisfied with PD.
Nevertheless, PD users identified opportunities for potentially
improving the usefulness of PD.
During our audit, management initiated corrective actions and plans to further improve controls associated with the Oracle database administration and AIX operating system functions. Management further acknowledged the PD user-identified suggestions, and has taken and planned actions to implement some suggestions. One such suggestion was to include batch approval, printing and archival functions. Management indicated that other suggestions would be explored and implemented, if feasible.
Background
The PD system is used by the House to purchase
goods and services for Members, Committees, and House Officers. There were 209 users at the House at the
time of our audit.[1] PD automates the entire purchase order
process from creation, data entry, review, approval, and reporting. PD is a commercial-off-the-shelf (COTS)
software package, licensed from American Management Systems, Inc.
In
mid-1998, the House implemented PD in the Chief Administrative Officer’s
(CAO’s) Office of Procurement (OP) and House Information Resources
(HIR). The system has since been rolled
out in the remaining CAO offices (e.g.,
Human Resources, Finance, Media and Support Services, and the Immediate Office
of the CAO). PD has also been
implemented in other House offices (e.g., OIG, Sergeant at Arms (SAA), Law
Revision Counsel, and General Counsel) and in the Office of the Attending
Physician. Implementation has also begun in the Office of the Clerk.
The
PD system incorporates several components.
The end user interactive component is a client-server purchasing
software application, written in the Powerbuilder library environment. This application resides on each end user’s PC and is compiled.[2] In the same directory is a proprietary
mainframe interface program named “CoreConnect.” The application uses a resident Oracle client to communicate with
a central data repository hosted in an Oracle Relational Data Base Management
System (RDBMS) located on a Unix server.
PD is not an electronic ledger system. Rather, data generated by the application is captured in approximately 200 discrete data tables. The application posts obligation, vendor update and receipts data to, and reads data from (but does not capture), the Federal Financial System (FFS) using the CoreConnect program.[3] FFS is the House’s centralized accounting and disbursement system. PD users have no other direct access to FFS, and the data interaction is transparent to the PD users. PD is also configured to provide pertinent asset information (e.g., purchase and receipt) via an Oracle view interface to the Fixed Asset Inventory Management System (FAIMS), now in a test phase prior to actual operations. FAIMS is scheduled for implementation in FY 2001.
In July 2000, accrual accounting was implemented in PD and the offices
began using PD for recording receipt of goods and services and posting to
FFS. OP plans to begin implementing PD
contracting features, such as Vendor Performance Monitoring by May 2001,
followed by PD functions supporting contract solicitation and management
sometime in the future.
Functional
support and technical operations of PD are the responsibility of a staff of
five within OP, collectively known as the PD Team. All five work with both the technical and functional tasks
required to keep House purchasing transaction processes running smoothly, and
to maintain and operate the automated procurement system. The major functional tasks, listed in order
of heaviest time demands, include (1) end user support for transactional
issues, including document modifications, immediate “help” to enter or complete
transactions; (2) application-level system administration, establishing
and managing electronic document routes, adding and disabling end users’
access, and clearing or restoring damaged electronic documents; (3) training
end users, both in classroom format and at the end user’s individual location;
(4) maintenance of vendor records; (5) planning and budgeting for PD operations
and implementation of new enhancements and version upgrades; and (6) working
with process participants through the PD users group and directly with CAO
managers to improve processes.
Technical tasks of the PD Team include (1) active management of the Oracle database to ensure speed and reliability; (2) active management of the PD, Oracle, and CoreConnect clients, specifically with regard to desktop configuration and compatibility with other desktop applications; (3) Advanced Interactive Executive (AIX) system operation and backup of the PD Oracle database and AIX operating system files; (4) development of technical specifications for PD application customizations and enhancements; (5) testing of PD releases, upgrades and enhancements; (6) Oracle and AIX version upgrades; (7) support for the FAIMS data interface views, including testing; and (8) management of the PD updater folder and executables maintained on the HIR App Server.
Objective,
Scope, and Methodology
The audit objective was to evaluate the effectiveness of PD in meeting the purchasing needs of the House. Specifically, we assessed the (1) effectiveness of management and internal controls in PD, (2) accuracy, completeness, reliability, and timeliness of data created, processed, and reported by PD, and (3) adequacy of current system performance and availability of PD, including identifying system improvements and future enhancements.
The audit scope focused on the administration and operation of PD within the CAO and other House offices, where the desktop application was implemented. Our scope did not include gathering feedback from Member and Committee offices regarding PD operation since the PD application has not been implemented in the Members and Committee offices.[4] The audit work did not address operating system security or network security controls. Work in the operating system security area is being addressed in an upcoming OIG Non-Windows NT audit report. Audit results from two network security control reviews are addressed in two prior OIG Audit Reports: (1) Report No. 00-CAO-06, entitled Backbone Ubiquitous Data Network (BUDnet) Controls Were Generally Effective, dated November 27, 2000 and (2) Report No. 99-CAO-08, entitled Additional Security Controls Needed Over The House's High Speed Legislative Branch Network (CAPNet) Connection, dated October 8, 1999. Field work was conducted from early November 2000 to mid‑January 2001. The audit coverage included system-related activities associated with the 105th and 106th Congresses.
We conducted our audit in accordance with Government Auditing Standards, issued by the Comptroller General of the United States as implemented by the OIG Policies and Procedures Manual. To gather and verify data, we interviewed key personnel, reviewed PD-related policies and procedures, and reviewed other relevant documents. We performed appropriate tests of various processes and procedures, including PD automated processes and controls, and administered a customer satisfaction questionnaire for selected PD users. In addition, we applied applicable information systems audit guidelines used in the Federal government and private industry in evaluating system and internal controls.
Internal Controls
We evaluated the effectiveness of management’s internal controls over the PD system. Specifically, we assessed the adequacy of PD input, processing, and output controls to determine the accuracy, completeness, reliability, and timeliness of data created, processed, and reported by PD. While management internal controls were generally adequate, we identified an internal control weakness involving segregation of duties. This weakness is described in the “Audit Results” section of this report.
Prior Audit Coverage
The OIG has previously issued two reports containing PD-related issues. The first audit, The House Is Ready To Implement Procurement Desktop In House Information Resources (Report No. 98-CAO-09, dated July 20, 1998) addressed the status of critical system implementation and application tasks and agreed that the system was ready for operational deployment. The report also made two recommendations for maintaining user confidence and trust in the system, and adhering to the House’s System Development Life Cycle policy for subsequent rollouts and system enhancements. The CAO agreed with the findings and recommendations and both recommendations have since been implemented and closed.
The second audit, entitled Significant Improvements In The Management
And Operations Of The Office Of The Chief Administrative Officer (Report
No. 98-CAO-19, dated December 16, 1998) acknowledged that the CAO had initiated
significant improvements in the management and operations of his offices during
the 105th Congress. The
report also identified additional financial management, information technology,
and procurement operation weaknesses needing improvement. In particular, the procurement weakness
involved the continued use of a paper-driven system to support procurement of
goods and services in the Offices of the SAA, the Clerk, and other House
offices. The report contained a
recommendation to extend PD to the Office of the SAA, Office of the Clerk, and
other House offices as soon as practical.
The CAO agreed with the finding and recommendation and the
recommendation has been closed. The
actions taken for completing the implementation of this recommendation are
detailed in the Exhibit of this report.
II. AUDIT RESULTS
The results of the PD system audit showed
that PD operations were effective in meeting the purchasing needs of the House
and users were satisfied. Based on the
results of our audit work, we found that management and internal controls
(e.g., standards, policies, and procedures; problem management; and
information security management) were adequate. However, we found that operational controls can be strengthened
through segregating duties associated with the Oracle database administration
and AIX operating system functions.
Also, opportunities may exist to improve PD users’ satisfaction with
various PD system attributes (see Section III, Other Matter).
Finding: PD System
Management And Operations Can Be Further Strengthened
The assignment of both PD database administration and AIX systems administration duties to the Procurement Automation Director are incompatible functions, which creates a conflict in segregation of duties within OP. Specifically, the Director is the primary PD Database Administrator responsible for (1) establishing Oracle access rights to PD, (2) performing database upgrades in the PD production environment, and (3) applying database corrections. This same individual is also the primary AIX Systems Administrator responsible for (1) administrating server security, 2) performing AIX server upgrades and applying server software patches, and (3) initiating server start up and shut down procedures. These incompatible duties increase the risk of unauthorized access to, and/or mismanagement of, important House procurement data and/or programs without leaving an audit trail.
In April 1997, after experiencing difficulties with PD server operations, OP and HIR agreed to transfer PD server administration responsibilities to OP. This action allowed OP to procure contractor services and training support for server administration and operations. Thus, this transfer prompted the Procurement Automation Director to take on systems administration responsibilities (e.g., server operations and maintenance).
According to the Director of HIR Information Management, HIR is responsible for providing system administration services on most CAO application and database production servers. Support functions currently provided by HIR to PD include network management, communication linkages, PD and FFS end user installations, and operation of the HIR Appserver through which the PD updater works. Presently, HIR does not have sufficient, fully trained human resources to provide all the necessary technical support for PD. For PD, the Procurement Automation Director continues to perform the AIX systems administration tasks (i.e., backups, AIX upgrades, and patches). HIR is developing the human resources to provide system administration support on the PD production servers in the near future.
Risks inherent with combining system and database administration responsibilities include the ability to assign powerful rights and privileges to others in the AIX or database environment. Administration of both the Oracle database and the AIX operating system by the same person increases the data security/protection risk to the Oracle data files stored in the central Oracle database. While there are audit trail logs in operation on the server to record actions by the “root” user and by the Oracle database administrator, the rights held by the AIX system administrator allow him the capability to delete both the RDBMS data files and the system level audit trail logs.
Without appropriately segregating the duties of the Procurement Automation Director, one individual has the capability to control all key aspects of PD data, program, and system operations, which could result in compromising the system security controls. The Information Systems Audit and Control Foundation’s CobiT: Control Objectives for Information and Related Technology provides best practices for ensuring that roles are designated with consideration to appropriate segregation of duties so that no one individual can control key aspects of data and operations. Best practices normally provides for segregation of duties between operations and data control, and operations and information security. Therefore, operations (operating the server) and systems administration (upgrading operating system software) responsibilities are typically segregated.
In addition, the Procurement Automation Director’s system administration role reduces his availability to perform management duties, such as (a) managing continued deployment/ implementation of PD contracts functionality, (b) overseeing and controlling projects, (c) managing the specification for and delivery of software customizations and enhancements, (d) directing technical support contractors, and (e) managing his staff to maintain PD end user support.
Need To Transfer Server Responsibility. During this audit, we learned that a working group comprised of PD and HIR staff prepared the Procurement Desktop Working Group Final Report, dated June 14, 2000. This report addressed the need to define appropriate divisions of labor over PD system support functions and identified the functions currently supported by HIR. The report specifically addressed a Conceptual Model for managing and administering COTS database applications and identified functional divisions for providing both system and non-system PD support. It further identified three additional support functions that could be “…transferred, or in some cases, shared with HIR operating units...”. However, we believe the transfer of support functions cannot occur without a service-level agreement between OP and HIR and the execution of such an agreement. The agreement should define the support to be provided, expected timeliness, and proficiency standards. The additional support functions planned for transfer include:
·
PD
personal computer client setup,
·
Server
hardware and AIX operating systems support and maintenance, and
·
Backup
support for Oracle.
Among the three proposed functions, transferring the server hardware and AIX operating systems support and maintenance and backup support for Oracle to HIR will provide adequate segregation of duties. While the report provides a good starting point for transferring selected PD operational tasks to HIR, the responsibilities involving server upgrades should also be transferred to HIR. Although no internal service-level agreement has been approved to date, a draft agreement has been prepared and is being reviewed.
Recommendation
We recommend that the Chief Administrative Officer prepare an internal service-level agreement and timeline to effectively segregate conflicting duties related to the administrative operations of PD within OP. At a minimum, this agreement should include PD system-related tasks/activities, including backup personnel support, for AIX systems administration (e.g., server security, upgrades, and operations).
Management Response
On May 14, 2001, the CAO concurred with this finding
and the associated recommendation
(see
Appendix). According to the response,
HIR and OP executed the recommended service-level agreement to effectively
segregate conflicting duties related to the administrative operations of PD on
May 7, 2001. The response further
stated that the agreement, which includes PD system-related tasks/activities,
including backup personnel support for AIX systems administration, will be
fully implemented no later than 120 days from the date of its execution.
Office of Inspector General Comments
The actions taken and planned for implementing the recommendation are responsive to the issues we identified and, when fully implemented, should satisfy the intent of the recommendation. Further, the milestone date for completing the actions remaining appears reasonable.
III. Other Matter
Opportunities Exist To Improve PD Users’
Satisfaction
During our review, we developed a user satisfaction questionnaire to evaluate the level of satisfaction with PD and solicit suggestions for potential system improvements and enhancements to better serve the House. The results of our questionnaire showed that respondents within the Office of the CAO were generally satisfied with PD. Users were generally satisfied with PD availability, accuracy, completeness, and timeliness. Additionally, several users (both CAO and non-CAO users) identified potential PD improvements, such as system performance and Help Desk support, as well as suggested potential PD enhancements, such as notification or confirmation of completed actions.
We conducted interviews with PD users by means of the user satisfaction questionnaire. Thirty-five PD users (or 19.7 percent) were selected and interviewed from a total of 178 active PD users. User selection took into consideration the number of PD users in each office. For example, in an office with 20 active PD users, we surveyed 3 users, whereas, in an office with 2 active PD users, we only interviewed 1 user. Of the 35 users[5] we interviewed, users indicated their level of proficiency, ranging from beginner to advanced, with PD. We noted that 77 percent of the users rated themselves either intermediate or advanced in proficiency. These users also indicated their level of use with PD, ranging from infrequent to frequent. Almost half (46 percent) of them use PD frequently. The skill and use levels of PD indicated by users are depicted in Figure 1 and Figure 2, respectively.
Figure 1.
Respondents Proficiency Level With PD
Figure 2.
Respondents Use Frequency With PD
PD Users Are Generally Satisfied
Figure 3 illustrates users’ satisfaction with PD meeting expectations. Of the 35 respondents, 17 (48.6
percent) indicated that they were either Very Satisfied or Satisfied with PD
and
Figure 3. User Satisfaction With PD
11 (31.4 percent) were Neutral. Six (17.1 percent) indicated that they were either Dissatisfied or Very Dissatisfied with PD. One respondent provided a “Not Applicable” answer, because the user had an atypical PD function, which was limited to administering FFS/PD interface security for users in the office.
Of the 35 respondents interviewed, 31 were from within the CAO offices and 4 were from non-CAO offices. Of the 31 CAO respondents, ratings ranged from very satisfied to very dissatisfied. Of the four non-CAO office respondents, one was Satisfied, one was Neutral, one was Dissatisfied, and one was Very Dissatisfied with PD meeting procurement system expectations.
User Satisfaction With Key
Attributes Of PD
Figure 4 depicts high ratings for key system attributes, such as availability, accuracy, completeness, and timeliness for PD. While the ratings for the four attributes did not deviate significantly, system availability and completeness of information received slightly higher ratings from respondents (88.6 and 80 percent, respectively).
Figure 4. User Satisfaction With Key Attributes Of PD
Users Identified Potential Improvements For PD
Based on our survey results, respondents indicated interest in a variety of PD improvements to simplify their purchasing duties. The Table below lists the desired improvements based on the respondents interviewed. The most requested changes desired in PD included (1) improved speed and efficiency, (2) improved PD Help Desk response time, (3) improved user-oriented reports, (4) additional data entry automation (e.g., drop-down menu for budget object codes), (5) clear or simplified error messages, and (6) additional training, including follow-up training, and updated PD User’s Manuals.
|
Desired Improvements |
Number
of Respondents |
|
Improved
speed/efficiency overall |
12 |
|
Improved PD Help Desk response time |
6 |
|
Improved user-oriented reports |
5 |
|
More automated entry/pull-down menus (e.g.,
Budget Object Codes) on the desktop application |
4 |
|
User-friendly error messages |
3 |
|
More PD user training, updated manuals, and
follow-up training |
3 |
|
More varied quantity selections for goods
(e.g., by the case and by the sheet) |
1 |
|
Increased user availability at night (i.e.,
after 8:00 pm) |
1 |
Table.
Desired Improvements to PD
Although respondents were generally satisfied with various attributes of PD, respondents indicated that they have experienced operational problems, such as system performance, routing glitches, indecipherable errors, and difficulties in interfacing with FFS, which prompted suggestions for improvements. The most prominent problem noted by respondents was the slow performance of the system when executing tasks, such as using the search function and opening “cabinets” in PD. Other respondents stated that moving items, such as receivers to an “outbox”, and processing items was time-consuming in PD. Slow system performance may be attributed to a variety of reasons, such as the capabilities and configuration of the user’s desktop computers, speed of connection to FFS required for obligations and data verification, and other PD application operation misperceptions. In any event, the performance delay has prompted respondents to devise alternate methods for storing and retrieving files in PD or outside of PD in order to find and access files more quickly.
Another problem cited involved a routing problem (or bug), where PD would not time/date stamp envelopes routed for approval, causing the envelope to be sent back to the sender’s inbox. Three respondents cited problems associated with unclear error messages; one of these users stated that error messages slow down the procurement process. Four respondents mentioned problems in interfacing with FFS or connecting to the mainframe. While respondents indicated that a workaround was devised to resolve the routing problem and the slowness in opening cabinets, the other operational difficulties--which may be inherent in the current version of PD--have yet to be resolved. On the other hand, more than half the respondents cited no operational difficulties with PD.
Respondents
also were generally satisfied with the quality (i.e., functional and technical
support) of the responses received from the PD Help Desk staff, which is
supported by the PD Team within OP.
However, they indicated experience with slow PD Help Desk response to
user inquiries or problems.
Users
Suggested Enhancements to PD
In addition to expressing a desire for improvements in the existing system, respondents suggested enhancements (i.e., features or capabilities requiring changes to software application), which are not currently in PD. Enhancements are application system changes that provide additional functionality, features, and/or capabilities that are not available in the current version of the application. Suggested enhancements included:
· Notification or confirmation of completed actions,
· Ability to see line items in aggregate (i.e., not in separate screens),
· Ad hoc report functionality,
· Notification for user to take action,
· Single data repository,
· Batch approval function,
· Notification of payment,
· Capability to process multiple receivers,
· Batch printing function,
· Ability to delete partially approved but cancelled PO’s, and
· Archival function.
Implementing one or more of these suggestions may improve existing user satisfaction or increase PD usage within the House. Often upgrades can offer enhancements without requiring software customization or modification, thereby minimizing costs.
According to OP, several of the desired improvements/enhancements are underway. For example, improved user-oriented reports are pending delivery from AMS to be potentially available during May 2001. Further, OP plans to add additional automated entry/pull-down menus desired by users to improve user convenience with reports criteria selection. However, which pull-down menus are added, and when, is governed by funds available for technical enhancements, as well as CAO guidance as to which enhancements are priorities.
Conclusion
House users are satisfied with using PD for procuring goods and services. Nevertheless, PD users see opportunities for improving the system or adding new features to PD. Additional improvements as well as research on the specific suggestions may result in cost-effective solutions for improving the usefulness of PD for House users.
Management Response
On May 14, 2001, the CAO acknowledged the issues identified and the associated suggestions (see Appendix). According to the response, OP has or plans to implement some suggestions, such as the batch approval function, and the batch printing and archival functions. The response further stated that efforts have begun to improve PD Help Desk response time. Further, management indicated that user desire for improved response speed will be addressed by moving the production database in June 2001 to a newly configured RISC server that has much better performance capabilities. The response cited that HIR’s new minimum PC configuration standards will also assist in increasing PD end user performance satisfaction by prompting replacement of old PCs with higher performance and faster PCs. The CAT5 communications upgrade project will improve the efficiency of the House network.
Additionally, the response
recognized several user suggested items for improving satisfaction levels and
indicated that customization of the PD system would be required. It further stated that the CAO is currently
engaged in a project to replace the House financial system, a factor that may
impact the desirability and timing of expending funds for additional
enhancements to the inter-related House acquisition system. Nevertheless, management stated that
increasing
customer satisfaction
remains a vital part of the CAO vision and the feasibility of implementing the
remaining suggested improvements and enhancements cited in our report would be
fully explored.
Office of Inspector General Comments
The actions taken and
planned for implementing the suggestion are responsive to the issues we identified
and, when fully implemented, should satisfy the intent of the
recommendation. Further, the milestone
date for completing planned actions appears reasonable.
