Report Transmittal Memorandum

All critical tasks for the Procurement Desktop (PD) implementation in the U.S. House of Representatives’ (House) Information Resources (HIR) have been completed, and the system is ready for operational deployment. There are additional tasks, however, that are not fully complete and must be completed as soon as possible. Without the completion of the remaining tasks, PD’s operational deployment in HIR may not meet users’ expectations and the implementation project could lose its creditability. These tasks are not complete because the PD Implementation Team has concentrated on completing tasks critical to having PD operational as soon as possible.

Additionally, continued strong planning and management is needed for subsequent deployment of PD to other House offices. To do this properly, the House System Development Life Cycle (SDLC) policy should continue to be followed. Using this methodology will provide an orderly and structured approach to implement PD in other House offices, meeting users’ needs in a more timely and cost-effective manner.

PD, a Windows-based client-server purchasing software application, is intended to be used initially by HIR to purchase goods and services. PD automates the entire purchase order process, from creation, data entry, and policy review through approval and authorizing signature. The House Office of Procurement and Purchasing (OPP) will be involved in the operational rollout of PD.

PD is an off-the-shelf software package that is owned and maintained by American Management Systems, Inc. (AMS). PD is not an electronic ledger system, but provides an electronic gateway into the Federal Financial System (FFS). PD resides on an ORACLE database and communicates with FFS as needed to post obligations and vendor information.

Our objective was to ensure that critical tasks were prioritized, in compliance with House SDLC policy, and implemented prior to going live with the new system. Specifically, we reviewed, analyzed, evaluated, and provided advice on various aspects of the House’s implementation of PD in HIR. In addition, we worked closely with the PD Implementation Team to help ensure that the PD implementation followed proper practices, and was adequately completed prior to going live as HIR’s primary procurement system. We provided detailed review and advice in the following areas:

• Project management infrastructure and activities.

• Implementation and transaction testing of PD.

• Documentation of user procedures.

• Development of training for users.

• Implementation and unit testing of custom reports produced by PD.

• Implementation of the security setup for PD and FFS.

• Configuration of the PD technical architecture.

• System acceptance testing.

We conducted our review in accordance with Government Auditing Standards issued by the Comptroller General of the United States.

This review evaluated the internal controls being incorporated in OPP’s new procurement system. This included both the manual and automated application controls being implemented in the system. This also included examination of security in five areas: PD application security, AIX operating system security, PD database security, internal network security, and physical security. The scope of the system security integrity portion of this review was limited to the technical and physical protection over PD in the two office buildings where it is currently accessed and used. During the course of our review functionality was added or modified to PD to correct PD application and database security weaknesses which we identified. No other significant internal control or system security integrity weaknesses were identified.

II. RESULTS OF REVIEW

System implementation projects typically include prioritization of tasks to identify those that are critical to complete prior to going live with a new system, versus those that can be completed shortly thereafter.

The PD Implementation Team has prioritized and completed those tasks that are critical for the implementation of PD in HIR. However, there are additional tasks related to implementation in HIR that must be completed as soon as possible. Listed below are tasks that will require additional time and effort by the PD Implementation Team and must be completed shortly after or concurrently with PD’s operational deployment:

• Determine and document that software deficiencies identified in PD version 3.2 at the Library of Congress (LOC) do not effect PD implementation at House offices. Certain deficiencies have been previously identified and corrected at the House, while others are in the process of being corrected or appear unique to the LOC operating environment.

• Determine and document that problems identified during system acceptance testing do not adversely and materially impact the ability of users in HIR and in subsequent offices to efficiently process procurement documents. During our review, we noted multiple test problem reports or exceptions to expected results detailed in the test plan scripts. Most test problem reports have been corrected, but certain reports remain unresolved. These unresolved reports appear to relate to local area network or Windows 95 limitations and were deemed not critical.

Financial management system implementation projects are managed using a formal SDLC methodology. A formal SDLC methodology provides the project manager with an orderly and structured approach to plan and manage system implementations. The methodology also directs the collection and documentation of user requirements, design of the system to meet user requirements, verification, validation and testing of the system, and training of users on the new system.

During the initial phases of the PD implementation, the House’s SDLC policy was not completely followed and considerable delays were incurred. In the later phases, however, management made substantial progress in achieving compliance with the House SDLC policy. The PD Implementation Team has adopted and should continue to follow this policy.

After PD is implemented in HIR, the PD Implementation Team will have the time to carefully plan subsequent rollouts to other House offices and determine needed enhancements to PD in those offices. Subsequent rollouts and enhancements should continue to be structured to thoroughly consider users’ needs, and should target those areas where users have the greatest concern or where inefficiencies are most acute. To do this properly, the PD Implementation Team should continue to follow the House’s SDLC policy. The methodology should include the following:

• Review of procurement and purchasing processes to identify areas that must be addressed in each subsequent rollout.

• Prioritization of individual projects.

• Development of a detailed project work plan based on level of effort by area, available resources, and realistic goals and target dates.

• Collection and documentation of functional requirements for areas that will be included in each rollout.

• Analysis of how to best meet user requirements.

• Establishment of the settings on the system to meet user requirements.

• Verification, validation, and testing of the system.

• Development of user procedures.

• Training of users on the system.

Following the House’s SDLC policy mitigates the risk that delays, unrealistic completion estimates, additional costs, and inefficiencies that may occur in subsequent rollouts or enhancements. In addition, the functionality planned for these rollouts and enhancements may not completely meet users’ needs if the tasks associated with the House’s SDLC policy are not completed. To help assure that subsequent rollouts and enhancements will meet users’ needs and avoid delays and additional costs, the House’s SDLC policy must be followed.

We recommend the Chief Administrative Officer:

1. Prioritize and assign adequate resources to execute steps in the work plan to (a) determine and document that software deficiencies identified in PD version 3.2 at LOC do not effect PD implementation at House offices and (b) determine and document that problems identified during system acceptance testing do not adversely and materially impact the ability of the users in HIR and in subsequent offices to efficiently process procurement documents.
2. Continue to follow the House’s SDLC policy for subsequent rollouts and implementation of PD enhancements.

On July 9, 1998, the CAO verbally responded to a draft of this report, and fully concurred with the matters identified and all recommendations. He stated that he would ensure that adequate resources are assigned to the remaining steps required to fully complete the PD implementation. In addition, he stated that House’s SDLC methodology would continue to be followed for subsequent rollouts and implementation of PD enhancements.

The CAO’s current and planned actions are responsive to the issues we identified, and when fully implemented, should satisfy the intent of our recommendations. In addition, it is feasible for PD to be implemented in other offices immediately after the HIR implementation. As agreed when HIR was designated as the pilot office for PD implementation, OIG involvement in these subsequent PD implementations is not necessary.