Audit of science-related information technology acquisitions

December 3, 2015

Agriculture and Agri-Food Canada - Office of Audit and Evaluation

---

Executive summary

Agriculture and Agri-Food Canada (AAFC) established its Science and Technology Branch (STB) in 2012 by integrating the existing departmental scientific expertise into one branch. STB's science work is project-based and is driven by the Branch's science sector strategies, which were developed in collaboration with Industry and other science partners. Science projects span multiple years and can involve a number of science teams located at different research centres across Canada.

STB is an innovative adopter of state of the art scientific equipment and generates and analyses extensive volumes of data. As such, STB relies heavily on information technology (IT) to support its activities. STB is supported by AAFC's Information Systems Branch (ISB), which is responsible for the delivery and support of IT activities within AAFC, as well as the department's focal point with Shared Services Canada (SSC). SSC is focused on the adoption of enterprise-wide approaches for managing IT infrastructure services across the Government of Canada.

The Audit of Science-Related Information Technology Acquisitions was approved by the Deputy Minister as part of the 2014-2015 Risk-Based Audit Plan.

The audit focussed on the governance and planning processes for the acquisition of science-related IT. These two processes were identified as part of a risk assessment because they are inter-related and directly impact STB's ability to implement the IT needed to carry out science research in support of AAFC's science objectives.

Science-related information technology includes two categories of assets:

• IT for science research: This includes electronic storage and servers, used to support science research activities. This does not include core departmental information technology resources such as corporate data storage repositories, email, or standardly issued computers; and
• IT enabled science equipment: This includes science equipment that has an information technology component, such as equipment (for example, mass spectrometer) with an attached, dedicated computer.

The governance processes for IT for science research and IT-enabled science equipment varies due to the nature of the assets and the roles and responsibilities of STB and ISB. As such, the audit team has provided separate conclusions below for IT for science research and IT-enabled science equipment.

For IT needed for science research, the audit concluded that management controls within AAFC in the area of governance, including planning, are adequate and effective with the exception of areas identified in the recommendations below.

Planning and acquisition of information technology for science research

• 1. The ADM STB, in consultation with the ADM ISB, should develop a high-level long-term IT plan to document the IT needs for AAFC science research that is aligned with STB science sector strategies and the ADM, ISB, should share the approved plan with SSC.
• 2. The ADM STB, and ADM ISB, should review and improve the planning process by identifying timeline and approval efficiencies as well as identifying opportunities for the earlier engagement of IT partners. The process improvements should be implemented and integrated into formal guidance that is provided to STB and ISB employees.

For the acquisition of IT-enabled science equipment, Internal Audit determined that governance is effective and has identified opportunities to enhance the adequacy of planning controls.

Information technology-enabled science equipment

• 3. Develop a formalized approach to life-cycle management for IT-enabled science equipment, including maintaining local inventories and involving ISB in the acquisition process for future science equipment.

1.0 Introduction

1.1 Context

Science and Technology Branch within Agriculture and Agri-Food Canada

• 1.1.1 Science and Technology Branch (STB) was created in 2012 by integrating the existing departmental scientific expertise into one branch. It is organized into three agricultural zones with characteristic ecological features, such as climate and vegetation: Coastal Ecozone; Prairie/Boreal Plain Ecozone; and Mixedwood Plains Ecozone. The Ecozones each include a network of research centres which conduct science and collaborate with sector partners and other science stakeholders. Each Ecozone is led by a Director General responsible for tailoring the delivery of national priorities to the regional needs of the sector.
• 1.1.2 In addition to these three Ecozones, a Cross-Sectoral Strategic Direction Directorate, also led by a Director General, provides strategic advice to STB in the management, administration and delivery of science programs, including alignment to departmental and Government of Canada priorities.
• 1.1.3 STB's science work is project-based and is driven by the science sector strategies, which were developed in collaboration with Industry and other science partners. Science projects span multiple years and can involve a number of science teams located at different research centres across Canada.

Science sector strategies

• 1.1.4 In order to provide leadership in the growth and development of a competitive, innovative and sustainable Canadian agricultural and agri-food sector, Agriculture and Agri-Food Canada (AAFC) continues to modernize its delivery of science and technology. As noted in the 2015-2016 STB Plan, the Branch has developed nine science sector strategies to set priorities for the Department's science activities over the medium term. The strategies provide the basis for detailed work planning within the Branch. The strategies also outline the Branch's objectives and focus areas for research and development, as well as knowledge and technology transfer. In addition, they provide a framework for scientists to propose areas of work and describe the role(s) STB will play in relation to and in collaboration with other organizations.
• 1.1.5 From a long-term perspective, the science sector strategies inform science investment decisions related to capital resources and scientific expertise necessary to support projects and achieve results.^{Footnote 1}

Information technology for science

• 1.1.6 As a science-based branch, STB currently relies heavily on information technology to support its activities. Examples include:
  • Bioinformatics tools for managing and analyzing large and complex genetic data; and
  • Using collection database management systems to manage biodiversity information on Canadian genetic resources.

Support for information technology acquisitions

• 1.1.7 AAFC's Information Systems Branch (ISB): ISB is responsible for the delivery and support of Information Management / Information Technology activities within AAFC. The mandate of the Branch is to enable the Department's delivery of agriculture programs by providing the information and technology based solutions to connect employees, producers, and the public with agriculture knowledge resources. ISB management is located in the Department's National Headquarters with Regional IT Managers and staff who process information technology client service requests (for example, software installations, technology troubleshooting, etc.) in the regions (which include research centres).
• 1.1.8 STB, like all AAFC branches, participates in the Department-wide integrated planning process, which includes the IT planning process led by the ISB, in order to identify and prioritize its annual IT needs.
• 1.1.9 Shared Services Canada (SSC): In 2011, the Government announced the creation of SSC, which resulted in the transition of responsibility for the management of IT infrastructure services to SSC. This included responsibility for network, data centre and email services and was then extended to the procurement of workplace technology devices and software including:
  • Personal workstations – desktops, mobile workstations such as laptops and tablets and peripherals and accessories such as monitors, keyboards, and external and internal storage devices; and
  • Software that delivers common office productivity functionality, such as word processing, spreadsheets, presentation graphics, etc., including Internet browser software.^{Footnote 2}
• 1.1.10 SSC's mandate is focused on the adoption of enterprise-wide approaches for managing IT infrastructure services across the Government of Canada.
• 1.1.11 ISB's Strategic Management Directorate includes a Client Relationship Management Unit responsible for interfacing with SSC and managing AAFC acquisition requests that require the engagement of SSC.

Overview of science-related information technology governance and planning processes

• 1.1.12 AAFC has established departmental and branch-level planning and procurement processes and practices which include the acquisition of science-related IT. Science-related IT includes two categories of assets:
  • IT for science research: This includes electronic storage and servers specifically used to support science research activities, as well as scientific software. This does not include core departmental IT resources such as corporate data storage repositories (for example, AgriDocs), email, or standardly issued computers and software (for example, Microsoft Outlook); and
  • IT-enabled science equipment: This includes science equipment that has an IT component, such as equipment (for example, mass spectrometer) with an attached, dedicated computer.
• 1.1.13 Investment Planning Process: AAFC's annual Integrated Corporate Planning process, which includes investment planning, is coordinated by the Corporate Management Branch. As part of this process, all branches, including STB, make requests for investments to be included in the Departmental Investment Plan. In STB, these requests can include a variety of investment categories, including IT for science and IT-enabled science equipment. The Departmental Investment Planning Committee ensures that investments represent good value for money and align to the strategic priorities of the department and as such its mandate covers the entire Investment Plan including all AAFC capital and acquired services investments. Assets costing greater than $10,000 are considered capital assets.^{Footnote 3}
• 1.1.14 Investment recommendations are brought to Investment Planning Committee from two management teams: one focussed on IT investments and the other focussed on asset investments. Each management team includes Directors and Directors General with representation from AAFC branches. The role of these teams is to collect, assess and prioritize investments for endorsement by Investment Planning Committee, on an annual basis. Planned capital IT investments should be reflected in the corporate Investment Plan.
• 1.1.15 At the time of the audit, the Investment Planning Committee made recommendations to the senior executive Horizontal Management Committee which was mandated to make strategic decisions related to the Investment Plan. As of April 1, 2015, the AAFC governance structure changed and the Horizontal Management Committee was eliminated and the Departmental Management Committee mandate was adjusted to assume this role.
• 1.1.16 Planning process related to information technology for science: The annual IT Planning Process is integrated with the Investment Planning process. All planned IT expenditures, including expenditures on the Investment Plan as well as those related to routine maintenance, are included in the Departmental IT Plan which is developed by ISB in consultation with the other AAFC branches. In addition, the IT Plan is updated twice each year to capture new business requirements during the timeframe of the plan's implementation.
• 1.1.17 ISB has introduced Opportunity Proposal Forms or branches to use to identify and describe the IT requirements requested. The Opportunity Proposal Forms are completed at the research centre level and follow the branch approval process, including obtaining ADM-level approval. Once approved by the ADM, the forms are submitted to ISB where they are assessed and approved for inclusion in the IT Plan. Approved items then proceed through administrative and governance processes, depending on the nature of the request. For example, some requests are required to follow the IT project management process while others would be submitted to SSC.
• 1.1.18 Competitively sourced acquisitions greater than $100,000 and sole-sourced acquisitions greater than $25,000 must be submitted to the Procurement Review Board for review.^{Footnote 4} The board is the main control point for these procurements, as it ensures compliance with administrative, contractual, and financial policies, procurement discipline(s), legislative regimes and delegations. Procurement Review Board's focus is on procurements which are significant in terms of cost, overall impact or risk. The Board is comprised of senior management who review and approve acquisitions and it is accountable to the Departmental Management Committee (formerly the Horizontal Management Committee). Acquisitions of IT for science that are within the SSC mandate do not require Procurement Review Board review as SSC manages the procurement.
• 1.1.19 The ADM ISB is AAFC's Chief Information Officer, and is a co-chair of the federal interdepartmental Science Chief Information Officer-Integration Board working group ("Tiger Team"). This group is focused on identifying collaborative solutions and pilots among the science departments and agencies along with SSC. The working group reports to the Science and Technology Integration Board, which is committed to enhancing the integration of science and technology activities within a number of federal science departments and agencies.
• 1.1.20 Planning process related to information technology-enabled science equipment: The IT planning process described above does not include IT-enabled science equipment; as these acquisitions are managed by STB. The Integrated Planning and Reporting Unit of STB issues an annual equipment call to the Ecozones and research centres with proposed equipment purchases prioritized at the Ecozone level and then again across the Ecozones at the branch level by the Ecozone Directors General. Requests are reviewed and factors such as cost and whether the asset would serve multiple researchers are taken into consideration.
• 1.1.21 Approved acquisitions then proceed through the procurement process, depending on the materiality of the item with smaller value items purchased under local authorities and larger value items proceeding through to the Procurement Review Board.

1.2 Audit objective

• 1.2.1 The objective of this audit was to provide assurance on the adequacy and effectiveness of the governance and planning processes for the acquisition of science-related IT.
• 1.2.2 This audit was approved by the Deputy Minister as part of the 2014-2015 Risk-Based Audit Plan.

1.3 Audit scope

• 1.3.1 The scope of this audit included the departmental and STB-level governance and planning processes for science-related IT acquisitions. This includes IT-enabled scientific assets, IT purchases related to supporting science, and software used to support science.
• 1.3.2 The audit reviewed the governance and planning processes up to the submission of acquisition requests to the Procurement Review Board. The audit scope did not include:
  • Contracting, contract administration, and post-contract evaluation processes; and
  • IT project management. This was addressed by a separate, concurrent audit.
• 1.3.3 AAFC's Internal Audit's mandate does not include processes or controls under the responsibility of SSC, however the audit team took into account the federal government-wide transition of IT infrastructure services to SSC and the resulting impact on AAFC processes related to the acquisition of IT assets.
• 1.3.4 The audit was conducted primarily in STB and ISB in Ottawa. Teleconference interviews with regional staff were held and regional documentation was requested as required.
• 1.3.5 The risk assessment identified the following lines of enquiry which were reviewed during the audit conduct phase:
  • Governance
    The governance structure for the acquisition of science-related IT ensures that decisions are based on consideration of appropriate financial and non-financial information and key partners are engaged on a timely basis.
  • Planning Process
    The planning processes for science-related IT acquisitions ensures that resources are allocated in a cost-effective manner, taking into consideration available options, associated risks and expected benefits.
  • Cost Considerations
    Planning processes for science-related IT acquisitions take into account the whole-of-life cost of stewardship based on the expected life cycle of the acquisitions.

1.4 Audit approach

• 1.4.1 The approach and methodology used for the audit was consistent with the Internal Audit Standards, as outlined by the Institute of Internal Auditors and aligned with the Internal Audit Policy for the Government of Canada.
• 1.4.2 Audit criteria were selected from AAFC and Treasury Board Secretariat policies, as well as from best practices, including a standard management control framework.
• 1.4.3 A risk-based audit program was developed that defined audit tasks to assess each audit criterion. Audit evidence was gathered through methods including interviews, observations, documentation review and analysis.
• 1.4.4 The audit's conduct phase took place December 2014 to May 2015.

1.5 Conclusion

• 1.5.1 As separate governance processes are in place for the two types of acquisitions reviewed as a part of this audit (IT for science research and IT-enabled science equipment), the audit team has provided separate conclusions below.
• 1.5.2 For IT needed for science research, the audit concluded that management controls within AAFC in the area of governance, including planning, are adequate and effective with the exception of areas identified in the recommendations below.

Governance and planning for information technology for science

• 1. The ADM STB, in consultation with the ADM ISB, should develop a high-level long-term IT plan to document the IT needs for AAFC science research that is aligned with STB science sector strategies and the ADM ISB should share the approved plan with SSC.
• 2. The ADM STB and ADM ISB should review and improve the planning process by identifying timeline and approval efficiencies as well as identifying opportunities for the earlier engagement of IT partners. The process improvements should be implemented and integrated into formal guidance that is provided to STB and ISB employees.

• 1.5.3 For the acquisition of IT-enabled science equipment, Internal Audit determined that governance is effective and has identified opportunities to enhance the adequacy of planning controls.

Information technology-enabled science equipment

• 3. Develop a formalized approach to life-cycle management for IT-enabled science equipment, including maintaining local inventories and involving ISB in the acquisition process for future science equipment.

• 1.5.4 The recommendations noted above, focus on improving AAFC's processes in an effort to help to ease some of the challenges (delays and risk of data loss etc.) faced by STB staff when acquiring IT as well as, improving the awareness and understanding of STB's IT needs within ISB and SSC.

1.6 Statement of conformance

• 1.6.1 In the professional judgment of the Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the conclusion provided and contained in this report. The conclusion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed on with management. The conclusion is applicable only to the entity examined.
• 1.6.2 This audit conforms to the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

2.0 Detailed observations, recommendations and management responses

2.1 Audit findings and management responses

• 2.1.1 This section presents the key observations, based on the evidence and analysis associated with the audit, as well as recommendations for improvement.
• 2.1.2 Management responses are included and provide:
  • an action plan to address each recommendation;
  • a lead responsible for implementation of the action plan; and
  • a target date for completion of the implementation of the action plan.

2.2 Information technology for science acquisitions requiring Shared Services Canada support

• 2.2.1 AAFC is one of 43 organizations competing for demand and supply arrangements with SSC. Given that science-based research is data-intensive, STB has large electronic storage capacity and data transmission requirements. As such, SSC is a key service provider in the delivery of IT for science.
• 2.2.2 Interviews noted that STB is not putting forward many new requests to SSC for 2015-2016 because there are a high number of pending requests. Of the 14 active requests in 2015-2016, 10 are carry-overs from 2014-2015. By not communicating the increased IT requirements, STB's current IT needs may not be adequately prioritized and planned resources may not be adequate to support STB objectives.
• 2.2.3 Interviews with STB management noted that in their experience, it can require 6-18 months for requests to be delivered for IT for science. This is resulting in an impact on research projects that are usually only 3 years in duration.
• 2.2.4 As an example, one of the requests to SSC that was reviewed by the audit team was for 308 terabytes (TB) of electronic data storage capacity across many AAFC research sites. This request was made to have the electronic data storage capacity augmented to continue research. The request was made in November 2014. As of June 2015, AAFC and SSC have not signed a Recovery Agreement to implement this electronic data storage capacity request. A new request to address new and additional storage needs beyond the initial request has not been sent to SSC for 2015-2016 because the 2014-2015 request remains unimplemented.
• 2.2.5 Based on interviews conducted, STB staff noted that given the long lead time for delivery from SSC, some researchers resolve IT storage needs locally in order to continue research work. Based on an assessment of acquisition card data for a sample of research centres, Internal Audit observed examples of external hard drive storage that had been locally purchased.
• 2.2.6 For external storage that is locally purchased, while the lead time to acquire is short, does not include safeguards to mitigate the risks of theft, data loss, destruction, etc. Information of business value should be secured and recoverable, which requires connection to the network and the physical safeguards available through SSC-managed IT storage.
• 2.2.7 As of 2015-2016, AAFC is implementing local hard drive encryption that will limit the ability to use USB-connected IT storage devices. ISB management advised the Internal Audit team that ISB is seeking alternatives to authorized storage devices currently being used, such as encrypted portable hard drives and encrypted flash drives.
• 2.2.8 AAFC's Internal Audit's mandate does not include processes or controls under the responsibility of SSC. As SSC is a key enabler for the acquisition of IT for science, the information noted above adds important context to understanding the challenges faced by STB in obtaining the IT needed for science research.
• 2.2.9 Recommendations that focus on improving AAFC's processes are identified in the following sections of this report.

2.3 Long-term information technology planning to support science sectors strategies

• 2.3.1 Internal Audit expected to find that STB's science sector strategies were supported by a long-term IT plan and that the long-term IT objectives were communicated to ISB and SSC.
• 2.3.2 IT is a component of the majority of science research in STB and effective planning and acquisition of science-related IT is critical to the achievement of the department's science objectives.
• 2.3.3 As a science-based department, AAFC is facing significant challenges in ensuring adequate IT capacity in the near future. IT planning in STB is focused on addressing immediate needs related to current science projects and the enhancement of research centre capacity. Although there is a Chief Information Officer "tiger team" focussed on identifying collaborative solutions among the science departments and agencies along with SSC, the audit team determined that STB has not developed a long-term IT plan to support its science sector strategies. As a result, ISB and SSC are not provided with complete information about the objectives or scope of work over the longer-term.
• 2.3.4 A long-term IT plan for science, aligned with the science sector strategies, is needed in order to identify the science-related requirements and to inform ISB and SSC of the technological capacity required to pursue existing and future science objectives.

Recommendation

2.4 Planning for information technology for science

2014-2015 planning process

• 2.4.1 Requests for IT acquisitions for science research (as well as planned maintenance, upgrades, etc.) are completed by research centre management or scientists. These requests for IT are reviewed by research centre senior management and Ecozone Director Generals and are then submitted to the branch ADM for approval before being sent to ISB for their consideration in the overall departmental IM/IT planning.
• 2.4.2 ISB assesses the information included in the requests, which includes information describing the requirement, any options explored, and the IM/IT impact of the request. Based on this assessment, ISB develops the IM/IT Plan, which is approved by the Departmental Management Committee (DMC), and updates the plan biannually.
• 2.4.3 Requests that identify needs that require SSC involvement are directed to the Client Relationship Management Unit of ISB for submission to SSC.
• 2.4.4 For requests that can be implemented by the department, ISB project leaders, in conjunction with STB project leaders, identify the procurement requirements and analyse specific options. They take into consideration factors such as the technological direction of the federal government, cost, and the impact of maintaining the status quo. When procurements are above $100,000 or sole sourced contracts above $25,000, the standard Departmental procurement process is followed which includes submission of requests to the Departmental Procurement Review Board.^{Footnote 5}
• 2.4.5 The IM/IT Planning process described above does not include the acquisition of non-enterprise hardware and software which is managed by ISB's IT Client Services Unit. This would include items such as corporately approved, but non-standard, software (for example, Microsoft Visio software).

Processes to plan for information technology for science

• 2.4.6 The Treasury Board Policy Framework for the Management of Assets and Acquired Services reflects the authority of the Deputy Head for asset acquisition. Responsibility for the planning and acquisition of IT for science and IT-enabled science equipment is further addressed in the AAFC Policy on Planning, Managing, and Accounting for Assets, which describes the managers' responsibility for asset acquisition. At the time of the audit, the policy had not been updated to reflect the relative roles to be played by Corporate Management Branch, STB and ISB in the context of departmental and SSC-led processes, however it is currently under review.
• 2.4.7 In 2014-2015, the processes to plan for and acquire IT assets were evolving and limited documentation exists to describe the complete planning process from end-to-end and the roles and responsibilities of the key players. Interviews within STB indicated that there is a need to clarify the complete process as it is not well understood by STB scientists and management.
• 2.4.8 Internal Audit consulted with management and staff in STB and ISB and developed process flowcharts to document the complete processes. These flowcharts will also facilitate the identification of areas for improvement such as opportunities to engage partners earlier, as well as, the number and levels of required approvals. These flowcharts were validated with branch management and provided for future use when developing a framework for the planning of science-related IT acquisitions.
• 2.4.9 Interviews with management and staff from STB and ISB indicate that the integration between STB and ISB needs improvement, including better notification when calls are made for IT requests, more dialogue on cost estimates, and earlier identification of IT needs. For example, interviews with research centre management and scientists who requested IT for science indicated that they received no confirmation back regarding Opportunity Proposal Form approval (if approved); the expected timeframes for processing and delivery; and the lead IT analyst assigned. More engagement at the regional level would be seen as positive, in particular during the early proposal development and planning stages.
• 2.4.10 As noted earlier, some IT for science requests are SSC-oriented. Interviewees in STB and ISB noted the processes to engage SSC are not well understood within STB. This includes how to express IT needs as a business requirement and how to determine current status of a request. Internal Audit identified that there are opportunities within the existing process to improve planning by STB in order to get requests to SSC earlier and reduce the risk that STB research project timelines and outcomes may be affected.

Recommendation

2.5 Planning for information technology-enabled science equipment

Information technology-enabled science equipment planning process

• 2.5.1 STB management explained that most modern science equipment is IT-enabled and is either connected to the departmental network or with a stand-alone computer used for processing.
• 2.5.2 Although planning documentation that describes the process end-to-end has not been developed, the audit team observed that consistent practices exist across STB to plan for the acquisition of IT-enabled science equipment. IT-enabled science equipment purchases are captured via the annual integrated planning call, in-year individual requests to support research projects and in response to a call for the use of unallocated funds in the department
• 2.5.3 Interviewees stated that not all science equipment procurement is captured in the annual integrated planning process. When specific project funding is available, some procurement flows directly from requests by scientists to managers, Directors and Director Generals to procurement.
• 2.5.4 Under existing planning practices, there is no formal requirement to engage ISB prior to the purchase of the equipment. As research projects tend to have specific funding, scientists may simply proceed with any needed acquisitions and ISB may not become aware of such acquisitions until the equipment is on site, if at all. Internal Audit observed that, in practice, STB science staff inconsistently involves local and national ISB staff with these acquisitions.

Information to support planning for the acquisition of information technology-enabled science equipment

• 2.5.5 AAFC's Policy on Planning, Managing and Accounting for Assets, requires that decisions related to the acquisition of assets be determined according to specific requirements, linked to departmental priorities and plans. These decisions should be based on cost-benefit analysis of available alternatives and include a consideration of all costs, including acquisition costs and ongoing operating and maintenance costs (for example, life-cycle management costs).
• 2.5.6 IT-enabled science equipment can be initially acquired to support specific science projects, and in that case may be purchased using specific project funding. Once purchased, these pieces of equipment can then be used to support multiple projects at the research centre.
• 2.5.7 For acquisitions without project-specific funding, research centres maintain an ongoing list of proposed equipment that is put forward for consideration when other funding becomes available. These procurements can be made using the research centre budget or in-year unallocated departmental funding. This list is created or updated by research centre management or scientists whenever called upon to do so by STB's Planning and Coordination Unit. It is the responsibility of the research centre management or scientist to assess options and provide relevant detail to research centre management. This practice remains external to the overall branch planning process as there is no certainty that there will be unallocated departmental funds for equipment purchases and as noted earlier, local ISB is not regularly involved in the preparation of these requests.
• 2.5.8 The request and approval forms for the above mentioned purchases contain information on the assets to be acquired. Non-financial information includes items such as: identification of need, link to departmental priorities, identification and assessment of options and the expected benefits/outcomes of acquisitions. Financial information includes items such as: available budget, initial cost and implementation cost.
• 2.5.9 In terms of financial controls, there is some management review of the costing figures. For example, management reviews the proposal information to determine if service contracts are good value-for-money. While the cost to maintain the equipment over its lifetime may not be expensive, Internal Audit noted that the full life cycle costing and costs related to ISB and SSC services are not adequately determined and considered by STB as part of the purchase decisions. The cumulative effect of the lack of consideration and planning for these costs across STB increases the risk of significant unplanned costs arising.
• 2.5.10 Internal Audit determined that the department experiences challenges ensuring that complete information is received in order to make fully informed acquisition decisions. Based on a review of acquisition requests forms, Internal Audit noted that the request and approval templates do not include information related to: roles and responsibilities for the asset over its life cycle, if an asset includes IT elements, operating costs over expected lifetime, maintenance costs over expected lifetime, replacement costs and disposal costs.
• 2.5.11 Other challenges related to the planning of IT-enabled science equipment noted by Internal Audit through the conduct of the audit were:
  • No formal ISB notification for IT-enabled science equipment: Planning templates do not specifically identify equipment as being IT-enabled or formally require ISB review of the proposed IT-enabled science equipment. Science is highly-specialized and IT analysts do not have the scientific knowledge to assess the appropriateness of equipment options proposed. However, IT analysts can review proposed asset technical data to ensure that any potential issues related to connectivity, IT security and capacity are identified and addressed during the planning stages.
  • IT impact of new science equipment may not be considered prior to purchase: Within research centres and as part of the IT planning procedures, the research centre management or scientist identifies the impact of an equipment acquisition on the centre's IT capacity. This information is not subsequently reviewed or confirmed by ISB and the accumulated impact of equipment installation on a centre's IT capacity is not measured as a standard component of the IT planning process.

Information to support life-cycle management for information technology-enabled science equipment

• 2.5.12 In AAFC's Policy on Planning, Managing, and Accounting for Assets, asset management is focused on the role that managers must play in the planning, acquisition, management and disposal of assets under their control. Decisions related to potential acquisitions are expected to be driven by specific program requirements.
• 2.5.13 Internal Audit noted that the 2014-2015 STB Plan notes that STB will be developing a strategic approach, process steps, responsibilities and data collection templates to identify, rationalize and prioritize the replacement of scientific equipment such as laboratory equipment. As of June 2015, this plan was not yet in place.
• 2.5.14 Equipment is tagged with an asset number which is recorded in the departmental financial system by Corporate Management Branch staff assigned to the research centre. Based on interviews with research centre staff, the financial system asset listing is not used to identify upcoming and future equipment replacements, based on estimated useful life. Instead, equipment is identified by research centre staff in response to central requests to identify equipment requirements, usually related the availability of unallocated departmental funds.
• 2.5.15 Internal Audit determined that if equipment is purchased with an attached computer, it is not physically or uniquely identified with an asset number as it is considered part of the overall equipment acquisition. However, if the computer was procured separately (for example, through ISB), it is given an asset number.
• 2.5.16 Therefore, for computers procured with equipment, there is no readily accessible list of their existence, purchase date or expected useful life to use to make life-cycle management decisions.
• 2.5.17 For assets connected to the network, an electronic record exists, through survey software managed by ISB. Assets that are off-network cannot be surveyed so ISB may not be aware of them or about computers connected to scientific instruments.
• 2.5.18 Internal Audit interviewed management and staff from STB and ISB to understand how each branch becomes aware of the existence of an IT-enabled science equipment asset, in order to manage it over its life-cycle. Respondents in STB and ISB were unclear about how science-related IT assets were tracked. There is no policy or procedural requirement for science staff to inform IT staff about non-networked IT assets or to maintain a list locally.
• 2.5.19 Although IT-enabled science equipment is not life-cycle managed by STB, the replacement of IT equipment can occur when IT staff advises STB management that an existing IT asset is aging or that capacity is inadequate. Internal Audit noted instances of costly reactive rather than proactive maintenance and replacement of the IT-portion of IT-enabled science equipment.
• 2.5.20 Life-cycle management is needed to ensure assets are captured, managed and replaced according to an analysis of its useful life.

Recommendation

Annex A: audit criteria

1. The governance structure for the acquisition of science-related IT ensures that decisions are based on consideration of appropriate financial and non-financial information and key partners are engaged on a timely basis.
2. The planning processes for science-related IT acquisitions ensures that resources are allocated in a cost-effective manner, taking into consideration available options, associated risks and expected benefits.
3. Planning processes for science-related IT acquisitions take into account the whole-of-life cost of stewardship based on the expected life cycle of the acquisitions.

Annex B: Acronyms

AAFC

Agriculture and Agri-Food Canada

ADM

Assistant Deputy Minister

CMB

Corporate Management Branch

ISB

Information Systems Branch

IT

Information Technology

SSC

Shared Services Canada

STB

Science and Technology Branch

USB

Universal Serial Bus