Significant Improvements In The Management and Operations

Of The Office Of The Chief Administrative Officer

Report No. 98-CAO-19

December 16, 1998

Report Transmittal Memorandum

Management Response To The Draft Report
 
 

RESULTS IN BRIEF



CONCLUSIONS

Appointed in 1997, the Chief Administrative Officer (CAO) has initiated significant changes in the management and operation of the critical administrative functions supporting the United States House of Representatives (House). These changes have led to significant improvements in the conditions reported in our previous performance audit report, entitled Improvements Are Needed In The Management And Operations Of The Office Of the Chief Administrative Officer,

(Report No. 96-CAO-15, dated December 31, 1996). The Office of the CAO has dramatically improved communication with staff, strengthened planning and goal setting, and the implemented enhanced monitoring processes. These improvements have been achieved through major initiatives in the Immediate Office of the CAO and subordinate offices in the areas of strategic planning, financial management, information technology, and others. The achievements are highlighted below:

Although there has been significant improvement in the management and operations of the Office of the CAO, additional actions are needed to further strengthen its financial management, information technology, and procurement operations.

Notwithstanding these accomplishments, the Office of the CAO has not developed a comprehensive long-term strategy, including a needs analysis/requirements definition and business process reengineering (BPR) analysis, to guide the Office of Finance in addressing the new financial management technologies, processes, and any associated organizational and staffing needs in anticipation of FFS replacement. Such a plan can help the Office of the CAO more effectively (1) identify all financial planning, budgeting, accounting, and reporting needs, (2) determine how to link programs to budgets and costs, and (3) assess what will be needed to replace FFS and other financial systems. This has occurred because during the past two years, the Office of the CAO has focused its efforts on strategic planning and other management and operational improvements.

The Office of the CAO needs to more aggressively and effectively pursue opportunities available to reduce processing and thus, decrease costs. For example, in Calendar Year 1997 the Office of the CAO processed, essentially through a paper-driven process, over 94,000 vouchers to pay for about 284,000 transactions. However, the Office of the CAO is not taking full advantage of the significant savings associated with reduced voucher processing. Also, the Office of the CAO is not benefiting from the associated efficiencies of improved cash management, a streamlined payment process, reduced procurement lead times, and reduced workload in procurement offices. While the Office of the CAO’s currently planned initiatives will reduce the voucher processing burden, these efforts can be more properly focused and prioritized when the problems to be solved have been adequately defined and analyzed. Through more detailed analysis of the universe of voucher transactions, the Office of the CAO will be able to more effectively determine where solutions are most needed. Also, the CAO will be able to focus his resources toward those alternatives that can solve problems most quickly and at the least cost.

While HIR has established a Quality Assurance (QA)/Configuration Management (CM) position description and assigned the functions to a staff person in the HIR Security Group, important activities, such as system documentation reviews and signoff and post-implementation reviews, which are essential parts of both the QA and CM functions, are missing from the position description. In addition, the QA/CM staff person is not performing the activities defined in the current position description—that individual’s activities have been limited thus far to Year 2000 testing. Without a good QA program, HIR cannot assure that the development or modification of the House’s systems have been subjected to thorough verification, validation, testing, certification, and accreditation, and that systems adequately meet the operational and security needs of the users. Without a good CM program, HIR has no assurance that new House information technology systems can be properly integrated with existing systems, or replace older systems. Several factors have impacted HIR’s ability to fully perform the QA and CM functions. First and foremost, HIR has not adequately defined the QA and CM functions to ensure that all necessary activities are carried out to the meet the House’s needs. In addition, HIR has not identified the necessary tools and techniques to enable staff to effectively carry out QA and CM activities. Further, HIR has not identified the staffing necessary to meet the QA and CM needs. Finally, HIR has not developed adequate policies and procedures.

The Office of the CAO needs to expand the implementation of PD to the Office of the Sergeant at Arms (SAA), the Office of the Clerk, and other House offices, as soon as practical. These offices continue to use a paper-based system to support procurement of goods and services. By implementing PD in those offices, the procurement and purchasing process could be streamlined and economies could be achieved. However, there are no documented plans to provide PD to the Office of the Clerk, Office of the SAA, or other House offices.
 
 

RECOMMENDATIONS

We recommend that the Chief Administrative Officer (1) develop a financial management plan, including a needs analysis/requirements definition and a BPR analysis, to address the House’s financial management goals, objectives, and needs on a comprehensive and long-term basis, (2) perform a detailed analysis of the Office of Finance’s non-travel-related voucher transactions to determine the areas of the most administrative burden and identify the most appropriate technological and programmatic improvements to minimize this burden, (3) identify and clearly define the QA and CM functions and activities to meet the House’s needs, (4) identify and acquire the necessary tools and techniques and staffing to fully support the QA and CM functions, (5) develop comprehensive QA and CM policies and procedures, and (6) extend the implementation of PD to the Office of the Clerk, Office of the SAA, and other House offices, as soon as practical.
 
 

MANAGEMENT RESPONSE

On November 9, 1998, the CAO concurred with the findings and recommendations in this report. According to the response:

OFFICE OF INSPECTOR GENERAL COMMENTS

The actions planned by the CAO are responsive to the issues identified and, when fully implemented, should satisfy the intent of these recommendations. The milestone dates provided for the actions appear reasonable.
 
 

I. INTRODUCTION

Background

Election of the Chief Administrative Officer (CAO). The Rules of the House of Representatives (the House) effective for the 105th Congress (dated January 1, 1998) detail the duties of the Speaker of the House (Rule I), the Election of Officers (Rule II), the duties of the CAO (Rule V), and the duties of the Standing Committees, including the Committee on House Oversight (Rule X 1.(h) and 4.(d)(1)).

Rule II for the election of Officers states:

"There shall be elected by a viva voce vote, at the commencement of each Congress, to continue in office until their successors are chosen and qualified, a Clerk, Sergeant-at-Arms, Chief Administrative Officer, and Chaplain, each of whom shall take an oath to support the Constitution of the United States, and for the true and faithful discharge of the duties of his office to the best of his knowledge and ability, and to keep the secrets of the House; and each shall appoint all of the employees of his department provided for by the law. The Clerk, Sergeant-at-Arms, and Chief Administrative Officer may be removed by the House or by the Speaker." The CAO is chosen, qualified, and submitted to the House for a voice vote of the Membership of the House. The CAO may be removed either by Speaker or by a vote of the Members of the House.

Role of the Committee on House Oversight (CHO). The CHO has certain responsibilities detailed in Rule X 1.(h) regarding the CAO, including:

1.(h) (1) "Appropriations from accounts for committee salaries and expenses (except for the Committee on Appropriations), House Information Systems, and allowances and expenses of Members, House Officers and administrative offices of the House."

1.(h) (2) "Auditing and settling of all accounts described in subparagraph (1)."

1.(h) (3) "Employment of persons by the House, including clerks for Members and committees, and reporters of debate."

1.(h) (6) "Expenditures of accounts described in subparagraph (1)."

1.(h) (9) "Measures relating to accounts of the House generally."

1.(h) (13) "Measures relating to services to the House, including the House Restaurant, parking facilities and administration of the House Office Buildings and the House wing of the Capitol."

1.(h) (16) "Measures relating to the compensation, retirement and other benefits of the Members, officers, and employees of the Congress."

4.(d) (1)(B)"Providing policy direction for, and oversight of, the Clerk, Sergeant-at-Arms, Chief Administrative Officer, and Inspector General."

Therefore, although the CHO cannot directly or indirectly hire or remove the CAO, the CHO has direct oversight of the CAO. The CHO also has oversight responsibility for appropriations, personnel decisions, and expenditures of the CAO.

The CHO provides the following critical functions in relation to the Officers of the House:

Role of the CAO. The CAO has certain responsibilities, detailed in Rule V, regarding its interaction with the CHO and the Speaker, including:
  1. "The Chief Administrative Officer of the House shall have operational and financial responsibility for functions as assigned by the Committee on House Oversight, and shall be subject to the policy direction and oversight of the Committee on House Oversight."
  2. "In addition to any other reports required by the Committee on House Oversight, the Chief shall report to the Committee on House Oversight not later than 45 days following the close of each semiannual period ending on June 30 or on December 31 on the financial and operational status of each function under the jurisdiction of the
  3. Chief. Each report shall include financial statements, a description or explanation of current operations, the implementation of new policies and procedures, and future plan for each function."
  4. "The Chief shall fully cooperate with the appropriate offices and persons in the performance of reviews and audits of financial records and administrative operations."
The mission of the Office of the CAO. The mission of the Office of the CAO is to provide the administrative support functions for the Member, Committee, and other House Offices. These functions include development and maintenance of hardware and software systems, processing of payroll and personnel actions, maintenance of support services such as day care, supply store, gift shop, photography and recording studios, procurement and purchase of goods and services, and management of financial activities.

The Office of the CAO was established at the beginning of the 104th Congress. The Office of the CAO’s operating budget is approximately $58,829,000 for Fiscal Year 1999 and includes approximately 600 employees. The CAO has operational and financial responsibilities for the administrative support functions of the House. These responsibilities are delegated to six offices as follows:

Status of significant Office of the CAO activities. Since our prior report, entitled Improvements Are Needed In The Management And Operations Of The Office Of The Chief Administrative Officer (Report No. 96-CAO-15, dated December 31, 1996), the Office of the CAO made significant progress to strengthen and improve management and operations of the House. During this period (105th Congress) the Office of the CAO accomplished the following notable achievements: Objective, Scope, And Methodology

The objective of our review of the Office of the CAO was to provide an operational assessment of the Office of the CAO during the 105th Congress. We conducted the work during the months of September through November 1998. We examined the adequacy and effectiveness of the operations of the Office of the CAO in the following areas:

  1. Management and direction of each office.
  2. Administrative controls.
  3. Program procedures and controls over Office of the CAO operations.
We conducted our audit in accordance with Government Auditing Standards, issued by the Comptroller General of the United States. Our audit included the following steps: Internal Controls

We assessed the control environment, including those over the management and direction of each CAO office, administrative functions, and programs. Weaknesses in the internal control environment are described in the "Findings and Recommendations" section of this report.

Prior Audit Coverage

The Office of Inspector General (OIG) has completed the following audits related to the Office of the CAO operations during the 105th Congress. We did not follow up on prior audit recommendations since that is the subject of the first audit report identified below.

Followup Review Of Prior Recommendations In The Office Of The Chief Administrative Officer (Report No. 98-CAO-12, dated November 4, 1998)

Audit Of The Financial Statements For The Year Ended December 31, 1997 (Report No. 98-HOC-11, dated November 4, 1998).

The House Is Ready To Implement Procurement Desktop In House Information Resources (Report No. 98-CAO-09, dated July 20,1998).

Stronger Management Controls Needed Over House Food Service Contractor Operations (Report No. 98-CAO-08, dated July 20, 1998).

More Effective Contract Administration Needed In House Food Services (Report No. 98-CAO-07, dated July 20, 1998).

ACF2 Controls Implemented And Planned Increase House Mainframe Security (Report No. 98-CAO-06, dated May 26, 1998).

Opportunities Exist For Improving The Workers’ And Unemployment Compensation Programs At The U.S. House of Representatives (Report No. 98-CAO-05, dated May 11, 1998).

Controls Over Recording Studio Use Need Improvement (Report No. 98-CAO-04, dated April 21, 1998).

Mainframe Migration Options Study For Mission-Critical Application Systems At The U.S. House Of Representatives (Report No. 98-HOC-03, dated April 6, 1998).

Results Of The House Mail Operations Customer Satisfaction Survey (Report No. 98-CAO-02, dated February 27, 1998).

Improvement Are Needed In House Mail Operations (Report No. 98-CAO-01, dated February 27, 1998).

Despite CHO And CAO Mandates HIR Has Not Begun Development Of A Frame Migration Plan (Report No. 97-CAO-15, dated December 12, 1997).

Audit Of The Financial Statements For The Year Ended December 31, 1996 (Report No. 97-HOC-14, dated December 1, 1997).

House Needs To Refocus It’s Efforts To Meet The Year 2000 Deadline (Report No. 97-CAO-13, dated September 29, 1997).

Management and Financial Irregularities In The Office Of The Chief Administrative Officer (Report No. 97-HOC-12, dated September 24, 1997).

Internal Controls Over Equipment Inventory Systems Can Be Improved (Report No. 97-CAO-11, dated July 28, 1997).

Direct Storage Device Management Can Be Improved (Report No. 97-CAO-10, dated May 8, 1997).

HIR Management Practices Undermine The House’s Ability To Keep Pace With Technological Changes (Report No. 97-CAO-09, dated May 8, 1997).

Proactive Management Approach Can Improve House Telecommunications Services And Operations (Report No. 97-CAO-08, dated March 24, 1997).

Improvements Needed In The House’s Contingency And Disaster Recovery Planning For Telecommunications (Report No. 97-CAO-07, dated March 24, 1997).

Changes In Operating Practices Needed To Improve The Economy, Efficiency, And Effectiveness Of House Telecommunications Functions (Report No. 97-CAO-06, dated March 24, 1997).

Opportunities Exist For The House To Save Over $1 Million Annually Through Better Telecommunications Cost Management (Report No. 97-CAO-05, dated March 24, 1997).

Weak Telecommunications And Information Systems Controls Compromise House Information Resources (Report NO. 97-CAO-04, dated March 24, 1997).

Results Of The House Telecommunications Customer Survey (Report No. 97-CAO-03, dated March 24, 1997).
 
 

I. FINDINGS AND RECOMMENDATIONS

Finding A: The CAO Needs To Develop A Comprehensive Long-Term Financial Management Improvement Plan

Significant improvements have been made in the financial and related management systems that support House activities. The Office of the CAO successfully compiled its own financial statements for the first time in 1997 without the assistance of contractors. In addition, the CAO has implemented and stabilized FFS as its interim accounting and financial reporting system. The Office of the CAO is also implementing a Fixed Asset Inventory Management System, which consolidates three main House inventory systems, and PD, which automates the entire requisition and purchase order process.

Notwithstanding these accomplishments, the Office of the CAO has not developed a comprehensive long-term strategy, including a needs analysis/requirements definition and business process reengineering (BPR) analysis, to guide the Office of Finance in addressing the new financial management technologies, processes, and any associated organizational and staffing needs in anticipation of FFS replacement. Such a plan can help the Office of the CAO more effectively (1) identify all financial planning, budgeting, accounting, and reporting needs, (2) determine how to link programs to budgets and costs, and (3) assess what will be needed to replace FFS and other financial systems. This has occurred because during the past two years, the Office of the CAO has focused its efforts on strategic planning and other management and operational improvements.

The Legislative Branch Financial Managers’ Council and the Joint Financial Management Improvement Program are promoting financial management improvements

Through the Legislative Branch Financial Managers’ Council (Council), Legislative Branch agencies have been encouraged to work towards a financial environment that supports the mission of the Legislative Branch and to operate integrated, customer-driven/output-oriented financial management systems that link programs to budgets and costs. In his Semi-Annual Report, July 1 – December 31, 1997, the CAO stressed his commitment, as a member of the Council, to enhance financial operations through (1) a strong internal control structure, (2) adoption of best practices, (3) compliance with rules and regulations applicable to the House, and (4) compliance with Joint Financial Management Improvement Program (JFMIP) pronouncements.

An essential building block to achieve the financial environment envisioned by the Council and the CAO is a comprehensive financial management improvement plan. Such a plan should provide a framework for financial management processes and an integrated, customer-driven/output-oriented financial management system. In May 1995, JFMIP outlined the following key factors to be considered in planning for an integrated system environment:

Within the context of these key JFMIP factors, a financial management improvement plan should consider long-term financial management improvements, as follows: According to best practices, a financial management improvement plan must be based on detailed analysis (needs analysis and requirements definition and BPR analysis). These analyses address the financial management requirements of the organization in areas such as budget, purchasing, accounts payable, accounts receivable, asset management, and other accounting needs.

A comprehensive financial management improvement plan has not been developed

During the past two years, the CAO has taken significant steps to pave the way for implementing a CAO-wide financial management improvement plan. A key step has been the development of the CAO Strategic Plan, which includes several Vision Elements including Disciplined Resource Management. The plan categorizes all Office of the CAO functions into projects, which include goals, budgets, and performance measurement indicators. Other steps taken by the Office of the CAO include individual initiatives to strengthen financial management as shown in the table below.
 
CAO Office
Project Name
   
Budget FY '99
Start date
Completion date
Office of Finance FFS Replacement    
141,629 
10/1/98
9/30/99
  Member Accounting System Replacement    
37,998 
10/1/98
9/30/99
  FFS Future Initiatives    
127,812 
10/1/98
9/30/99
  Total Office of Finance    
307,439 
   
Office of Human Res. New Human Resources/Payroll System    
2,542,510 
10/1/98
9/30/99
  Procuring a New Payroll System and Replacement    
24,500 
10/1/98
9/30/99
  Total Office of Human Resources    
2,567,010 
   
Media & Support Serv. Fixed Assets System Implementation    
147,234 
10/1/98
9/30/99
  Procurement Desktop Implementation    
6,475 
10/1/98
9/30/99
  Total MSS    
153,709 
   
Total Financial Management Initiatives
3,028,158 

Table 1-- Office of the CAO Financial Management Initiatives

The Office of the CAO is committed to improving its financial management, as evidenced by its initiatives in financial accounting, human resources/payroll, asset management, and procurement. In addition, the Office of the CAO has developed a high-level plan to identify a solution for replacing FFS, its interim accounting and financial reporting system. FFS is limited to general ledger accounting and voucher processing. While FFS provides critical information for day-to-day operations, it does not support the House’s budgeting process, cost and performance information needs, and full management reporting requirements.

The Office of the CAO’s Strategic Plan also includes several other initiatives to improve financial management over the next two years. However, the Office of the CAO has not developed a comprehensive financial management improvement plan which identifies the House’s long-term (e.g., five years) financial management goals and addresses how it will achieve those goals. Decisions to implement new financial management initiatives, such as the FFS replacement, should be made within the context of a comprehensive long-term financial management plan.

As a first step toward developing a financial management improvement plan, the Office of the CAO should conduct detailed analyses (needs analysis/requirements definition and BPR analysis).

A needs analysis/requirements definition must address the detailed financial management requirements of the Office of the CAO, Member, Committee, and other House offices. OIG Audit Report, entitled "The House Needs To Take Steps To Implement Standard Financial Management Systems, Processes, and Policies" (Report No. 96-CAO-10, dated December 23, 1996), serves as a baseline for identifying the House’s financial management requirements. The report summarizes focus group meetings on financial management requirements with Office of the CAO, Member, Committee, and other House offices. Each of these groups identified their high-level financial management requirements. For example, the Office of the CAO focus meetings identified 117 high-level financial management requirements related to the following areas:

In conjunction with defining its requirements, the Office of the CAO must perform a BPR analysis to identify opportunities for streamlining the current financial management processes, while meeting its financial management requirements. The BPR analysis should identify (1) opportunities where technologies can facilitate new processes, (2) benefits gained from new processes, and (3) organizational and staffing changes necessary to implement new processes.

Recommendation

We recommend that the Chief Administrative Officer develop a financial management plan, including a needs analysis/requirements definition and a BPR analysis, to address the House’s financial management goals, objectives, and needs on a comprehensive and long-term basis.

Management Response

On November 9, 1998, the Office of the CAO concurred with this finding and recommendation (see Appendix). According to the response, the Office of Finance will build on the existing Disciplined Resource Management Vision in the current 5-year CAO Strategic Plan to address the development of a long-range financial management improvement plan, as well as other financial management issues facing the House, such as training, technology, organization, and staffing. The Office of Finance anticipates submission of the financial management plan to the CHO by September 1999.

Office of Inspector General Comments

The action planned is responsive to the issue identified and, when fully implemented, should satisfy the intent of the recommendation. Furthermore, the milestone date for completing the action appears reasonable.

Finding B: Costs Of Voucher/Purchase Order Processing Can Be Reduced

Voucher/purchase order processing costs can be reduced through techniques such as (1) reducing processing steps, (2) consolidated invoices from large vendors, (3) on-line (Internet) purchasing, and (4) purchase cards. The Office of the CAO has eliminated processing steps and as a result, reduced voucher processing from seven days to about three and a half days. Also, the Office of the CAO is exploring consolidated invoices from large vendors, on-line ordering, and purchase cards.

While these Office of the CAO actions are progressing in the right direction, the Office of the CAO needs to more aggressively and effectively pursue opportunities available to reduce processing and thus, decrease costs. For example, in Calendar Year 1997, the Office of the CAO processed, essentially through a paper-driven process, over 94,000 vouchers to pay for about 284,000 transactions. However, the Office of the CAO is not taking full advantage of the significant savings associated with reduced voucher processing. Also, the Office of the CAO is not benefiting from the efficiencies associated with improved cash management and a streamlined payment process, reduced procurement lead times, and reduced workload in procurement offices. While the Office of the CAO’s currently planned initiatives will reduce the voucher processing burden, these efforts can be more properly focused and prioritized when the problems to be solved have been adequately defined and analyzed. Through more detailed analysis of the universe of voucher transactions, the Office of the CAO will be able to more effectively determine where solutions are most needed. Also, the CAO will be able to focus his resources toward those alternatives that can solve problems most quickly and at the least cost.
 
 

Processing of vouchers and purchase orders (transactions) under the traditional paper-based method used by the Office of the CAO can represent a significant portion of the costs of administration. The current process to procure goods and services requires a purchase request to be prepared, approved at various levels, submitted to Office of Finance for payment approval, sent to a vendor, initialed to show receipts of goods or services, and included on a voucher so a check can be drawn on the U.S. Treasury. The entire administrative process can take days and may involve several levels of approvals. For example in 1993, the Purchase Card Council, an Executive Branch interagency work group, estimated the average cost to process a purchase order for 10 Federal agencies was $94.

Many techniques to eliminate processing steps and reduce paper work are readily available that can significantly lower administrative costs. Some of the most commonly used techniques are discussed below.

Use of these techniques can achieve significant savings. For example, the Purchase Card Council estimates that shifting from a traditional paper-based procurement method for small purchases of commercially available goods and services to a Government Purchase Card method (a credit card program that allows direct procurement for transactions under $2,500), can reduce processing costs by as much as 14 percent, and up to $54 per purchase order. The Council estimates that, over the next few years, the purchase card will cut the 10 million purchase orders prepared for buys under $2,500 in half, saving at least $250 million in transaction costs in the Executive Branch. In addition to reducing costs, the use of the above techniques provides the added benefits of improved cash management and a streamlined payment process, reduced procurement lead times, and reduced workload in procurement offices.

In Calendar Year 1997 the Office of the CAO processed, essentially through a paper-driven process, over 94,000 vouchers1 to pay for about 284,000 transactions, which included 108,244 non-travel-related transactions or about 36,000 vouchers, and 69.4 percent of those involve non-travel-related transactions less than $100 (see Tables 2 and 3). Although an estimate of the cost of processing purchase orders or vouchers for the House is not available, any decrease in their number is likely to lead to significant savings. For example, based on the $54 savings per voucher estimated by the Purchase Card Council, if the Office of the CAO could reduce the 36,000 vouchers processed for the House each year by 10 percent or 3,600, an estimated annual savings of $194,000 could be achieved. Also, the Office of the CAO could benefit from the efficiencies associated with improved cash management, a streamlined payment process, reduced procurement lead times, and reduced workload in procurement offices.

While the Office of the CAO has currently planned initiatives to promote consolidated billing, on-line ordering, and purchase cards, these efforts can be more properly focused and prioritized when the problems to be solved have been adequately defined and analyzed. The Office of the CAO should complete a comprehensive analysis of its universe of voucher transactions to assess factors such as who are the major clients, what they mostly purchase, and how often. By performing this detailed analysis, the Office of the CAO will be able to more effectively determine where solutions are most needed. Also, the CAO will be able to focus his resources toward those alternatives that can solve problems most quickly and at the least cost.

Recommendation

We recommend that the Chief Administrative Officer perform a detailed analysis of the Office of Finance’s non-travel-related voucher transactions to determine the areas of the most administrative burden and identify the most appropriate technological and programmatic improvements to minimize this burden.

Management Response

On November 9, 1998, the Office of the CAO concurred with this finding and recommendation (see Appendix). According to the response, the Office of Finance will perform a detailed analysis of non-travel-related payment voucher transactions to determine the areas that impose an administrative burden disproportionate to value and will identify improvements that can minimize the burden. Upon completion of the payment analysis, we will perform a review of purchase orders by major vendors and correlate the categories of purchases to "P2" vouchers. This two-phase analysis will be aimed at programmatic improvements in processing and will be completed by June 1999.

Office of Inspector General Comments

The actions planned are responsive to the issue identified and, when fully implemented, should satisfy the intent of the recommendation. Furthermore, the milestone date for completing the actions appear reasonable.
 
 

Finding C: The CAO Needs To Strengthen HIR’s Configuration Management And Quality Assurance Functions

Significant improvements have been made in the information technology infrastructure that supports House operations. The Office of the CAO has implemented an HIR reorganization plan. The goal of the reorganization was to make this office more responsive to the needs of the House. The Office of the CAO has also adopted a new SDLC methodology to guide all new information technology development efforts and is currently updating this guidance. The Office of the CAO has also implemented the House’s first detailed information systems security policies and has made progress in preparing for the Year 2000 and mainframe migration.

While HIR has established a QA/CM position description and assigned the functions to a staff person in the HIR Security Group, important activities, such as system documentation reviews and signoff and post-implementation reviews, which are essential parts of both the QA and CM functions, are missing from the position description. In addition, the QA/CM staff person is not performing the activities defined in the current position description—that individual’s activities have been limited thus far to Year 2000 testing. Without a good QA program, HIR cannot assure that the development or modification of the House’s systems have been subjected to thorough verification, validation, testing, certification, and accreditation, and that systems adequately meet the operational and security needs of the users. Without a good CM program, HIR has no assurance that new House information technology systems can be properly integrated with existing systems, or replace older systems. Several factors have impacted HIR’s ability to fully perform the QA and CM functions. First and foremost, HIR has not adequately defined the QA and CM functions to ensure that all necessary activities are carried out to meet the House’s needs. In addition, HIR has not identified the necessary tools and techniques to enable staff to effectively carry out QA and CM activities. Further, HIR has not identified the staffing necessary to meet the QA and CM functional needs. Finally, HIR has not developed adequate QA and CM policies and procedures.

QA and CM functions are critical to ensuring efficient and effective information technology

CobiT: Control Objectives for Information and Related Technology2 states that management should establish a standard approach regarding QA, which covers both general and project specific QA activities. QA is the planned, systematic process that ensures that automated system products and acquisition/development processes comply with established standards, practices, and procedures. Some of the QA activities include (1) life-cycle validation, verification, and testing, (2) monitoring of development and testing activities and change controls, (3) data integrity assurance, and (4) reviews and audits.

CobiT states that CM is needed to account for all information technology components, prevent unauthorized alterations, verify physical existence, and provide a basis for sound change management. CM is enabled by controls which identify and record all information technology assets and their physical location, and a regular verification program which confirms their existence. CM ensures that hardware, software, data management, and telecommunications resources are maintained and procured in accordance with organizational standards. Some of the CM activities include (1) maintaining configuration baseline integrity, (2) programming access authorization controls, (3) recovering configuration items and change requests at any point in time, and (4) performing periodic evaluations of the configuration recording function.

QA and CM functions are vital to the efficient and effective operation of information technology activities within the House. HIR is responsible for the support of all House information technology activities, and it must provide sufficient QA and CM support to ensure that House systems meet user needs.

HIR needs to adequately define the QA and CM functions and provide appropriate resources for those functions

HIR established the QA and CM functions and assigned those functions to the HIR Security Group, as part of the HIR reorganization approved by the CHO in late July 1998. These functions were assigned to one staff person. According to the position description, the incumbent must:

However, other important activities, such as system documentation reviews and signoff and post-implementation reviews, which are essential parts of both the QA and CM functions, are missing from the position description. For example, specific QA procedures would include: (1) validation, verification, and testing; (2) monitoring of development and testing activities, and change controls; (3) data integrity assurance; and (4) reviews and audits. In addition, the QA/CM staff person is not performing the activities defined in the current position description—that individual’s activities have been limited to Year 2000 testing. Without a good QA program HIR cannot assure the development or modification of the House’s systems have been subjected to thorough verification, validation, testing, certification, and accreditation, and that systems adequately meet the operational and security needs of the users. Without a good CM program, HIR has no assurance that new House information technology systems can be properly integrated with existing systems, or replace older systems.

Several factors have impacted HIR’s ability to fully perform the QA and CM functions. First and foremost, HIR has not adequately defined the QA and CM functions to ensure that all necessary activities are carried out to meet the House’s needs. Neither high-level goals or detailed pertinent activities associated with the two functions could be found in a mission statement, objectives document, or group responsibilities document. In addition, HIR has not identified the necessary tools and techniques to enable staff to effectively carry out QA and CM activities such as life-cycle validation, verification, and testing and tracking system configuration changes. Further, HIR has not identified the staffing necessary to meet the QA and CM needs. Finally, HIR has not developed adequate QA and CM policies and procedures. For example, HIR’s current and proposed SDLC policies address some aspects of the QA function from a high-level. However, QA procedures for the following areas have not been developed: (1) validation, verification, and testing, (2) monitoring of development and testing activities, and change controls, (3) data integrity assurance, and (4) reviews and audits. The successful achievement of these latter factors is dependent upon fully defining the QA and CM functions. Without clearly defining the QA and CM functions, HIR cannot be assured that the QA and CM functions will meet the goals of the CAO and the information systems needs of the House.

Recommendations

We recommend the Chief Administrative Officer:

  1. Identify and clearly define the QA and CM functions and activities to meet the House’s needs.
  2. Identify and acquire the necessary tools and techniques and staffing to fully support the QA and CM functions.
  3. Develop comprehensive QA and CM policies and procedures.
Management Response

On November 9, 1998, the Office of the CAO concurred with this finding and the recommendations (see Appendix). According to the response, the incumbent for the QA/CM position was hired August 8, 1998, and is tasked to create the initial Configuration Management Plan. This plan will provide the detailed guidance for implementing Configuration Management for hardware and software including any associated documentation in support of HIR software integration/development and hardware configurations. The final objective is to construct and implement the CM system. This plan is intended to apply to all documentation, computer programs, tools and processes used in the production of all HIR systems, including, but not limited to, source, object, and executable load images. The draft plan is expected to be completed in the second quarter of 1999.

In support of quality assurance and configuration management for the Year 2000 independent testing process, HIR has purchased software from Platinum Technologies. It is intended that prior to production certification of systems that are remediated, renovated, or replaced, those systems will come under control of this configuration management software. Approval of purchase is expected in November 1998. Staffing will be addressed as a result of assessing the QA/CM plan and the implementation of the current tool set. As such it will be assessed in the second quarter of 1999.

In performing the activity to address Recommendations 1 and 2 above, a plan for the development of the policies and procedures will be developed. Creation of the appropriate policies and procedures will occur following the plan's approval. This action will commence in the third quarter of 1999 and will be completed as indicated in the approved plan.

Office of Inspector General Comments

The actions planned are responsive to the issues identified and, when fully implemented, should satisfy the intent of the recommendations. Furthermore, the milestone dates for completing the actions appear reasonable.

Finding D: Procurement Desktop Should Be Extended To The Office of the SAA, Office of the Clerk, and Other House Offices

The Office of the CAO provides procurement and purchasing support to Member, Committee, and other House offices. The Office of the CAO has taken steps to improve its support by upgrading procurement and purchasing processes, including the implementation of PD).3 The Office of the CAO has implemented PD in HIR, OPP, and MSS and plans to rollout PD to other CAO offices during Fiscal Year 1999.

However, the Office of the SAA, Office of the Clerk, and other House offices continue to use a paper-driven system to support procurement of goods and services. By implementing PD in those offices, the procurement and purchasing process could be streamlined and economies could be achieved. However, there are no documented plans to provide PD to the Office of the Clerk, Office of the SAA, or other House offices.

The Office of the Clerk, the Office of the SAA, and other House offices outside the Office of the CAO continue to use a paper-driven system to support procurement of goods and services. While the Office of the CAO performs the procurement function for the Office of the SAA and other House offices in most cases, the Office of the Clerk still performs many procurement processing functions. For example, while OPP assists the Office of the Clerk on most major contracting activities, the Clerk’s office is still handling purchase order preparation, vendor identification, quotes collection, vendor visits for demonstrations, Requests for Proposal preparation, and procurement package assembly.

Implementation of the PD system will provide all House offices with significant efficiencies, including:

The implementation of PD by the Office of the CAO is a significant step toward improving procurement and purchasing functions in the House. Expanding the use of PD to all House offices can provide a mechanism to streamline procurements, reduce administrative burden, and eliminate duplication of procurement processing effort. In addition to the automation it provides, PD can reduce procurement lead-times and ensure consistent implementation of policies and procedures. OPP personnel have indicated that the CAO desires to implement PD in other House offices, however this has not been included in Office of the CAO budget or strategic plans for the next two years.

Recommendation

We recommend the CAO extend the implementation of PD to the Office of the Clerk, Office of the SAA, and other House offices, as soon as possible.

Management Response

On November 9, 1998, the Office of the CAO concurred with this finding and recommendation (see Appendix). According to the response, the CAO will re-prioritize its PD implementation planning and prepare a proposal, for submission to the CHO, to extend PD implementation to the SAA, Clerk and other House offices by the end of FY 2000.

Office of Inspector General Comments

The action planned is responsive to the issue identified and, when fully implemented, should satisfy the intent of the recommendation. Furthermore, the milestone date for completing the action appears reasonable.


<