MEMORANDUM Legislative Fiscal Office 900 Court St. NE, Room H-178 Salem, Oregon Phone FAX

Transcription

1 MEMORANDUM Legislative Fiscal Office 900 Court St. NE, Room H-178 Salem, Oregon Phone FAX To: Joint Ways and Means Information Technology Subcommittee Joint Committee on Ways and Means From: Robert L. Cummings, Principal Legislative Analyst (IT) John Borden, Principal Legislative Analyst Date: May 26, 2015 Subject: Oregon State Treasury: HB 5041 POP #102 Cash Management Improvement and Renewal Program (CMIRP) Projects (ACH, LGIP, and CB projects) LFO Analysis and Recommendations Agency Request: Within HB 5041 Policy Option Package (POP) #102, the Oregon State Treasury (OST) has made a request for Other Funds expenditure limitation in the amount of $4,490,000 (modified), to continue the execution of its Cash Management Improvement and Renewal Program (CMIRP) efforts. The CMIRP Program currently contains three interrelated projects: 1) the Automated Clearing House (ACH) Business Systems Renewal (BSR) Project ($200,000 for the implementation phase, including quality assurance and control, and $750,000 for ongoing biennial costs); 2) the Local Government Investment Pool (LGIP) Business Systems Renewal (BSR) Project (up to $2,200,000 for the implementation phase, including quality assurance and control, and $880,000 for ongoing biennial costs); and 3) the Core Banking (CB) Business Systems Renewal (BSR) Project ($150,000 for business case development, including quality assurance and control, and $310,000 for mitigation activities). The revenue to support this request is from charges to participating entities on the value of short term cash balances as well as banking transaction fees. Both the ACH and LGIP (BSR) projects began with a business case phase and are now ready to move into their implementation phases. The funding requests in POP #102 related to the ACH and LGIP (BSR) projects are directly associated with implementing the vendor solutions recommended in their business cases. The funding request for the CB (BSR) Project is for project startup activities. A. LFO Analysis ACH and LGIP (BSR) Projects LFO has been working with OST on the ACH (BSR) Project and the LGIP (BSR) Project since the December 2012 Emergency Board meeting when OST first identified the operational problems and failures that it was experiencing in its ACH, LGIP, and CB processes. While OST s initial focus was the LGIP (BSR) Project (due to the immediacy of its needs), OST s discussions with the Legislature included all three business system renewal efforts included in the CMIRP Program. OST received approval to proceed with the business case components of both the ACH and LGIP (BSR) projects in the 2013 legislative session. The overall schedule and timeline for the CMIRP Program showed the Page 1 of 5

2 ACH and LGIP efforts running in parallel, and also included the proposed schedule for the CB (BSR) Project. Once OST s CMIRP Program package was approved by the 2013 Legislature, OST began meeting with LFO to begin the more formal planning for the ACH and LGIP (BSR) projects business case efforts. OST has regularly updated LFO throughout 2014 on the business case efforts for both the ACH and LGIP (BSR) projects. In addition, it has voluntarily worked to comply with the recently implemented Joint State CIO/LFO Stage Gate Review Process on both of these projects. It is important to note that while both of the initial OST projects for ACH and LGIP were labeled business case projects, they were, in fact, much more and included a wide range of additional planning and design work related to preparing for the planned implementation of re engineered processes for both the ACH and LGIP business functions of OST. Because both of these projects were not the common systems development type IT project, but rather hybrid projects that encompassed business process reengineering and the outsourcing of both business and information technology processes to an external financial service provider, the stage gate process and its associated deliverables were modified to better fit the specific needs of these OST business process re engineering projects. The stage gate oversight process is summarized in the table below. The process includes four basic project stages, each with key expected deliverables, and additional associated actions that must be completed to gain OSCIO endorsement for each of the four key stage gates. Because OST is not an Executive Branch agency, OST was not required to obtain an OSCIO endorsement for each of the four stage gates. However, within the normal stage gate review process, LFO also utilizes the same processes and deliverables to make its own corresponding assessment of agency progress within each stage gate. While there were no OSCIO reviews of OST deliverables, LFO did provide reviews of OST s key deliverables for each of the first three stage gates. Stage Gate Pre Planning Purpose Key Deliverables/Actions Required at Each Stage Gate Internal agency project concept related documents. #1 High level (H/L) Planning POP, H/L business case, workplan, and risk analysis. #2 Detailed Business Case, Project Management Planning, and Transition to Detailed Planning #3 Detailed Planning, Readiness & Ability Assessment, & Transition to Project Execution #4 Project Closing and Transition to Operations Project charter, detailed business case, workplan, risk analysis, requirements, statement of works (SOW s), QA vendor hired, initial QA risk/qc assessments, etc. Project management plans (15+), rebaselined workplan, RFP s, contracts/sow s, quality management plan (QMP), fall back plans, etc. Executed contracts and amendments, updated business case & IRR, risk logs, status reports, QA reports, SDLC related docs, etc. Post Implementation Reviews (PIR s), closeout/lessons learned reports, benefits realization reports, and other documents deemed relevant by the State CIO or LFO. OST has worked with LFO to identify the key stage gate project management deliverables to develop to facilitate the proper management and oversight of both the ACH and LGIP (BSR) projects. Page 2 of 5

3 The following key stage gate #2 and #3 documents have been completed and associated actions have been undertaken for each project: 1. Detailed business case and supporting high level workplan (i.e. schedule, project costs, resource plan, and risks analysis); 2. Requirements; 3. Detailed project work breakdown structure (WBS) and associated detailed workplan; 4. Project charter (including scope statement, deliverables, roles & responsibilities, etc.); 5. Project management plan; 6. Project governance plan, including steering groups and external stakeholder groups; 7. Communication and transition plans; 8. Project control infrastructure (i.e., requirements management, scope control, risk and issues management, vendor management, etc.); 9. Business process reengineering plan (BPR) including a current and future business state analysis; 10. A vendor evaluation and selection process; 11. Selection of implementation and operations vendors (including solution platforms); 12. Quality assurance (QA) vendor; 13. Quality assurance vendor completed initial risk assessment; and 14. Regular project status reporting (internal and external stakeholders and oversight). Early in 2014, OST retained a QA vendor (Hittner & Associates) which provided periodic reports throughout the Spring and Summer of Additional follow up activities were also conducted in the Fall of 2014 as part of the original QA contract. This contract ended in the late Fall of 2014, and in December, OST made a decision to re engage Hittner & Associates for the implementation phases of both the ACH and LGIP (BSR) projects. OST worked with DAS throughout the period December 2014 to early March 2015, to get a contract in place. In March 2015, Hittner & Associates was finally brought on board. From the monthly written status reports that OST has regularly provided LFO since September 2014, it appears that both the ACH and LGIP (BSR) projects are on schedule and within scope. Detailed budget tracking information is not provided within the monthly status reports for either project (other than state staff expenditures) to allow LFO to verify that either project is within budget. Hittner & Associates recently completed an Initial Risk Assessment Report (April 14, 2015) on both the ACH and LGIP (BSR) projects, which provides some additional status and risk related information. This risk assessment showed both the ACH and LGIP (BSR) projects as being at medium risk for overall project health, budget, schedule, scope/quality, and resources. In addition, the assessment did identify two high risk areas of concern: 1) delivery commitment schedule and 2) the current mix of team skills. Hittner s concerns related directly to questions concerning the availability of definitive and firm vendor delivery dates, and the overall feasibility of the proposed schedule. Hittner reported that the long term project schedule still has many outstanding questions for both the LGIP and ACH implementations, and recommended that OST work with U.S. Bank to gain more understanding of all project implementation ramifications. Hittner also expressed concerns related to the current mix of team skills on the ACH and LGIP (BSR) project teams. Their concern was whether the project teams and contractors that will be supporting each project have an appropriate mix of technical skills to accomplish the scope of work being Page 3 of 5

4 proposed in both efforts. In particular, Hittner expressed concerns about the ability of OST to obtain needed MicroSoft.Net development skills in a timely manner, and recommended that OST begin preparing immediately for.net training and also work to procure a.net developer to assist with development and mentoring. OST is currently working on mitigation strategies for both of these high risk findings. In addition, it is important to note that due to OST s difficulty in getting a QA on board, that the quality control reviews of all key project management documents for both projects have not been completed. OST has completed its selection of its final solution (vendor and platform) for both the ACH and LGIP (BSR) projects. For the ACH (BSR) Project, the final solution is U.S. Bank s SinglePoint/Direct Send Platform. For the LGIP (BSR) Project, the final solution is U.S. Bank s Enhanced CashCon Platform. Final contracts have been developed but OST s signing is awaiting legislative approval of the funding requested in POP #102. Both of these selected solutions totally eliminate OST s middleman role in the current business processing done by OST. Core Banking (BSR) Project With respect to the status of the Core Banking Business System Renewal Project, OST has submitted to LFO the required stage gate #1 deliverables (i.e., POP, high level business case, high level workplan, and risks analysis), and is asking for $150,000 in funding to complete stage gate #2 deliverables, including the foundational detailed business case. Based upon the evidence provided by OST to date, LFO believes that OST has met the requirements for stage gate #1, and that it is ready to begin the development of stage gate #2 deliverables. In addition, OST has provided LFO with sufficient justification for why it also needs an additional $310,000 in funding to retain hard to find technical skills needed during both the implementation and operational phases of the project. This problem is exacerbated by the pending retirement of key OST technical staff who have both intimate knowledge of the existing systems, but who are also highly trained in many of the technical skillsets that will be needed throughout the life of the CB (BSR) Project. B. LFO Recommendations LFO recognizes the importance of POP #102 and the significant risk mitigation and benefits that may accrue from re engineering OST s key internal business processes related to the ACH, LGIP, and CB (BSR) projects. The two in progress re engineering projects (ACH and LGIP) are both ready for a final readiness ability assessment, and are seeking funding to begin the implementation of their selected transformational solutions with U.S. Bank. The Core Banking (BSR) Project is just starting and is between stage gates #1 and #2, where a detailed business case and supporting workplan is needed to help better define the problem to be solved and the best solution for solving it. Based upon LFO s review of the status of each of OST s three business system renewal projects, LFO recommends incremental, conditional approval of Policy Option Package #102 assuming the spending authority and personnel resources are made available to OST within the adopted budget. Specifically, the LFO recommends that OST: Work with Hittner & Associates to address all outstanding areas of high risk identified in its Initial Risk Assessment Report Deliverable 5.1 April 14, Page 4 of 5

5 Work with LFO to immediately conduct a formal readiness/ability assessment for both the ACH and LGIP (BSR) projects, to validate readiness and ability to proceed on project execution and implementation. Continue to follow the Joint State CIO/LFO Stage Gate Review Process throughout the life of each project. Regularly (at least monthly) report project status to the appropriate internal OST oversight groups (i.e., steering committees, etc.) and LFO throughout each project s lifecycle. Review/update/develop the business case and supporting workplans, as required, for the CB (BSR) Project. Advise internal OST stakeholders and LFO of any significant changes to project scope, costs, and schedule for all projects. Utilize a qualified project manager(s) with experience in planning and managing projects of this type, scope, and magnitude of the CB (BSR) Project. Continue the development of required foundational project management documents, and provide all key documents to the QA vendor for quality reviews. Obtain independent quality management services for the CB (BSR) Project. The contractor shall: - Conduct an initial risk assessment and respond to OST feedback. - Perform quality control reviews on the key project deliverables including the business case, individual cost benefit/alternatives analysis documents, and foundational project management documents as appropriate. - Perform ongoing, independent quality management services as directed by LFO. Provide LFO with copies of all QA vendor deliverables for all projects. Submit updated detailed business cases, project management documents, initial risk assessments, and quality control reviews to LFO for review. Complete a formal project close out report upon completion of all projects. Motion on the LFO recommendations C. Final IT Subcommittee Action Transmit the Information Technology Subcommittee recommendations to the General Government Subcommittee of the Joint Committee on Ways and Means. Page 5 of 5