Performance Assurance

Warning This Web page has been archived on the Web.

Review of Health InformationManagement Module

Internal Audit
378-1-207

PDF

April 29, 2009

Table of Contents

Annexes

 

EXECUTIVE SUMMARY

Background

This project review has been performed by the Centre for Public Management in conjunction with Internal Audit of Correctional Service Canada (CSC) to respond to Treasury Board Secretariat (TBS) requirements under the Enhanced Management Framework1 for IT Projects. This engagement was performed to a review level of assurance and covers the Health Information Management Module (HIMM) planning activity since the initial HIMM review performed in 2007.2 The review objectives are to follow-up on the recommendations and related action plans of the initial review and to identify opportunities for improvement which can be implemented while the project is underway to improve its chances of success.

Presently, the health information management activities within CSC are done manually. Since it is becoming increasingly difficult to track, monitor, and report on health services provided to offenders, an automated HIMM will be developed to improve the monitoring of performance measurement indicators such as health trends, health outcomes, and expenditures and to improve planning/forecasting for future policy and programming needs. The objective of the HIMM project is to implement a commercial off-the-shelf (COTS) solution to effectively manage and share information, facilitating the management of health care to CSC’s approximately 12,000 inmates and the allocation of resources for Health Services. The HIMM project is scheduled to be implemented in CSC’s 58 institutions by 2010.

Conclusion

Overall, the review team found that a number of initiatives to strengthen project management were underway and the recommendations from the initial review were being implemented to support this objective.3 However, as the project moves from finalizing the procurement process to implementation, an increased focus on project management will be required. As well, delays in the procurement process may impact the ability of the project to meet its delivery dates. We recommend that when financial and scheduling implications of the procurement delay become clearer, the HIMM project team should promptly inform CSC management and other stakeholders, as required, of the consequences of the delays and take necessary action to ensure effective implementation of the HIMM project.

Opportunities for Improvement

More specifically, over the course of this review, we noted the following opportunities to strengthen the project management processes as the project moves into the implementation phase:

  • In order to ensure that HIMM receives the support necessary during the roll-out and post-implementation phases of the project, the HIMM Steering Committee should ensure that meetings are held regularly;
  • Planning, processes and funding to ensure HIMM end-user training will be coordinated and delivered need to be finalized;
  • As the HIMM project moves from finalizing the procurement process to implementation it will be essential for the HIMM project team to maintain project management resources with sufficient time to address issues and make decisions in a timely manner;
  • When information becomes available, the team should assess and quantify the financial and scheduling implications of the procurement delay and should promptly inform CSC management and  relevant stakeholders, as required, of the consequences of the delays; and
  • Although the Chairperson of the HIMM Steering Committee is a representative from the Health Services Group, without the dissemination of regular communication and reports to Health Services from the HIMM project team on a regular basis, the project may lose visibility and priority. The HIMM project team should ensure that monitoring and reporting initiatives and key project deliverables are shared with relevant stakeholders.

Recommendations have been made in this report to address these areas for improvement. Management has reviewed and agrees with the findings contained in this report and a Management Action Plan has been developed to address the recommendations (see Annex C).

1.0 INTRODUCTION

The tracking, monitoring and reporting of Correctional Service Canada (CSC) health related needs is becoming increasingly difficult with a paper based system as it is a duplicative and cumbersome method of sharing information among health care providers and between correctional facilities. It is becoming increasingly important that an automated HIMM be implemented in order to improve the delivery of health services to offenders, to improve the monitoring of performance measurement indicators such as health trends, health outcomes, and expenditures and to improve planning/forecasting for future policy and programming needs.

The Treasury Board (TBS) approved funding for a HIMM in February 2004 and by March 2005, a Preliminary Project Approval for $16M plus GST4 was received xxx xxxxxxxx xxxx xxx xxxxxxxxx xxxxxxxxxx: XXXX xxxx xx xxxxxxxxx xxxx x xxxxxxxxxx xxxxxx; xxx xxxxxxxxx xxxxxxxxxx xxxxxxx xxxx xxx xx xxx xxxxxxxx XXX xxxxxxx xxx xxx xxxxxxxxxx; xxx xxx xxxxxxxx Xxxxxxxx Xxxxxxxxxx Xxxxxx Xxxxxxx xxxxxxx xxxxxxxx xxxx xx xxxxxxxxx xx xxx XXXX xxxxxxx.

In April 2005, the HIMM project was officially launched with the following system objectives:

  • Strengthen evidence based decision - making for the development and implementation of program policies, practices and initiatives using standard methods for monitoring and tracking healthcare trends and issues;
  • Apply "best practice" initiatives, for prevention, care, treatment and support, based on documented benchmarks and outcome measures;
  • Monitor and evaluate health - related programs and initiatives with a view to ensuring program enhancements, resource allocation, and managing audit reporting; and
  • Provide meaningful communication with healthcare partners, who, along with CSC, are committed to ensuring accurate and appropriate essential medical services to the inmate population.

In spring 2007, an initial HIMM Review was performed by CSC Internal Audit with the assistance of the Centre for Public Management (CPM).5  The following recommendations emerged from that review:

The Senior Deputy Commissioner, in collaboration with the Assistant Commissioner, Health Services should continue to enhance IM/IT project management practices, as they relate to the HIMM project, in particular that:

  • The HIMM business case be updated to reflect the missing components and then kept up to date over the life of the project;
  • A dedicated project steering committee be established, meeting regularly and co-chaired by senior executive within the Health Services Sector;
  • A dedicated project manager be appointed when project activity dictates;
  • The delivery of end user training be included in the project plan; and
  • Communication and accountability between the business representatives on the project and Health Services be strengthened.

This document will articulate the specific observations, recommendations, and management action plans developed through the Annual Review of the Health Information Management Module (HIMM).

2.0 REVIEW OBJECTIVES AND SCOPE

2.1 Objectives

This review is part of a continuing commitment by CSC to conduct a periodic progress review of HIMM by an independent third party. Specifically, this review will assess the progress and current status of the HIMM project.

The objective is to examine the HIMM project undertaken by CSC in order to address the status of recommendations made in the initial review, current work underway, and project plans and directions. The result is to provide Treasury Board Secretariat, as part of the Enhanced Management Framework obligations, and CSC management with an overall assessment of the progress and current status of the HIMM project.

The specific criteria and procedures related to these objectives are included in Annex C.

2.2 Scope

This project is being performed to a review level of assurance and the scope covers all HIMM planning activity since the initial review. Therefore, the review will cover the project lifecycle from April 1, 2007 to the present.6

3.0 APPROACH AND METHODOLOGY

3.1 Criteria Development

Our preliminary survey and risk assessment highlighted the following COBiT areas that would most benefit from a review.7

  • Project governance;
  • Project planning;
  • Project procurement; and
  • Project monitoring and reporting.

The specific COBiT processes selected, and the associated review criteria, are illustrated in Annex B.

3.2 Audit Program Development

Our preliminary survey risk assessment, relevant COBiT goals and metrics, and PMBOK best practices then guided the creation of specific review procedures.8

3.3 Conduct

As part of the review we performed interviews with HIMM project members and key stakeholders. The team also examined supporting documentation to determine whether specific project management processes and / or controls are in place.9

3.4 Debriefs Held with Senior Management

Upon completing of the review field work, the team held a debrief meeting with the senior management on relevant findings and recommendations. Specifically, debriefing sessions included the following individuals:

  • Michael Doucet, Chief Information Officer, Information Management Systems
  • Louise Saint-Laurent , Assistant Commissioner, Corporate Services
  • Gino Lechasseur, Deputy Director General, Systems Development; and
  • MacLean, Leslie; Assistant Commissioner, Health Services;

4.0 FINDINGS AND RECOMMENDATIONS 

4.1 Project Governance

We expected to find that the HIMM project team has defined processes/relationships, established flexible and responsive organizational bodies and governance structure, and has clearly defined roles and responsibilities for all HIMM stakeholders.

4.1.1 HIMM Steering Committee

We expected to see regular steering committee meetings where Health Services is engaged and where there is an appropriate level of discussion with respect to project management, project risks, and roll-out.

While Steering Committee meetings are scheduled in advance, these meetings are frequently cancelled.

Since October 15, 2007 we found that nine steering committee meetings have been cancelled due to the unavailability of committee members; specifically, two out of three were cancelled in 2007 and seven out of 13 were cancelled in 2008. The majority of these cancellations have been proposed by the Health Services Chair of the Steering Committee.

Based on the current stage of the project this is unlikely to have had a substantial negative impact to-date, although over the next phase of the project, Steering Committee interaction and engagement will be increasingly important. Regular and frequent Steering Committee meetings will be vital for ensuring that the needs of Health Services are met over the course of the HIMM project. Through this forum, Health Services also has the opportunity to participate in project direction and convey concerns over progress to-date and milestones. Without active and consistent participation HIMM may lack the required buy-in and support necessary during HIMM roll-out and post-implementation phase of this project.

Lack of evidence that project risks are discussed at Steering Committee Meetings.

The HIMM Risk Management Framework indicates that in addition to the Steering Committee, a governance committee, the Risk Management Committee (RMC), meets on a monthly basis to discuss project risks. Moreover, the HIMM Risk Management Framework indicates that the RMC reviews and recommends risk response strategies and refers them to the HIMM Steering Committee using a Risk Information Sheet. Our review indicated that the RMC meets on an ad hoc basis, and while there are no minutes of these meetings there is a log which indicated monthly risk discussions have commenced in October 2008. This risk review process updates the HIMM risk register, however, there was a lack of evidence of project risks or risk status discussed at the Steering Committee meetings. Evidence of this discussion with respect to changes to the risk register or “no change” would provide assurance that risk mitigation strategies are in place.

Planning processes and funding to ensure HIMM end-user training will be coordinated and delivered need to be finalized.

Of the seven Steering Committee meetings that occurred in 2007 and 2008 only two had discussions pertaining to post-implementation support and no meeting minutes reflected evidence of discussion pertaining to HIMM training.

Although the HIMM Project risk register has identified business transformation risk as high impact and high likelihood and work is underway to deliver a change management workshop to Health Services teams pertaining to HIMM, to date, there are no processes or mechanisms in place that ensure end-user training will be coordinated and delivered.

Xx xx xxxxx xx xxx xxxxx xxxxxxx xxxxxxxxx xx xxxx-xx, xx xxxx xxxxx xxxx xxx XXXX XXX xxxxxxxxxx xxxx xxxxxxxx xxxxxxx xxxxxxxxxxxx xx xxxxx xxx xxxxxxx.  Xxxxxxxxxx xxxxxxx xxxx xx xxxxxxxx xxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx, xxx xxxxx xxxx xxxxx xxx xxxxxx xxxx x xxxxxx xxxxxx xx xx xxxxxxxxx xxx, xxxx xxxxxxxx xxxx xxxxxx xx xxxxxxxxxxx.  Xx xxxx xxxx, xx xxxxxx xx xxxxxxx xxx xxxx xxxxxxxxx xxxxxxxx xxx xxxx xxxxxxxxxx.

Conclusion:

Our review highlighted the frequent cancellation of scheduled Steering Committee meetings. This review also demonstrated the opportunity for Health Services to take a leadership position in the areas of change management and training as it relates to the HIMM development and implementation.

Recommendation #1: 

The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services should ensure that:

  • Once the project moves into the implementation phase, the steering Committee meetings adhere to regular scheduling consistent with project milestones and ensure that risks are discussed and documented in the meeting minutes.

Recommendation #2:

The Assistant Commissioner, Health Services should take a leadership position in defining the change management strategy and end-user training for HIMM, including ensuring that a funding strategy is in place for the training.

4.2 Project Planning

We expected to find an established project management framework, which defines the scope and boundaries of managing projects, and is being implemented and enforced by the HIMM management team to ensure the project will be executed on time, on budget, and within scope.

4.2.1 Project Roles and Responsibilities

We expected to see clear project management roles and responsibilities. We also expected to see individuals in these roles with sufficient availability to execute required project management tasks.

The HIMM Project Manager and Project Control Officer ( PCO ) are not dedicated to HIMM on a full time basis and their time is divided among projects; however, when HIMM is procured and the project moves to the implementation phase,  a dedicated Project Manager and PCO will be increasingly important.

We found that in response to a recommendation made in the first HIMM Review, a PCO was introduced to the project. Originally, he was dedicated to the HIMM project exclusively; however, due to the current phase of the HIMM project his role has changed and now the PCO Administrator’s time is also being divided among projects.

Both the roles of Project Manager and Project Control Officer are integral to the success of the HIMM project in terms of meeting project milestones and objectives.  When individuals in these positions are required to choose from competing priorities with similar timelines it may result in delays. Based on the current stage of the project this is unlikely to have had a substantial negative impact to-date, although once a vendor is selected, a dedicated Project Manager and PCO will be increasingly important.

4.2.2 Project Budget

We expected to find HIMM projected costs are aligned with the HIMM project budget, and that spending was appropriate to the project tasks completed to date.

The financial information received indicates that HIMM total budget is equal to HIMM projected costs and total spending to date is reasonable given the number of project tasks completed to date.

CSC has spending authorization approved by TB in the Preliminary and Effective Project Approval of $16M plus GST10. Xx xxxx xxxx xxx.xX xxxx XXX xxxxxxx xxx xxxxxxx.  Xxxxxxxxx xx xxx Xxxxxxxxx Xxxxxxx Xxxxxxxx XXX xxxx xxxx xxxxxxx xxxxxxxxxxx xxxxx xx Xxxx xxx xx xxxxxxxx xx xxx Xxxx xxx xxxxxxxx xx XX.

Total project spending to date, including O&M, salary, and capital, is summarized in the following table.

Table: HIMM Expenditures to Date

  FY
2005-2006
FY
2006-2007
FY
2007-2008
FY
2008-2009
(as of Jan. 9/09)
Total Expenditures per FY ($) 651,331.00 746,866.00 701,228.00 421,659.00

When total O&M, salary, and capital expenditures to date are aggregated, costs are equivalent to $2.5M. Thus, the HIMM project team has spent approximately 16% of the HIMM total project budget; consistent with the fact that a vendor has not yet been selected.

As a result of project delays, the HIMM project has had to re-profile operating and capital funds to subsequent years. As at February 2009, $5.6M of the $10M operating and capital funds budgeted for 2008-2009 was re-profiled, as CSC expected to procure the software package. However, as the procurement was delayed, a large portion of these funds will not be spent until the 2009-2010 fiscal year. We were informed by the Assistant Commissioner Corporate Services that due to delays in re-profiling the $3.5M earmarked for the software purchase, CSC will be incorporating this amount into the capital envelope and using it for other capital purchases. These funds will be made available to the HIMM project by CSC in the coming fiscal year.

In 2009-10, funding of $8.2M will be received from TBS and the additional $3.5M from CSC will be available, as needed. Financial information received from CSC’s Financial Management Services indicates that projected costs to complete the project are in line with the funding anticipated.

Upon project completion, CSC will have to begin to pay for maintenance as per agreed contractual clauses with the selected vendor and such costs are estimated to be $1.2 annually.11

During the course of our review we faced challenges obtaining financial information about the HIMM project. These challenges were consistent with those faced in the 2007 post closure review of the Offender Management System Renewal project, where opportunities for improvement were noted in the overall project financial tracking and monitoring process. This audit report can be found at http://www.csc-scc.gc.ca/text/pa/adt-omsrpcr-378-1-234/omsr378-1-234-eng.shtml . Given the project delays and the impact on funding measures, it will be important to keep financial information on this project up to date.

We found that due to procurement delays, funding allocated to the HIMM project may require re-profiling beyond the HIMM Effective Project Approval timeline.

As noted previously, with approximately 16% of funds spent towards the HIMM project, it can be assumed that the majority of HIMM funds will be directed towards the procurement and implementation phase of this project. This may require a re-profiling of HIMM funds beyond the current project delivery date.

Conclusion:

HIMM project management processes are generally in place. However, as the project moves from finalizing the procurement process to implementation it will be essential for the HIMM to maintain a Project Manager who has sufficient time to address issues and make decisions in a timely manner. Also, it is essential to have a PCO Administrator with sufficient time to dedicate to the project as he is responsible for the functioning of project management processes, the risk management process, and project scheduling processes. The project appears to be on budget, and expenditures are consistent with the fact that a vendor has not yet been selected, however procurement delays may result in the project not meeting the Effective Project Approval timeline.

Recommendation #3:

The Chief Information Officer, Information Management Systems should enhance IM/IT project management, as they relate to the HIMM project, in particular that:

  • The project manager and project control officer should have sufficient availability to perform all their duties when project activity dictates.
  • Projected costs and time to complete should be formally reassessed, in collaboration with the Assistant Commissioner Corporate Services, once a vendor is selected and the solution determined.

4.3 Project Procurement

We expected that HIMM procurement processes and procedures protect CSC's best interests by ensuring that a complete and cost effective IT solution will be procured.

4.3.1 Procurement Timetable

We expected to find adherence to procurement timetable. Where deviations are evident, we expected to see that the HIMM project team has communicated changes to the appropriate stakeholders and has made the appropriate compensating actions.

We found that setbacks in the procurement process have resulted in delays in the implementation of the procurement timetable.

Setbacks in the PWGSC led Request for Proposal (RFP) and Advance Contract Award Notice (ACAN) processes have led to unmet tasks in the procurement schedule.  Although this delay has been communicated to CSC senior management, the full impact of this delay on delivery dates has not been determined and communicated to all stakeholders. Appropriate communication is vital due to the fact that a delay in schedule may have an impact on resources and scheduling outside the HIMM project team.

Conclusion:

Although the HIMM project team has defined and documented a procurement process, including a procurement timetable, the procurement process has been delayed due to factors external to the team. The full impact of this delay on delivery dates has not been determined or communicated to all stakeholders. As such, it may be necessary for CSC to inform TBS and other stakeholders once the information becomes available.

Recommendation #4:

The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services and Assistant Commissioner, Corporate Services should:

  • When information becomes available, assess the implications of the procurement delay and ensure the timely escalation of activities for implementation where needed and should inform relevant stakeholders.

4.4 Project Monitoring and Reporting

We expected to find that the HIMM project performance monitoring and evaluation process includes the defining of relevant performance indicators, systematic and timely reporting, and prompt acting upon deviations.

4.4.1 Communications and Reporting Framework

We expected adequate interaction/communication between the project team and Health Services. We also expected to see the adequate dissemination of information within Health Services.

The level and adequacy of communication and reporting between the project team and Health Services counterparts should be enhanced.

We found that several highly relevant reporting mechanisms in the communication plan do not include Health Services in the dissemination plan. These include the Master Project Plan, the Project Deliverables, and Project Status Reports.

Although Health Services chairs the HIMM Steering Committee, without the dissemination of these materials to Health Services on a regular basis, the project may lose visibility and priority. Having a record of timelines and status would also assist Health Services in preparing and planning for the transition.

There is no formal means to disseminate information within Health Services (i.e., Clinical Services leadership and staff).

Although a communication plan which outlines the principles, approaches and processes to use to create, implement and maintain effective communication with all HIMM stakeholders does exist, we found that it is not being leveraged to disseminate information throughout Health Services (i.e., Clinical Services leadership and staff).

The engagement of clinical leadership and staff is vital to the success of the project post-implementation and the dissemination of information to front-line users would assist in the change management process.  

Conclusion:

Our review highlighted a limited level of communication and reporting between the HIMM project team and Health Services. This review also demonstrated a formal mechanism to disseminate HIMM information throughout Health Services could be strengthened (i.e., Clinical Services leadership and staff).

Recommendation #5:

The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services should enhance monitoring and reporting as they relate to the HIMM project. In particular:

  • The HIMM project team should ensure that monitoring and reporting initiatives and key project deliverables are shared with relevant Health Services stakeholders.

5.0 OVERALL CONCLUSION

Overall, the review team found that a number of initiatives to strengthen project management were underway and the recommendations from the initial review were being implemented to support this objective. However, as the project moves from finalizing the procurement process to implementation, an increased focus on project management and communication with Health Services will be required. We also found that due to setbacks in the procurement process the HIMM project may not meet its Effective Project Approval timelines. We recommend that when implications of the procurement delay become clearer, the HIMM project team should ensure the timely escalation of activities for implementation where needed and should inform relevant stakeholders.

Annex A

Progress on Initial Review Recommendations12
HIMM Project Team - May 2008

Recommendation
(September 2007)
Action
The HIMM business case be updated to reflect the missing components and then kept up to date over the life of the project. A revised draft business case will be produced with the missing components in the form of an Annex to the existing business case by October 30, 2007. Review and approval of the revised business case with the Business client will be completed by November 16, 2007. It will be presented to Information Management and Technology Sub-Committee (IMTSC) as part of the HIMM project update by December 2007.
A dedicated project steering committee be established, meeting regularly and co-chaired by a senior executive within the Heath Services Sector. Terms of Reference for a dedicated project steering committee were produced by September 15, 2007 for consultation with Health Services stakeholders. The Project Steering Committee will be in effect by October 15, 2007.
A dedicated project manager be appointed when project activity dictates. A Project Manager has been hired for the duration of the project and this position reports to the Deputy Director General, OMS.
The delivery of end user training be included in the project plan. In collaboration with Health Services, an end-user skills assessment will be developed and administered during the winter of 2007/2008. The delivery of end user training will then be added to the project plan.
Communication and accountability between the business representatives on the project and Health Services be strengthened. With the introduction of a revised project steering committee (refer to second bullet above), this recommendation will also be addressed.

Annex B

COBIT Focus Areas and Review Criteria

COBIT Domain COBIT Process Criteria
Plan and Organize PO 4 Define the IT processes, organization and relationships (Governance) The HIMM project team has defined processes/relationships, established flexible and responsive organizational bodies and governance structure, and has clearly defined roles and responsibilities for all HIMM stakeholders.
Plan and Organize PO 10 Manage projects An established project management framework, which defines the scope and boundaries of managing projects, is being implemented and enforced by the HIMM management team to ensure the project will be executed on time, on budget, and within scope.
Acquire and Implement AI5 Procure IT resources HIMM procurement processes and procedures protect CSC's best interests by ensuring a complete and cost effective IT solution will be procured.
Monitor and Evaluate ME 1 Monitor and evaluate IT performance The HIMM project performance monitoring and evaluation process includes the defining of relevant performance indicators, systematic and timely reporting, and prompt acting upon deviations.

Annex C

Management Action Plan

Recommendation Action Summary OPI Planned Completion Date
Recommendation #1:
The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services should ensure that:
  • Once the project moves into the implementation phase, the steering Committee meetings adhere to regular scheduling consistent with project milestones and ensure that risks are discussed and documented in the meeting minutes.
The CIO, in collaboration with ACHS will ensure that, upon contract award and throughout implementation of the HIMM application, the HIMM Steering Committee (HIMM SC) will meet at least once a month, or more frequently if needed, to address project milestones. Prior to a contract award, the SC will meet quarterly consistent with the TORs. All meetings will include an agenda item on risk and risk discussions shall be documented in the minutes of each SC meeting.

Actions
  1. A regular HIMM SC meeting will be scheduled for the last week of April 2009.
  2. TORs will be reviewed and revised to reflect scheduling commitments and other changes.
  3. A recurrent monthly meeting will be scheduled for all SC members once the contract has been awarded.
CIO
  1. April 2009



  2. June 2009



  3. Upon contract award


Recommendation #2:
The Assistant Commissioner, Health Services should take a leadership position in defining the change management strategy and end-user training for HIMM, including ensuring that a funding strategy is in place for the training.
The ACHS will lead the development of a strategy which will introduce the electronic medical record in CSC Health Services operational units. This will include a Change Management Strategy, a training strategy for end users and a funding strategy for end user training.
Once a contract is in place, an end-user training strategy and funding strategy will be developed for planned delivery in 2010/11.

Actions
  1. IMS and HSS will collaboratively develop a Change Management Strategy
  2. Health Services Sector with the assistance of IMS, will plan and deliver a Change Management Workshop to relevant stakeholders on introducing the electronic medical record into a manual documentation environment.
  3. Develop a draft Training Strategy for end-users.
  4. Identify an approach for funding end user training on the HIMM application.
ACHS
  1. Nov. 2009



  2. March 2010









  3. March 2010

  4. March 2010


Recommendation #3:
The Chief Information Officer, Information Management Systems should enhance IM/IT project management, as they relate to the HIMM project, in particular that:
  • The project manager and project control officer should have sufficient availability to perform all their duties when project activity dictates.
  • Projected costs and time to complete should be formally reassessed, in collaboration with the Assistant Commissioner Corporate Services, once a vendor is selected and the solution determined.
The CIO will ensure that the HIMM project has the required human resources to implement the HIMM project.The CIO will ensure that the projected costs are reviewed with the ACCS once a vendor and application are identified.

Actions
  1. IMS will ensure that IM/IT resources are appropriately assigned (Project Control Officer full-time) to the HIMM project following contract signing with a vendor.
  2. The HIMM Project will continue to be part of the IMS Quarterly budget review and reported to the ACCS.
  3. The CIO will conduct a formal review of the project costs and schedule with the ACCS once a vendor and application are identified.
CIO
  1. Upon contract award



  2. June 2009 and ongoing to end of project 2012

  3. Upon vendor selection






Recommendation #4:
The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services and Assistant Commissioner, Corporate Services should:
  • When information becomes available, assess the implications of the procurement delay and ensure the timely escalation of activities for implementation where needed and should inform relevant stakeholders.
The CIO, in collaboration with the ACHS and ACCS will ensure that all relevant stakeholders receive up-to-date information on the status of the project procurement delays. Further, the ACCS will ensure that any further procurement delays are immediately addressed and stakeholders are informed.

Actions
  1. The CIO will communicate directly in writing, with both the ACHS and ACCS to provide updates as soon as information is available on all relevant procurement delays or activities to ensure that the ACHS and ACCS are advised. This communication will include impacts on the HIMM project schedule and budget.
  2. ACCS to continue to meet periodically through the established Strategic Procurement Committee (starting April 2009) to expedite the procurement process and ensure that the CIO and ACHS receive reliable up to date information from PWGSC on the status of procurement.
  3. The ACCS will inform Treasury Board Secretariat of the funding implications as a result of the procurement delays.
CIO
  1. Ongoing until procurement completed











  2. Ongoing until procurement completed









  3. September 2009



Recommendation #5:
The Chief Information Officer, Information Management Systems, in collaboration with the Assistant Commissioner, Health Services should enhance monitoring and reporting as they relate to the HIMM project. In particular:
  • The HIMM project team should ensure that monitoring and reporting initiatives and key project deliverables are shared with relevant Health Services stakeholders.
The CIO, in collaboration with the ACHS will ensure that all relevant Health Services stakeholders receive regular updates on project milestones and deliverables.

Actions
  1. The CIO will share HIMM Project briefing materials with the Chair of the SC and the ACHS for dissemination to relevant stakeholders.
  2. The CIO will prepare bi-weekly status reports on HIMM Project activities, for the Chair of the SC and the ACHS for dissemination to relevant stakeholders.
  3. HIMM project team will continue current project management activities including weekly project updates and monthly risk review with all Project members.
  4. The HIMM Working Group will share information with Health Services, Executive Team (Regional Directors and NHQ Directors General) and minutes of meetings will be available on the HIMM Infonet site.
  5. The HIMM project team will continue to publish quarterly newsletters to CSC operational staff.
  6. The HIMM project team will seek approval on a CSC corporate communications strategy to communicate with all CSC stakeholders.
CIO/
ACHS
  1. April 2009.





  2. April 2010






  3. Ongoing to project completion




  4. Once procurement is completed






  5. Ongoing, next in May 2009

  6. Once procurement is completed




1 The Enhanced Management Framework is designed to ensure that government information technology projects fully meet the needs of the business functions they are intended to support, deliver all expected benefits and are completed on time and on budget.

2 Health Information Management Module - Annual Review, Correctional Service of Canada, September 25th, 2007. http://www.csc-scc.gc.ca/text/pa/adt-himm-378-1-233/himm378-1-233-eng.shtml.

3 Refer to Annex A for progress on initial review recommendations. Information included in Annex A originates from the status report entitled “Progress in Addressing Internal Audit Recommendations” created by the HIMM project team dated May 2008.

4 TBS Preliminary Project Approval as at June 2005

5 Health Information Management Module - Annual Review, Correctional Service of Canada, September 25th, 2007. http://www.csc-scc.gc.ca/text/pa/adt-himm-378-1-233/himm378-1-233-eng.shtml.

6 A review level of assurance involves procedures to reduce the risk of an incorrect conclusion to a moderate level. Review-level procedures are normally limited to enquiry, analysis, and discussion.

7 The ISACA Control Objectives for Information and related Technology (COBiT) are industry best practices that help to optimize IT-enabled investments, ensure service delivery, and provide a measure against which to measure deviations. Refer to Annex B for a description of COBiT focus areas.

8 The Project Management Institute’s Guide to the Project Management Body of Knowledge (PMBOK) is recognized as the global standard and best practice in project management. Refer to Annex C for all relevant criteria, procedures, and sub-procedures developed for this review.

9 Refer to Annex D for the documentation list.

10 TB Preliminary Project Approval as of June 2005, $15,992,626

11 HIMM as of October 20, 2008.

12 The recommendations were all addressed according to the Progress report provided to the Audit Committee in May 2008.