This article is an excerpt from the 2020 edition of The Art of Tendering: A Global Due Diligence Guide, which is available for purchase.
In its January 2019 report entitled Information Access and Privacy Information Technology Projects, the Auditor General of Nova Scotia found that the government failed to maintain proper confidentiality protocols in its technology projects due to weak risk management and project management practices. The report recommended that the government clarify the mandate of its technology oversight body so that project teams had a better understanding of their reporting obligations:
The Department of Internal Services should clearly define the scope of responsibilities of the Architecture Review Board and ensure stakeholders clearly understand what [information technology (IT)] projects should be submitted. The scope should include new IT systems or changes to existing systems and should require a full scope of documentation and testing.
Furthermore, while it found that the project team had expertise in access and privacy issues, the Auditor General found that it did not have the technology expertise necessary to navigate complex IT projects to ensure the protection of confidential information in new government systems:
From the beginning, the Department did not mitigate the risks associated with the overall project sponsor, who, although experienced with freedom of information and privacy issues, had limited IT experience or knowledge. We do not expect all project sponsors to be familiar with IT projects, but it is important for the Department to identify this risk and take steps to ensure appropriate expertise is in place to provide support.
With a project sponsor inexperienced in IT, the Department should have taken steps to ensure there was IT project management expertise on the team that was focused on managing risks, including IT risks, to the Province. This expertise could have come from a Provincial employee or a contracted consultant.
In fact, the audit found that the government placed an inordinate amount of responsibility on its contractors to ensure that technology standards were properly implemented and that project teams lacked the necessary expertise to oversee those same contractors.
In one example, the Auditor General found that the government’s Accesspro project, which focused on the implementation of the new public access request software with case management, redaction, and reporting functions, actually had no project manager at all. Unsurprisingly, the Auditor General found weak overall project management practices in this project, as evidenced by the failure of the project team to properly document a project charter or integrate risk mitigation strategies into its overall procurement plan:
Poor project management led to many issues throughout the Accesspro project. We found several key documents, including the initial Accesspro project charter, were left unsigned, or were incomplete. We also noted many instances of missing supporting documentation, including meeting minutes, key milestone approvals, evidence of user acceptance testing, a project plan, and a close-out report.
The project charter for the Accesspro project was never signed and it lacked key components, particularly around risk assessment. A strong project charter is intended to lay out the basics of a project and serve as a guide for what the project should entail, what it is intended to accomplish, what the possible challenges or risks to success are, and how management will deal with those risks. Failing to complete a strong project charter meant the Accesspro project began without a clear plan and it significantly increased the chances the project would fail.
The Accesspro charter included some project risks, such as the Information Access and Privacy Division’s lack of established policies and procedures, impact of summer holidays, and availability of staff throughout the project. However, the charter did not include mitigation strategies for those risks.
Several other types of risks, including reputational risks (public confidence in government), financial risks (costs of project overruns), and regulatory risks (breach of privacy related legislation), had not been considered. In addition, the impact of the significant organization changes happening in the Department were not included.
Moving forward, the Auditor General recommended that the government ensure that adequate project management expertise is in place for all future projects.
As this report illustrates, the failure to properly staff procurement projects and to ensure appropriate internal project management practices puts those projects at risk of failing to meet proper operational standards in project implementation.
