| |
Search Options | |||
| Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us | |
|||
| Home > Electronic Reading Room > Document Collections > Inspector General Reports > 1996 > OIG/96A-15 |
Contents
Office of the Inspector General
U.S. Nuclear Regulatory Commission
Washington, DC 20555
Review of NRC's Progress in Developing and Implementing an Integrated Payroll/personnel System (PAY/PERS)
September 30, 1996
| Memorandum to: | James M. Taylor Executive Director for Operations |
| From: | Thomas J. Barchi /s/ Assistant Inspector General for Audits |
| Subject: | Review of NRC's Progress in Developing and Implementing an Integrated Payroll/Personnel System (PAY/PERS) |
Attached is the Office of the Inspector General's audit report entitled, "Review of NRC's Progress in Developing and Implementing an Integrated Payroll/Personnel System (Pay/Pers)."
On September 5, 1996, the Deputy Executive Director for Nuclear Materials Safety, Safeguards and Operations Support responded to our draft report. He agreed with our recommendations and also provided points of clarification. In response to the DEDO's comments, OIG modified the report as we deemed appropriate.
Attachment:
As stated
| cc: | H. Thompson, OEDO J. Milhoan, OEDO J. Blaha, OEDO J. Hoyle, SECY K. Cyr, OGC D. Rathbun, OCA R. Scroggins, OC P. Norry, ADM G. Cranford, IRM R. Bangart, OSP W. Russell, NRR E. Jordan, AEOD D. Morrison, RES C. Paperiello, NMSS J. Funches, ICC W. Beecher, OPA H. Miller, RI S. Ebneter, RII A. Beach, RIII L. Callan, RIV OPA-RI OPA-RII OPA-RIII OPA-RIV OPA-RIV-FO |
The Nuclear Regulatory Commission (NRC) has been planning and developing an integrated payroll/personnel system (Pay/Pers) since early 1992. Three offices, the Office of Information Resources Management (IRM), the Office of Personnel (OP), and the Office of the Controller (OC) are involved in this effort. The time and attendance (T&A) module was implemented in February 1996, and the current implementation date for the remainder of the system is March 1997. OIG's review of the development and implementation efforts focused on determining if user needs are being met, the adherence to schedule and costs, and the adequacy of T&A internal controls.
OIG found that (1) OP believes that its needs will not be met when Pay/Pers is scheduled to become operational (March 1997), (2) the implementation date although more than six months away, may be optimistic, (3) one module was indefinitely deferred and the eventual cost of both the module and final system is unknown, and (4) the system testing process needs improvement.
We also found that there was inadequate coordination and communication between IRM and OP management. As a result, misunderstandings about the final product may delay implementation. In our recent report entitled, "Improvements Needed in Agency Oversight of Information Resources Management Activities," we noted that systems development efforts could benefit from an agency-wide approach and focal point. As noted in that report, we believe that the Pay/Pers system development and implementation effort is a system development effort that demonstrates the need for a senior level official to oversee major information resources management activity.
Our report makes two recommendations to address the issues identified.
The Nuclear Regulatory Commission (NRC) has been planning and developing an integrated payroll/personnel system (Pay/Pers) since January 1992. The first segment of that system, an automated time and attendance module (T&A) was implemented in February 1996, with the remainder of the system scheduled for completion in March 1997. Because the completed system will play an important role in NRC's personnel and financial management capabilities, the Office of the Inspector General (OIG) conducted an audit of system activity. OIG's review of the development and implementation efforts focused on determining if user needs were met, the adherence to schedule and costs, and the adequacy of T&A internal controls. Appendix I provides additional information on our objectives, scope, and methodology for this review.
NRC has approximately 3200 employees and more than 17 different pay plans and salary tables. The Payroll Branch, a component of the Office of the Controller (OC), handles the payroll functions. The Office of Personnel's (OP) activities are dispersed among headquarters, satellite, and regional personnel offices. The Office of Information Resources Management (IRM) provides guidance and centralized support for management information systems.
In January 1992, a Payroll/Personnel System Study Team was formed to identify, analyze, and evaluate the options available for a new payroll and personnel system. The study was prompted by several factors including the age and lack of flexibility of the existing systems, the lack of an automated interface between the payroll and personnel systems, the need for a master employee record, and, later, the need for labor cost distribution capability. OC, OP, and IRM participated in this process.
The study evaluated other agencies' payroll and personnel systems and services as a replacement for NRC's system. In Circular A-127(1), the Office of Management and Budget (OMB) discouraged new systems development in that area. The Circular states that custom developments will be the last resort for new financial management systems. In August 1992, the study team reported that no ideal system was available. Of the systems evaluated, the team found that the Department of Health and Human Services' (HHS) IMPACT system most closely met the NRC's requirements. The team noted, however, that the advantages and disadvantages of the IMPACT system needed careful consideration. Three issues concerned the study team: (1) the responsiveness of HHS management and liaison staff, (2) HHS's lack of experience in converting other agencies, and (3) the need for additional hardware and software. Based on the study team's reservations and recommendation, an in-depth review of the HHS payroll/personnel system was initiated in January 1993.
This effort progressed for about nine months. As the effort continued and more difficulties were encountered, NRC hired a contractor to explore other candidate systems. In September 1993, the contractor reported that the Federal Bureau of Investigation's (FBI) Bureau Personnel Management System (BPMS) offered the most promise.
In November 1993, the HHS project final report recommended that NRC discontinue further consideration of the HHS option because of the concerns expressed above and additional concerns with HHS' system's features and architecture. At the same time, NRC began an in-depth review of the FBI/BPMS system.
In June 1994, NRC produced a detailed analysis correlating the FBI/BPMS features with NRC requirements. Each NRC requirement was described in an issue paper that contained an issue description, discussion, recommendations, impact assessment, and other information needed for tracking, reporting, and system implementation planning. NRC staff and a contractor developed 245 issue papers. NRC maintains these papers as living documents, and updates them as needed through the system implementation process. A version of the FBI/BPMS system was subsequently installed on a mainframe computer at an HHS facility. In September 1994, work began on customizing the system to meet NRC's requirements. NRC estimated that about 50 percent of the system would need modification.
IRM, OC, and OP established two teams to manage the project. A project team, consisting of representatives from each of the three offices generally met weekly to discuss issues such as user needs, system security, staffing, schedule, and other issues. A senior management team, consisting of the Deputy Directors of IRM, OC, and OP, met as needed for project team briefings and to discuss systems-related management issues, including progress toward meeting major milestones.
Although each office planned to give the project the resources and staff attention needed, other business needs occasionally diverted resources from the project. At the present time, IRM, OC, and OP are committed to providing adequate resources for the remainder of the project. However, they also recognize that other priorities may affect the level of resources applied.
The Pay/Pers system was scheduled for completion in September of 1996, with the T&A portion to become fully implemented in September of 1995. However, implementation of the T&A module slipped by about five months to February 1996. IRM explained that the slippage was primarily due to the additional time needed for developing Graphical User Interface (GUI) screens(2) and developing and implementing credit hours requirements. Full implementation of Pay/Pers is now scheduled for March 1997.
Despite an extensive planning process, including an interoffice team approach to development and implementation, we found that (1) unmet user reporting requirements may delay system implementation currently scheduled for March 1997, (2) project costs were not tracked or controlled, and (3) a formal test plan is needed before implementing the remaining system module.
Our review found that OP believes that its reporting requirements will not be met if Pay/Pers becomes operational when scheduled in March 1997. Due to inadequate coordination and communication, IRM and OP did not share a common understanding of OP's needs. Although reporting criteria were established in user requirements, these criteria lacked specificity. As a result, the scheduled implementation date for Pay/Pers may be optimistic if OP's needs are not satisfied.
Early in the project, OP and IRM recognized that the Pay/Pers system would not satisfy all of OP's reporting needs. Therefore, they decided that Pay/Pers would provide certain reports and additional reports would be available from a second set of systems(3) (a client-server) that IRM was developing for OP. Reporting requirements were outlined in the Pay/Pers implementation plan dated March 1994 and remained unchanged as of June 1996. These documents lacked specifics as to the interface needed. Although IRM was developing these systems as two distinct projects, OP considered them co-dependent. According to OP, their initial and continuing expectation is that the client-server reports will be available when Pay/Pers becomes operational.
The client-server reports were scheduled to be available before Pay/Pers was initially scheduled for implementation. However, several problems arose with the client-server development effort causing it to fall far behind schedule. In fact, a new milestone schedule for the client-server systems is currently being developed. IRM is uncertain whether the client-server development and testing effort will be completed at the same time as Pay/Pers.
OP does not believe it can operate effectively without the client/server reports, and states that it may not be able to convert to Pay/Pers without them. OP advised us that it needs these reports to meet NRC and Office of Personnel Management reporting requirements.
IRM stated that it can implement Pay/Pers in March 1997. IRM is concerned, however, that OP may not be willing to include the personnel portion of the database in the Pay/Pers system on that date. Because both the payroll and personnel portions of the Pay/Pers system will share a common database, IRM does not believe it can implement the payroll portion without the personnel portion of the system. Thus, Pay/Pers may incur schedule delays, depending on the work necessary to provide the required personnel reports.
In our recent OIG audit entitled, "Improvements Needed in Agency Oversight of Information Resources Management Activities," we noted concerns with NRC's cost management practices for systems development efforts. We have similar concerns with Pay/Pers' cost management.
We found that costs have not been sufficiently monitored or controlled for the Pay/Pers project. IRM's practice is to monitor costs by contract. Since Pay/Pers is one project under a master contract, its distinct costs are not tracked. Although IRM prepared an original budget for total project costs, this budget was not used as a baseline for comparison with actual costs. It appears that as long as funding sources are available, Pay/Pers project costs can increase. We believe that without effective cost management practices and accountability, there is less incentive to contain costs.
As of May 1994, the original Pay/Pers budget for development, operations, and maintenance was estimated at $4.9 million for fiscal years 1994 through 1997. As of July 1996, the Pay/Pers budget estimate had increased to $5.9 for that same period, and IRM expects the bulk of development efforts to be completed by that time. Some of the increased costs were due to increased effort to develop GUI screens and to implement a new agency requirement for credit hours.
The current estimated cost through FY 1997 does not, however, include labor cost distribution capability, which was originally envisioned as a part of this system. Thus, if these costs are included, we believe total system development and operating costs will increase.
Labor Cost Distribution Capability Has Been Deferred
An added motivation for obtaining a new payroll and personnel system was NRC's need for labor cost distribution capability. This capability has been deferred and a schedule for development and implementation is unknown at this time. The labor cost distribution system (LCDS) was to be a separate module of the Pay/Pers system and was originally scheduled to be operational with the T&A module. OMB recommends labor cost distribution, and the lack of this capability will result in a continued reportable condition in the agency's financial statements.
While planning the LCDS, the Pay/Pers management team realized that numerous manpower tracking systems existed throughout the agency. An agency-wide LCDS, in addition to these existing systems, would require repeated entry of manpower tracking data for some offices. IRM tasked a contractor to study NRC's many manpower tracking systems and determine whether the agency might benefit from a "single input vehicle" instead of an LCDS and numerous manpower tracking systems. The study recommended that systems development for a single input vehicle with LCDS capability undergo a viability study and then consider implementation. This was recognized as a large systems development undertaking that would require the participation of numerous program offices.
As a result of the single input vehicle study, the Pay/Pers management team decided to defer development of an LCDS until after the remainder of the Pay/Pers system becomes fully operational. While the management team has recognized the potential benefit of a single agency-wide manpower reporting system, the total cost of this system and its effect on the total cost of Pay/Pers is unknown. We believe these costs will be significant.
Our independent testing of the T&A module found that internal controls appear adequate.(4) Although the project team performed documented testing on the T&A module, the testing lacked a sound methodology and formalized plan to ensure all controls were functioning as intended. Therefore, we are concerned about the testing implications for the remaining system modules, especially for pay and benefit calculations. A sound methodology and testing plan is needed to ensure that all control and calculation features are functioning as intended, and that management can have confidence in the system and the financial data it provides. Further, without documented system testing, NRC may not be able to troubleshoot future problems by reviewing and evaluating the testing performed.
The Pay/Pers project team advised that they recognize the need for and value of a sound methodology and documented testing plan for the remaining system modules. The team is developing its methodology and intends to document the testing plan, testing results, and systems adjustments for the system's remaining modules.
NRC's intention to implement the Pay/Pers system in March 1997 appears optimistic. OP and IRM recognized that OP's reports would be produced by the Pay/Pers system and the client server systems. However, they lacked a common understanding of the need for both systems to become operational at the same time. The delay in completing the client server systems may, therefore, impact the plan to implement Pay/Pers in March 1997, as scheduled. OP believes it cannot convert to Pay/Pers unless its reporting requirements can be met.
We believe that coordination, communication problems between IRM and OP were due to vague user requirements and indicate the need for a focal point, such as a Chief Information Officer, to monitor and resolve systems development issues.
Cost management and containment does not appear to be a priority consideration for this project. Actual costs are not compared to a baseline budget to evaluate cost progress and management. Because IRM does not control costs by specific project, it appears that Pay/Pers funding can increase as long as funding sources are available. There appear to be no specific cost limits on the Pay/Pers project.
The delay in redefining and implementing a labor cost distribution capability will increase total costs and result in a continued reportable condition on NRC's financial statements. While the effect on the total cost for the Pay/Pers project, as originally envisioned, is unknown, we believe the effect will be significant. Although this effort is being postponed to better fulfill the needs of NRC as a whole, we believe that the agency-wide ramifications would have been more appropriately considered in the early planning stages.
Two recent OIG reports(5) have emphasized the need for an agency-wide perspective and effective cost management for systems development efforts. We believe these issues apply equally to Pay/Pers and should be considered part of and not ancillary to any systems development effort.
Although documented testing was performed on the T&A module, the testing lacked a sound methodology to ensure all controls were functioning as intended. Because the remaining system modules include sensitive pay and benefit calculations, a detailed testing plan and documented results should ensure a comprehensive review and demonstrate the system's reliability.
Because recommendations pertaining to agency-wide perspectives and cost management for systems development efforts were made in a previous OIG report, they will not be repeated here. However, those recommendations have applicability to Pay/Pers and we will evaluate corrective actions when we perform follow-up work. Therefore, to specifically address Pay/Pers related issues, we recommend that the Executive Director for Operations:
Designate a senior NRC official to monitor, mediate, and if necessary, resolve issues related to Pay/Pers and the client server.
Ensure that the Pay/Pers project team develops, documents, and implements a comprehensive testing plan for the remaining modules.
On September 5, 1996, the Deputy Executive Director for Nuclear Materials Safety, Safeguards and Operations Support (DEDO) provided comments on our draft report. These comments are included as Appendix II.
The DEDO agreed with our recommendations and provided attachments which included the most current version of the Pay/Pers test plan and points of clarification regarding our draft report. In response to the DEDO's comments, OIG revised its report as deemed appropriate.
In one point of clarification, the DEDO stated his belief that Pay\Pers costs were appropriately monitored and controlled. Because there were (1) no cost constraints on the Pay\Pers project and (2) no evaluations of budgeted to actual costs, we continue to believe that costs were neither adequately monitored or controlled.
During the course of our annual Chief Financial Officer's Act audit of the U.S. Nuclear Regulatory Commission (NRC), the Office of the Inspector General (OIG) became aware that a new payroll and personnel information system (Pay/Pers) was scheduled for implementation in fiscal year 1997. Given the impact of this system on the agency's administrative and financial operations, OIG initiated an audit of the work performed on the system to date.
We reviewed the project to ascertain whether user needs were being met, schedules and milestones were accurate, and costs were properly managed. We also tested the internal controls of the first operating module of the system, which provides electronic time and attendance reporting capability.(6)
To conduct this audit, we interviewed senior management and staff from the Office of Information Resources Management, Office of the Controller, and Office of Personnel. We reviewed NRC Management Directives, IRM guidance, and other supporting documents. We also reviewed the Information Technology Management Reform Act of 1996 and guidance from the Office of Management and Budget.
We performed our audit in accordance with generally accepted Government auditing standards from March through June 1996.
United States Nuclear Regulatory Commission
Washington, DC 20555
September 5, 1996
| Memorandum to: | Thomas J. Barchi Assistant Inspector General for Audits |
| From: | Hugh L. Thompson, Jr. /s/ Deputy Executive Director for Nuclear Materials Safety, Safeguards and Operations Support |
| Subject: | Response to Draft Report - Review of NRC's Progress in Developing and Implementing an Integrated Payroll/Personnel System (PAY/PERS) |
This responds to Thomas Barchi's August 9, 1996, memorandum transmitting the subject audit report. With respect to your specific recommendations, the following is submitted:
Recommendation 1
Designate a senior NRC official to monitor, mediate, and if necessary, resolve issues related to Pay/Pers and the client server.
Response
Agree. The authority and functional responsibilities outlined for the agency's Chief Information Officer (CIO) include, in consultation with the CFO, ensuring that financial and other information systems are designed, developed, and used, effectively to provide financial and program performance data. Thus, the CIO would be expected to resolve such issues in the future. Pending the appointment of a CIO, the Deputy Executive Director for Nuclear Materials Safety, Safeguards and Operations Support is addressing the issues noted in your report. There has been ongoing communication between OP and IRM management on the Pay/Pers development effort. While the CIO can assist in resolving issues and professional differences as in the case of the client server, to date there has been no delay to the Pay/Pers development effort due to these issues.
Recommendation 2
Ensure that the Pay/Pers project team develops, documents, and implements a comprehensive testing plan for the remaining modules.
Response
Agree. The agency has developed and is maintaining a test plan that covers all aspects of the NRC's Pay/Pers system and has developed procedures for documenting the results of those tests (see Attachment 1). This plan is a living document that will be revised on an ongoing basis to accommodate testing required by systems modifications enhancements.
In reviewing the draft report, we have identified three points which we believe should be reflected in the report. Please see Attachment 2.
Attachments:
As stated
Figure 1: The U.S. NRC Functional Organization Chart
Anthony C. Lipuma
Team Leader
Judith L. Leonhardt
Senior Auditor
Doris A. Martin
Senior Auditor
An Investigative Report documents pertinent facts of a case and describes available evidence relevant to allegations against individuals, including aspects of an allegation not substantiated. Investigative reports do not recommend disciplinary action against individual employees. Investigative reports are sensitive documents and contain information subject to the Privacy Act restrictions. Reports are given to officials and managers who have a need to know in order to properly determine whether administrative action is warranted. The agency is expected to advise the OIG within 90 days of receiving the investigative report as to what disciplinary or other action has been taken in response to investigative report findings.
The Event Inquiry is an investigative product that documents the examination of events or agency actions that do not focus specifically on individual misconduct. These reports identify institutional weaknesses that led to or allowed a problem to occur. The agency is requested to advise the OIG of managerial initiatives taken in response to issues identified in these reports but tracking its recommendations is not required.
MIRs provide a "ROOT CAUSE" analysis sufficient for managers to facilitate correction of problems and to avoid similar issues in the future. Agency tracking of recommendations is not required.
An Audit Report is the documentation of the review, recommendations, and findings resulting from an objective assessment of a program, function, or activity. Audits follow a defined procedure that allows for agency review and comment on draft audit reports. The audit results are also reported in the OIG's "Semiannual Report" to the Congress. Tracking of audit report recommendations and agency response is required.
A Special Evaluation Report documents the results of short-term, limited assessments. It provides an initial, quick response to a question or issue, and data to determine whether an in-depth independent audit should be planned. Agency tracking of recommendations is not required.
Regulatory Commentary is the review of existing and proposed legislation, regulations, and policies so as to assist the agency in preventing and detecting fraud, waste, and abuse in programs and operations. Commentaries cite the IG Act as authority for the review, state the specific law, regulation or policy examined, pertinent background information considered and identifies OIG concerns, observations, and objections. Significant observations regarding action or inaction by the agency are reported in the OIG Semiannual Report to Congress. Each report indicates whether a response is required.
Notes:
1 Financial Management Systems, dated July 23, 1993.
2 A GUI is a computer display that allows the user to interact with buttons and other graphical elements.
3 These "client/server" systems would include the Agency Training System and other OP systems.
4We tested the T&A module data against related leave and earnings statement information. We also performed various limits tests on the system, randomly testing system edits. System edits for the T&A module include, but are not limited to, controls to ensure that leave charged is not greater than leave available, system access is only granted to persons authorized, and that limits on premium hours earned are not exceeded.
5Selecting, Managing, and Utilizing the M-Cubed Contract, 96E-13, dated April 17, 1996, and Improvements Needed in Agency Oversight of Information Resources Management Activities, 96A-11, dated September 24, 1996.
6In doing as such, we used a 95% confidence interval with a 5% acceptable error rate. Testing a sample of 58 records from a universe of 3331, no errors were found.
|
Privacy Policy |
Site Disclaimer |
