Audit of Inventory Management: IT Assets (Workstations)

September 27, 2017

Table of contents

• Executive summary
• 1.0 Introduction
• 1.1 Background
• 1.2 Audit objective
• 1.3 Audit scope
• 1.4 Audit approach
• 1.5 Conclusion
• 1.6 Statement of conformance
• 2.0 Observations, recommendations and management responses
• 2.1 Governance
• 2.2 IT Workstation refresh strategy
• 2.3 IT workstation lifecycle management practices
• 2.4 Inventory records management
• Annex A: Audit criteria
• Annex B: Acronyms

Executive summary

Agriculture and Agri-Food Canada’s (AAFC) Information Technology (IT) Workstation Refresh Strategy (the Strategy) was developed for the Information Systems Branch (ISB) to have a long-term strategy related to IT workstation refreshment to efficiently manage upgrading and replacing workstations in a predictable, controlled manner. The Strategy aims to establish and fund a five-year lifecycle for standard workstations for both acquisition and deployment efforts. As of October 2016, there were 7,377 standard IT workstations across AAFC.

ISB received funding approval for fiscal year 2016-17 following its proposal for the initial year of the strategy at the Departmental Management Committee on October 4, 2016. As of December 31, 2016, ISB had deployed 1,925 workstations purchased in fiscal year 2015-16.

The objective of the Audit of Inventory Management: IT Assets (Workstations), which was included in the 2016 19 Risk-Based Audit Plan, was to provide assurance on the adequacy of the Strategy, and the adequacy and effectiveness of key lifecycle management practices in place that support the Strategy’s implementation.

The Department has custodial and managerial responsibility for its IT assets, including the acquisition, improvement, maintenance and disposal of those assets. For the record management of IT workstations, the authoritative departmental record is in the financial and materiel management system: Systems Applications and Products (SAP) software, while ISB uses the Symantec Management Platform software for tracking the operational inventory.

The audit concluded that the IT Workstation Refresh Strategy was adequate and key IT workstation lifecycle management practices were in place and adequate to support the Strategy’s planned implementation. In particular, the following strong practices were noted:

• Objectives of the Strategy were clearly defined and communicated;
• Appropriate procurement processes were followed for the acquisition of the 1,925 workstations in 2015-16; and
• Processes were in place and accurately followed to input acquisitions into SAP.

The following opportunities were identified to improve the lifecycle management practices in place:

• Ensure the justification for not replacing older units is documented and future deployment is monitored to align with the goal of the five-year Strategy;
• Review and revise the processes associated with the communication and timing of recording IT workstation disposals in SAP; and
• Implement a single source for tracking and maintaining an inventory of IT assets within ISB.

1.0 Introduction

1.1 Background

1.1.1 Modern and performing workstation hardware is an essential part of the Agriculture and Agri-Food Canada (AAFC) workforce’s ability to deliver on key priorities. The Strategy was developed for Information Systems Branch (ISB) to have a long-term strategy related to Information Technology (IT) workstation refreshment to efficiently upgrade and replace workstations in a predictable and controlled manner. The Strategy applies to endpoint devices, such as but not limited to: desktops, laptops, monitors, high-end workstations and tablet devices^{Footnote 1}.

ISB’s Strategy proposed to establish consistent year-over-year funding for the acquisition and deployment effort of standard workstations^{Footnote 2} over a five-year lifecycle. As of October 2016, this covered 7,377 standard workstations across AAFC. ISB received funding approval for fiscal year 2016-17, the initial year of the strategy, following its proposal at the Departmental Management Committee on October 4, 2016. As of December 31, 2016, ISB had deployed the 1,925 workstations purchased in fiscal year 2015-16.

1.1.2 Funding of $2.5 million (M) was provided in 2015-16 for the acquisition of 1,925 replacement workstations. An additional $2.66M was provided in 2016-17 for the first year of the Strategy. Going forward, an annual funding requirement of $2.27M is estimated for 2017-18 to 2020-21. These actual and projected costs cover the purchase of the IT workstations and the cost of AAFC resources to deploy the IT workstations.

1.1.3 In support for this Strategy, the Corporate Materiel Management Centre’s Asset Management team within the Corporate Management Branch (CMB) conducts the acquisition of IT workstations and processes their disposals.

1.1.4 The Audit of Inventory Management: IT Assets (Workstations) was included in the 2016-19 Risk-Based Audit Plan.

1.2 Audit objective

1.2.1 The objective of the audit was to provide assurance on the adequacy of AAFC’s planned IT Workstation Refresh Strategy, and the adequacy and effectiveness of key lifecycle management practices in place that support the Strategy’s implementation. (See Annex A for the audit criteria.)

1.3 Audit scope

1.3.1 The audit examined the process used to develop the five-year Strategy (2016-17 to 2020-21) and the governance structure that was in place to support the Strategy.

1.3.2 In terms of lifecycle management practices, the audit assessed the practices used to:

• Plan and acquire the 1,925 workstations in 2015-16;
• Deploy the 1,925 workstations in 2016-17;
• Dispose of the replaced workstations identified as surplus in 2016-17; and,
• Plan the workstations to be acquired in 2016-17.

1.3.3 Governance mechanisms and inventory records management associated with the practices listed above were examined.

1.3.4 The assessment included a detailed sample review of 25 acquired workstations, as well as a sample review of 25 workstations that were replaced.

1.3.5 The workstations categorized as “standard workstations” were considered in-scope for this engagement. “Specialized”^{Footnote 3} workstations were considered out of scope, as they were not part of the Strategy.

1.3.6 The audit did not include an assessment of the acquisition of workstations in 2016-17 and their subsequent deployment, as these were still in the process of being purchased at the time the audit was being planned.

1.3.7 The processes and controls under the responsibility of Shared Services Canada were deemed out of scope for this engagement.

1.4 Audit approach

1.4.1 The audit approach and methodology were risk-based and consistent with the International Standards for the Professional Practice of Internal Auditing and the Treasury Board Policy on Internal Audit and Directive on Internal Audit. These standards require that the audit be planned and performed so as to conclude against the objective. The audit was conducted in accordance with an audit program that defined audit tasks to be performed in the assessment of each line of enquiry.

1.4.2 The audit was conducted was completed from May to July 2017. Evidence was gathered through various methods including interviews, sampling of records, and the review and analysis of documentation.

1.5 Conclusion

1.5.1 The audit concluded that the IT Workstation Refresh Strategy was adequate and key IT workstation lifecycle management practices were in place and adequate to support the Strategy’s planned implementation. In particular, the following strong practices were noted:

• Objectives of the Strategy were clearly defined and communicated;
• Appropriate procurement processes were followed for the acquisition of the 1,925 workstations in 2015-16; and
• Processes were in place and accurately followed to input acquisitions into Systems Applications and Products (SAP).

1.5.2 The following opportunities were identified to improve the lifecycle management practices in place:

• Ensure the justification for not replacing older units is documented and future deployment is monitored to align with the goal of the five-year Strategy;
• Review and revise the processes associated with the communication and timing of recording IT workstation disposals in SAP; and
• Implement a single source for tracking and maintaining an inventory of IT assets within ISB.

1.6 Statement of conformance

1.6.1 In the professional judgment of the Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the conclusion provided and contained in this report. The conclusion is based on a comparison of the conditions, as they existed at the time of the audit, against pre-established audit criteria that were agreed on with management. The conclusion is applicable only to the entity examined.

1.6.2 This audit was conducted in accordance with the Mandatory Procedures for Internal Auditing in the Government of Canada (Appendix A of the Treasury Board Directive on Internal Audit), as supported by the results of the Quality Assurance and Improvement Program.

2.0 Observations, recommendations and management responses

This section presents the key observations, based on the evidence and analysis associated with the audit, and provides recommendations for improvement. Management responses were provided and include:

• An action plan to address each recommendation;
• A lead responsible for implementation of the action plan; and
• A target date for completion of the implementation of the action plan.

• Governance;
• Information Technology (IT) Workstation Refresh Strategy;
• IT Workstation Lifecycle Management Practices; and
• Inventory Records Management.

2.1 Governance

2.1.1 Governance

2.1.1.1 Agriculture and Agri-food Canada (AAFC) senior management committees oversaw the Strategy and the lifecycle management of IT workstations. These included:

• Departmental Management Committee for the approval of the plan once per year; and
• Procurement Review Board for the procurement of IT workstations.

2.1.1.2 The audit reviewed the Terms of Reference for the Departmental Management Committee and the Procurement Review Board, as well as the following Strategy-related items presented to the committees since 2016-17:

• IT Workstation Refresh Strategy (October 2016); and
• IT Workstation Refresh Strategy (July 2017).

2.1.1.3 The audit determined that governance bodies, with defined and communicated roles and responsibilities, were in place to provide adequate support and oversight.

2.1.2 Policies and Procedures

2.1.2.1 The audit determined that AAFC policies and procedures related to the procurement and disposal of IT workstations were in place and available in AgriSource and Knowledge Workspace to both Corporate Management Branch (CMB) and Information Systems Branch (ISB) staff. These included:

• AAFC Policy on Planning, Managing and Accounting for Assets; and
• AAFC IT Media Disposal Guide.

2.1.2.2 The audit found that AAFC policies and procedures were aligned with Treasury Board Secretariat requirements, including:

• Policy on Investment Planning;
• Policy on Management of Materiel;
• Directive on Disposal of Surplus Materiel; and
• Directive on Management of Information Technology.

2.2 IT workstation refresh strategy

2.2.1 Objective and Plan Alignment

2.2.1.1 The audit confirmed the Strategy’s objectives were clearly defined and communicated through presentations and discussions of the Strategy. This included the IT Workstation Refresh Strategy presented to a senior management committee (Departmental Management Committee) in October 2016. The audit determined there was communication between the National Desktop Lifecycle Management unit, who manages the implementation of the strategy, and IT Team Leaders regarding the deployment strategy.

2.2.1.2 The audit determined that the Strategy was based on IT workstations identified for replacement based on age from a Symantec Management Platform database listing of on-line IT workstations. The initial listing was obtained in May 2016.

2.2.1.3 The 2016-17 AAFC IT Lifecycle Renewal Deployment Plan (the Plan) was aligned with Treasury Board requirements. The audit found the Plan factored in the following aspects associated with Treasury Board policies and directives: lifecycle management procurement details, branch usage and mobility considerations (including user-specific needs), estimated multi-year workstation refresh investment requirements (per unit and annual totals), as well as deployment efforts and timelines. The audit assessed the following policy and directive requirements in the context of the scope of the audit.

2.3 IT workstation lifecycle management practices

2.3.1 Procurement practices

2.3.1.1 The audit confirmed appropriate procurement processes were followed for the acquisition of the 1,925 workstations deployed in 2016-17. Supporting documentation was obtained and examined for a random sample of 25 acquisitions, confirming sections 32 and 34 of the Financial Administration Act were followed. Documentation included:

• Authority Request (with Chief Information Officer and Director ISB approvals);
• Procurement Review Board approval;
• Standing Offer; and
• Public Service and Procurement Canada Purchase Order.

2.3.1.2 In addition, the 25 sampled IT workstations were purchased through Shared Services Canada, in compliance with the Shared Services Canada Act (April 2013).

2.3.1.3 The audit determined that asset tags were applied by the vendor as part of the Sales Agreement prior to being shipped to AAFC. This was confirmed through interviews with IT Team Leaders and in reviewing packing slips which included asset tag details.

2.3.2 Deployment practices

2.3.2.1 The audit found that deployment practices generally adhered to procedures established for the Strategy. These procedures were established by AAFC National Desktop Lifecycle Management who provided IT Team Leaders with instructions to replace IT workstations from oldest to newest.

2.3.2.2 The audit confirmed that IT Team Leaders used a listing of workstations by age as guidance, supplemented by their own personal knowledge of user requirements to determine final distribution/replacement of IT workstations. Direction was also provided by AAFC senior management to address branch-specific needs. The audit noted that some older IT workstations identified in the replacement lists were specifically configured to support scientific equipment and therefore could not be replaced. Based on interviews of the seven IT Team Leaders, it was determined the practices noted above were consistently applied.

2.3.3 Actual versus planned deployment

2.3.3.1 The Strategy was initiated in 2015-16 based on a five-year replacement cycle (approximately 20nbsp;percent per year) for both the acquisition and deployment of IT workstations. In reviewing the 2016-17 list of candidate workstations provided to IT Team Leaders, the audit identified 129 workstations between nine and 11 years old that were not replaced, with no documented rationale; and instead newer workstations were replaced, as per Figure 1. The audit determined there was a need for greater documentation and monitoring of actual deployment against planned results to ensure the intention of the Strategy is met over the five years.

2.3.3.2 There is a risk that a set of older IT workstations, which have been identified for the refresh initiative, are not being replaced year over year resulting in higher workplace inefficiencies and maintenance costs.

Recommendation 1

The Assistant Deputy Minister (ADM), ISB should ensure the justification for not replacing older units is documented and future deployment is monitored to align with the goal of the five-year Strategy.

Management response and action plan: ISB IT Client Services staff will maintain records within the Symantec Management Platform of any justification for not upgrading units during the scheduled lifecycle deployment. Captured information will be used when providing updates to governance or when requesting approval for future hardware purchases.

Lead(s) responsible: ADM, ISB

Target date for completion: September 2018

2.3.4 Disposal of IT workstations

2.3.4.1 The audit confirmed that the disposal process for IT workstations was aligned with Treasury Board Secretariat and Public Services and Procurement Canada directives and guidelines, as well as AAFC’s internal policies.

2.3.4.2 The audit found the surplus and/or disposal request forms had been completed, along with signatures confirming the cleaning of hard drives, for the 25 sampled disposals had been completed. The audit validated that the 25nbsp;sampled disposals were provided to the Computers for Schools program, as per the Treasury Board Directive on Disposal of Surplus Materiel. All seven interviews with IT Team Leaders confirmed this as a standard AAFC practice.

2.4 Inventory records management

2.4.1 System records

2.4.1.1 The Department has custodial and managerial responsibility for its assets, including the acquisition, improvement, maintenance and disposal of those assets. For the record management of IT workstations, CMB maintains the authoritative departmental records using the financial and materiel management system SAP, while ISB uses the Symantec Management Platform software for tracking the operational inventory. Due to the different purpose for each system, there was an expectation that slight variances may exist at any given point in time.

2.4.1.2 For acquisitions, the audit confirmed, based on a random sample of 25 IT workstations purchased in 2015-16, that processes were in place and accurately followed by CMB. The audit reviewed the processes followed for the random sample and determined that CMB accurately recorded the model, serial and asset tag numbers into SAP based on supporting invoices and packing slips, in compliance with AAFC’s Policy on Planning, Managing and Accounting for Assets.

2.4.1.3 For deployments, the audit performed an analysis on the full 1,925 IT workstations purchased in 2015-16 to assess whether their records were accurately recorded in the Symantec Management Platform and Systems Applications and Products (SAP). The analysis found six of the 1,925nbsp;workstations had different location information between the two systems. The audit acknowledged there may be timing differences for updates between the two systems in situations where equipment was transferred from one location to another.

2.4.1.4 In the review of workstation disposals, the audit identified two out of a random sample of 25 workstations that were pending final updates in SAP as of July 2017 and which have since been completed. These two workstations had been approved by ISB for disposal between April and July 2016. It was noted that there could be a time lag between the approval for disposal and the actual removal of the disposed workstations, depending on the AAFC site, which may require a minimum number of disposal bins to be filled before they are removed.

2.4.1.5 There is a potential risk of temporarily inflated IT workstation inventory records in SAP.

Recommendation 2

The ADM, ISB and ADM, CMB should review and revise the processes associated with the communication and timing of recording IT workstation disposals in SAP.

Management response and action plan: ISB IT Client Services team will work with CMB’s Corporate Materiel Management Centre team to review existing processes (including roles and responsibilities) related to deployment and disposal with the goal of improving communication efficiencies between ISB and CMB. Once the process review is complete, a communique will be sent to all pertinent resources providing direction and access to all process related documentation.

Lead(s) responsible: ADM, ISB and ADM, CMB

Target date for completion: September 2018

2.4.1.6 In addition to SAP, there were several mechanisms used by ISB to manage the lifecycle (such as “cradle to grave”) inventory of IT workstations. As previously mentioned, ISB uses Symantec Management Platform software as its primary tool to electronically obtain consolidated inventory information, such as: workstation name, primary user, Internet Protocol address, manufacturer, model, and serial number information. This software was used to identify and prioritize older IT workstations for annual replacement.

2.4.1.7 There were also approximately 50 Microsoft Excel files within SharePoint that were used by IT Team Leaders to track the inventory of IT workstations at their sites. The audit noted that two of seven IT Team Leaders who were interviewed used the files in SharePoint to manage the IT workstation inventory at their respective locations, while the other five IT Team Leaders used their own Microsoft Excel or Access Database files to manage site inventory (not within SharePoint).

2.4.1.8 Without a single tool for ISB representatives to manage the inventory of IT workstations, there is a risk of inconsistent detail and lack of consolidated information, available for planning and oversight, which may not facilitate the periodic reconciliation with SAP records.

Recommendation 3

The ADM, ISB should implement a single source for tracking and maintaining an inventory of IT assets within ISB.

Management response and action plan: ISB IT Client services team will review and implement improved use of the current Symantec Management Platform as the ISB single source for records.

Lead(s) responsible: ADM, ISB

Target date for completion: September 2018

Annex A: Audit criteria

1.0 Line of enquiry 1: Governance

• Governance bodies, with defined and communicated roles and responsibilities in relation to the Information Technology (IT) Workstation Refresh Strategy and the lifecycle management of IT workstations, are in place.
• Policies and procedures are defined, communicated, and align with Government of Canada requirements.

2.0 Line of enquiry 2: IT workstation refresh strategy

• Strategic objectives have been clearly defined and communicated in the IT Workstation Refresh Strategy.
• Plans are in place, aimed at achieving the strategic objectives and aligned with Treasury Board Secretariat (TBS) direction.

3.0 Line of enquiry 3: IT workstation lifecycle management practices

• Appropriate procurement practices align with established policies and procedures for the acquisition of IT workstations.
• Performance deployment practices adhere to policies and processes established for the IT Workstation Refresh Strategy.
• Management monitors actual performance against planned results and makes adjustments as needed.
• The process followed for the disposal of IT workstations aligns with Departmental and Government of Canada requirements.

4.0 Line of enquiry 4: Inventory records management

• The acquisition, deployment and disposal of workstations are accurately and completely reflected in the system of record.

Annex B: Acronyms

AAFC: Agriculture and Agri-Food Canada

CMB: Corporate Management Branch

ISB: Information Systems Branch

IT: Information Technology

M: Million

SAP: Systems, Applications and Products (software)

TBS: Treasury Board Secretariat

PSPC: Public Services and Procurement Canada