:
Good morning, colleagues. This is meeting five of the Standing Committee on Public Accounts. It's Thursday, March 10, 2016.
Today we're studying chapter 4, Information Technology Shared Services, of the fall 2015 report of the Auditor General of Canada entitled.
We're very pleased to have a number of witnesses appearing here today.
From the Office of the Auditor General of Canada, we have Michael Ferguson, Auditor General of Canada, and Martin Dompierre, principal.
From Shared Services Canada, we have Ron Parker, president; John Glowacki Jr., chief operating officer; and Manon Fillion, director general and deputy chief financial officer, corporate services.
From the Treasury Board Secretariat, we have John Messina, chief information officer, and Ms. Jennifer Dawson, deputy chief information officer.
There will be three opening statements. We'll start with our Auditor General.
Thanks again, and welcome.
[Translation]
Mr. Chair, thank you for this opportunity to discuss our fall 2015 report on information technology shared services. Joining me at the table is Martin Dompierre, the principal who was responsible for the audit.
This audit examined whether Shared Services Canada had made progress in implementing key elements of its transformation plan and maintained the operations of existing services.
Specifically, the audit focused on Shared Services Canada's objectives of improving services, enhancing IT security and generating savings.
We also looked at how the Treasury Board of Canada Secretariat assisted and provided governance and leadership on the strategic vision for Shared Services Canada and how it fits into the government IT landscape.
As part of the audit, we consulted seven federal government departments and agencies to get an understanding of how they viewed their collaboration with Shared Services Canada.
[English]
Our 2010 audit report on aging information technology systems indicated that the federal government infrastructure was aging and at risk of breaking down. In turn, this could affect the government's ability to deliver some essential services to Canadians. The report recommended that a plan be developed for the government as a whole to mitigate risks associated with aging IT systems on a sustainable basis.
In August 2011, the government announced the creation of Shared Services Canada as a new department to manage and transform the IT infrastructure of 43 individual departments, including servers, data centres, human resources, and IT budgets. The IT infrastructure included 485 data centres, 50 networks, and about 23,400 services.
In 2013, Shared Services Canada developed a seven-year transformation plan to consolidate, standardize, and modernize the Government of Canada email, data centres, and network services. Shared Services Canada committed to maintain and improve the level of IT services and security during the transformation.
[Translation]
Overall, we found that there were weaknesses in Shared Services Canada's implementation of government IT shared services to date, specifically in managing service expectations with its partners and in measuring and tracking progress on transformation initiatives and savings.
For example, we found that Shared Services Canada did not set clear and concrete expectations with its partner departments in providing IT infrastructure service to support their services and applications. As a result, it could not show if and how it was maintaining or improving services.
This finding is important because Shared Services Canada needs to understand whether its services meet its partners' needs. As the recipients of these services, Shared Services Canada's partner departments need to have confidence that the levels of IT service they receive from Shared Services Canada adequately support their ability to deliver services to Canadians.
[English]
In addition, we found that Shared Services Canada rarely established expectations or provided sufficient information to partners on core elements of security. This is important, because Shared Services Canada plays an important role in implementing Government of Canada security policies, directives, standards, and guidelines to ensure the security of government IT shared services. As the government's IT infrastructure service provider, it's important that the department collaborate with partners to manage security threats, risks, and incidents to help protect the government's critical IT-related assets, information, and services.
Finally, we found that Shared Services Canada did not have consistent financial practices to accurately demonstrate that it was generating savings. For example, there was no standard costing methodology in place to determine savings, and there were incomplete baselines to measure total savings generated. This finding matters, because Shared Services Canada spends about $1.9 billion each year to deliver IT services to partners, invest in projects, and fund its operations.
As this audit is a mid-transition review of the department's progress in implementing key elements of the government's IT transformation, our recommendations provide concrete opportunities to look at what has been done so far and to identify needed adjustments. Our report makes eight recommendations to Shared Services Canada and one to the Treasury Board of Canada Secretariat. Both entities have agreed with our recommendations.
[Translation]
Mr. Chair, this concludes my opening remarks. We would be pleased to answer any questions the committee may have.
Thank you.
[Translation]
Good afternoon.
I am Ron Parker. I was appointed president of Shared Services Canada in July 2015.
I am accompanied today by my colleagues John Glowacki, chief operating officer, and Manon Fillion, director general of finance, to discuss the Auditor General's report that was tabled in Parliament on February 2 and to take your questions and comments.
But first, I would like to briefly outline SSC's history and mandate.
SSC was created to modernize information technology infrastructure services to ensure a secure and reliable platform for the delivery of digital services to Canadians.
[English]
This followed, as Mr. Ferguson noted, the Auditor General's report of 2010, which drew attention to the aging systems of the Government of Canada and the risk those systems were of breaking down and jeopardizing services to Canadians. Shared Services was created to standardize, consolidate, and re-engineer the federal IT infrastructure into a single shared IT enterprise. The department aims to deliver one email system; consolidated data centres; a reliable and secure telecommunications network; and 24-7-365 protection against cyber threats across the 43 departments, 50 siloed networks, some 400 data centres, and 23,000 servers.
This year the Auditor General has noted limited progress in the key elements of Shared Services Canada's transformation program. This report recommends that the department develop a strategy to meet partner legacy and transformation service needs; develop agreements with partners setting out service expectations and reporting commitments; provide partners with more information on IT security, protocols, guidelines, and standards; and prioritize, allocate, and report on funding commitments and realized savings.
[Translation]
Shared Services Canada accepts these findings. They are timely, and they echo the feedback I have received from partners, stakeholders and staff.
In fact, the department has made tangible progress on each of the recommendations. That said, some aspects of the AG's report deserve comment.
[English]
Shared Services Canada's service management strategy has already been finalized and shared with our partners. We've established service level expectations in five priority areas: email, mobile devices, video conferencing, application hosting, and the Government of Canada-wide area network services. Service level expectations cover such areas as service hours, service availability, and the time to restore services.
Regarding the email transformation initiative, the challenges in migrating email systems vary by department. Readiness to migrate also varies by department. As such, the costs of migration differ by department, and additional costs may be incurred. Migrations were also put on hold in November 2015 while the vendor addressed the system's stability and capacity issues.
Finally, regarding security, as noted in the Auditor General's report, it's important to remark that the Auditor General did not test the effectiveness of our security controls. Rather, as he's just said, he focused on the communications with partners and whether security's roles and responsibilities were adequately documented.
[Translation]
SSC's transformation plan represents an unprecedented exercise in orchestration and synchronization. As we move forward, we are placing increased emphasis on client service, sound financial management and ensuring accountability.
We also face some challenges.
[English]
At the enterprise level, work is proceeding more slowly than anticipated. The complexity of the challenges has caused some delays, and some procurements are taking longer than planned. In addition, the capacity of industry to meet our requirements varies, and we have important funding pressures arising, in part, from stronger than forecast demand growth.
To address these issues, we are focusing on a three-pronged approach.
First, our staff are our priority. They are our strongest asset. Their support, commitment, and drive are a very precious commodity, like gold. I want to recognize the Herculean work to remake the delivery of IT infrastructure services supporting all types of services to Canadians. They should be very proud.
First, at Shared Services Canada, service excellence is part of the DNA of our staff, and we must make it easier for people to deliver the services through providing new tools, new processes. This, of course, is a major concern for our customers as well. Improving customer satisfaction is key to Shared Services' success, and is key, at the same time, to improving staff morale. We will strengthen service delivery through new service strategies and the standardization of processes.
Second, the department will update the transformation plan in fall 2016, with the participation of Shared Services Canada's employees, customer organizations, central agencies, and outside experts. We want a conversation about the scope, pace of implementation initiatives, and the cost of the plan, while ensuring that the legacy systems continue to deliver programs and services to Canadians.
Third, we recognize that some legacy infrastructure will remain operational longer than we'd originally anticipated. We will therefore continue to reinforce the legacy infrastructure to prevent outages in the delivery of services to Canadians.
In conclusion, I want to stress that since its creation, Shared Services Canada has made progress in modernizing government-wide IT systems.
[Translation]
We are moving forward with renewed vigour, while absorbing the lessons learned over the last four years, along with the recommendations for ongoing audit and evaluation work.
Ultimately, the IT services SSC provides are an integral part of a vision of a 21st century public service. They complement the Government of Canada's commitment to improve digital services to all Canadians.
Thank you.
:
Thank you, Mr. Chair. I'm pleased to be here to speak about the role of the chief information officer branch in providing governance and strategic leadership for the transformation of government IT services.
[Translation]
With me today is Jennifer Dawson, deputy chief information officer, who will help me respond to any questions.
The role of the chief information officer branch in the Treasury Board Secretariat is to provide strategic leadership and policy direction for information technology, information management and cyber security.
[English]
We do this with guidance from departmental deputy heads and input from chief information officers as well as other stakeholders. The Auditor General, during his review of the information technology of Shared Services, said it is important that SSC have more support in the form of strategic guidance from TBS to help it achieve its mandate.
[Translation]
He recommended that the Treasury Board Secretariat, Chief Information Officer Branch put into effect an IT strategic plan for the Government of Canada.
Mr. Chair, we agree with the recommendation and have committed to completing an IT strategic plan by March 31, 2016.
[English]
We've also promised to help departments and agencies implement the plan. Accordingly, we have fully reviewed business and technology trends, as well as industry best practices, to determine what changes are needed as a result of advances in information technology, the experience of other jurisdictions, and recent operational developments within the Government of Canada.
[Translation]
As part of our review, the chief information officer branch has consulted broadly with the government's IT community to understand their service and technology needs.
[English]
We have also consulted with our internal policy centres to ensure that the IT strategic plan meets Canadians' expectations for the security of information. Our consultations are now complete, and we are on our way to having the strategic plan completed by the end of the month. Following this, TBS will ensure approval of the plan.
[Translation]
This plan will provide a strategic vision for IT in the Government of Canada. It will give SSC and other departments direction and priorities for enhancing IT management, security and service delivery. It will also help the broader government IT community, as they develop and coordinate their own plans and activities.
[English]
Going forward, TBS will help departments and agencies implement a strategic plan by providing communications, guidance, and oversight.
Mr. Chair, as you can see, much work has been done to address the Auditor General's recommendations. We will continue to work with Shared Services Canada to provide governance and strategic leadership to help it achieve its mandate.
Thank you for your time today. I would be pleased to answer any questions from the committee.
As the MP for Nepean, which is in Ottawa, I know a bit about Shared Services Canada, because I keep hearing about it from my constituents. Some are union leaders. Some are employees. Some are contractors. Trust me, this is the single biggest disaster as far as they're concerned.
I know you're new and one of the understatements you made is that the complexity of the challenges has caused some delays, and some procurements are taking longer than planned. You also said that the capacity of industry to meet your requirements varies, and that you have important funding pressures arising. This is after four or five years of being under implementation.
Now in 2016 you want to have a conversation about what is called the pace of implementation, the transformation and schedule, and the cost of the plan.
Mr. Messina, you say your strategic plan will be ready at the end of March. Was there not a strategic plan before Shared Services Canada was established?
There is a highly technical term used when something is this complex involving this many billions of dollars and has this much ineptitude and inaction, and that highly technical term is boondoggle. That's exactly what we have here. I'm not satisfied at all that this department has a handle on this. I think the proof of that is in front of us.
I want to follow up on where some of my colleagues have been on this business of the draft plan is going to be “complete”—is the word in the action plan—by March 31, 2016. It then goes on to say that it has to be approved. It seems to me that the March 2016 draft has no more status than the June 2013 draft, simply because it wasn't approved. Let's remember, this is three years they've had the draft plan. The best they can come up with as a resolve is a year ago they said they would update the draft plan from what was then two years before, and we still don't have a final date.
What we have is a game. We have a shell game telling us March 31, 2016, is looking like it's some kind of a deadline where we can start expecting action. All that is, is the completed draft which has no more status than the June 2013 draft, which didn't get acted on either. Then I hear that sometime this fall there's going to be approval. It's not good enough, not good enough.
I want a date. When will this be approved and when will it be implemented? No more of this draft stuff. That's just dodging. When is this report going to be adopted and when will it be implemented?
:
Good, okay. You can expect that we'll be incorporating that in our report and looking for some detailed follow-up.
I want to go back to Mr. Parker's opening remarks. He said, and I quote, that Shared Services Canada “was created to modernize information technology infrastructure services to ensure a secure...”. The first word that Mr. Parker used was “secure”. So the services were there to ensure, and I continue the quote, “a secure and reliable platform for the delivery of digital services to Canadians.”
The Auditor General said, even this morning, “In addition, we found that Shared Services Canada rarely established expectations or provided sufficient information to partners on core elements of security. This is important, because Shared Services Canada plays an important role in implementing Government of Canada security policies, directives, standards...”.
My question for Mr. Parker is, if ever there was a buzzword of this era it's “security” and it was used as the first word. So why the deficiency? Why does the Auditor General find out that you weren't in touch and providing sufficient information on the core elements of security?
My second question is for Treasury Board, the ones who are supposed to make sure they do it. Why did they fail in their job in making sure they didn't do it in the first place?
First of all, I have to say that it's a privilege to be here.
Mr. Chair, it is quite typical in this managed service provider industry that when you go into an engagement such as this, you take on the existing status. The agreements are quite standard to come in and say, as the phrase goes, “your mess for less”. Basically, you run it at the same status. If there are pre-existing measurements, you take on those measurements and you agree to run them at the same status. What we had here was that, in many cases, there were not sufficient systems in place doing the operational metrics that we could take on and say now we have a baseline and we will continue to measure against that baseline. Absent that baseline, it becomes a best effort kind of engagement.
To your question about service credits, if you will, this goes back to some of the previous questions about how things are paid for. We are trying to migrate from what we were created as. Some base had to be established with the appropriations, but as we move forward, we're going into what we call a fee-for-service environment. As demand goes up, additional services are always added. That's just the law of nature. We will have agreements in place that show the level we will provide, the availabilities, the liabilities, etc. We're all in the government, so it is not typical to say that we'll provide some sort of service credit if we miss the mark.
Now, the caveat is that we inherited a hybrid environment where we do go to industry for a certain amount of our services. It's predictable that we'll continue to do some services ourselves. For some it will make perfect business sense to have industry doing those. The benefit we get with industry is that we ensure that we have service credits through them. Take email, for instance; we do have service credits. Those are piling up, and we have a very careful count of those. As we unfold the operation, we will apply those as necessary.
I'm pleased to be here to answer questions.
The budget is $2 billion. That is roughly the budget since the organization was created in 2011-12.
In terms of the funding structures, credits of about $1.5 billion to $1.6 billion have been adopted since the organization began. We also have an envelope from partners and clients, which is about $400 million or $410 million since the organization's creation.
We have spoken a lot about challenges. We have tried to reassure you by saying just how well we are managing the organization. Since its creation, the organization's challenge has been maintaining the level of services it inherited and that, in terms of service standards, was not standard and completely diversified. That also includes the type of services offered internally to partners.
What we have done that has helped us to better manage the department is to create 25 services that we offer to clients and that they can purchase. For each service, we set standards based on the services offered when the organization was created.
As you said, technology changes rapidly. Things move quickly. Certain services that we provide today were not offered at the time. So we are putting in place a pricing strategy to differentiate the service standards that were covered by the credits when the organization was created, and all the various broader services or new services for which we will invoice a certain amount of money per service, because that is really a service-by-service approach.
The other important thing that is allowing us to move forward and that is telling us we are on the right track, is the fact that we are also aware that we have reduced the per unit cost for all services. The issue is managing service consumption by partners. At Shared Services Canada, it is our duty and our responsibility to provide each partner with information on service consumption so that they are aware of the services they are using and do not request services that aren't reasonable or completely frivolous. If that is the case, we can at least recover the costs for this type of service.
So that is what we did. I am quite passionate when it comes to talking about this.
:
Mr. Chair, I'd be happy to provide that background.
The vast majority of our staff are technical experts in the CS category, which is the computer sciences category in the government. There's a wide variety of skill sets ranging from data centres to telephony to networks. They bring a wealth of experience and skills to the job every day. There's also, obviously, a group of internal services staff, financial among others, who support us well through this period.
In terms of the overall, I'll say, mix, my view is that we have extremely good staff. We inherited staff from the various departments when we were formed, including large blocks of staff that just moved holus-bolus. You can see this particularly in the procurement area and some of the data centre areas as well.
It is a challenge with 43 departments. They come with different cultures, different experiences, and different ways of operating. This has been one of the challenges that we have faced to get everyone on the same page, moving in the same direction, with the same process and the same understanding of how to work. That's a large part of what we need to do to get the service management nailed down, get everybody understanding the processes of how to work together, how to talk to clients, and how to relate to clients. In that regard, one of the changes that was recently brought was, we've stood up account teams who are charged specifically with talking to the clients and engaging in planning with the clients, and there are service delivery managers who have the responsibility of delivering to the clients and organizing the services that are required to deliver what the clients need.
:
This is interesting. This is where we get into the bump up between the political and the bureaucratic. I didn't hear anybody here take ownership of that decision. If anything, I heard people saying to go somewhere else down the line to find an answer. We'll have to decide how we're going to wrestle with that as we're pulling together our report. It looks like it was an artificial pressure from outside governance and management, and enough that the Auditor General has made a pretty big deal of it in his report.
Now we're finding out that some of the delays we're dealing with are as a direct result of that money being taken out. This is a big deal, and it's not that complicated. The fact is, there was a three-year plan to save $72 million. The first year was delayed, and yet they went ahead and took all the money out in one year. Now we're hearing from Shared Services the damage that did.
I can't get an answer out of Treasury Board because that's likely where the pressure came from. I would be very shocked if it were a bureaucrat who ordered them to take that money out. It would be an interesting pursuit of the separation between the bureaucratic and the political were we to go down that rabbit hole. But clearly, I think I can see the politics.
What I want to do is to come back to the Auditor General on this.
Sir, on page 22, exhibit 4.2, you've gone very much out of your way to explain this issue, to make sure that it's highlighted and that we understand.
Can you please give us your further thoughts and comments not only about how this was a mistake, but would you also tell us how this should have been properly handled and accounted for?
:
No, that was my question, though. My question was clearly whether or not this was a decision made based on a business case presented by Shared Services Canada.
Now, it is true that the government could have decided to provide an extra $56 million in order to reward SSC for failing to meet its deadline, but if we had done that, imagine the moral hazard, as economists call it. You'd be sending the signal out to the entire government of Canada that if you miss your deadlines and as a result go over budget, don't worry; you'll still get your $56 million. That would be exactly the wrong way to go, and I can't imagine that we as a parliamentary committee, which is supposed to protect the public purse, would take the position that government agencies and bodies should be rewarded with extra money when they miss their timelines, because ultimately, that's what we would have been saying if we had injected that extra $56 million.
Now, I would point out that this was not a decision by a political actor suddenly in 2015-16 to cut the budget by $56 million. This was simply implementing the plan that Shared Services Canada came to Treasury Board with in its own submission three years earlier.
My question then for Shared Services, if anyone wants to explain this, is this: when you made the submission and you said in your submission that you would save $56 million, did you mean it?
According to the clock on the wall, our time is up.
I want to thank you for being here today, but I also want to make this fairly clear that we as a committee would like to see these plans. The Treasury Board needs to complete its IT strategic plan by March 31. I don't know if there's any need to send it to us until it's approved, because as a committee, we want to receive this thing in June.
As soon as that thing is approved, could you send us the plan, approved?
Now to Shared Services, this fall I think there's kind of a timeline for you in regard to the transformation plan. I may have these plan names wrong, but there are certain benchmarks that we expect, and we're going to follow up on this.
I'm speaking without the full committee meeting on this, but you can pretty well expect to be called back here within eight or nine months. Yes, you've given us your plan on time, and yes we have received the transformation plan on time, but how is it going now?
We have appreciated this, and I know how complex this is, and when you have complexities like this, there are problems, but we expect, the taxpayers expect and Parliament expects that we will see goals laid out that are achievable, and that you've met them. We know what the ultimate goal might be, but we want to see some achievable goals on the way to that.
Thank you very much, all of you, for being here today.
Give our best wishes to the secretary—