Archived - System Under Development Audit of the First Nations and Inuit Transfer Payment (FNITP) System Project

Background

The First Nations and Inuit Transfer Payment System (FNITP) is designed to replace the Transfer Payment Management System. The goal of the FNITP project is to build a web-enabled transfer payment management system that will provide integrated service delivery and enhanced management tools for First Nations and Inuit communities. The system aims to provide improved accountability by introducing better financial and non-financial reporting capabilities for transfer payment recipients.

The FNITP system will assist Indian and Northern Affairs Canada (INAC) in managing funding arrangement information and applying prudent cash management practices in accordance with Treasury Board requirements.

FNITP includes functionality:

• to facilitate the front-end preparatory work to develop funding arrangements (e.g. budget allocation activities);
  
  
• to create and maintain funding arrangements; and
  
  
• to manage recipient reports through which expenditures are justified, results of activities are recorded, and the potential need for corrective action is identified (e.g. noncompliance with funding arrangement terms and conditions).
  
  

The FNITP project began in 2004 and is expected to be completed by March 2008, at a total cost of $13.3 million (including first year maintenance costs).

The first release of the system is currently in production, and, upon approval by the FNITP Project Steering Committee, will be used to create funding arrangements covering the 2007-2008 fiscal-year. The first release was meant to contain all of the functionality required for the beginning of the transfer payment cycle. The remaining functionality will be implemented in conjunction with the required management of the first 2007-2008 Funding Arrangements.

The financial significance of transfer payments processed by the department and the pivotal role to be played by the FNITP system in the monitoring and control of related transactions led the Audit and Evaluation Sector to include this System under Development audit in its Internal Audit Plan.

Timing, Objectives and Approach

A preliminary scoping exercise for this audit was conducted from April to June 2006 to facilitate the development of a detailed project work plan. Following the scoping exercise, it was determined that audit fieldwork would be covered through five overlapping streams from August to December 2006. As work was completed for each stream, a presentation of the results was made to the FNITP Steering Committee.

The audit objectives, as well as the streams followed to carry out the required fieldwork, are identified in the table below. For each of the streams, the detailed report contains a separate section presenting the audit methodology and timelines, the scope and the corresponding findings.

Scope

As the vast majority of the audit and review procedures were conducted before the first release of the application on December 11th, 2006, and all direct testing in the FNITP application was conducted in the test environment, the scope of this audit only covers the design of controls. No opinion is provided on whether or not controls have actually been implemented in the production environment, or whether they have been operating effectively over a period of time. These items should be addressed as part of a post-implementation review.

Audit work conducted in two of the streams (FNITP Application Controls and General Computer Controls) was intended to be assurance-based, whereas the audit work conducted for the remaining three streams was intended to be more consultative in nature. Caution should be exercised when relying on the conclusions stated in these three streams, as some of the findings may be based solely on information obtained through interviews.

Conclusions and Statements of Assurance

Statement of Assurance

Sufficient and appropriate audit procedures have been conducted and evidence gathered to support the following opinions on general computer controls and FNITP application controls:

General Computer Controls

In our opinion, while a number of control strengths were identified during the audit, the design of general computer controls requires significant improvements in the following areas: logical security, testing, data conversion, disaster recovery and business continuity.

FNITP Application Controls

In our opinion, the design of application controls associated with:

• compliance with sections 32, 33 and 34 of the Financial Administration Act has areas requiring moderate management attention; and
  
  
• the Transfer Payments Directorate Management Control Framework requires significant improvements in the following areas: extent of the use of the system to automate controls versus providing tools to support manual controls outside of the system, segregation of duties, specific control weaknesses identified, and functionality not yet developed.
  
  

These opinions are based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed to by management. The evidence was gathered in compliance with Treasury Board policy, directives and standards on internal audit, and the procedures used meet the professional standards of the Institute of Internal Auditors.

Conclusions from the Non-Assurance Streams

Project Management Controls: In our opinion, project management controls are effective, with the exception of the lack of a "Go / No Go" decision framework at the time of the assessment.

Data Input and Processing Controls: In our opinion, the design of data input and processing controls within FNITP has areas requiring moderate management attention. Most of these issues will be resolved when recommendations made in the General Computer Controls and FNITP Application Controls streams are addressed.

Technical Vulnerability Controls: In our opinion, the design of controls to mitigate technical vulnerabilities is effective, with the exception of a few medium risks that can easily be addressed.

Management has developed a detailed action plan to address the issues raised throughout the report. In our opinion, the implementation of the proposed action plan will adequately address all identified areas for improvement and mitigate identified risks.

Recommendations

The audit includes a total of 18 recommendations intended to address the findings detailed in the audit report. Given that five broad areas of control were examined and the time available for specific corrective action prior to the system go-live is limited, the audit does not attempt to aggregate recommendations at a more general level.

General Computer Controls

Information Security - Access

• Update access privileges in the production environment should be removed from the accounts of all FNITP project team members.
  
  
• A review should be conducted to ensure that all access request forms are completed and that access privileges in the system reflect what has been approved as per the access request forms. Management should consider implementing a process to review access granted to users on a regular basis, to ensure ongoing appropriateness of access privileges.
  
  
• A formal process involving Human Resources should be implemented to ensure that accounts (i.e. at the network, server, database and FNITP application levels) of employees who have been terminated, or who have changed roles and responsibilities, are revoked or modified on a timely basis.
  
  

Application System Implementation and Maintenance

• Formal sign-offs should be obtained from the user community (or its representatives) confirming their agreement with the scope (e.g. completeness, appropriateness) of testing. In addition, for each test case (both internal FNITP Project Team test cases and user acceptance test cases), sign-offs should be obtained confirming that the test cases were used and that results were as expected.
  
  
• All data cleansing activities should be approved by user management or the project sponsor. User management or the project sponsor should also approve the results of testing conducted to confirm the accuracy of cleansing activities.
  
  
• The scope and results of data reconciliation activities should be documented as part of the "Go / No Go" checklist, to be approved by the FNITP steering committee.
  
  

Network and Systems Software Support

• The change advisory board should ensure that requirements from the change management guide are fully implemented, specifically with regards to the requirement to provide documented test plans and documented test results.
  
  

Business Continuity Planning and Backups

• The INAC Business Continuity and Disaster Recovery Plans should be updated to include FNITP. Processes should be implemented to ensure that both plans are tested and updated on a regular basis.

FNITP Application Controls

• The functionality provided by FNITP should be leveraged to automate controls that support the Transfer Payments Directorate Management Control Framework and the Financial Administration Act (Sections 32, 33 and 34) to the fullest extent possible. The options to override or circumvent funding arrangement formulas, to delegate authorities, to create more than one funding arrangement per recipient per fiscal period, and to create funding arrangements without using models that have been approved by Transfer Payments Directorate should be removed. Furthermore, arrangement models should be pre-populated with signature blocks that are in-line with the requirements from the relevant authorities and policies. Alternatively, manual monitoring controls should be developed and implemented to ensure that control requirements from the Transfer Payments Directorate Management Control Framework and the Financial Administration Act (Sections 32, 33 and 34) are adhered to.
  
  
• Manual controls should be developed and implemented for all Transfer Payments Directorate Management Control Framework control requirements that are not completely addressed by FNITP automated controls.
  
  
• Considering the difficulties in trying to create FNITP user access profiles that match position titles, a segregation of duties conflict matrix should be developed to clearly document activities that need to be segregated. If conflicting responsibilities need to be given to specific users, monitoring controls should be implemented.
  
  
• Users should not be given the opportunity to modify FNITP variables that can create discrepancies between data in FNITP and the hard copy funding arrangements. In addition, as long as funding arrangements are in a status where they can be modified in FNITP, the printed arrangements produced by the system should be clearly marked as draft.
  
  
• Exception reports should be developed and used to monitor control overrides. Furthermore, FNITP should force users to provide comments when overriding mandatory reporting requirements.
  
  
• The design of the FNITP application controls within the modules or functions that have not yet been developed should be assessed once the remaining functionality and controls are implemented, and before they are available for use.
  
  

Project Management Controls

• A "Go/No Go" decision framework should be developed and approved by the FNITP Steering Committee. The decision framework should be used to assess the project's readiness for the planned go-live date.
  
  
• Knowledge transfer activities should be implemented within the project team to minimize dependencies on the project manager. Increased delegation should be a priority.
  
  

Data Input and Processing Controls

• Until the reconciliation module is developed and implemented, reports from FNITP and the financial system should be compared on a regular basis to ensure that there are no discrepancies. The reports should be retained for audit trail purposes.
  
  

Technical Vulnerability Controls

• The department should formally sign off on its acceptance of some of the risks identified in the FNITP Threat and Risk Assessment report, acknowledging its awareness of identified residual risks.
  
  

Background

Indian and Northern Affairs Canada (INAC) has primary, but not exclusive, responsibility for meeting the federal government's constitutional, treaty, political and legal responsibilities to First Nations, Inuit, Métis and Northerners. INAC is currently responsible for the disbursement and monitoring of approximately $5.6 billion in annual Grants and Contributions. Transfer payments (Grants and Contributions) are made to First Nations, Inuit, Métis and Northerners and their organizations to enable the delivery of services to their respective community members, in accordance with Treasury Board's Policy on Transfer Payments, and are monitored in accordance with INAC's internal accountability, performance reporting and evaluation requirements. The Transfer Payment Management System is the financial system currently used to manage the $5.6 billion entrusted to INAC for the handling of grants, contributions and other transfer payments. Most of these payments are transferred directly to about 2,000 recipients, the majority of whom are First Nations and their organizations.

The First Nations and Inuit Transfer Payment System (FNITP) is designed to replace the Transfer Payment Management System. The goal of the FNITP project is to build a web-enabled transfer payment management system that will provide integrated service delivery and enhanced management tools for First Nations and Inuit communities. The system will also improve accountability by providing better financial and non-financial reporting capabilities for transfer payment recipients. The new FNITP system will assist INAC in managing funding arrangement information and applying prudent cash management practices in accordance with Treasury Board requirements.

FNITP includes functionality to facilitate the preparation of funding arrangements (e.g. budget allocation activities), to create and maintain funding arrangements, and to manage the recipient reports which are the basis for expenditure justification, reporting on results of activities, and identification of needs for intervention.

The FNITP project began in 2004 and is expected to be completed by March 2008, at a total cost of $13.3 million (including first year maintenance costs). The first release of the system is currently in production and, upon approval from the FNITP Project Steering Committee, will be used to begin creating 2007-2008 Funding Arrangements. The first release was meant to contain all of the functionality required at the beginning of the transfer payment cycle. The remaining functionality will be implemented in conjunction with the required management of the first 2007-2008 Funding Arrangements. The financial significance of transfer payments processed by the department and the pivotal role to be played by the FNITP system in the monitoring and control of related transactions led the Audit and Evaluation Sector to include this System under Development audit in its Internal Audit Plan.

Timing, Objectives and Approach

A preliminary scoping exercise for the FNITP System under Development audit project was conducted from April to June 2006 to facilitate the development of a detailed project work plan for the audit.

The audit objectives as well as the streams followed to carry out the required fieldwork are identified in the table below. For each of the streams, a separate section of this report details the audit methodology and timelines, the scope, and the findings.

The purpose of pursuing each stream of audit work was:

• General Computer Controls: to provide assurance over the design of General Computer Controls supporting FNITP. General Computer Controls are controls related to the processing of information within the computer environment;
  
  
• FNITP Application Controls: to provide assurance over the design of the control activities supported by the FNITP system that are included in the Transfer Payments Directorate Management Control Framework. This includes, for example, FNITP functionalities that are being developed to support the requirements of sections 32, 33 and 34 of the Financial Administration Act and designed to prevent material financial misstatements;
  
  
• Project Management Controls: to comment on the adequacy of project management controls;
  
  
• Data Input and Processing Controls: to comment on the adequacy of data input and processing controls; and
  
  
• Technical Vulnerability Analysis: to complement the threat and risk assessment that INAC recently performed on the FNITP system with a technical vulnerability analysis of the FNITP Web-based design.
  
  

Scope

As the vast majority of the audit and review procedures were conducted before the first release of the application on December 11, 2006, and all direct testing in the FNITP application was conducted in the test environment, the scope of this audit only covers the design of controls. No opinion is provided on whether or not controls have actually been implemented in the production environment, or whether they have been operating effectively over a period of time. These items should be addressed as part of a post-implementation review.

For the assurance-based streams, information gathered during interviews was corroborated by the examination of supporting documentation and or observation. In the case of the consultativebased streams, although corroboration was conducted in certain areas, some of the findings may be based solely on information obtained through interviews.

Methodology

This assessment was performed using a risk-based approach aligned with the COBIT IT control framework issued by the IT Governance Institute. The methodology consisted of conducting the following audit activities for each control area included in the scope of the review:

• identify relevant control objectives for each review area;
  
  
• identify relevant control activities that completely fulfill the control objectives; and
  
  
• evaluate the design of the identified control activities (prior to go-live).
  
  

Scope and Timelines

Scope

Timing

The General Computer Control assessment was conducted from June to December 2006.

Conclusion

While a number of control strengths were identified during the audit, in our opinion, the design of general computer controls requires significant improvements.

Strengths

Some of the strengths noted in this area include:

• FNITP is equipped with effective functionality to monitor system components and errors;
  
  
• strong password rules are enforced both at the network and application level;
  
  
• a ticket tracking system is used to manage both system development and changes to the application;
  
  
• a change advisory board exists to ensure that risks related to changes to INAC's Information Technology production environment are adequately assessed; and
  
  
• FNITP backups are conducted and stored in a separate building and city from where the FNITP production servers are located.
  
  

Methodology

The objective of this stream was to determine whether the design of the application controls within FNITP adequately supports the control requirements from the Transfer Payments Directorate Management Control Framework and Sections 32, 33 and 34 of the Financial Administration Act. The following audit activities were conducted to achieve this objective:

• control statements were extracted from the Transfer Payments Directorate Management Control Framework and Sections 32, 33 and 34 of the FAA to create audit criteria;
  
  
• the resulting audit criteria were validated with the FNITP project sponsor;
  
  
• planned FNITP application controls that address the requirements of the audit criteria were identified; this resulted in the list of FNITP controls supporting the Transfer Payments Directorate Management Control Framework and Sections 32, 33 and 34 of the FAA, and formed the scope for this stream;
  
  
• interviews were held to understand how the identified application controls will be implemented in FNITP, and what steps will be taken to ensure that those controls are working properly prior to go-live (e.g. testing activities); and
  
  
• the design of the identified FNITP application controls was documented and tested.
  
  

Scope and Timelines

Scope

The design of the FNITP application controls supporting the control framework for the Transfer Payments Directorate Management Control Framework and Sections 32, 33 and 34 of the Financial Administration Act defined the scope for this stream. Controls were assessed in the following areas:

• Entry Criteria / Management Assessment;
  
  
• Funding Arrangement Terms and Conditions;
  
  
• Financial and Program Reporting;
  
  
• Active Monitoring;
  
  
• Intervention; and
  
  
• Financial Administration Act Sections 32, 33 and 34.
  
  

Timing

The assessment of FNITP application controls was conducted from June to December 2006.

Conclusion

In our opinion, the design of application controls within FNITP related to Financial Administration Act requirements from Sections 32, 33 and 34 has moderate issues requiring management focus.

While a number of control strengths were identified during the audit, in our opinion, the design of application controls within FNITP related to the Transfer Payments Directorate Management Control Framework requires significant improvements. Numerous manual controls are still required to complement controls within FNITP and ensure control objectives are met.

Strengths

Some of the strengths noted in this area include:

• FNITP provides tools to manage reporting requirements more efficiently, including the automatic inclusion of mandatory reporting requirements during the funding arrangement preparation process;
  
  
• FNITP interfaces with the financial system to ensure that funding obligations and payments are only processed if sufficient funds are available; and
  
  
• security controls prevent the same user from conducting Financial Administration Act Section 33 and Section 34 sign-offs.
  
  

Methodology

Our assessment was based primarily on the conduct of documentation reviews and interviews with key project stakeholders within INAC. Numerous meetings were held with the First Nations and Inuit Transfer Payment System (FNITP) project manager, project stakeholders from INAC headquarters (i.e. the Director of Administration Services, a representative of the Information Management Branch's Project Management Office, the FNITP project sponsor), and three FNITP regional coordinators (i.e. Quebec, Saskatchewan and Nunavut regions). Our assessment was based on a comparison of current practices against best practices for large IT system implementation projects.

Scope and Timelines

Scope

The assessment of project management controls focused on seven key areas, as follows:

The project management controls assessment was consultative in nature, and as such, some findings may be based solely on information gathered through interviews.

Timing

The assessment was conducted from July to October 2006. The project management controls assessment report was originally submitted on October 31, 2006.

Conclusion

In our opinion, project management controls are well established, with the exception of the lack of a "Go / No Go" decision framework at the time of the assessment.

Strengths

Some of the strengths noted in this area include:

• a steering committee that has been in place from the very beginning of the project;
  
  
• stakeholders that believe that they were appropriately consulted during the scope definition phase and that no major scope changes have taken place;
  
  
• FNITP regional coordinators in each region that can facilitate communications between First Nations, INAC regional staff and the FNITP project team; and
  
  
• documented standards and guidelines that have been developed by the FNITP project team for the development of the application, for change management, and for quality assurance.
  
  

It is recognized that, as the audit assessment was conducted close to the initial go-live date, the likelihood of occurrence of the identified risks is somewhat reduced. Considering, however, that the FNITP project team's mandate extends until March 2008, our observations may serve as lessons learned to be taken into account when planning future developments within the FNITP initiative.

Methodology

The objective of this stream was to determine whether data input and processing controls embedded in FNITP are in line with best control practices. A subset of the recommended application control objectives from the CobiT 4.0 framework were used for the review. CobiT is an IT governance framework and supporting toolset published by the IT Governance Institute. The following audit activities were conducted:

• identify relevant control objectives for each category;
  
  
• identify relevant application controls that fulfill the control objectives; and
  
  
• evaluate the design of the identified application controls (prior to go-live).

Scope and Timelines

Scope

The following control areas and objectives from CobiT 4.0 were assessed:

The data input and processing controls assessment was consultative-based, and as such some findings may be based solely on information gathered through interviews.

Timing

The assessment of data input and processing controls was conducted from June to December 2006.

Conclusion

In our opinion, the design of data input and processing controls within FNITP has moderate issues requiring management focus.

Strengths

Some of the strengths noted in this area include:

• edits checks are used to control the quality of data inputs and produce error messages when issues are identified. Transactions are not processed unless users address error messages;
  
  
• transactions generate detailed audit trails; and
  
  
• reports submitted by recipients are only considered final after the reports have been reviewed by INAC personnel for appropriateness.
  
  

Methodology

The analysis included both network and application-level vulnerability assessments. The network vulnerability assessment methodology was designed to detect weaknesses in network services and to minimize the risk during testing of denial of service or data corruption. This methodology included host profiling, as well as service profiling and vulnerability identification. The application-level vulnerability assessment testing was performed under two scenarios: 1) against the application by an anonymous hacker without an account and 2) against the application by a user with a valid application account.

Scope and Timelines

Scope

The following items were in scope: a network vulnerability assessment, an application vulnerability assessment, and an update on the status of the action plan to address recommendations from the FNITP threat and risk assessment report.

The following items were not in scope: a complete examination of the underlying network infrastructure and the Corporate Application Security Controller module used to support the FNITP login.

The technical vulnerability assessment was consultative in nature and, as such, some findings may be based solely on information gathered through interviews.

Timing

The Technical Vulnerability Assessment was conducted from November 8 to November 14, 2006.

Conclusion

In our opinion, the design of controls to mitigate technical vulnerabilities is effective, with the exception of the medium risks detailed below. These risks can be easily mitigated by implementing the suggested recommendations.

Strengths

Some of the strengths noted in this area include:

• a Threat and Risk Assessment and Statement of Sensitivity were recently conducted on the FNITP system;
  
  
• Secure Socket Layer encryption is used by the application to secure communication between the web server and the web browser clients; and
  
  
• a virtual private network offers additional protection for users who are accessing FNITP from outside of the INAC network (e.g. First Nations users).