ICL Pathway
FUJ00079788
FUJ00079788
Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
Document Title:
Document Type:
Abstract:
Status:
Distribution:
Author:
Comments to:
Audit of Implementation
Report
This report documents the outcome of an internal audit of
Implementation. The audit was one of a planned programme of
audits within ICL Pathway for 1999. Its prime objective was to
confirm the state of readiness of the Implementation operation
for the advent of National Rollout. Terms of reference for the
conduct of this audit were circulated on 31 March 1999 and the
initial interviews were conducted on 29 April. A draft report
was circulated to Implementation management for comment on
10 August; formal comment was received on 8 September and
the report has been amended where appropriate. Where these
comments refer to action taken subsequent to the review, the
action has been annotated in the body of the report and will be
followed up during the CAP phase.
APPROVED
J. Flynn J. Bennett
M. Bennett D. Groom
J. Holmes
E. Long (FELO1 co-ordinator)
C. Tebbs (KIDO1 co-ordinator)
Library
S. Loam
S. Loam
© 1999 ICL Pathway Ltd
COMMERCIAL IN CONFIDENCE Page 1 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
0 Document control
0.1 Document history
Version Date Reason
0.1 10/08/99 First draft for comments.
1.0 08/09/99 Issued following receipt of management comments
0.2 Approval authorities
Name Position Signature Date
M. Bennett — Director Quality & Risk
0.3. Associated documents
Reference Vers Date Title Source
TA/PLA/001 1.0 Internal Audit Plan 1999
0.4 Abbreviations
ATDB Activity Tracking Database
BA Benefits Agency
CCB Change Control Board
cP Change Proposal
HSH Horizon System Helpdesk
IPE Implementation Programme Executive
IPM Implementation Programme Manager
MTC Minimum Training Compliance
NRO National Rollout
OMR Organisation Management Review
POCL Post Office Counters Limited
Qs Quantity Surveyors
RFI Ready for Installation
COMMERCIAL IN CONFIDENCE Page 2 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
RODB Rollout Database
SLA Service Level Agreement
TED Technical Environment Description
TEI Technical Environment Implementation
WT Workplace Technologies ple
0.5 Table of content
1 Entroduction ee eeccseeesseeeeeeeeeseeeeseeesseeseseeesseeeneesessteesensesneeensesennsessmesenetesneneeneesnneeese 4
2 Scope & Conduct 2.0... cececececec cece eesesseeessceeesesseeesueesesessessesneessenssessnensessnseeeseeneeeeee A
3 Management Summary .............c:cceceeeeeeeeeeeseeereeeeee Error! Bookmark not defined.
B.D Gemeral 2... cece ces eee eee eeeseeetesseesneesneesenesessseenesnsesnesnsersesnessneesesesseseeereesneeneeeesenee 5
3.2 Financial Control... cesses ees eecseec ness sess eesseeseesessensseesneesesesesseesneesseesteaessenssee SD
3.3 Support Systems..........e.cecceceesesseseeseseesessessesneseesesneeseseaeesesueesesreeeeseeseeeeeneneeeeenee 6
3.4 Sub-Contractor Management .............cscceecseeseesesssesseesseesneeseeeseseeesneensessneesesesesees O
3.5 Asset Management... cece eeeceeeeeseeseesesses teense teaesneenesnseteseeneessneeeeseeneeeees O
4 Detailed Findings...
4.1 Communication Channels and Management .................ccccseseeeeeeeseeeeseeeeeeeeeeeees 8
4.2 Financial Control ......
4.2.1 Budgeting and Variance Analysis ..........0...ccccescesee tees esteseeeeseeseeteeeeeeeee D
4.2.2 Cost Control
4.2.3 Payments to Suppliers ...........c.ceccecsceeesseseeseeseesecseeeeseeseesessesteseesesseeeeeeaees 9
4.3 Management of Subcontractors ............0.ccsseessesseeseeessesseeseeeseeesteeseeseesseesneeseeee 12
4.3.2 Surveys and re-surveys.
4.4 Acquisition, Storage and Distribution of Equipment..............0:cceeneneeeee 14
4.5 Scheduling and Monitoring of the Programme ...............0.:0cecseeeeeeeeeeeeeee LO
4.6 Support Infrastructure o.oo... ceeceeecseeeeseeseesesseseeaeeeesesneeteatseeeseeneeeereeeeseeseeee LT,
4.7 Implementation Support Systems ............s.eccesecsessesseeeeseereeseeseceseereeseereetesteneee 17
18
4.9 Sub-Contractor Contingency / Business Continuity 0.0.0.0... cee 18
4.8 Resourcing Plans...
5 Annex I - Terms of Reference ...........ccecccccceessteesseeseseeesseeseseeesneeseeesesneesnieseseseeneees 20
COMMERCIAL IN CONFIDENCE Page 3 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4
Introduction
Implementation is an operational unit within ICL Pathway responsible for managing
the national rollout of the Horizon system into Post Office Counters Limited. The
division was recently reorganised and now comprises four sections:
= The rollout team, based at Kidsgrove, with responsibility for delivery of the
programme, technical design, scheduling, supply of components, monitoring
survey and modification costs, and running the rollout helpdesk.
= Training and Migration, based at Feltham, responsible for defining the training
requirements and managing the delivery of training and migration (training is
carried out by a subcontractor and ‘in office’ data migration is effected by POCL).
= Four Field teams, one in each of the POCL regions, managed from Feltham. Their
role is to manage the implementation and subcontractors in the regions and liaise
with POCL on work to be carried out. They are Pathway’s primary interface for
issue resolution.
= Business Operations, based in Feltham, covering programme office, finance and
acceptance.
In addition there is a small HQ group based at Feltham comprising the
Implementation Director and a Financial Controller (recently appointed).
Scope & Conduct
The audit forms part of the 1999 programme of planned internal audits into aspects of
ICL Pathway’s organisation and activities. The emphasis in this audit was to confirm
the readiness of the constituent parts of the Implementation operation for the advent of
national rollout, and to evaluate the adequacy of controls over expenditure.
The audit was undertaken in accordance with the Terms of Reference (attached as
Annex 1). The audit resources planned were not all available when the audit was
conducted; the assistance of Pathway’s Y2k manager, Ian Honnor, is gratefully
acknowledged.
COMMERCIAL IN CONFIDENCE Page 4 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
3.1
3.2
Management Summary
General
This audit was carried out much later than initially planned, largely due to staff
availability and organisational restructuring within Implementation. The principal
general findings of this audit were:
e At the commencement of the audit there was a general dearth of process and
procedure documentation for all functions. This was recognised as a major area of
concem, and process engineers were appointed to produce the required
documentation. Management focussed their effort primarily on areas identified by
the audit, as they did not believe they would achieve comprehensive coverage of
the outstanding areas in the time available (authorisation has been obtained to
utilise process engineers for 6 man months).
e Some areas, notably the Quantity Surveyors (who authorise the payments for
surveys and re-surveys) and the people responsible for purchasing equipment,
operate with a large degree of independence and minimal internal control, as
detailed in paragraphs 4.2.3 and 4.4. These are specialised areas run by competent
staff, and appear to be operating well. Working practices have evolved over time,
but the absence of formalised and documented processes and procedures results in
a huge degree of dependence on the present incumbents. Should they suddenly be
removed, significant disruption would result.
e Agreement was reached on the preparation of business contingency plans. Most of
them should have been completed by the end of June 1999, but there has been
little progress in this area to date.
Financial Control
When the audit commenced there was not an effective system of budgeting or
variance analysis — control was exercised via high-level financial reviews. Line
managers did not have a mechanism to enable them to exercise effective financial
control, nor was there an apparent delegation of this control to them. During the
course of the audit a Financial Controller was appointed; he has done a good job of
developing a detailed forecasting model against which actual expenditure is being
compared. At the most recent review it was noted that the level of detail in the
forecast (which was appropriate for line managers’ control purposes) exceeded that
which was readily available from the central accounting system, resulting in the need
for manual analyses of actual results for comparison against forecasts.
Controls over payments to suppliers were generally effective.
The processes around placing orders and paying suppliers for their delivery of goods
and services were reviewed. The processes were well established and generally
COMMERCIAL IN CONFIDENCE Page 5 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
3.3
3.4
3.5
known, but for the most part not documented. Controls around purchasing and
payments were effective, but at a detail level there was scope for improved efficiency.
[Note: The Implementation Director confirmed that corrective action has commenced.
This will be verified during the Corrective Action phase of the audit.]
Support Systems
A number of support systems have been developed locally to assist individual staff
members or groups to carry out their functions more effectively and efficiently. They
have not benefited from the controlled environment of testing, change control or Y2k
compliance. They were generally not documented and were dependent on one key
individual for their effective operation. Principal among these was the Activity
Tracking Database, which has become a business-critical application.
Sub-Contractor Management
Early indications were that this was an area of concern — less sites were being fed into
the survey process than were agreed contractually, and there was a higher dropout rate
to re-survey than was initially envisaged. The experience in Live Trial indicated that
there were numerous problems in offices which had been indicated as RFI (this was
after more review and checking had been carried out on those sites than will be
available to the rest of the estate in NRO). These issues are being addressed by
Implementation; at their request the Pathway Quality Manager conducted an audit of
WT processes and the managerial control of processes carried out by sub-contractors
on behalf of WT (QU/REP/004). Implementation management have determined that
WT is their only source of concern in this area and have instituted an action plan
which is reviewed weekly.
Asset Management
The operational functions of purchasing and managing the storage and distribution of
components are controlled by two employees. The processes for the ordering of
equipment and payment of invoices are reasonably sound (with the exception of
verbal confirmation of the receipt of goods in some instances). From the point of
receipt, however, the same people have total control over the stock. They manage the
receipt and issues of stock, maintain stock records and track the progress of goods
ordered and issued. There is no independent internal control process to verify the
accuracy of their stock records.
[Note: The Implementation Director confirmedthat corrective action has commenced.
This will be verified during the Corrective Action phase of the audit.]
All stock purchased is being stored in a single location at Byley — current value about
£20M. In the event of destruction of the warehouse (e.g. by fire) the rollout process
would be decimated as some of the stock (e.g. Ithaca printers) are imported and have
COMMERCIAL IN CONFIDENCE Page 6 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
long lead times. Pathway does not have effective control over assets removed from
post offices.
= Currently assets are removed by Exel when they go on site to do an installation at
an automated site (both ECCO and release lc sites — the former equipment
belonging to POCL, the latter to Pathway. Similar issues will arise with ALPS
equipment). The equipment is placed in overshippers and taken to the Byley
warehouse where it is sorted and listed by Exel staff. Only at that point is Pathway
informed of what equipment is held.
= There are no documented procedures covering the shipment to POCL of
equipment belonging to them (ALPS and ECCO kit).
COMMERCIAL IN CONFIDENCE Page 7 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
41
4.2
4.21
Detailed Findings
Communication Channels and Management
The primary focus of this audit was to confirm the Implementation Team’s readiness
for National Rollout. Due to the geographic dispersion of the different parts of
Implementation, communication between the various locations was considered as one
of the key areas that would need to be managed effectively. Discussions with
management indicated that meetings are held in a matrix thatcovers Implementation,
POCL and suppliers.
Implementation
The Implementation Director attends CCB and Pathway Management Team Meetings
weekly and briefs all his direct reports on the same day. They also meet monthly (this
meeting follows a fixed agenda including recruitment, progress and issues). Formal
minutes are not recorded but the Implementation Director records and monitors
actions via his daybook.
IP staff recently attended a ‘functional’ meeting. The intention is to hold such
meetings at 2 or 3 monthly intervals to provide an opportunity for the staff dispersed
in the IP regions to share their experiences and provide motivation.
The Implementation Director’s direct reports provide him with weekly reports of their
activities and copies of their diaries.
POCL
Following BA’s withdrawal a new process has been proposed by POCL and accepted
by Pathway for reporting. It consists of a fortnightly checkpoint meeting, which is
preceded by a session between the Implementation Director and his Horizon
counterpart to ensure that the meeting is presented with a consensus view and that any
new issues are understood before being exposed to a wider audience. These meetings
are chaired, minuted and actions monitored by POCL.
Suppliers
Meetings are held in a hierarchical structure along peer group levels, from the
Managing Director’s “Suppliers Round Table” meetings, through the Implementation
Director’s management briefing forums, to the supplier management forums led by
line managers. Detailed minutes of proceedings are not kept for the latter two forums
but action plans are agreed, documented and monitored.
Financial Control
Budgeting and Variance Analysis
Budgets had not been prepared in sufficient detail to facilitate effective management
control over expenditure (Implementation’s total expenditure is expected to be about
COMMERCIAL IN CONFIDENCE Page 8 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.2.2
4.2.3
£200M). A Financial Controller was appointed for Implementation subsequent to the
commencement of the audit; at the time this area was reviewed he was preparing
detailed monthly expenditure forecasts. The approach taken has necessitated the
introduction of a more comprehensive accounting structure, which will result in more
meaningful reports for control purposes. Actual results are being reported in the
required format, but currently need to be manually analysed and input into an Excel
spreadsheet to produce the division’s financial report
Cost Control
Implementation’s Financial Controller has recently instituted a monthly review with
his division’s managers responsible for budgets. The proposed reporting format
(which had not been introduced fully at the time of the audit) will include a forecast
spreadsheet (comparing actual and forecast expenditure and reflecting variances),
general ledger report and (in the longer term) purchase order commitment report. The
intention of the purchase order commitment report is to list all open purchase orders,
reflecting the value originally approved, as well as the amount already expended and
the balance available.
Payments to Suppliers
Survey / re-survey fees
In general there was effective control over payments made to subcontractors.
Processes and procedures for authorising work to be done, as well as payments for the
work completed, were well established and consistently applied. The processes and
procedures were, however, not documented. Due to the high degree of automation in
the processes and the limited staff complement, this represents a significant risk
exposure as the effectiveness and efficiency of the processes are wholly dependent on
the present incumbents. Limitations of the staff complement and the degree of
specialisation required to perform the function effectively have resulted in a division
of responsibilities that is not ideal to support effective internal control in the system,
specifically segregation of duties and independent authorisation.The Commercial
Manager (who manages the Quantity Survey Department) is responsible for the entire
process from work authorisation to settlement by:
= authorising quotes for irregular work to be done;
= authorising the subcontractors’ invoices;
= agreeing the amount to be paid on each invoice;
= arranging for any credit notes to be issued to Pathway where appropriate.
= His department monitors the reconciliation of the accounts and maintains the
document trail.
The highlighting of these system weaknesses is not intended to suggest that there has
been any impropriety in this area — the audit concluded that sub-contractor payments
for surveys and re-surveys were competently managed and well controlled. The total
costs to be incurred on these fees was budgeted at £40M; it appears thatthe final cost
will be within budget. In addition, this department has recovered more than £1.5M
arising from sub-contractors’ over-invoicing.
COMMERCIAL IN CONFIDENCE Page 9 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
The processes and procedures around the authorisation of category C quotes and the
verification of invoices for payment have been agreed as one of the high priority
areas to be reviewed by the Process Engineers in the short term. Audit endorses this
prioritisation and will review the progress during the Corrective Action phase of the
audit.
Standard rates have been agreed for work to be carried out at most sites. Quotations
are submitted for irregular items — “Category C” work carried out by WT and all
modification work carried out by Pearce. Category C items are authorised by the
Commercial Manager (Quantity Surveyors’ team) while modification work is
authorised by one of the region’s IPEs. (At the time of the review quotations for
modifications were being authorised by the IPM but it had been agreed that they
would not be able to meaningfully review all quotations at the peak of national rollout.
A decision was made to delegate this responsibility to an IPE — the organisation
structure had been amended and provided for 2 IPEs in each region; the
Implementation Director has indicated that this has now been increased to 3 per
region). One of the checks carried out is a comparison of the amount quoted to a table
(parameters are based on the number of counter positions). If these amounts will be
exceeded the office is suspended from the programme and referred to POCL, who will
decide whether the installation should proceed. If they approveit, they are responsible
for payment of the excess amount. The high level agreement is covered by a contract
controlled document, but there is not a formal process detailing how the excess costs
this will be recovered from POCL.
Processes must be formalised for expenditure in excess of Pathway’s agreed limits. In
particular, the authorisation procedures and documentation must be formalised, and
the mechanism and control over the management of charges to be recovered from
POCL must be agreed and documented.
An error in the RODB caused the status of an outlet to be reflected as “RFI” (ready for
installation) if the “preparation date” was earlier than the current day. The RODB
status was thus not being used to verify an invoice for payment — reference was
instead being made to the “preparation actual date” held on the RODB. This dateis,
however, input by the supplier. A further check is now being carried out to ensure that
Exel have received the completion pack before an invoice is passed for payment. A
retrospective application of this comparison resulted in £56000 being deducted from
WTs payment (where they had been paid for conducting the survey but had not
forwarded the completion pack to Exel).
Payment must be made within 30 days of presentation of invoices. Accruals are not
raised for costs incurred, but for which invoices have not yet been presented.
Equipment
Controls in this area were generally effective, although occasionally informal (e.g. the
routing of invoices and delivery notes is not consistent. Invoices may be sent to
Kidsgrove or Feltham. Delivery notes are seldom forwarded to Feltham in support of
payments. Where a delivery note has not been received, confirmation of receipt of the
goods will generally be obtained by telephone, hence accountability for errors cannot
be confirmed at a later stage).
COMMERCIAL IN CONFIDENCE Page 10 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.3
4.3.1
There is scope for improvement in the efficiency of processes and procedures —
effective working practices have evolved, but have not yet been documented. Several
of the processes involve the transmission of documents between Kidsgrove and
Feltham, where the process can be amended for greater speed and efficiency (e.g.
KIDO1 fax details of a request to FELO1; FELO1 prepare a “purchase order request”
form and fax it to KIDO1 for signature — not authorisation. It is sent back to FELO1
and is signed by the Implementation Director. An “order request” form is made out in
duplicate and authorised, then entered in the Oracle system to produce a requisition.
The requisition and photocopies of the other manual forms are sent to Finance to
generate a purchase order).
The Process Engineers should review the efficiency of document handling activities in
their formalisation of the processes and procedures covering the order placement and
payment authorisation for equipment.
There is not an end-to-end control over the tracking of equipment. Existing records
will be able to monitor the number of assets of each description from their receipt to
delivery to Celestica for preparation. At that point the serial numbers are recorded for
the first time and a copy is sent to Feltham and recorded on anExcel spreadsheet to
track the movement of assets. When Exel do an installation they scan the bar codes of
the equipment installed and forward this data to Customer Service. There is no
comparison between these two sets of records.
The end-to-end control over equipment, from its receipt into the warehouse to its
installation in an outlet, should be covered by a formal process, which should ensure
that all equipment is accounted for and that the various records are reconciled where
appropriate.
Management of Subcontractors
Training
Peritas (ICL Training Services) are responsible for developing the training material
and delivering the training. Pathway define the training requirements and manage the
delivery of the service. The Training and Migration function’s role is thus supplier
management (Peritas) and customer management (POCL).
Most of the measures employed in the reporting process relate to the 9 contractual
SLAs against which Pathway measures its compliance. Peritas supply four reports:
e A daily report detailing people who have failed courses
e A daily report of people who have not arrived for their training courses
e A daily report of offices that have not met the Minimum Training Compliance
(MTC) requirements
e A weekly report outlining user awareness events, invitations sent out, refusals to
attend, etc.
COMMERCIAL IN CONFIDENCE Page 11 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
Peritas provide a monthly evaluation report, which summarises feedback of the level
of attendees’ satisfaction with the course content and venues (SLA based areas). It
also provides details of the number of attendees at courses and the number of courses
held. Minimum Training Compliance criteria require that the outlet manager and 50%
of the outlet staff be trained (and pass a test) before an outlet can go live. The training
required for MTC must be completed in the 5 days prior to installation. There
is,however, provision for POCL to override this requirement.
Pathway management reports are produced on a weekly and monthly basis, and are
mainly SLA-based. A monthly evaluation meeting is held with Peritas and an
evaluation report is produced.
At the end of each training event sub-postmasters are required to complete an
evaluation form, as Pathway is contractually required to provide feedback to POCL.
These forms are completed at the end of an event. Peritas accumulate the forms, input
the data and send the overall results to Pathway on a weekly and monthly basis. They
also review the comments to establish a trend analysis. Since there is not an
independent analysis (Peritas are accumulating the results of the evaluation of
themselves and communicating those results to Pathway), Pathway are not in a
position to defend the results if challenged.
There should be an independent evaluation to confirm the accuracy of the results of
the sub-postmasters’ evaluation of the training received.
The main concern in this area is the speed at which changes can be communicated to
field staff. Training PCs are not ISDN-enabled. Updates are e-mailed or posted to
trainers; for new releases all trainers will be “recalled” by Peritas — during peak
national rollout they will have about 200 contract/temporary trainers in the field.
Peritas employ regional training managers whose responsibilities include ensuring that
all updates have been received. They will also have a role in ensuring that overall
quality control standards are maintained. Apparently they currently do random checks.
It is anticipated that random sampling procedures will be introduced but these have
not yet been formalised. A further complication is that there is not a formal
communication process to inform Trainingwhen changes are effected in the live
system. It was also noted that there were regional differences in the training material
being presented.
It is imperative that a process be introduced to ensure the consistent application of
the latest training material, and that these processes be formally documented. The
communication of changes to the live system which will impact the training process
must also be addressed.
[Note: The Implementation Director confirmed that corrective action has commenced.
This will be verified during the Corrective Action phase of the audit.]
There is not a formal procedure for ensuring that feedback received from training
programmes is incorporated into the programme to achieve improvements. The
Training and Migration Manager has been tasked with producing a Training
Programme Feedback Plan, which will define how feedback received during national
rollout can be applied to the existing material and made available to the training PCs
COMMERCIAL IN CONFIDENCE Page 12 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.3.2
4.4
in the field. It is understood that a major review is planned to take place during the
December pause, but there is currently not a documented strategy for this.
Formal processes must be introduced to pro-actively incorporate feedback from
training programmes in future releases. The specific objectives of the December
review should also be defined to ensure that the appropriate staff are available as
required.
Where the criteria for MTC have not been met, POCL frequently sanction the
continuation of installation (e.g. where the criteria have not been met due to maternity
leave or due to a high proportion of casual/temporary staff in outlets). Pathway
procedures and responsibilities in such an instance have not yet been formalised.
Agreement must be reached regarding the process to be followed where MTC has not
been achieved. Procedures must be agreed with POCL and documented. Roles and
responsibilities must be clearly defined.
Surveys and re-surveys
Installations carried out during the previous month are reviewed at the Supplier
Management Forums run by the Rollout Manager. The recently initiated Inspectorate
Service, provided by OSD, is tasked with auditing 10% of all Infrastructure and
Installation sites independently. It was noted that, at the Live Trial sites installed, there
was a snagging ratio of about 60%. The subcontractors used by WT at the time of the
preparation of those sites have since been replaced. These issues are being addressed
by Implementation; at their request the Pathway Quality Manager conducted an audit
of WT processes and the managerial control of processes carried out by sub-
contractors on behalf of WT (QU/REP/004). As this is the subject of a separate review
it was not pursued any further in this audit.
Acquisition, Storage and Distribution of Equipment
These functions are currently being performed by two staff members — formerly it was
the responsibility of PPC, an ICL company which has now been disbanded (both of
the present incumbents were employed by PPC). Their work procedures and
methodology have not changed, and their records are maintained on their own stand-
alone PCs (they will apparently be connected to the network in the near future). They
have no formally documented processes or procedures.
The effective management of the functions responsible for the acquisition, storage and
distribution of equipment is a crucial element of rollout. Currently the successful
execution of these functions is dependent entirely on the skills and knowledge of the
present incumbents. It is important that these processes and procedures are
documented as a matter of urgency.
The separation of responsibilities in the procurement and stock management functions
is not conducive to strong internal control (the capability whereby successive
processes within a system monitor earlier activities and highlight errors or
irregularities):
COMMERCIAL IN CONFIDENCE Page 13 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
= The same staff members forecast the stock requirements (using a stand-alone
system which is not correlated to existing systems such as RODB; authorisation
of the order is based on the same forecast);
= initiate the placement of the order;
= receive the stock
= control stock movement and storage.
= The only stock records available are maintained by the same people, also on their
stand-alone system. They provide the data on stock movements for the financial
records to be updated at month-end.
This is not intended to suggest that there has been any impropriety. The audit opinion
in this area is that these functions are competently managed and well controlled, albeit
with very strong dependence on the current incumbents (with no formally documented
processes, as mentionedearlier).
The Process Engineers’ reviews should include an end-to-end analysis of the
procedures and should identify controls/monitors relevant to the process. In
particular, there should be a correlation between the forecast requirement for
equipment and the RODB (which holds precise details of the number of counters per
outlet and the outlets being installed at any time), and between the stock records and
the financial records.
[Note: The Implementation Director confirmed that corrective action has commenced.
This will be verified during the Corrective Action phase of the audit.]
The forecasting of equipment to be purchased is not based on information from the
Rollout Database, but on a forecasting model developed under Excel. Stock on hand,
which forms part of the calculation of items to be ordered, is manually input from the
stock records. The intention is to use the results of the physical stock counts in future
— these will probably be undertaken quarterly.
The ordering procedure is as follows:
= Order initiation takes place at Kidsgrove and is based on a forecast produced on an
Excel spreadsheet with no direct interfaces to any other records (such as RODB).
= The requirements are e-mailed to Feltham{Marlene Henderson} to complete a
“Purchase Order Requisition” (manual document). The request details the
supplier, item, quantity and price.
= The “Purchase Order Requisition” is sent to Kidsgrove for signature (not
authorisation).
= Tt is then sent back to Feltham for authorisation and order origination. The order is
then sent to {Marlene Henderson} for placement and a copy is sent to Kidsgrove
to progress.
= Goods are usually delivered to the Byley warehouse, but may also be shipped
directly to Ashton (Celestica). The receipt of these goods will not be recorded in
the normal way, and will be confirmed with Celestica by telephone.
COMMERCIAL IN CONFIDENCE Page 14 of 20
FU.
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.5
FUJ00079788
IJ00079788
The Process Engineers should review the ordering process during the course of
producing their documentation, specifically to assess whether the required functions
can be carried out more efficiently and/or effectively.
All equipment purchased for the installation programme is housed in a warehouse at
Byley, owned by Exel (the same distribution hub from which the Exel installation
teams operate). They manage the warehousing of the stock, including the acceptance
of deliveries on Pathway’s behalf— these goods are then isolated until checked by
Pathway staff. The value of current stock holding is about £20M, and includes 18000
Ithaca printers (imported), 9000 Epson 200 printers in black (model no longer made;
colour non-standard) and 36000 scanners. The current stock of PCs is about 1950
166MHz machines. Most of these will be used in training — 1400 by Pathway and 350
by POCL. 332 were added to stock as returns from 1c counters.
At least two separate locations should be utilised for the storage of equipment
purchased for the installation programme. The loss (e.g. by fire) of the entire stock of
a line of imported components, which may have a lead time of a few months, will
seriously hamper the installation programme.
There is not a formal, controlled process for handling stock that is removed from
counters and returned to the warehouse, nor for recording and authorising stock write-
offs. Assets are removed by Exel when they go on site to do an installation at an
automated site (both ECCO and release Ic sites— the former equipment belongs to
POCL, the latter to Pathway. Similar issues will arise with ALPS equipment). The
equipment is placed in overshippers and taken to the Byley warehouse where it is
sorted and listed by Exel staff. Only at that point is Pathwayinformed of what
equipment is held.
Formal procedures should be implemented for handling stock returned to the
warehouse and for writing off stock items where appropriate. Procedures should
include guidance on packaging (to prevent or minimise damage), labelling, control
and maintaining an audit trail of movements until delivered to the nominated depot.
All items to be installed in POCL are routed through Celestica for preparation, and
then delivered to Exel in overshippers. Requests for goods to be delivered to
Celestica, and confirmation that the required stock has been received, are generally
communicated verbally or occasionally by e-mail.
Scheduling and Monitoring of the Programme
Scheduling is effected by inputting parameters into the RODB, which then produces
the schedules of offices to proceed to the next phase of the programme. It also
provides exception reports to indicate which offices have dropped out and at what
stage.
Monitoring is carried out by field staff. Each regional office produces a report of
successful installations on a daily basis. They will also produce a weekly report of
exceptions from the RODB and ATDB and a weekly report showing trends. Field staff
will manage Pathway staff and subcontractors in the regions. IPEs are responsible for
COMMERCIAL IN CONFIDENCE Page 15 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.6
issue management (they must manage the issue resolution process to the point where
the office can be re-scheduled), as well as liaison with the planning team for the
scheduling and re-scheduling of offices. They also approve quotes for modifications.
Escalation procedures have not been documented, although a hierarchy of escalation
has evolved through usage and existing practices.
To facilitate speedy resolution of issues arising when the peak rollout rate is
achieved, escalation routes for outstanding issues need to be clearly defined and
documented.
Support Infrastructure
Outlets operating in the live environment are supported by the Horizon System
Helpdesk (HSH), which is the Postmasters’ primary contact point. While they are
being prepared for live operation the Rollout Helpdesk (ROHD) provides the primary
liaison for the parties involved in the rollout. When Postmasters raise calls related to
the implementation, they raise a call on HSH and HSH raise a call on ROHD. At the
time of the review the documentation was still being finalised, but the contents of the
existing manuals was sufficient to provide a good induction for a new starter, and
generally adequate to ensure that principles and procedures were applied consistently.
‘Priority’ and ‘severity’ ratings are allocated to each call. These have not been fully
defined, although all staff questioned appeared to have a similar view on their
application.
It is recommended that ‘priority’ and ‘severity’ ratings are formally defined to ensure
their consistent application, particularly relevant when rollout is running at peak
rates.
ROHD statistics were reviewed. Reports were not available directly from the system,
and on one occasion could not be produced. Statistics at 29 April reflected a weekly
average of about 1000 calls; about 2500 were open calls and the trend indicatedan
increase of about 100 open calls per week. Reports were not available at 30 June, but
the ROHD Manager indicated that there were about 1800 open calls at that stage, and
that the trend was a decrease of about 100 calls per week. He also mentioned that a
support team from HSH would be reviewing their reporting requirements shortly.
Reporting requirements from the ROHD need to be addressed to facilitate accurate
and timely statistics being obtained easily.
The ROHD Manager indicated that they did not have appropriate codes for all the
entries they needed to make in the PowerHelp system.
A CP must be raised to request the appropriate PowerHelp codes needed by ROHD.
There are no SLAs or other agreements with HSH or any suppliers. There are
operational level agreements which they attempt to meet, but these are not formally
binding. They are included in the Problem Management Registers, which are in place
for all but one of the suppliers (Pearce).
COMMERCIAL IN CONFIDENCE Page 16 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.7
4.8
Implementation Support Systems
It was noted that several support systems had been developed in isolation, initially to
assist individuals or small groups to control their functions more effectively. Some of
these systems have now become business-critical, but have never been subjected to
formal testing or acceptance criteria, such as Y2k compliance. Principal among these
is the ATDB (activity tracking database), which is the primary tool used by field
support staff. Similar issues (although not on the same scale) apply to the sitecosting
database used by the Quantity Surveyors; this is used mainly for comparing quotes
with invoices and for forecasting payments. Changes will also be required when the
RODB is moved to a secure server, as QS currently have direct links into it to runtheir
queries against invoices presented. The architecture of the replacement solution will,
however, facilitate the maintenance of the current working practices.
Issues around systems being developed outside of the formal development
environment include the following risks:
e They may not comply with the requirements of the TED and TEI.
e They may not have effective control over change management or backup.
e They may not have appropriate visibility when major changes are planned (e.g.
Workplace 2000).
e They are not run from a controlled server— most are run from local workstations
and are backed up to a server periodically.
e They have not been subjected to the standard testing processes, such as Y2k
compliance.
e They are not documented
e The are generally dependent on one key individual for technical support.
All stand-alone systems must be identified and at least be formally documented,
subjected to Y2k testing, and benefit from formal, tested contingency planning and
change management.
Resourcing Plans
The resource levels have been derived from conducting an OMR based on the
Infrastructure project and experience gained during live trial. A spreadsheet of
resources required for national rollout has been developed covering the full range of
positions required. This identified a peak of 104 personnel required for the period 8/99
to 3/00, to an average of about 95 from 4/00 to 1/01, followed by a tailing off as the
installation tail reduces.
No key posts have been identified nor has any formal succession planning been
undertaken.
COMMERCIAL IN CONFIDENCE Page 17 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
4.9 Sub-Contractor Contingency / Business Continuity
This has been acknowledged as a weak area, both from the perspective of ensuring
that Pathway’s subcontractors have plans in place to ensure their own continuity of
service, and from the Pathway perspective of losing a sub-contractor.
Business continuity plans must be formalised as a matter of urgency. They must be
formally documented and tested.
[Note: The Implementation Director confirmed that corrective action has commenced.
This will be verified during the Corrective Action phase of the audit.]
COMMERCIAL IN CONFIDENCE Page 18 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
5 Annex 1 - Terms of Reference
1.
Audit Aims
This audit will provide assurances about the policies, procedures and practices applied in the
Implementation Programme for New Release 2.
Objectives
To evaluate the operational and management control over the financial commitment involved
in the implementation process.
To assess the communication and co-ordination between the various units involved in
implementation (Feltham, Kidsgrove, Field personnel, POCL Regional offices and POCL HQ
interface).
To assess the degree of preparation for the effective control over the implementation
programme, specifically addressing:
Control and monitoring of the four Implementation Programmes;
Management of subcontractors
Programme Planning, Scheduling and Monitoring mechanisms
Counter Baseline Management (hardware and software, including procurement)
Monitoring, co-ordinating and reporting Implementation Activities
Support infrastructure (HFSO, HSH and Rollout Helpdesk)
Implementation Support Systems (RODB and ACDB)
Asset Management
Security
Resourcing Plans
To ensure that Management Reporting structures are adequate to communicate relevant
information to interested parties in a timely fashion
Exclusions
The migration of the existing Data Service Centres will not be included as that function is the
responsibility of Customer Service.
Dates
The audit will start during the week commencing 26 April 1999 and be completed before Live
Trial, with a final report to the Managing Director and Implementation Director, ICL Pathway.
Approach to the Audit
The nature of the Implementation programme and availability of audit resource means that it
will not be possible to complete theaudit in a four- week block. Rather a series of interviews
and site visits will be conducted at mutually agreed dates at the location where the work is
carried out.
The available procedural documentation will be scrutinised and used to structure interviews
where the emphasis will be on confirmation that procedures are successfully deployed and
complied with.
Every effort will be made by the audit team to minimise interruption to the normal
work of the Department although this has to be tempered with the need to complete the audit
within the required time scales.6. Audit Resources
COMMERCIAL IN CONFIDENCE Page 19 of 20
FUJ00079788
FUJ00079788
ICL Pathway Audit of Implementation Ref; IA/REP/O13
Version: 1.0
Date: 08/09/99
The resources for conducting this audit will be drawn from the following members of the
Quality and Risk Management Directorate:
Jan Holmes
Patrick Cattermole
Stanley Loam
Barry Procter
David Groom
Graham Hooper
7. Reporting
Pathway Audit Manager
Fraud Risk Manager
Internal Auditor
Pathway Security Manager
Pathway Quality Manager
Alliance & Leicester Internal Auditor
At the conclusion of the audit a draft report will be produced and discussed with the auditees.
Corrective actions will be agreed and documented in a Corrective Action Plan. A final report
will be produced and distributed to the Managing Director, Implementation Management
members and the Quality & Risk Management Director.
Further distribution will be at the discretion of the Implementation Director.
8. TOR Distribution
Jim Flynn
Bob McDermott
Graham Chatten
Eamonn Long
Celia Tebbs
Bryan Day
Martyn Bennett
Audit Team Members
Implementation Director
Rollout Manager
Programme Office Manager
Implementation Business Operations Manager (QA Leader)
Modifications Manager (QA Leader — Kidsgrove)
Rollout Database End-to-End Project Manager
Director of Quality and Risk Management
COMMERCIAL IN CONFIDENCE Page 20 of 20