Background 13.1 The 1996 Report of the Auditor General made reference to our interest in the government’s privatization initiatives. We indicated that some privatization projects would be selected for review in future years. 13.2 During the year we reviewed the May 1995 decision by government to privatize its data processing facility. 13.3 A consortium consisting of partners Datacor/ISM and Unisys agreed to a seven year contract with the Department of Supply and Services to operate the Province’s Data Centre. 13.4 The Master Service Agreement (MSA) between the contracting parties is a fairly complex document. It contains approximately three hundred and forty-five pages of agreement detail. Separate agreements are part of the package and cover: • employee transfers; • industrial benefits; • premises lease; and • transition services. 13.5 The MSA is quite specific in detailing the benefits that the government was to achieve by this privatization initiative. The benefits articulated on the first two pages of the agreement are: • creating an environment that maximizes the benefits from the current investment in data processing and encouraging participation by government departments and agencies in both the existing centralized data processing facilities and a common and standardized client server platform; • creating cost savings in the delivery of technology to government departments and agencies; • ensuring increased technology industrial benefits and associated ancillary industrial benefits; • developing technology solutions to improve the integration of data and applications which shall enhance the delivery and effectiveness of government programs; and • establishing an environment which encourages marketplace opportunities for maximizing any additional capability of the Consortium to provide services. Scope 13.6 The objective of our review was to compare the results obtained during the first two years of private Data Centre operation with the expectations set out in the MSA and its various schedules. 13.7 Our work consisted of interviews with government contract administrators, consortium managers and users of Data Centre services. The MSA was reviewed in detail and various reports and financial documents were analyzed covering the first two years of operation by the Consortium. Results in brief 13.8 Users report that the quality of service remains as good and in some cases better than prior to privatization. 13.9 There were no cost savings accruing to government as a result of this new arrangement. In fact savings from staff reductions implemented by the government in their last year of operating the Data Centre were lost when the Centre was privatized. 13.10 A control study of the Data Centre by an independent firm of chartered accountants indicates serious control weaknesses exist. Although it was a requirement of the contract between the government and the Consortium, little has been done to bring the Centre up to industry control standards. The lack of a complete disaster recovery plan is part of this problem at the Data Centre. 13.11 Provisions in the contract that would see up to 15% of personnel resource costs per year transferred from staff reductions in the main frame environment to other government work have not materialized. At the time of our review no efficiencies had accrued to the government from the Consortium’s ability to operate the Centre with considerably fewer staff than was funded in the contract. Quality and cost of the private service 13.12 Users of the Data Centre indicated the quality of the service being provided by the Consortium run Data Centre had improved since the change was made in 1995. Production data also suggests that transaction volumes have increased since the takeover. However the impact on any anticipated government cost savings is not as clear. 13.13 The base funding to be provided to the Consortium was developed using the 1993-94 actual Data Centre expenditures. This analysis indicated a funding level of $11.9 million as the adjusted cost of services the Data Centre provided in 1993-94 that would be turned over to the Consortium. This was augmented by an extra $100,000 to arrive at a minimum service guarantee of $12 million for the initial three years of the contract. In addition to this approximately 19,000 square feet of office space is provided by the government to the Consortium at a nominal fee of $120 annually. 13.14 The government agreed to fund the Consortium for 52.5 person years. According to the Department of Supply and Services the actual staffing had been reduced from the 1993-94 level of 52.5 person years to 44 person years at the time of the take-over in May 1995. This efficiency (52.5 py - 44 py = 8.5 py) was lost when government agreed to fund the Consortium at the old (93-94) level of 52.5 person years. 13.15 In our opinion the Consortium has provided the government with a quality and volume of services that is equal to or better than that formerly provided by the government run centre. The costs are no less, though, than those under the government run system. It would appear as though the efficiencies gained when the government cut back staff at the Data Centre (reduction of 8.5 person years between 1993-94 and 1994-95) were lost under the privatized contract. Departmental comments 13.16 The goal of this particular outsourcing was to achieve equal or better service for equal or better cost . . . . .this has been achieved. Also there were other goals besides cost savings such as industrial benefits, and demonstrating a commitment to downsizing/outsourcing. 13.17 The staffing reduction referenced (52.5 py – 44 py) is not really relevant to the contract. The contract was based on 1993-94 Business As Usual (BAU) costing. It was necessary to choose a snapshot point to ascertain costs relative to a given scope of work. Some time period had to be chosen. The 44 py’s were associated with a different cost period 1994-95. There was also an element of “business not as usual” in 1994-95 which impacted on human resources as the department prepared for the imminent hand-over by re-deploying resources and holding back on new activities. Our comment on the response 13.18 One of the five benefits articulated in the agreement with the Consortium was “to create cost savings in the delivery of technology to government departments and agencies”. We were unable to identify any cost savings arising out of the privatization of the Data Centre. Contract 13.19 The Master Service Agreement (MSA) is a lengthy and complex document. There are several sections dealing with requirements for information or some specific action requirement on the part of the Consortium and/or government. Our analysis of the various requirements is contained in this section of the report. No service auditor’s report prepared 13.20 The MSA requires that the Consortium deliver to the Auditor General, Comptroller, and Department of Supply and Services a copy of a Service Auditor’s report on control procedures at the Data Centre by 31 March 1996 and not less than every second year thereafter. Such report shall be in respect of the control procedures as at a date not more than four months prior to the date the report is required to be delivered. 13.21 In our 1996 Report we commented that this part of the agreement had not been followed. Since that time a firm of chartered accountants was engaged to carry out this audit of Data Centre controls. They were unwilling to issue an audit report because of several unresolved issues. The main issue seemed to be the use of a security protocol (TTSS Software) by the Data Centre that was not recognized by the industry. The firm made several suggestions for improvements. 13.22 At the time of our review the control requirement had not been brought up to standards suggested by the accounting firm. Recommendation 13.23 We recommend the Department of Supply and Services ensure the Consortium bring the Data Centre in line with control requirements set out in the chartered accountants’ report. Departmental response 13.24 The Consortium, in consultation with this department, is addressing the issues identified for improvement. The TTSS security protocol replacement is a very costly undertaking to government as major modifications are required to a large suite of customized applications. These changes are being made as systems are replaced and as applications support budgets permit. The pace of reaching the requirement is heavily dependent on budget available for this priority with respect to the TTSS replacement. External auditor’s report 13.25 The MSA indicates that the Consortium will provide, annually, an External Auditor’s report on the financial statements of each member of the Consortium and any management letters as they related to the Services provided under the Agreement. 13.26 This requirement would appear to anticipate that audited financial information for each partner’s operation be provided to government. This is not being provided. 13.27 One consortium partner provided a copy of the company’s standard audit report with no financial statements or management letter. The other consortium partner provided a copy of their annual report and indicated they do not have a financial audit carried out. 13.28 The Department is not clear on just what is required and have accepted the above noted documentation as evidence that the requirement has been met. Recommendation 13.29 We recommend that the relevent section of the agreement be clarified so that appropriate financial information can be obtained from the Consortium partners. Departmental response 13.30 . . . . . the purpose of this section was to ensure we would annually have evidence of the solvency of the Consortium companies. It is not clear. . . . . that this is in fact what is requested and whether an Auditor’s Report, not a financial statement, is the requirement. In any case we would not expect any “management letters” unless the external auditor found discrepancies. In the case of Datacor/ISM they did submit a letter that basically testified that the audit had been done. In the case of Unisys, they replied with an Annual Report stating that “Unisys Canada Inc. does not complete external audits on their financial statements”. As you know however the U.S. parent is a publicly traded company, and their financial position was investigated when the clear path technology was acquired in 1996-97. The contract allows for a “report on the financial statement” not audited financial statements. Perhaps the external audit report from Datacor/ISM should be more detailed. Unisys, clearly has not attempted to fulfil their requirement here unless one accepts the Annual Report as evidence of solvency. 13.31 It should also be noted that the Province has extensive right to audit under 4.12(a) on a confidential, non-disclosure basis all “books, records, documents and other evidence…”. There has not been any evidence that financial problems, in either partner, has impacted on the performance of the contract so no audit has been initiated by ourselves. Value assurance audit 13.32 The MSA requires the Consortium to engage an independent, unaffiliated, expert firm (the “Consultant”) to evaluate some or all of the Services provided pursuant to this Agreement at a fee of approximately $50,000 for the first review and a reasonable relative fee for each subsequent review. These fees will be shared one-third by the government and two-thirds by the Consortium. The purpose of this evaluation is to review the Service Levels and the Charges for the Services, assess the appropriateness of both and, if required, make recommendations. The Consultant must conduct its evaluation and base its report (including any recommendations) on standards which reflect the environment within which the Consortium operates as compared to the information technology industry marketplace. 13.33 The MSA talks quite extensively about a value assurance audit being done on a regular basis. It appears to be an attempt to assure the various parties to the agreement that the Data Centre is operating efficiently. At the time of our audit a draft performance report had been prepared by Compass Analysis Canada Limited. The final results, in particular the comparison of IBM environments to the Unisys environments, need to be evaluated by the Consortium as well as the government. Recommendation 13.34 Our recommendation is that the Department analyse the results of the value assurance study, document the results, make recommendations for change where appropriate and prepare an appropriate action plan. Departmental response 13.35 The Department has done this. The results of this study were reviewed by Department of Supply and Services (DSS) Contract Management and communicated to the Departments. The Departmental contract advisory committee (DCWG) was given the report and it was discussed and accepted at their 21 March 1997 meeting. 13.36 The value assurance report is required every two years under the contract. The objective is to get a price comparison of our facility to comparable environments elsewhere. 13.37 It was difficult to find a good set of comparison sites for our. . . . . Unisys environment. Compass used six European facilities. . . . . for the Unisys reference group. They also used another comparison group of five IBM sites. 13.38 The findings are documented on page 13 of the report. Although our gross costs appeared to be $2.2M higher than the Unisys comparison group maximum, adjustment of $2.638 M attributable to back-end loaded past lease arrangements brings our cost below the Unisys reference. In other words, our costs compare favourably, when the “sunk” costs built into the contract are recognized. 13.39 The IBM reference group was substantially lower in cost. This is probably not especially relevant because: • it would be extremely costly to convert our applications to run in that environment; and • we have an outstanding Unisys lease running until 2002. Disaster recovery 13.40 Disaster recovery planning is important to ensure continued operation of government operations should some major event occur impacting the Data Centre. 13.41 The MSA acknowledges that the Data Centre did not have a disaster recovery plan at the time it was taken over by the Consortium. The agreement does recognize the need and talks about working together (government and Consortium) to develop such a plan. 13.42 At the time of our review some progress was being made. A consultant was working with the various stakeholders and some plans had been developed and documented. However, a key decision on whether to spend considerable monies on securing a back-up computer site had not been made. 13.43 The need for a disaster recovery system is also pointed out in the Chartered Accountants’ study of controls and in previous Auditor General’s Reports. Departmental comments 13.44 The Province, with the assistance of the Consortium, is in the process of finalizing a technical recovery plan. In the 1997-98 fiscal year we will be presenting to government the findings and costs of acquiring this service. Administering the Master Service Agreement (MSA) 13.45 It is incumbent on government to ensure it maximizes the value of the taxpayer’s dollar which has been committed under the agreement with the Consortium. 13.46 In order to do this the Department of Supply and Services (DSS) assigned experienced staff to manage the MSA. They meet bi-weekly with Consortium management to discuss and resolve problems and plan new initiatives. DSS staff are also responsible for helping user departments understand the contractual arrangements with the Consortium. 13.47 At the time of our review the DSS staff were embarked on a major effort with the Consortium to more specifically identify Data Centre overhead costs. DSS expects the results of this study to provide the basis for lower pricing of new services by the Consortium. Some other areas, noted below, have the potential to improve the return the government gets for its data processing dollars and will need to be monitored closely by DSS. Allocation of costs to user departments 13.48 The method used by the Department of Supply and Services to allocate data processing costs to user departments was a problem prior to privatization and continues to be a problem under the new set up. The problem is primarily due to the commitments for certain mainframe costs that have to be paid regardless of the usage. As departments move to client server environments the government could be in the position of paying twice for the same service, once for the commitment for their old system which operated on the mainframe and again for their new client server systems which may or may not be operated by the Consortium. The Department of Supply and Services is aware of this possibility and has a strong resolve to see this duplication does not happen. As well the departmental user group has studied the situation in some detail and has put forward proposals to improve the process. These proposals include: • strong contract management by Supply and Services to ensure the government is not over charged or double charged for services; • a business case should be required for departments that want to use other than the central services provided by the Consortium; and • the annual planning process should be strengthened so departmental agreements with the Consortium can be signed prior to the beginning of a new year. 13.49 Several other suggestions were aimed at helping make the current funding model more responsive to the budgets and needs of user departments. Recommendation 13.50 We recommend the Department review the cost allocation model currently in place and give consideration to suggestions put forward by the user group. Departmental response 13.51 This is in process. Principles have already been discussed with the ITSSC. Some detail issues remain but we are in the process of coming up with a recommendation. We are very cognizant of the issue of “paying twice for the same service”. Each service including the mainframe is priced separately and care is taken with each new order to ensure the price reflects competitive market rates. As departments migrate off the mainframe there may be an issue of the remaining departments having to cover the price of the mainframe but this is now being watched to ensure decisions account for sunk costs and value for money. This is a government problem and is being addressed through collective planning. A cost allocation model is under review and will shortly be taken to the government by DSS for ratification. Reallocation provisions of the MSA 13.52 One key provision in the agreement between the government and the Consortium has to do with the reallocation of personnel resources from the mainframe environment to client server environments. Generally the agreement anticipates up to 15% of the mainframe personnel resource costs being available annually to the government to fund new client server environments at the Data Centre. 13.53 During the first two years of the contract this transfer has not materialized. If this transfer is not achieved the results will be very costly for government. As noted previously the government will in effect pay the full cost of the mainframe until the year 2002 plus the costs of client server environments for those applications which move to other hardware. Recommendation 13.54 We therefore recommend the Department of Supply and Services take advantage of provisions of the agreement that transfer up to 15% of the mainframe personnel resource costs annually from mainframe to client server environments or re-negotiate this part of the agreement if necessary. Departmental response 13.55 The government usage of the mainframe has continued to increase since the Consortium has assumed its operation. As (and when) this utilization decreases the Contract Management will diligently pursue the reallocation benefits. Attraction of new business by the consortium 13.56 The MSA sets out quite specifically that the Consortium is expected to attract new clients to supplement its government business. The idea is that it would create employment as well as contribute to some of the Consortium fixed costs of operating the Data Centre. This in turn should benefit the government through lower pricing of services by the Consortium. 13.57 In the first two years of the agreement the Consortium had not attracted any significant amount of non-government business. The reasons given were that the Unisys equipment could not adequately separate and secure government data from non-government data. Therefore this significant value added component of the privatization concept was never really viable. 13.58 The original hardware was replaced in January 1997. The new equipment may provide some more options to attract new business. Departmental comments 13.59 The issue of security of government data had limited business development options, for the mainframe. However, you are correct that Datacor has not explored opportunities for the Centre itself. 13.60 However certain Year 2000 work is now heading for processing in the Data Centre. Computer lease 13.61 The quality assurance review carried out for the Consortium by Compass Analysis Canada Limited raised an issue about leasing practices for the Unisys mainframe. The analyst’s report makes an adjustment to the annual lease cost of $2,638,000. 13.62 The analyst’s note reads as follows: Adjustments The Consortium inherited the lease obligations at the commencement of this contract. Consequently, the current cost structure should include some adjustment for the difference between reference group ownership costs and the inherited lease obligation. COMPASS calculates that the inherited lease obligation is $2,638,000 per year higher than the reference group ownership costs for similar sized equipment. It should be emphasized that this was the difference at the beginning of the contract period. Most organizations who find themselves in this situation are able to reduce this difference through negotiations with the vendors on subsequent acquisitions. 13.63 The past practice of rolling the payouts of lease obligations of equipment that is no longer in use into leases for new equipment created much of this problem.This is a poor accounting practice at best and has served to inflate the costs of the Unisys mainframe environment to where the lease payments were $2.6 million a year over the market rate at the time the above noted study was carried out. Departmental comments 13.64 The adjustment to the lease obligations, as raised in the Compass Analysis Canada Ltd. review, has been addressed earlier and is a necessary cash payment but a “sunk” cost relative to the Consortium arrangement.