Item - 2011.AU1.13

The Audit Committee recommends that:

1.                  City Council request the City Manager to provide clarification to City divisional management regarding the role and responsibility of the Chief Information Officer as the single point of authority for managing City-wide and division-specific software.

2.         City Council request the City Manager, in consultation with the Chief Information Officer and the City’s Agencies, Boards, Commissions and Corporations, to review the need for the development of closer coordination in the acquisition and management of software.  Closer coordination with the Agencies, Boards, Commissions and Corporations has the potential for significant cost savings.

3.         City Council request the Chief Information Officer to prepare a Software Asset Management Plan.  Such plan to address the role of information technology governance committees, accountability, policies, procedures, practices and divisional coordination related to managing software.

4.                  City Council request the Chief Information Officer to ensure the City Information Technology Risk Management Program includes a periodic risk assessment to identify, assess and implement processes to address software related risk.

5.                  City Council request the Chief Information Officer to review existing City information technology related policies, procedures and software asset management best practices.  Additional policies, procedures and processes should be implemented where needed, to ensure City software is managed in a consistent, cost-effective and controlled manner.

6.                  City Council request the Chief Information Officer to determine resources and processes necessary to update and maintain the Information Technology Asset Management System prior to implementation.

7.                  City Council request the Chief Information Officer to ensure project goals, benefits and expectations for the Information Technology Asset Management System are clear, measurable and documented.

8.         City Council request the Chief Information Officer to provide regular reports to the Business Advisory Panel on project progress.

9.         City Council request the Chief Information Officer to review current practices followed by divisions and take steps to standardize management controls to ensure effective processes are in place to track, reconcile and monitor City-wide software compliance.

10.       City Council request the City Manager:

a.         to communicate to staff regarding the need to comply with the 2007 directive to summarize software license agreement terms and conditions; and

b.         to instruct divisional management to provide contract summaries to the Corporate Information and Technology Division.

11.       City Council request the Chief Information Officer to develop a plan for the Finance and Administration Unit to effectively promote good contract management practices for software license agreements.

12.       City Council request the Chief Information Officer to include software management service level expectations in formal service level agreements between operating divisions and the Information and Technology Division.

13.       City Council request the Chief Information Officer to clarify the respective roles and responsibilities of divisional and corporate staff responsible for managing compliance with software agreement provisions.

14.       City Council request the Chief Information Officer:

a.         to implement a formal City-wide process for granting system administrative rights and privileges; and

b.         to formalize a system for reviewing system administrative access rights and privileges on a periodic basis.

The objective of our review was to determine the adequacy of controls over the administration of information technology software owned by the City.

Our review identified opportunities for strengthening controls over information technology software.  Specifically, the City should develop a comprehensive software governance plan to address the Information and Technology Division’s overall program for acquiring and managing computer software used throughout the City.

Our audit also identified other areas where computer software management needs improvement.  Implementation of the 14 recommendations contained in this report will align City processes more closely with best practices related to computer software management, increase efficiency and improve management control.