Report 2014-116 Recommendation 13 Responses

Report 2014-116: California Department of Consumer Affairs' BreEZe System: Inadequate Planning and Oversight Led to Implementation at Far Fewer Regulatory Entities at a Significantly Higher Cost (Release Date: February 2015)

Recommendation #13 To: Technology, California Department of

To ensure that IT projects have the oversight needed to better position them for success, CalTech should require state departments to appropriately address deficiencies identified in CalTech's approval of any SPRs as conditions that must be met, and to do so according to specified timelines. If the deficiencies are not adequately addressed within the specified timelines, CalTech should take action to suspend the project until the department has either resolved the identified deficiencies or adequately documented its justification for not addressing the deficiencies.

Annual Follow-Up Agency Response From November 2017

Written procedures were developed and implemented.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

The technology department revised SIMM Section 45 - Appendix G - by including a section in the IPO report template focused on the respective state department's actions to address conditions identified in the Technology Department's approval of any SPRs. Further, the technology department revised its Issue Escalation Process to more fully describe how issues or risks, including stagnant remediation of any conditions in the approval of an SPR, will be escalated to state department officials and to management of the technology department. Further, the Issue Escalation Process includes when and what the technology department should require as remedial actions, or the sanctions that it will impose when departments do not comply with these remedial actions.

Annual Follow-Up Agency Response From October 2016

ITPOD publishes the most recent project approval conditions and the status of each in the IPOR. If the project fails to make progress on the project approval conditions by the dates established in the approval letter, the IPOD manager notifies the Branch Chief and Deputy Director for discussion with the department and project leadership. This process has been successfully used in 2016, but with the publication of the Escalation and Corrective Action Plan policies referenced above, departments will have greater understanding of the importance of addressing the project approval conditions.

California State Auditor's Assessment of Annual Follow-Up Status: Not Fully Implemented

1-Year Agency Response

Due to funding constraints and workload, the anticipated Project Planning & Lifecycle Automation system will be delayed until next year. But, ITPOD is now using a manual process to track compliance with project approval conditions. This includes documenting the conditions in the IPOR and reporting on progress each month. If the project fails to make progress on the project approval conditions, the IPO manager will follow the new draft Escalation Process that is expected to be finalized by March 2016. We are also developing a follow-on process for issuing a "Corrective Action" (CAP) requirement on an IT project. This will take the form of both policy and formal ITPOD process. Because the CAP will take the form of published policy, we expect to finalize it by June 2016.

Together the Escalation process and the CAP policy will contribute to the framework necessary to evaluate project problems and ensure appropriate attention and accountability are employed so that the problems can be resolved.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

This capability has been included in the requirements for the Department's new IT system project: Project Planning and Lifecycle Automation. Target date for the new system is September 2016. Until then, a manual process is required. The manual process is expected to be completed by September 2015.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

60-Day Update:

CalTech ITPOC will develop a standardized process to track the results of a state entities compliance with any/all conditions that CalTech places on approval of a Special Project Report. In the event a state entity fails to respond adequately to the conditions, the IPO will follow Project Oversight Escalation Process and ITPOC management will determine and/or recommend the appropriate remedial action.

The new process is expected to be implemented by July 2015.

California State Auditor's Assessment of 60-Day Status: Pending

All Recommendations in 2014-116

Agency responses received are posted verbatim.