City and County of San Francisco Civil Grand Jury 2011-2012 F15. There is no comprehensive annual reporting on the

Recommendations 19

• R1
  The Mayor regularly attend COIT meetings to communicate his interest and support of internal citywide technology and move it forward within City government. Response is requested from the Mayor. Déjà Vu All Over Again 17
• R2
  The Budget Analyst or the Controller perform a management audit evaluating the Department of Technology’s functions to determine if the Department adequately communicates with other departments, and how to alleviate the Department’s barriers to better performance. Responses are requested from the Mayor, the Board of Supervisors, the Controller, Budget Analyst, the City CIO, and the departmental CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R3
  Policies and citywide consolidation initiatives adopted by COIT be communicated as Mayoral Directives to Department Heads and CIOs. Responses are requested from Mayor, the Chair of COIT, and the City CIO.
• R4
  COIT appoint two non-voting, non-City employee members to sit on COIT without further delay. Responses are requested from the Mayor, the Board of Supervisors, the City Attorney, the Chair of COIT and the City CIO.
• R5
  The City CIO develop consolidated citywide comprehensive ICT budget and staffing plans, reviewed and approved by COIT, and take the lead in its presentation to the Mayor’s Budget Office and the Board of Supervisors. Responses are requested from the Mayor, the Board of Supervisors, the Controller, the Department of Human Resources, the Chair of COIT, the City CIO, and Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R6
  Subsequent to COIT approval of the ICT budget and staffing plans, COIT and the City CIO monitor adherence to these plans. Responses are requested from the Mayor, the Board of Supervisors, the Controller, the Department of Human Resources, the Chair of COIT, the City CIO, and Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission. Déjà Vu All Over Again
• R7
  The City CIO position be elevated in authority, responsibility, and accountability by creating functional “dotted-line” relationships between the City CIO and the departmental CIOs. Responses are requested from Mayor, the Board of Supervisors, the Controller, City CIO, and Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R8
  Provide staff support to both the City CIO and COIT. Responses are requested from Mayor, the Board of Supervisors, the Controller, City CIO, and Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R9
  Amend Administrative Code, Section 22A.4 and 22A.7, to separate the position of City CIO from the Department of Technology. Responses are requested from the Mayor, the Board of Supervisors, the Chair of COIT, and the City CIO.
• R10
  Amend Administrative Code, Sections 22A.4 and 22A.7, to create the separate position of Director of DT, appointed by and reporting to the City CIO. Responses are requested from Mayor, the Board of Supervisors, the Chair of COIT, and the City CIO. II. A Dearth of ICT Information The Jury, in conducting this investigation, found a dearth of in-depth information about technology in the City, including: technology usage; staffing requirements; and overall costs. A. Technology Reporting ICT planning and reporting is focused on individual projects. Even the recent five-year ICT Plan is focused on projects, including consolidation initiatives, but contains little citywide data on costs, personnel, or equipment. Individual departments create and maintain information on their own ICT plans. COIT also collects this information. However, none of this information is consolidated or used for later citywide analysis. The lack of hard, comprehensive financial information has discouraged decision-makers, particularly those in the top leadership positions, Déjà Vu All Over Again 19 from tackling technology issues citywide or seeing its potential in furthering City programs and reducing costs. Sound management and accountability require such data. Little attempt has been made over the years to track, analyze, and evaluate the costs related to ICT. No citywide comprehensive ICT annual report is made to the Mayor or Board of Supervisors, other than a presentation of ICT project plans for budget proposals and hearings. The structure of ICT citywide does not make this data visible to the public or to decision-makers. B. Asset Management While departments often keep track of the equipment and software they own, there is no citywide ICT asset management system to track hardware and other equipment, software, and licenses. The lack of citywide information hampers the ability of COIT and the City CIO to identify duplication in, and opportunities to share, equipment and licenses. An inventory would provide City leaders critical information from when to upgrade software to developing a standard schedule for equipment replacements across departments, large and small. Furthermore, an inventory would allow the City to track the life expectancies of critical computer systems and determine a replacement schedule, and budget for the highest-priority systems. C. Human Resource Management There also is no effort to systematically catalog the skill sets of ICT personnel to ensure that skills match the business needs of departments or that appropriate training opportunities are offered. With this data, it would be easier to exchange or temporarily transfer department ICT staff for short-term assignments, foster a more creative work environment, and provide a better approach to resolving ICT problems. D. IT Spending There are 49 departments in the body of San Francisco City government for which ICT financial budgets are identified and reported by the SF Controller’s Office (see Table 2). The 2011-12 summary table includes information on all City ICT budgets (ICT staff, non-ICT staff doing ICT work, professional services, materials and supplies, equipment, and licenses and work orders) totaling $196 million. These figures represent merely what is budgeted, not what is actually spent. Several departments have been able to reallocate monies toward the funding of ICT projects from other sources within their budgets but are not reflected in the Controller’s summary. Some personnel and costs outside of ICT job classifications, which COIT funds and which DT considers to be part of technology, are not included, such as: new media, telephony, and radio personnel. A more accurate accounting of ICT costs is estimated to be closer to $250 million according to those interviewed by the Jury. Déjà Vu All Over Again In the Controller’s chart, ten departments account for 81% of total ICT spending. However, this information is a summary and cannot be used to determine savings that might be captured, particularly due to consolidations and system upgrades. E. Reporting and Measures As mentioned in Lowery’s 2002 report, An Enterprise Approach to IT, as well as by interviewees, there is a need for an accurate baseline assessment of where the City is in terms of ICT performance and expenditures, both at DT and at the departmental levels. The report suggested a survey35 of every City department. Besides measuring quantitative data such as system uptime and help call response time, both at DT and the departmental level, the survey should include: • what ICT services the departments have now; • how the departments currently ensure they receive timely and high quality ICT service and support; • how the departments currently measure success of ICT services and projects; • how and why the departments currently split their ICT dollars between their departments, DT, and outside contractors; • how departments rank their current level of satisfaction with services the departments receive from DT; • how departments rank their current level of satisfaction with their internal ICT services; and • what departments see as missing critical ICT services. An ICT needs assessment for smaller departments has not been conducted. This survey is as needed today as it was in 2002, and would be invaluable in assessing improvements in customer service and in tracking projected and actual long-term savings, once consolidations and other ICT systems are in place. Comparative data can be used to benchmark ICT expenditures, to capture areas of concern and to identify successes and how to exploit them. F. Findings
• R11
  The City CIO work with the Controller to conduct a survey, including, but not limited to, performance data, client satisfaction, decision-making and evaluation criteria, inventory of services, and needs assessment, first for baseline figures and then annually to measure improvement over the baseline figures. Responses are requested from the Mayor, the Board of Supervisors, the Controller, the Chair of COIT, the City CIO, and the Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R12
  The City CIO report annually on the state of technology in the City to the Mayor and the Board of Supervisors. Responses are requested from the Mayor, the Board of Supervisors, the Controller, the Chair of COIT, the City CIO, and the Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission. Déjà Vu All Over Again 23
• R13
  The City CIO and the Controller create a citywide asset management system for ICT equipment. Responses are requested from the Mayor, the Board of Supervisors, the Controller, the Chair of COIT, the City CIO, and the Department Heads and CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission.
• R14
  The City CIO and DHR create a citywide skills database for personnel, to catalog such skills as programming languages, web development, database, networking, and operating systems. Responses are requested from the Mayor, the Board of Supervisors, the Department of Human Resources, the Chair of COIT, the City CIO, and the departmental CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF Police Department, the Department of Public Health, and the Public Utilities Commission, and Local 21. III. The Need for a Citywide Staffing Plan As noted earlier, the Administrative Code, without much definition, requires an ICT staffing plan. This plan should address, among other things, two major issues: the classification of ICT personnel, whether Permanent Civil Service (PCS) or Permanent Exempt (PEX), and the need for a more streamlined hiring process. A. Classification of Positions Most tech positions within the City are filled as PCS. However, technology is a dynamic field, and it is hard to predict even within five years’ time what that technology is going to look like and what skill sets are going to be needed. There is a constant need for training, and not all employees can be retrained to fit the changing business needs of ICT units. This becomes a problem within the department, not just for managers but also for motivated colleagues whose morale is affected by significantly less motivated co-workers. Under PCS, employees acquire certain rights to their positions, and there is less flexibility to hire new employees, move employees around on an “as needed” basis, or terminate them. Under PEX, however, employees are considered “at will” and serve at the pleasure of their appointing officer. Department heads have more discretion in the use of the “merit system” for exempt positions. Under the Charter,36 19 categories of employment are exempt from civil service. These 24 Déjà Vu All Over Again are divided into three groups. Group I consists of such positions as elected officials, heads and deputy heads of agencies and departments, and members of commissions and other advisory committees. Group II includes such named positions as attorneys, physicians, dentists, the law librarian, the actuary of the Employee’s Retirement Board, and other positions that were designated exempt under the 1932 Charter, long before information technology became a professional category. Group III includes temporary and seasonal appointments and those hired for special projects or for professional services with limited term funding (generally approved for up to three years of employment). Currently, approximately 15% of all active ICT employees are Group III exemptions.37 But, it is a sometimes arduous approval process to create such positions in the City and can involve appeals by unions to the Civil Service Commission. The last time the Charter was changed to expand exempt categories was in 1999. Under Proposition E, the City created SFMTA and added their managerial positions as another category of exempt appointments. It is time to make another Charter change to add technologists as a Group II exemption category from civil service. This category could include computer operators, LAN administrators, database administrators, programmers, and ICT project managers and analysts. As departmental technology changes, employees can be offered training opportunities, or, as “at will” employees, be terminated to more nearly match changing business needs with staff skills. B. Hiring Practices Another issue is the City’s ICT-position hiring practices. With more private firms moving into the City, competition for the best ICT talent will only increase. Hiring processes are not designed to meet the need to make timely job offers. For some managers, this has meant they are not getting the best people. The process for hiring a PCS employee is cumbersome and drags on for several months. First, DHR is involved in posting the positions and screening the applicants for education, experience, and certification qualifications. Local 21 is also involved with testing and ranking procedures. An applicant list is then created, with the top three scorers sent to the hiring department to interview. However, priority is given to former employees who have been laid off. These positions are posted for three months; if a suitable candidate is not found, the position is posted for another three months, and a new list is created. There is also always the possibility that even though the position had been previously approved, the Mayor may declare a hiring freeze. This hiring process for PCS positions has sometimes gone as long as eight months before a candidate is able to come onboard. Hiring PEX employees is a much faster process. Job descriptions are written by the respective departments and are posted by DHR. Candidates that have the requirements are interviewed by the respective departments. If a candidate is accepted by the departmental CIO and the department head, an offer is made. This hiring process can take approximately 2-3 months. Déjà Vu All Over Again 25 C. Findings
• R15
  Revise the Charter so that all vacant and new technology positions be classified as Group II exempt positions. Responses are requested from the Mayor, the Board of Supervisors, the Department of Human Resources, the City CIO, and the departmental CIOs or IT Directors from the Airport, the Department of Emergency Management, the General Services Agency, the Department of Public Works, the Human Services Agency, the SF Municipal Transportation Agency, the SF 26 Déjà Vu All Over Again Police Department, the Department of Public Health, and the Public Utilities Commission, and Local 21.
• R16
  The City CIO be involved, with department heads, in hiring decisions for their highest level ICT personnel. Responses are requested from the Mayor, the Board of Supervisors, the Chair of COIT, the City CIO, and the Department of Human Resources.
• R17
  The City CIO be included, with department heads, in the performance review process of senior ICT personnel in all departments. Responses are requested from the Mayor, the Board of Supervisors, the Chair of COIT, the City CIO, and the Department of Human Resources.
• R18
  Pending revision of the Charter, the Mayor develop methods for speeding up the hiring process for ICT personnel. Responses are requested from the Mayor, the Board of Supervisors, the Chair of COIT, the City CIO, the Department of Human Resources, and Local 21. IV. A Culture in Need of Change The iPhone Dictionary App defines “culture” as “the sum total of ways of living built up by a group of human beings transmitted from one generation to another.” With that definition in mind, and after extensive interviews with department heads and technology managers, attending numerous meetings, and reading reports and regulations, it is clear that the City believes that operating departments require a high level of independence. In turn, the City gives its operating departments a wide range of latitude in carrying out their missions. While important in providing services to the public, that culture of independence stands as a hurdle to the introduction of important technological improvements which can lead to citywide cost savings and more efficient operations. A high level of independent department behavior can co-exist with meaningful citywide efficiencies. Technology culture is in need of change. In an October 2005 Harvard Business Review article titled, “The Passive-Aggressive Organization,” the authors stated that: Healthy companies are hard to mistake. Their managers have access to good, timely information, the authority to make informed decisions, and the incentive to make them on behalf of the organization which promptly and capably carries them out.38 Déjà Vu All Over Again 27 When good, timely technology information is available in the City, it is found mainly at the department and project level. Though COIT has the authority to focus its attention on citywide efficiencies, it spends most of its efforts on review and evaluation of project proposals. Attempts to gather and consolidate data for citywide projections and analyses, therefore, are rare. Without citywide data, informed decisions are limited to departments and projects, with little consideration given to citywide concerns. This is accepted because it is part of the City’s culture. The authors list three failings found in organizations that slide into passive-aggressive behavior. They are used to describe an organization’s quiet but tenacious resistance, in every way but openly, to corporate directives. These three failings demonstrate the Jury’s concerns stemming from the culture around citywide technology. First is “Unclear Scope of Authority.” While the Administrative Code gives the City CIO the authority to implement COIT policy, this authority is seldom applied. For instance, department heads have reversed their initial commitments to a citywide email system, claiming that special security and reliability cannot be assured. Moreover, neither COIT nor the City CIO has enforcement tools, or the inclination to develop such tools, to ensure compliance with citywide policies such as standardized email systems, websites, centralized data centers, and server virtualization. As a result, exceptions to established policy are granted and opportunities for costs savings and operational efficiencies are lost. It is accepted because it is part of the City’s culture. Secondly, the authors identify “Misleading Goals” as a factor in organizational failure. The basic goal of city government is to provide for its people in the most effective way it can. The basic goal of a city department is to carry out its mission in the most effective way it can. Though it might be assumed that all of San Francisco government works with unified goals, citywide goals are at times in conflict with departmental goals. The priorities of a department are, by their nature, narrower than that of the City. Department heads place significantly greater importance on the successful performance of their agencies than on managing for citywide efficiency and effectiveness through the use of technology. They are judged on departmental performance. They know that City administrators rely foremost on departmental success and will not press department heads to take a greater citywide view. We have learned of the unique technology requirements placed on several City departments, such as SFO, Police, DPH, and HSA. Those requirements have led to unchallenged department demands for special treatment at the expense of efficiencies to citywide operations. That need not be. However, it is accepted because it is part of the City’s culture. The third organizational failure is “Agreement without Cooperation.” Our report has shown that department heads who sit on COIT can agree with the introduction of a particular citywide project and later ask for an exemption for their department, even though it reduces economies of scales and other efficiencies. And, they get away with it. Interviewees have made such comments as, “We work for the department and not for the City as a whole,” “San Francisco does not like 28 Déjà Vu All Over Again authoritarian leadership,” or just “We don’t want to be mean.” It is accepted because it is part of the City’s culture. The Administrative Code requires COIT to include two people from outside City government as active members of its body.39 This was done in part to expand COIT’s capacity to create policies and programs that would take advantage of the most advanced technology offerings and thinking. With San Francisco and Silicon Valley so rich in technology expertise, not to mention the nearby universities, such additions should prove very useful and easy to attract. Adding outsiders to COIT deliberations helps to change the City’s existing culture. However, little, if anything, has been done to meet this requirement, again allowing the status quo to remain embedded in the City’s technology culture. We recognize the difficulty in changing culture, but we believe the gains that can be made far outweigh the effort required. Culture change is less a matter of managing than it is of leading in a new direction, with visionaries that clearly embrace the changes to be made. Changing culture requires inspiration and direction from the highest organization level to demonstrate its seriousness and motivate progress. This is a role that can be played only by the Mayor. Prior to his election, our current Mayor served as a member of COIT in his capacity as former head of DPW and City Administrator. This experience should serve well to move internal citywide technology forward. Thus far, he has shown little inclination to do that. The absence of such leadership dilutes the sense of importance and urgency that is required. Leadership must be consistent, forceful, and visible. Culture, commonly defined, means “the way things are done around here.” The City can continue to follow the path of least resistance by not changing “the way things are done around here.” Or, the City can take bold steps toward a more cooperative, City-focused culture. The Jury, after extensive study, believes the City can, and should, do better and focus more on City needs and values, while not losing sight of the importance of department strengths. Success can be achieved if the Mayor brings the passion he exhibits toward technology external to City operations to bear on the internal issues facing us. A. Findings
• R19
  The Mayor provide consistent, passionate, and aggressive leadership in the field of citywide technology, fostering progress, and garnering agreement among departments toward a more cooperative and cohesive culture. Response is requested from the Mayor.