Orange County Grand Jury • 2013-2014

Orange County Information Technology Management:

Published: May 08, 2014 38 pages
Ver PDF original

Findings and Recommendations 8 findings

F1
Based on the Grand Jury’s survey of the Chief Information Officers of California counties with populations of one to three million, current costs of Information Technology in Orange County, per resident, appear to be comparable or lower than IT costs in California counties of similar population size.
Related Recommendations (1)
R1
CEO/IT should enhance the current format and guidelines for post implementation reviews of IT projects to include reviews of the achievement of the originally approved project goals and business case. Reviews of the achievement of project goals and the business case should be reviewed by the IT Investment Review Board, and should continue until the achievement (or failure) can be verified. (F.2.)
F2
IT project cost overruns do not plague the County. However, policies and procedures are not in place in the IT governance structure to adequately measure and evaluate achievement of benefits and goals of IT projects over their entire project life cycle.
Related Recommendations (1)
R2
As part of the implementation of the new Managed Services contracts with SAIC and Xerox, the Board of Supervisors and CEO/IT should place high priority on successfully completing a disaster recovery exercise with the new DR services provider, and marshaling agency/department support to do so. . Successful completion would include completion and verification of all transactions supporting processes the County datacenter supports that are designated “A” priority in Business Continuity plans. (F.3.)
F3
Recovery of IT resources and services will be critical to the functioning of vital County services in the event of a catastrophic disaster event. Recent Disaster Recovery (DR) exercises for the CEO/IT datacenter have not been completed successfully. Thus, the costs, time, and possibly the ability to recover some or all datacenter operations after a catastrophic disaster event has not been determined or demonstrated.
Related Recommendations (1)
R3
Because critical law enforcement, public protection and safety functions of the Sheriff’s Department are currently at risk, The Board of Supervisors and the Sheriff should place the highest possible priority on studying the alternatives for a short-term DR solution for the Sheriff’s critical systems, selecting and funding an alternative, and implementing and testing it as soon as possible. (F.4.)
F4
The Sheriff’s Department has both its primary production and backup mainframe computers and critical server platforms at its own datacenter. Those computers run most of the Sheriff’s critical applications, including Field, Booking, Jail, Criminal History and Records, and interfaces to outside databases such as the CJIS, DOJ, DMV, etc. A significant physical disaster event or cyber-attack disabling that datacenter would almost completely disrupt the Sheriff’s major law enforcement and public safety and protection functions. There is currently no plan in place to recover the Sheriff’s datacenter functions at another location.
Related Recommendations (1)
R4
CEO/IT should strengthen its leadership role in seeing that all County agencies/departments with critical functions dependent on IT processes implement and test DR procedures to meet stated recovery goals. (F.3., F.4.)
F5
IT best practices indicate that user satisfaction should be a key measurement of IT services. The current contracts for managed services both specify that the County shall “conduct satisfaction surveys semi-annually…or more frequently.” However, there are no consistent countywide policies, guidelines, or procedures for user satisfaction surveys of all IT services, including those provided by agencies/departments, and surveys are not taken or published on a regular basis.
Related Recommendations (1)
R5
CEO/IT should establish policies and procedures, and recommend the format and timing for user satisfaction surveys of IT services users, including CEO/IT services, and agency/department IT services. CEO/IT should review and publish the results of surveys of themselves and of agencies/departments and make the results available to all agencies/departments. (F.5.)
F6
The CEO/IT’s project management methodology that is accessible through the County Intranet site describes a traditional “Waterfall” approach to system development. Although still being used in the industry, Waterfall is a somewhat dated approach. More current Agile system development methodologies have proven very successful in several County agencies and are recommended in the IT industry as best practices. Use of the Waterfall approach may have been a factor in the failure of the PTMS development project; however, there are many factors that can contribute to the success or failure of system development projects, and the Grand Jury renders no opinion as to the fault or liability relative to any litigation.
Related Recommendations (1)
R6
CEO/IT should study, embrace, and consider incorporating Agile methodologies into the system development methodologies offered by the Project Management Office and presented on its website. CEO/IT should have the necessary expertise, and should promote use of Agile methodologies on projects where, and to the degree it is appropriate. (F.6.)
F7
Under the new managed services contracts, costs for these outsourced services will be very predictable over the life of the contracts, as long as the County can predict, manage, and control volumes (data, transactions, service calls, etc.) over that period.
Related Recommendations (1)
R7
In order to control and predict IT costs under the new Managed Services contracts, CEO/IT should use contract and other mechanisms to very closely monitor IT volumes specified in the contracts. Current and predicted costs or rate changes, and recommendations to avoid future costs increases based on volume trends should be reported to affected departments and agencies and to the Board of Supervisors. (F.7.)
F8
Under the new outsourced contracts, consolidation and centralization of some IT services will result in overall cost savings. It will also standardize the delivery of many services, allowing for more consistent governance and alignment with County strategies and IT guidelines. However, agencies/departments are concerned that additional centralization will result in higher costs and reduced levels of service for them. Centralization of some services may make more business sense than others, and this may vary by function and by business unit. Penal Code §933 and §933.05 require governing bodies and elected officials to which a report is directed to respond to findings and recommendations. Responses are requested, from departments of local agencies and their non-elected department heads. RECOMMENDATIONS In accordance with California Penal Code Sections 933 and 933.05, the 2013-2014 Grand Jury requires (or, as noted, requests) responses from each agency affected by the recommendations presented in this section. The responses are to be submitted to the Presiding Judge of the Superior Court. Based on its investigation of Information Technology in Orange County, the 2013-2014 Orange County Grand Jury makes the following nine recommendations:
Related Recommendations (1)
R8
Before centralizing IT services for an agency or department, CEO/IT should conduct a thorough analysis of the business case for the change, and one of the IT governance groups should review this case. The analysis should include a plan for prevention or mitigation of the possible reduction of service levels and quality, developed with and agreed to by the affected agency. (F.8.) REQUIRED RESPONSES The California Penal Code §933 requires any public agency which the Grand Jury has reviewed, and about which it has issued a final report, to comment to the Presiding Judge of the Superior Court on the findings and recommendations pertaining to matters under the control of the agency. Such comment shall be made no later than 90 days after the Grand Jury publishes its report (filed with the Clerk of the Court); except that in the case of a report containing findings and recommendations pertaining to a department or agency headed by an elected County official (e.g. District Attorney, Sheriff, etc.), such comment shall be made to the Presiding Judge with an information copy sent to the Board of Supervisors. Furthermore, California Penal Code Section §933.05 (a), (b), (c), details, as follows, the manner in which such comment(s) are to be made: (a) As to each Grand Jury finding, the responding person or entity shall indicate one of the following: (1) The respondent agrees with the finding (2) The respondent disagrees wholly or partially with the finding, in which case the response shall specify the portion of the finding that is disputed and shall include an explanation of the reasons therefore. (b) As to each Grand Jury recommendation, the responding person or entity shall report one of the following actions: (1) The recommendation has been implemented, with a summary regarding the implemented action. (2) The recommendation has not yet been implemented, but will be implemented in the future, with a time frame for implementation. (3) The recommendation requires further analysis, with an explanation and the scope and parameters of an analysis or study, and a time frame for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable. This time frame shall not exceed six months from the date of publication of the Grand Jury report. (4) The recommendation will not be implemented because it is not warranted or is not reasonable, with an explanation therefore. (c) If a finding or recommendation of the Grand Jury addresses budgetary or personnel matters of a county agency or department headed by an elected officer, both the agency or department head and the Board of Supervisors shall respond if requested by the Grand Jury, but the response of the Board of Supervisors shall address only those budgetary /or personnel matters over which it has some decision making aspects of the findings or recommendations affecting his or her agency or department. Comments to the Presiding Judge of the Superior Court in compliance with Penal Code section §933.05 are required from: Response Required: Sheriff/Coroner: F.4. Responses Requested: CEO/IT: F.1, F.2., F.3., F.5., F.6., F.7., F.8. Responses Required: Sheriff/Coroner: R.3. Board of Supervisors: R.2., R.3. Responses Requested: CEO/IT: R.1, R.2., R.4., R.5., R.6., R.7., R.8.

Agency Responses 2

Government agencies' official responses to this report's findings and recommendations. Click on a response to see the structured breakdown.