Internal Audit. Audit of HRIS: A Human Resources Management Enabler

Transcription

1 Internal Audit Audit of HRIS: A Human Resources Management Enabler November 2010

2

3 Table of Contents EXECUTIVE SUMMARY INTRODUCTION BACKGROUND OBJECTIVES SCOPE METHODOLOGY STATEMENT OF ASSURANCE OVERALL ASSESSMENT AUDIT CONCLUSION SCORECARD OBSERVATIONS AND RECOMMENDATIONS SUPPORTING THE ACHIEVEMENT OF HUMAN RESOURCES OBJECTIVES ADEQUATE MANAGEMENT INFORMATION AVAILABLE FROM THE HRIS PROTECTION OF THE CONFIDENTIALITY, INTEGRITY AND AVAILABILITY OF THE DATA RELIABILITY AND INTEGRITY OF DATA FLOWS FROM OTHER SYSTEMS CONCLUSION APPENDIX AUDIT CRITERIA... 24

4

5 Executive Summary Elections Canada s Strategic Plan identifies human resources as a key enabler of its strategic objectives and as one of the four pillars that support the agency s success in ensuring that it continues to earn the confidence of Parliament and Canadians. The Human Resources (HR) Sector at Elections Canada has various systems, tools and processes in place to support the recording, processing and reporting of human resources information: the primary IT system is called the Human Resources Information System (HRIS). The ultimate objective of this system is to support Elections Canada s employees and management by providing timely and relevant information for decision making. To meet the human resources needs of small government organizations, Public Works and Government Services Canada (PWGSC) developed the HRIS as a shared system; it is currently used by over 30 government organizations. PWGSC, in consultation with HRIS user organizations, is responsible for developing, maintaining and updating the core functionality of the HRIS. However, each user organization, including Elections Canada, is solely responsible for hosting its own copy of the HRIS application as well as for maintaining the application and the organization s own data. An audit was conducted to assess how well business processes at Elections Canada enable the HRIS to deliver useful management information. In addition, the audit assessed data integrity, the usefulness and limitations of the HRIS, management reports produced by the system, the control framework, control over interfacing with other systems and HRIS best practices in other organizations. The overarching goal of the audit was to focus less on the technology itself and more on the business processes supporting the ability of the technology to deliver on Elections Canada s human resources objectives. The audit was conducted from April to July The HRIS is a powerful tool for workforce management; still, the federal government is currently considering moving HRIS users to another IT system. Notwithstanding the functional capabilities of the HRIS or any other IT system, the effectiveness of such technology for human resources management is predicated on consistent policies, sound business processes and employee training and awareness at the organizational level. Elections Canada continues to develop its capacity for human resources data management at both the functional level in the HR Sector and the line management level. The current transformation of the HR Sector has involved positive initiatives, such as defining revised roles and responsibilities (including matching the right skills to the right roles) as well as developing data management policies and procedures and an associated awareness campaign targeting line managers. This transformation is also the source of significant change, which will take time to be implemented and become effective. The initiatives are underway and showing good progress, but current weaknesses in the identification, communication, capture and validation of salient human resources data from across the agency limits the reliability and timeliness of information available from the HRIS. Without the clear identification and timely capture of required data from all line managers, the quality of the HRIS reports continues to suffer. Audit of HRIS: A Human Resources Management Enabler 5

6 The audit of the HRIS had four objectives. They are outlined below, along with the key conclusions for each. Audit Objective 1: To assess whether the HRIS is used effectively and efficiently to support the achievement of HR objectives. Needs Moderate Improvement While a human resources strategy and the associated tactical plans to transform human resources are clear and well documented, clearly developed and communicated HR data management policies and procedures are not yet in place to ensure that reliable and timely HR data is fed into the HRIS from across the organization. The development of such policies and procedures would enhance the effectiveness and efficiency of the HRIS in supporting the achievement of Elections Canada s HR objectives. Audit Objective 2: To assess whether the management information available from the HRIS is adequate in meeting Elections Canada s human resources needs. Needs Minor Improvement The HRIS supports over 80 standard human resources reports as well as virtually unlimited custom reporting capabilities. Elections Canada relies heavily on custom reporting because of a wide range of requests for different human resources information from managers within the organization. Procedures for identifying the standard human resources information that is required for management reporting and decision making purposes, and for regularly collecting the data from line managers, have yet to be completed; however, the new Human Resources Dashboard ( Health of Agency report) is a positive first step, allowing for the tracking of key performance data over time. Once standard data are identified, appropriate data quality assurance procedures can be designed, and additional management reports can then be developed to track and report on progress toward objectives. The conclusion is that functionality in terms of generating management information is adequate, but the business processes needed to ensure the reliability and timeliness of the data in the HRIS continue to be a challenge in delivering adequate management information that meets the agency s human resources needs. Audit Objective 3: To assess whether the control framework in place is adequate and effective in protecting the confidentiality, integrity and availability of the data in the HRIS. Satisfactory HRIS roles and responsibilities are clearly documented, understood and implemented, including appropriate segregation of duties and control of logical and physical access to servers and data. This is accomplished through policies and procedures, as well as protocols and controls built into the HRIS application. Elections Canada s IT backup procedures are sufficient to ensure that all HRIS data are available while minimizing any potential data loss. The conclusion is that the control framework in place is adequate and effective in protecting the confidentiality, integrity and availability of the data in the HRIS. Audit of HRIS: A Human Resources Management Enabler 6

7 Audit Objective 4: To assess the reliability and integrity of data flows from other systems on which the HRIS depends. Needs Moderate Improvement Used as a tool to enable human resources management, the HRIS is entirely dependent on timely, accurate and reliable information coming in from across the agency. While the development of data management policies and procedures is underway and showing good progress, the current lack of consistently understood policies and procedures leads to inaccurate information in the HRIS, a lack of alignment between managers or sectors and the HR Sector, and negative perceptions of the usefulness and reliability of the HRIS. The conclusion is that the data currently entering the HRIS are less reliable than what is required to support effective reporting to management and decision making. Recommendations In order to support better human resources data management and more reliable reporting, Elections Canada s priority should be the creation of consistent, standardized policies and business processes to support the accurate, timely and reliable capture of human resources information from across the agency. To that end, the following four recommendations are made: Develop the supporting policies and business processes for the effective identification, communication, capture and validation of human resources data that are salient for organizational management. Develop a formal quality assurance framework relative to HRIS data to support and monitor improved information quality, timeliness and reliability. Develop a comprehensive awareness and education program, focused on achieving a high level of engagement among line managers, to support the implementation, understanding and buy-in of HR data management policies and business processes. Identify a set of standard HRIS reports that supports the day-to-day management needs of line managers and provide them with access to these reports in order to increase knowledge across the organization and minimize requests for custom reports. Audit of HRIS: A Human Resources Management Enabler 7

8 1. Introduction 1.1 Background Elections Canada s Strategic Plan identifies human resources as a key enabler of its strategic objectives and as one of the four pillars that support the agency s success in ensuring that it continues to earn the confidence of Parliament and Canadians. The permanent employee base is supplemented with casual, temporary and contract personnel as well as overtime performed by core staff when the workload peaks in particular, to prepare for and conduct electoral events. The succession of minority governments and significant electoral reforms are placing high demands on Elections Canada s personnel. The Human Resources (HR) Sector at Elections Canada has various systems, tools and processes in place to support the recording, processing and reporting of human resources information. These systems assist Elections Canada s employees and management by providing timely and relevant information for decision making. Elections Canada uses the HRIS as its core IT system to manage its human resources. To meet the human resources needs of small government organizations, Public Works and Government Services Canada (PWGSC) developed the HRIS as a shared system; it is currently used by over 30 government organizations. PWGSC, in consultation with HRIS user organizations, is responsible for developing, maintaining and updating the core functionality of the HRIS. Each user organization, however, including Elections Canada, is solely responsible for hosting its own copy of the HRIS application as well as for maintaining the application and the organization s own data. The HRIS provides all the basic human resources functionality required by small government organizations, including classification, staffing, leave and training, and employee information transactions related to official languages, conflict of interest, appraisals, education, security information, career management, etc. The HRIS is fully bilingual, meets central agency requirements and supports electronic data transfer to other systems so that the information can be used for various management reporting needs. The application also provides standard and custom reporting tools; it interfaces with salary management, spreadsheet and database systems to simplify ad hoc reporting. The HRIS also includes an on-line Help library, the HRIS User Guide and computer-based training for each module. Elections Canada is planning to launch a project to review all of its corporate systems, including the HRIS. This is currently the primary corporate system used to manage the agency s human resources, although the federal government is considering moving HRIS users to another IT system. The timing of this audit is appropriate, given Elections Canada s intention to review its corporate systems. Whether the agency uses HRIS or another IT system, it is important to ensure that the organization has an adequate and effective process for the management of information on its human resources. Audit of HRIS: A Human Resources Management Enabler 8

9 1.2 Objectives The overall objective of this audit is to provide reasonable assurance that the management control framework in place for the HRIS is adequate and effective in supporting Elections Canada s human resources needs. Specifically, this audit will assess: whether the HRIS is used effectively and efficiently to support the achievement of human resources objectives whether the management information available from the HRIS is adequate in meeting Elections Canada s human resources needs whether the control framework in place is adequate and effective in protecting the confidentiality, integrity and availability of the data in the HRIS the reliability and integrity of data flows from other systems on which the HRIS depends 1.3 Scope The audit assessed the processes in place for the management of human resources information captured in the HRIS. In addition, it assessed data integrity, the usefulness and limitations of the HRIS, management reports produced by the system, the control framework, control over interfacing with other systems and HRIS best practices in other organizations. The audit was conducted from April to July Methodology The audit methodology employed for this audit is in compliance with the Institute of Internal Auditors (IIA) Standards for the Professional Practice of Internal Auditing. The methodology included reviewing an extensive set of documentation, including more than 40 separate documents and reports covering the agency s Human Resources Strategy, HRIS policies and procedures, security assessments and sample reports. As well, an extensive series of interviews, including multiple interviews with key stakeholders, was undertaken to ensure that all relevant audit evidence was captured and properly understood. During the fieldwork phase of the audit, 30 separate interviews were conducted with stakeholders from across Elections Canada (including HR Sector managers, IT Directorate personnel and HRIS users), with PWGSC and, for benchmarking purposes, with other similar-sized government organizations that also use the HRIS. The internal audit process involved three main phases planning, conducting and reporting each of which was subject to a quality assurance review. The planning and conducting of the audit were done in conformity with professional standards and legislative and policy frameworks in order to ensure that the audit s findings and conclusions would be appropriate and consistent with the evidence collected. Audit of HRIS: A Human Resources Management Enabler 9

10 2. Statement of Assurance In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time of the audit, against pre-established audit criteria that were agreed with management. The audit opinion is applicable only to the entity examined, as described in the Scope section of this report. Audit of HRIS: A Human Resources Management Enabler 10

11 3. Overall Assessment 3.1 Audit Conclusion This section presents the overall conclusion for each audit objective. Supporting the Achievement of Human Resources Objectives The management process for the data in the HRIS is generally sufficient to support the agency s human resources objectives. The HRIS is a powerful tool for workforce management and is currently used by over 30 government departments and agencies. However, any IT system used to manage information on the human resources of an organization depends on the identification of key data, on quality data and on reports that support decision making. It is therefore important to establish and document appropriate business processes to manage that data. It is equally important to identify key data for decision making and develop an appropriate quality assurance process. Without the clear identification and timely capture of required data from all line managers, the quality of HRIS reports continues to suffer. The HR Sector is currently transforming some of its practices, and the changes are showing good progress. There has been much improvement in the quality and use of human resources information at Elections Canada in the past several years. Data are more consistently and actively used at the senior management level to help make planning and prioritization decisions; the new Human Resources Dashboard ( Health of Agency report) is a good example. However, the business processes in use with respect to the data in the HRIS could be enhanced in order to better support the achievement of Elections Canada s human resources objectives. Adequate Management Information Available from the HRIS The IT system used to manage information on the agency s human resources should provide adequate management information to support decision making. The HRIS supports over 80 standard human resources reports as well as virtually unlimited custom reporting. Elections Canada relies heavily on custom reporting because of a wide range of requests for different human resources information from the agency s managers. To maximize the efficiency of the reports, the first step is to identify key information required by the agency to achieve its objectives. Once this is identified, appropriate business processes and quality assurance procedures can be developed to track and report on the key data. The conclusion is that functionality in terms of generating management information is adequate, but the business processes needed to ensure the reliability and timeliness of the data in the HRIS continue to be a challenge in delivering adequate management information that properly supports planning and decision making regarding human resources. It is therefore important to develop a comprehensive awareness and education program, aimed at producing a high level of engagement among line managers. This will support the implementation and understanding of data management policies and business processes, and it will support having quality information on human resources in HRIS. Audit of HRIS: A Human Resources Management Enabler 11

12 Protection of the Confidentiality, Integrity and Availability of the Data The roles and responsibilities related to the HRIS are clearly documented, understood and implemented, including the appropriate segregation of duties and control of logical and physical access to servers and data. This is accomplished through policies and procedures as well as protocols and controls built into the HRIS application. The conclusion is that the control framework in place is adequate and effective in protecting the confidentiality, integrity and availability of the data in the HRIS. Reliability and Integrity of Data Flows from Other Systems Line managers at Elections Canada are generally aware of their human resources accountabilities and understand the basic human resources processes. However, the understanding of data management procedures varies from manager to manager. As a tool used to enable human resources management, the HRIS is entirely dependent on timely, accurate and reliable data coming in from across the organization. The development of data management policies and procedures for more transactional human resources activities is underway and showing good progress. Nevertheless, the current lack of consistently understood data management policies and procedures supporting a more strategic collection of human resources information leads to inaccurate information in the HRIS and negative perceptions of the usefulness and reliability of the HRIS. The policies and procedures for data entry and validation should also be developed and documented, and they should include an appropriate quality control framework. 3.2 Scorecard The rating and supporting explanation summarize the current status for each audit criterion. Criterion Rating Explanation Recommendation Objective 1 Governance Plans and Objectives HRIS Policies and Procedures Effectiveness and Efficiency of the Use of the HRIS to Support HR Objectives G A strategic HR plan exists ( ) and flows directly from Elections Canada s strategic plan. Identifies HR as a critical strategic enabler. Includes operational plans and objectives that support the HR strategy, including a new HR Sector structure to support the strategic use of HR information to achieve the agency s objectives. Y Progress is underway in the development of policy and procedures. However, better business processes are required to support timely and accurate management information. Need to clarify data management roles and responsibilities. R1 Develop policies and business processes. Audit of HRIS: A Human Resources Management Enabler 12

13 Criterion Rating Explanation Recommendation HRIS Risk Management Objective 2 Availability of HRIS Reports HRIS Performance Measures O While current risks and data quality issues are managed in an ad hoc fashion, there is no formal risk management framework in place to support the effective and efficient use of the HRIS as an HR enabler. Risks related to data quality, timeliness and reliability of data in the HRIS continue to exist and limit the usefulness of reports, but they have not been formally identified or mitigated through a quality assurance process. Adequacy of Management Information Available from the HRIS to Meet HR Needs Y HRIS can produce over 80 standard reports along with customized reports, which should meet the vast majority of standard HR management needs. Other similar organizations are able to leverage HRIS standard and custom reporting for all HR management needs. These organizations use the HRIS in a strategic fashion to directly support their corporate HR vision and HR objectives. Elections Canada is still in the early stages of using strategic reports on HR trends. B There is limited use of performance measures with respect to the HRIS. HRIS staff currently produces a very high volume of customized HR reports, based on management requests. This creates a significant workload that perpetuates a reactive, transactional use of the tool and precludes the development of a more strategic focus. There is no shared or consistent understanding of how standard and custom reports best align with the attainment of HR and agency objectives. The new HR Dashboard ( Health of Agency report) is an important step in the right direction. It identifies key data to track, and it enables their efficient collection, quality assurance and reporting of performance measures. Other HR Reports G Management reports (notably the HR Dashboard) draw relevant information from a range of sources, including Compensation Services. Information is not duplicated. Objective 3 HRIS Roles and Responsibilities Protecting Confidentiality, Integrity and Availability of Data in the HRIS G HRIS roles are clearly defined, implemented and understood through protocols and controls built into the HRIS application. R2 Develop a formal quality assurance framework. R1 Develop policies and business processes. R3 Develop an awareness and education program. R4 Identify and provide a set of standard HRIS reports. Audit of HRIS: A Human Resources Management Enabler 13

14 Criterion Rating Explanation Recommendation Segregation of Duties G Segregation of duties is enforced in such a way that there is little likelihood of overlap or duplication. HRIS Data Security G User access controls in the HRIS are sufficient to provide a reasonable level of data security. Physical access to the HRIS application and data is rigorously controlled through existing IT policies and procedures. All application and database information is backed up according to Elections Canada policies. The risk of data loss for the HRIS system is minimal. Objective 4 Reliability and Integrity of Data Flows from Other Systems on Which the HRIS Depends Employee Training Y While HRIS staff has provided strong day-to-day support and guidance, managers across the agency do not consistently use formalized approaches to HR data management. In interviews, the consistent understanding of HR data management procedures among line managers was uniformly weak. The result is a wide range of approaches by individual managers, leading to inaccurate information in the HRIS and negative perceptions of the usefulness and reliability of the HRIS. Management HR Accountabilities Data Transfer Controls B Managers across EC are generally aware of their HR accountabilities and understand the basic HR processes. Y While processes and checklists for data entry and validation are currently under development, they are not yet complete. Lack of documented business processes and procedures for data entry and validation are a significant source of concern for ensuring the reliability of HRIS data. R3 Develop an awareness and education program. R4 Identify and provide a set of standard HRIS reports. R1 Develop policies and business processes. R3 Develop an awareness and education program. R1 Develop policies and business processes. R2 Develop a formal quality assurance framework. G B Y O R Gr Satisfactory Needs Minor Improvement Needs Moderate Improvement Needs Significant Improvement Unsatisfactory Unknown; Cannot Be Measured Audit of HRIS: A Human Resources Management Enabler 14

15 4. Observations and Recommendations The details of each observation, conclusion and recommendation resulting from the audit process are outlined below. 4.1 Supporting the Achievement of Human Resources Objectives Governance Plans and Objectives Strategic and operational human resources plans are in place. Elections Canada s strategic plan identifies human resources as a key enabler of its strategic objectives and as one of the four pillars that support the agency s success in ensuring that it continues to earn the confidence of Parliament and Canadians. A strategic human resources plan exists and is in effect for the period It flows directly from the agency s strategic plan, identifies human resources as a critical enabler for the broader strategic objectives and includes operational plans and objectives that support the strategy. From a strategic perspective, human resources data are being more consistently and actively used at the senior management level to help inform planning and prioritization; the Human Resources Dashboard ( Health of Agency report) is a good example, providing guidance on the type of data that is key to the improved management of human resources. The new HR Sector structure supports the strategic use of HR information to achieve the objectives of the agency HRIS Policies and Procedures Procedures for human resources data management are still in development. Elections Canada continues to develop its capacity for human resources data management at both the strategic and the tactical levels. Identifying key information that will be used by management is an essential step in properly managing human resources information. Through the implementation of human resources plans over the last several years, there has been marked improvement in the quality and use of human resources information at Elections Canada. The agency is benefiting from enhanced data quality, following initiatives to review and correct the human resources data in the HRIS. However, current business processes with respect to data collection and validation could be enhanced in order to better support Elections Canada s human resources objectives. Appropriate policies and procedures are important to ensure that reliable and timely data is fed into the HRIS from across the agency. While suitable policies and procedures are in place to enable effective use of the HRIS application by the HR Sector, the supporting business processes for the effective and timely identification, collection, capture and validation of information from operational line managers are not yet in place. This situation is compounded by an inconsistent understanding of procedures among line managers and by a lack of buy-in with respect to human resources data management. Audit of HRIS: A Human Resources Management Enabler 15

16 While a process exists for data validation through the manual review of bimonthly and annual reports sent to administrative officers for each sector, this process does not yet provide timely identification of data integrity problems and is entirely dependent on the diligence, knowledge and timely feedback of administrative officers. Recommendation 1. Develop supporting policies and business processes for the effective identification, communication, capture and validation of human resources data that are salient for organizational management. Management Response Responsible Position: Assistant Director, Policy, Planning and Reporting Management agrees with this recommendation. A complete guide, documenting information system data management procedures for the various Human Resources sections, will be developed and distributed to all HR Sector staff. The Quick User Guide for self-service leave will be revised, and the updates will be communicated to employees and managers. Estimated completion date: September 30, HRIS Risk Management No formal risk management framework is in place to support the HRIS. While HRIS staff has informally identified certain risks, such as data validation, and has implemented mitigating activities, such as reviewing reports in order to determine data quality issues, no documentation or procedures yet exist with respect to the formal identification, assessment or management of risks associated with the HRIS. As such, risk management has been ad hoc. For example, although data validation (a form of quality assurance or risk management) is undertaken bimonthly and annually, no formal and ongoing quality assurance mechanism is in place to mitigate data quality risks on a transactional basis. Risks related to the quality, timeliness and reliability of data in the HRIS continue to exist and further limit the usefulness of reports based on data in the HRIS and the ability to use them as management tools. Recommendation 2. Develop a formal quality assurance framework relative to HRIS data to support and monitor improved information quality, timeliness and reliability. Management Response Responsible Position: Assistant Director, Policy, Planning and Reporting Management agrees with this recommendation. Audit of HRIS: A Human Resources Management Enabler 16

17 The current quality assurance framework for HRIS data will be reviewed, documented and reinforced in accordance with the audit team s recommendations. The updated framework will identify the methodology and frequency of quality controls. It will also identify a strategy for communicating to staff lessons learned in order to reduce the rate of error in entering data into the HRIS. Estimated completion date: October 31, Adequate Management Information Available from the HRIS Availability of HRIS Reports HRIS use has been generally limited to transactional activities. The HRIS supports over 80 standard human resources reports as well as virtually unlimited custom reporting capabilities. Functionality in terms of generating management information is adequate. However, it was noted that Elections Canada relies heavily on custom reporting because of a wide range of requests for different human resources information from managers within the organization. Despite the evident HRIS and in-house capability of producing reports (either standard reports or custom reports based on specific criteria) that can support human resources plans and demonstrate alignment with the broad strategic objectives of the agency, the lack of reliable, accurate and timely HRIS information makes management reports largely inadequate for meeting the human resources needs of the organization. A key step in improving the availability of HRIS reports is to identify the salient information required in management reports in order to then be able to collect that information in a timely manner. The agency is just starting to identify key strategic information on its human resources. For example, the recent initiative to produce a Human Resources Dashboard, called the Health of Agency report, which includes information from the HRIS, has been completed and approved. Going forward, the HRIS will be used to generate some of the standard information required for this new report. However, the lack of a consistent vision of the HRIS as a corporate enabler perpetuates the reactive, transactional use of the tool. This precludes the development of a more strategic focus on the identification of necessary human resources management information. The agency should ensure that it periodically reviews the key data it needs for the purposes of reporting on human resources. Recommendation See Recommendation 1 above. Audit of HRIS: A Human Resources Management Enabler 17

18 Other organizations that use the HRIS have demonstrated that the management information available from the system is adequate in meeting their human resources needs. In other similar-sized federal government organizations that were interviewed as part of this audit, the HRIS is being used in a strategic fashion to directly support a corporate human resources vision and the achievement of human resources objectives. For example, other HRIS user organizations regularly produce a set of standard reports for line managers across their organizations. These reports provide managers with timely and accurate information about their staff that allows managers to a) validate the information on an ongoing basis and report any discrepancies to the human resources department, b) better understand the strategic nature of the human resources function and its reliance on accurate, timely data from managers and c) more effectively plan, monitor and adapt to changes in their human resources needs over time. Recommendation 3. Develop a comprehensive awareness and education program, focused on achieving a high level of engagement among line managers, to support the implementation, understanding and buy-in of HR data management policies and business processes. Management Response Responsible Positions: Assistant Director, Policy, Planning and Reporting Assistant Director, Development and Talent Management Management agrees with this recommendation. An awareness and education program will be developed, comprising key messages and elements adapted to the various stakeholders in HRIS data quality assurance, including managers, HR Sector staff, administrative officers, etc. Estimated completion date: October 31, 2011 Recommendation 4. Identify a set of standard HRIS reports that support the day-to-day management needs of line managers and provide them with access to these reports in order to increase knowledge across the organization and minimize requests for custom reports. Management Response Responsible Position: Assistant Director, Policy, Planning and Reporting Management agrees with this recommendation. A new list of standard HRIS reports will be established on the basis of the key information identified by managers during the consultation process on the Human Resources Dashboard. The HRIS will consequently be reprogrammed to facilitate the production of reports for managers in accordance with Elections Canada s planning cycle. Estimated completion date: October 31, 2011 Audit of HRIS: A Human Resources Management Enabler 18

19 4.2.2 HRIS Performance Measures Procedures to identify and collect standard human resources data from all managers on a regular basis have yet to be completed; however, the new Human Resources Dashboard ( Health of Agency report) is a positive first step. It will allow key data, as well as key HR performance data, to be tracked over time. Once more detailed human resources information has been identified, performance measures can then be developed to track implementation and adherence to HR data management policies and procedures. Performance measures and indicators can then be reported on to track progress against HR objectives. As noted above, while suitable policies and procedures are in place to enable effective use of the HRIS application by the HR Sector, there is limited use of performance measures with respect to the HRIS. HRIS staff currently produces a very high volume of custom reports, based on management requests. This creates a significant workload that perpetuates a reactive, transactional use of the tool and precludes the development of a more strategic focus. The tracking of formal performance data on how HRIS staff spends its time would support the business justification for a more strategic focus on the use of the HRIS as a human resources management enabler and for the achievement of human resources objectives Other Human Resources Reports The HR Sector at Elections Canada has various systems, tools and processes in place to support the recording, processing and reporting of human resources related information. Elections Canada uses the HRIS as its core system to manage its human resources; the primary reason is that the HRIS provides all the basic functionality required by small government organizations, including classification, staffing, leave and training, and employee information transactions, including official languages, conflict of interest, appraisals, education, security information, career management, etc. The HRIS also interfaces with salary management, spreadsheet and database systems to simplify ad hoc reporting. While the HRIS is the sole source for the large majority of human resources management reports, some management information requires the HR Sector to access other sources of data. A good example is the new Human Resources Dashboard ( Health of Agency report), which draws relevant information from a range of sources, including Compensation Services. That said, the audit concluded that the HRIS is regarded as the core and primary source of human resources information within Elections Canada and that information held in the HRIS is not duplicated in other systems. This greatly simplifies the collection and use of human resources data across the organization by reducing the risk of data duplication and inconsistency (i.e. similar data being held in multiple locations). Audit of HRIS: A Human Resources Management Enabler 19

20 4.3 Protection of the Confidentiality, Integrity and Availability of the Data HRIS Roles and Responsibilities Policies and procedures to ensure the confidentiality, integrity and availability of HRIS data are in place. HRIS administrative and end-user roles are clearly defined and implemented through protocols and access controls built directly into the HRIS application. These roles and responsibilities were determined and implemented by PWGSC over time through discussions with the various government organizations that use the HRIS application. The standard HRIS administrative roles are clearly defined and described in the available HRIS documentation. Interviews indicated that all stakeholders clearly understand their respective roles and that the system of software controls is effective in delineating the various roles. Furthermore, segregation of duties is enforced by the HRIS application in such a way that there is little likelihood of overlap or duplication of accountabilities. One concrete example is the HRIS self-service application for leave management. Use of the application is fairly high and consistent among Elections Canada s employees. The different roles, responsibilities and access privileges accorded to HRIS administrators, managers and end-users are clear and enforced through controls built directly into the HRIS application. Interviewees indicated a fairly uniform understanding of their accountabilities and basic human resources processes for example, use of the Personnel Services Request (PSR) form and who to contact. In addition, interviews with the IT Directorate determined that its access controls and tools are distinct from HRIS administrators. The IT Directorate has no direct access to HRIS data and cannot make unilateral code changes to the HRIS application without the knowledge of HR Sector management Segregation of Duties The user access controls in the HRIS (including username and password controls) are sufficient to provide a reasonable level of control over the data held in the application. Furthermore, physical access to the HRIS application and data is rigorously controlled through existing policies and procedures related to the IT data centre HRIS Data Security The entire HRIS application and database are physically located and maintained within Elections Canada. PWGSC s Consulting, Information and Shared Services Branch provides helpdesk and debugging support to assist Elections Canada staff with technical issues that may arise. This occasionally requires that Elections Canada forward a depersonalized copy of the database to PWGSC to aid in debugging. That organization has provided Elections Canada with a depersonalization tool that is consistently used to remove any personal information from the database. Copies of the database sent to PWGSC are destroyed once the problem has been resolved. The depersonalization tool is an effective control to ensure that the confidentiality of the database is maintained. Audit of HRIS: A Human Resources Management Enabler 20

21 Furthermore, as discussed above, the procedures for ensuring that any and all IT Directorate involvement with the HRIS application and/or database are clearly understood and followed by staff are in place and understood by all stakeholders. These include ensuring that all activities that affect the HRIS are first approved by the HRIS administrator. Typical activities include updating and upgrading the HRIS application, evergreening the hardware used to run the HRIS application (i.e. keeping it up to date), troubleshooting and resolving HRIS data issues and creating depersonalized copies of the HRIS database (if needed) for PWGSC to help in problem resolution. Additionally, the IT Directorate ensures that all of the agency s application and database information, including the HRIS, is backed up according to Elections Canada s policies. The risk of data loss for the HRIS application is minimal. 4.4 Reliability and Integrity of Data Flows from Other Systems Employee Training Training with respect to human resources data management is limited. Used as a tool to enable human resources management, the HRIS is entirely dependent on timely, accurate and reliable information coming in from across the agency. However, a lack of consistently understood data management policies and procedures for supporting a more strategic collection of human resources information was noted during the audit. Line managers across Elections Canada are the primary source of human resources data coming into the HRIS. The HR Sector depends on line managers (those with staff) to provide accurate and reliable data for capture in the HRIS. Interviewees indicated that training with respect to human resources data management is limited; for the most part, managers learn data management processes and procedures from colleagues and from learning by doing rather than through formalized, consistent approaches to acquiring those skills and their related understanding. Interviewees indicated little to no consistency in the type or frequency of human resources data required by the agency, aside from what the standard PSR form requires. One exception, and a clear success story that Elections Canada can build on, is the advent and use of the HRIS self-service application for leave management. Awareness and use of this on-line component of the HRIS is high and consistent among both managers and staff within Elections Canada. The ability to avail themselves of the functionality at any time, and to do so regardless of whether HR staff is available, were noted as strong incentives for adoption. The fact that leave data are maintained and available on-line for up to two years makes the line managers job of verifying and approving leave requests simple and efficient. It also simplifies the identification of any leave-related discrepancies by employees and/or their managers. This self-service component of the HRIS is a good example of how the clear identification of human resources data requirements and the implementation of efficient processes can support human resources objectives and increase employee buy-in. While HRIS has been established as the primary tool for managing human resources data, interviewees indicated that a wide range of approaches are used by individual managers to maintain and manage their own copies of HR data on staff in their individual areas of responsibility. This information is not consistently shared with the HR Sector (or in-house HRIS Audit of HRIS: A Human Resources Management Enabler 21

22 specialists), and this situation leads to a range of issues: inaccurate information in the HRIS, a lack of alignment between managers and sectors and the HR Sector, and negative perceptions of the usefulness and reliability of the HRIS. In short, managers do not consistently follow human resources data management procedures, nor do they rely on the HRIS as the gold standard for human resources information across the agency. Recommendation See Recommendations 3 and Management of HR Accountabilities Managers across Elections Canada are generally aware of their human resources accountabilities and understand the basic human resources processes. Interviews with a range of managers from different levels and from different organizational units indicated that use of the HRIS self-service application for leave management is fairly high and consistent. Interviewees also indicated a fairly uniform understanding of their human resources accountabilities and basic human resources processes (e.g. use of the PSR form, who to contact); however, interviewees understanding of data management procedures was uniformly weak. Recommendation See Recommendations 1 and Data Transfer Controls Controls are in place to ensure that transfers of human resources related data to the HRIS are complete and accurate. Processes and checklists for data entry and validation are in development but are not complete. The lack of rigorous business processes and procedures for data entry and quality assurance (validation) is a source of concern for the accuracy of the data in the HRIS. Recommendation See Recommendations 1 and 2. Audit of HRIS: A Human Resources Management Enabler 22

23 5. Conclusion Elections Canada s heightened emphasis on the importance of organizational growth and development has become evident in its commitment to fostering a strong, strategic approach to workforce management. This corporate engagement has been exemplified by steps taken to enhance the overall capability of strategic planning in the HR Sector, particularly for those activities pertaining to resource acquisition, re-skilling of existing resources to reflect changing corporate priorities and determining learning and career development requirements that support resource retention. To underpin a more profound understanding of the characteristics and capabilities of the workforce, Elections Canada management must rely on key reports and data. Ideally, these will be generated from accurate, up-to-date workforce information that is primarily resident in the HRIS database, an important human resources management enabler. Given the demonstrated usefulness of such information and associated trend analyses, access to high-quality information is key to supporting sound decision making by management relative to the workforce, not only on a day-to-day basis but also over the longer term. In order to move swiftly toward a high level of confidence in the data derived from the HRIS, it is essential that the HR Sector take steps to enhance all related human resources business processes to ensure accurate and timely data entry; to confirm associated quality assurance activities; and to provide managers with easy access to meaningful, standardized reporting formats. These efforts would be complemented by the implementation of a comprehensive training and communications plan targeted at all managers. This plan would highlight the human resources management enabling processes for capturing accurate and timely information in the HRIS and the benefits particularly in terms of reporting the application provides. Audit of HRIS: A Human Resources Management Enabler 23

24 Appendix Audit Criteria Criteria The HRIS is used effectively and efficiently to support human resources objectives. Governance Plans and Objectives: The organization has operational plans and objectives in place aimed at achieving its strategic human resources objectives. HRIS Policies and Procedures: Suitable policies and procedures for the use of the HRIS to support human resources development and management are established, maintained and communicated. HRIS Risk Management: Management identifies the HRIS-related risks that may preclude the achievement of its objectives, assesses the risks it has identified and formally responds to the risks. The management information available from the HRIS is adequate in meeting Elections Canada s human resources needs. Availability of HRIS Reports: The HRIS has the ability to produce reports that support human resources plans and demonstrate alignment with the broad strategic objectives of the organization. HRIS Performance Measures: Management has identified appropriate performance measures, linked to planned results, for the use of the HRIS. Other HR Reports: Management reports generated from information sources outside the HRIS do not duplicate reports or data available through the HRIS. The control framework in place is adequate and effective in protecting the confidentiality, integrity and availability of the data in the HRIS. HRIS Roles and Responsibilities: The roles, responsibilities and accountabilities related to the HRIS are clearly articulated and understood by stakeholders. Segregation of Duties: There is appropriate segregation of duties. HRIS Data Security: Policies and procedures exist with respect to the use of the HRIS in order to ensure the confidentiality, integrity and availability of data. There is adequate reliability and integrity of data flows from other systems on which the HRIS depends. Employee Training: The organization provides employees with the necessary training, tools, resources and information to support the discharge of their HR data management responsibilities. Management HR Accountabilities: Managers at Elections Canada (not only in the HR Sector) are aware of their human resources accountabilities and understand the basic human resources processes that they are expected to follow with respect to data handling and communication. Data Transfer Controls: Controls are in place to ensure that transfers of human resources related data to the HRIS are complete and accurate. Audit of HRIS: A Human Resources Management Enabler 24