Outsourcing of Information Technology Services Application Sofmare System Development. Contract Guidelines technical asnects

Transcription

1 Outsourcing of Information Technoogy Services Appication Sofmare System Deveopment Contract Guideines technica asnects United Nations Educationa, Scientific and Cutura Organization

2 Pubished in 1998 by the United Nations Educationa, Scientific and Cutura Organization 7, pace de Fontenoy, Paris 07 SP Fra nce CAB-98iWSi03 0 UNESCO 1998 Printed in France

3 Contents Part I: Contract guideines Item Tite Page 1 Management awareness 9 1.a) Generaities regarding the terms of the contract 9 1.b) Hiring contractor/s 10 2 System deveopment phases 11 2.a) Panning 11 2.b) Deveopment 12 2.~) Impementation and operations 12 3 Information that the Project Manager shoud provide to the contractor 13 4 Required documentation provided by the contractor 13 4.a) System Manua 13 4.b) Operations Manua 13 4.~) User Manua 14 4.d) Source code of a programs 14 4.e) User training 14 5 Warning 5.a) Source x Object coding 5.b) Maintenance and updating 6 Source code poicy 6.a) Commerciaised software package 6.b) Ownership: custom-made software package 7 Confidentiaity - professiona ethics Writing a contract Future system maintenance/upgrading Software Quaity Assurance Contract visa Signing the contract 20 Prepared by UNESCO nspectorate Genera

4 Part 2: Contract Checkist Step Topics Page 1 Estabishment of Steering Committee and project team 23 2 Management awareness/commitments 24 3 Project specifications 24 4 Cost/benefit anaysis 24 5 Responsibiities and payment conditions 25 6 Software property rights 25 7 Confidentiaity 26 8 Documentation: User Manua 26 9 Documentation: System Manua Documentation: Operations Manua System s acceptance terms and conditions System maintenance/upgrading Network concerns Network administrator Personne training Software Quaity Assurance Contract visa 31 Prepared by UNESCO Inspectorate Genera

5 PREAMBLE 1. Objective The aim of these guideines is to emphasise the main points of concern that a UNESCO Sector or Division s head shoud take into account when contracting outside expertise services (outsourcing) for deveoping an appication software system (to be processed by a computer in order to automate their working tasks), thus ensuring that a successfu and secure system is produced. 2. What is a comuuter? According to Random House Webster s dictionary, a computer is a programmabe eectronic device designed to performing prescribed operations on data at high speed, speciay one housed with or inked to other devices for inputting, storing, retrieving, and dispaying data. Computer equipment is aso referred to as hardware. 3. What is a comm.&er proaram? It is a set of instructions in form of predefined codes that is written by a computerspeciaist in order to perform specific working tasks otherwise done manuay by peope. Computer program is aso referred to as sqftware. 4. What is Information Technooav (I?)? Information Technoogy is a science that combines the utiization of various types of eectronic devices, incuding computers, and software. Information Technoogy is ony a too, a means to perform working tasks faster and more accurate. It is not a soution in itsef. Appropriate technoogy is the right too for the right job; it gets the job done in a simpe manner and does not waste time, money, resources or efforts. Technoogy aone does not sove any probem. It needs to be utiized in an effective manner in order to do the right things in the right time. The key ingredient for successfu Information Technoogy depoyment is the invovement of quaified peope in this fied, i.e., anything to be automated needs to be programmed by computer speciaists. 5. What is an au&cation software svstem? It is a set of computer programs that are written by computer speciaists in order to perform specific working tasks otherwise done manuay by peope. Prepared by UNESCO Inspectorate Genera - I998 5

6 6. What does it mean to automate, comvuterize the services in a working environment? _ In principe, any financia, administrative and other specific tasks that are routiney done by one or more person coud be automated, as ong as the estabishment has or can easiy obtain the necessary Information Technoogy resources and faciities. Computer software systems do the work a great dea faster and more accurate than any person woud do it manuay. On the other hand, since routine work needs to be done but is neither chaenging nor creative (because it is something repetitive), by etting the computer do the work, it eaves the individua free to think, to be more creative, innovative and, consequenty, more productive. 7. In a working environment. such as in UNESCO for instance, what shoud be automated? There are many working activities presenty dispersed throughout the Organization being performed whoy or partiay on a manua basis which coud be processed by the computer. For exampe: Staff trave and trave caims, a types of staff eave, eectronic distribution of administrative memos, interna circuation of documents, any routine work carried out by sectors and divisions, contro over a sorts of contracts, financia activities carried out by fied offices, registration of mai, fiing, to mention few. 8. How shoud the automation be done? To automate any working procedure it is necessary the participation offour key eements: a) Top management commitment to support the automation procedures. b) Budget resources for the project. c) The computer speciaist - to deveop the project. d) The end-user/s - to inform the computer speciaist & are their needs as far as their work is concerned, and what they expect the computer to do. 9. Who shoud carrv out the automation tasks? The computer speciaist. The computer expert shoud appy the technoogy resources by focusing efforts and concentrating knowedge to providing soutions to the users. The right automation of services shoud be easy to use from the user stand point (user-friendy), it shoud eiminate or reduce redundancies, improve the quaity of the services, and eiminate many administrative work. If the computer speciaist is part of the Organization s staff, the appication system may be deveoped in-house, otherwise this service shoud be assigned to a third party (a contractor) for an agreed-upon price. Once the computer speciaist is chosen, the unit shoud estabish a Steering Committee made up of the foowing members: a) Some designated end-users, among them a senior user who knows we the working procedures subject to automation and who shoud act as the Project Manager. b) The computer speciaist. c) The computer auditor to advise, and ensure that necessary contros are incuded. Prepared by UNESCO Inspectorate Genera

7 At the beginning of the work, the computer speciaist shoud interview as many end-users as possibe to find out and to confirm how the manua work is being done, what are the users rea needs, what are the essentia procedures that need to be automated and what are the ones that may be eiminated. Further, it is equay important (from the stand point of automation) to find out whether the procedure that is going to be automated makes interface with other working segments (that may aready - or wi - be automated). Depending on what is going to be automated, the computer speciaist may need to consut the UNESCO Manua. Surey this is one area where the computer Auditor comes in, ensuring that the automated procedures are in ine with UNESCO Manua. 10. What is the roe of the comvuter Auditor? The computer Auditor shoud participate in the deveopment stages of a appication systems, i.e., before the system is deveoped, in order to provide a pro-active assurance services by suppying management with recommendations and/or guidance on soutions to probems, especiay those surrounding the design and impementation of interna contros. The Auditor s contribution shoud ensure that the system of contros, financia and otherwise, estabished by management is adequate and effective in reducing, to acceptabe eves, the risks faced by the Organization. Furthermore, the Auditor shoud confirm the eve of reiabiity and integrity of information, the efficiency of the system process, pus fraud prevention contros, and compiance with poicies, pans, procedures, aws and reguations, thus ensuring that the system wi do the rkht thinas - the first time. Prepared by UNESCO Inspectorate Genera I

8 Part 1: Con tract guideines Outsourcinp qf In-formation Technoopy Services (IT/IS) to deveou ad&ication software svstems 1. Management awareness 1.a) Generaities regarding the terms of the contract The end users* want a software resource too* that optimises and sveeds UD the -process of their tasks in a cost effective and reiabe manner. Such a resource shoud guarantee the integrity, reiabiity, and confidentiaity of the information that it processes as we as the continuity of the service that it performs. It is important to bear in mind that interna contros outined in the terms of the contract shoud be adequate to protect the appication software system s integrity, i.e., to protect the information that the software system wi produce. It is easier to make changes to a software system during the system deveopment stage; after the system becomes operationa, modifications may not be practica or economicay feasibe. Shoud the contract be atered once it is signed, probaby a its terms ought be reviewed, as the contract cannot remain the same because the synergy of scaes present in the origina contract may no onger be the same. Thus, a possibe working vrocedures and conditions such as rues, refuations and restrictions, as we as interfaces with other svstems which are part of the working task* that is going to be automated shoud be ceary stated by the users and duy specified in the contract in order to avoid the foowing probems: Further expenditures not foreseen in the origina budget for the deveopment of a project (appication software system) due to insufficienty understood requirements. Discontinuity of services from the contractor part. Having a system that does not meet the users rea needs and therefore may be rendered obsoete once it is deivered. Difficut in understanding, using and/or maintaining the system. Other sort of misunderstandings between UNESCO and the contractors. *software resource too - IS a set of software programs (a system) that are deveoped to perform automaticay by a computer the working tasks (administrative, financia, scientific, others) that woud be otherwise done manuay. *end users - are the personne who actuay make use of the Information Technoogy resources to perform their work. *working task -Exampes: Payro, Accounts Payabe, Participation Programme, Staff trave schedues, management Information Systems, attention: These guideines do not appy when purchasing a commerciaised (ready-made) software appication package. Prepared by UNESCO Inspectorate Genera

9 1. b) Hirinp con tractor/s: The deveopment of a new system requires a significant investment of time, effort, and money. It is in the best interests of UNESCO that its personne shoud ensure that proper systems are deveoped, the use of the Organisation assets are controed, and the system achieves its design objectives. Depending on the scope of the project to be deveoped, it woud initiay be advisabe for UNESCO to carry out a preiminary feasibiity study. This study may be carried out in-house by quaified personne in the Information Technoogy fied (which woud not require writing a contract) or by an externa reiabe consuting firm, here caed main contractor, with proven experience in business management as we as being technicay conversant with Information Technoogy matters. The objective of this preiminary study woud be the foowing: (a) To advise/indicate the purchase of a commercia software package avaiabe in the market to do the work needed - Or, (b) To prepare a master pan regarding the project to be deveoped; (c) To provide an accurate estimate of the fu cost of the project; (d) To assure that adequate resources and funding are avaiabe to deveop and impement the project; (e) To obtain both Management commitment and approva. If the party that carried out the feasibiity study cannot deveop the project, they shoud be abe to indicate a software firm, here caed a technica contractor, responsibe for deveoping the project as a whoe (software panning, hardware, and other system components when necessary) and to manage them. Contractors may be seected based on their abiity to perform the work, on strategic business aiances, as we as technica considerations. Further, the hiring of a contractor has to be in accordance with seection and bidding procedures outined in the UNESCO Manua item 326 Contracts Committee, and item 1025 Seection of Suppies and Contractors. The party responsibe for the feasibiity study shoud be responsibe for the foowing: (f) To work with the technica contractor in order to both manage and monitor the atter work. This incudes to estabish commitments with the technica contractor, and tracking and reviewing the contractor s performance and resuts. (g) To ensure that panning, tracking, and oversight of activities are performed appropriatey and that the software product deivered by the technica, contractor satisfies the acceptance criteria agreed upon. During this phase it is critica that the most accurate estimates are deveoped. Therefore this wi require the appropriate supporting documentation which provides the intricate detais of the various means of deriving such estimates. The overa activities performed by the contractor/s shoud be monitored by the members of a Steering Committee. Prepared by UNESCO Inspectorate Genera

10 2. Systems deveopment can be cateporised into three broad uhases: 2.a) Panning. 2.b) Deveopment. 2.~) Impementation and operation. 2. a) Panning The panning phase of svstems deveonment incudes the foowing activities: Estabishment of a Steering Committee with the participation of UNESCO s staff member/s who are acquainted with the procedures to be automated and the contractor, bearing the foowing responsibiities: 1. Prepare and co-ordinate the working agenda. 2. Confirm that funds and resources are avaiabe for the project s deveopment and impementation. 3. Monitor the contractor s administrative and technica activities. 4. Verify that the contractor s interpretation and impementation of administrative/financia and technica issues conform to the specified requirements. 5. Verify that commitments are being met. 6. Verify that a pertinent issues are resoved in a timey manner. 7. Estabish the contract s change contros mechanisms and oversee the changes to the software contractor s statement of work as we, as to assure that other commitments are resoved according to documented procedures. 8. Estabish the system s deveopment miestones and confirm that proper testing, verification and approvas are taking pace. 9. Tracking and overseeing the project deveopment in genera. 10. Prepare periodic progress report. Designation of a Project Manager - UNESCO shoud designate a senior staff member (who is fuy conversant with the working procedures to be automated) to act as Project Manager who woud be responsibe for negotiating the terms of the contract with the contractor, as we as for monitoring and reviewing the contractor s performance and resuts. This person shoud be a member of the Steering Committee User needs anaysis - A study is conducted to determine whether a new system shoud be deveoped or the Organisation shoud purchase a commerciaised software package avaiabe in the market. If a software package is purchased, then this type of contract woud not be written. Review of the current working method. Cost/benefit anaysis - Detaied financia anaysis is conducted to determine the cost to deveop and operate the new system, the savings or additiona expense that wi resut, and its return on investment. Prepared by UNESCO Inspectorate Genera

11 2.b) Deveopment The foowing activities take pace during. the deveopment nhase: Project team - A group formed by the Project Manager, pus key end users, and the contractor who wi be responsibe for designing the new system is estabished. Conceptua design - The systems fow and other information iustrating how the new system wi operate are prepared by the contractor in conjunction with the Project Team. Computer processing design - A detaied system s graphic description that shows how the working procedures wi be processed through the computer is prepared by the contractor in conjunction with the Project Manager. Output information design - Statements, in form of screens or reports, to be generated by the system are described by the contractor with the agreement of the Project Manager. Equipment requirements - Equipment requirements for system operation shoud be determined by the contractor. The equipment aocated for the system must be used effectivey and efficienty. Financia anaysis shoud be prepared for the purchase of new equipment (if needed), or viabiity study shoud be carried out to utiise existing hardware resources (if any is avaiabe). It is important to bear in mind and to take into account the system growth, i.e., to estimate what mass of information the system is expected to process at the beginning of its impementation and within two, three, five years time. The contractor shoud ascertain that the equipment configuration (e.g. RAM memory, disk storage capacity, LAN technoogy resources) wi be sufficient to process the foreseen amount of i- nformation that the system wi have to hande. 2.c) Impementation and Operation During svstem imnementation and operation the foowing activi ties occur: Data fie documentation - A fied-by-fied isting of what wi be contained in each data fie and a isting of the vaues that can be contained in each fied is prepared by the contractor and reviewed by the Project Team. Detaied system design documentation - Specifications of the programs contained in the system areprepared by the contractor. System deveopment - The program modues, and other software supporting toos needed to process the appication system are coded and tested. The various eves of tests shoud be accompanied by designated end users, the Project Manager, and computer Auditor. Contro procedures definition - Descriptions of systems operation and how the user wi contro the system once it is in operation are specified in writing by the contractor in the respective manuas: Operations, User and System manuas. This entais, in providing training for the system s operations personne (quaified technica staff) and end user personne. Operation and maintenance - Change contro processes are defined in writing and impemented in order to monitor and evauate any subsequent changes made in the system, as we as to maintain the system s integrity. System acceptance testing - The users and the computer auditor conduct system s acceptance testing according to predefined and agreed schedues. Prepared by UNESCO Inspectorate Genera

12 If the appication system is being re-designed, the information is transferred from the od to the new system. 3. Information that the Project Manager shoud Drovide to the contractor: Project document: A statement of objectives to be accompished by the proposed project. A description of the services to be performed. A description of how the requested project reates to other automated activities (if appicabe). This is very important, as the processed information may the integrated with other software appication systems. A description specifying the eve of confidentiaity and security in handing the information, incuding segregation of conficting functions within the system (for instance, when creating, updating and approving certain type of information, who can do what and who cannot). 4. Reauired documentation urovided bv the contractor The contractor shoud provide the foowing documentation to UNESCO: 4.a) System Manua. containing: An overa description of the appication system a whoe, its purpose, its objectives, and the performance capabiities of the system. A description or diagram of the computer-based operation, incuding the step-by-step procedures required to initiate processing. A description of the supporting software toos to run the system (e.g., Windows, UNIX, NOVELL, ORACLE, C ++, others). A description of the equipment needed to process the system. A description of a data fies used by the system (incuding description of each and a fied contents). A description of each program modue, incuding the purpose of each modue, cacuating formuas contained in it, and ogic decisions. A description of input (paper forms, screen, or magnetic data fie), fow of data through the processing cyce, and output (paper forms, screen, or data fie). The requirements for preparing and entering input data. The requirements reevant to each output (e.g., format and frequency). The detaied instructions necessary to initiate, prepare, process, and receive a query appicabe to the data base. A ist of error codes or conditions generated by the system and the corrective actions to be taken by the user. Creation of History fies (when appicabe). System s Security Administrator tasks and attributions (password administrator). 4.b) Operations Manua, containing: A description of its operationa environment (incuding LAN topoogy when LAN technique is appied). 0 Software instaation instructions. A diagram showing the inputs, outputs, data fies, and sequence of operations of the computer-based system. Prepared by UNESCO Inspectorate Genera - I998 13

13 An inventory of a programs incuded in the system. An inventory of each permanent fie that is referenced, created or updated by the system. A ist of the various runs possibe and a summary of each run s purpose. A description of the entire run cyce. Description of emergency procedures, such as: In case of a program hat, how to re-process it (the restart and recovery procedures for each run). Fies backup and fies retention periods. 4.c) User Manua, containinp: Genera instructions on how to operate the system. A concise description of the purpose of each program modue, and instructions how to access and process them. Description of screen s contents, and instructions how to enter information on it. Fied specification (numeric, aphabetic or aphanumeric). Fied vaidation procedure instructions (when appicabe). Use of password (when appicabe). 4.d) The source code of a urograms: A program source code modues (deveoped by the contractor) must be duy handed to the Organisation that paid for the deveopment of the software system in reference. 4.e) User traininp: Besides the system s documentation, the contractor has to provide the end users with proper training once the appication system is finished and ready to be impemented in a production environment. The Project Manager shoud assure that a end users receive proper training on how to use the system adequatey. Prepared by UNESCO Inspectorate Genera

14 5. Warning: Source x Object coding: 5.a) Propram sofware is made up of two versions or phases: The first version is the Source modue/coding (it is the way the proarammer originay codes a program using a programming anguage ike Basic, C++, COBOL, others). Once a program is coded, the computer s interna supporting software system converts it into machine anguage creating the so caed Object modue/code. It is in this version that the program modues are made avaiabe to execute/process the enduser appication tasks. 5.b) Maintenance and updating Changes in genera to program modues are done in the Source modues. Therefore, much care and attention must be dedicated to the programming source modues. Source modues shoud be entrusted to a senior staff member responsibe for the software appication system. However, at end-user eve, ony the Object modues shoud be instaed or made avaiabe to them in their computers. These measures serve to protect the source modues from unauthorised chances which might be made deiberatey or inadvertenty by anyone who may have access to them (to the source). 6. Source Code Poicv Many contractors or vendors of appication software provide the purchaser (icensee or cient) with ony the executabe machine anguage (Object) copy of a program. It is therefore impossibe for the cient to modify the appication that was purchased, for enhancement purposes, or to correct probems at ater time. Shoud the software vendor or contractor go out of business, or prove unabe to fufi his responsibiities (specified in the terms of the contract), or disappear from the market for any other reason, the cient coud find himsef/hersef ocked in to a software package with no means of making modifications or having probems corrected. In these circumstances the cient is eft with no resource, and as consequence the system wi be rendered unproductive if not obsoete. When a system does not offer a reiabe soution, it becomes yet another mobem. Prepared by UNESCO Inspectorate Genera

15 UNESCO (the cient) shoud bear in mind the foowinp: 6.a) Commerciaised software package: If the software too is a commerciaised package, i.e., sod to the pubic, this probem may be soved by contracting with the software vendor to pace a copy of the appication source code in the custody of an independent third party. This software escrow account becomes avaiabe to the purchaser ony when it has been determined that the software vendor has defauted on the maintenance agreement or has otherwise faied to ive up to the signed software contract. However, these precautions shoud be taken ony when the vendor is not we known in the market. A sma software firm may be acquired by another party, or go out of business, in which case the avaiabiity of the source code might be impossibe. With firms/products we estabished in the market at the eve of Microsoft@, Orace@, IBM@ or JavaTM for instance, there woud be no need to take specia measures to insure the avaiabiity of the software appication source code. 6.b) OwnershiD: custom-made software package: If UNESCO is paying (a firm or an individua) to deveop a software package, then it shoud be ceary specified in the contract that UNESCO is the soe owner of the entire appication software system, incuding its Source coding modues (because UNESCO is paving for its deveopment). As a matter of fact, a work performed by the contractor under a contract sha become the excusive property of UNESCO. This incudes the program modues and the documentation as we. The contractor sha have no right to such work uness UNESCO defauts on the contract, in which case tite sha revert to contractor. 7. Con fiden tiaitv The contractor shoud agree to hod confidentia any information beonging to or pertaining to UNESCO. Contractor staff who are exposed to such data shoud sign an agreement to keep such information confidentia. Faiure to maintain confidentiaity sha be considered a breach of contract. The contract shoud make it cear whether the contractor may or may not use UNESCO s name or its ogo in saes iterature, or in written proposas to prospective and current customers. Prepared by UNESCO Inspectorate Genera

16 8. Writing a contract 8.a) Eiminating unnecessary expenditures is a goa of any sector or division (or any business segment in genera). Writing Information Technoogy (IT/IS) service contract carefuy can prevent unnecessary expenditures. In a working environment, carrying out finance and administrative tasks are the responsibiity of staff members (users). However, many of these tasks may be automated with the hep of information technoogists who may be outside experts. The purpose of any contract is to carify for both parties their obigations and their rewards; therefore the first genera probem is to reate ceary and concisey who wi do what, when, where, how and at what price. An accuratey written contract protects both parties from future disagreement, usuay eiminating waste of time, poor reationship, and, in some cases, itigation. When writing out a contract with an externa party, it is important that the users correcty and ceary specify their metier/working tasks, and that the information technoogists (the contractors) pace more emphasis on software engineering than on the underying technoogy, as technoogy by itsef wi not sove any probem. Poor definition of working tasks is far and away the major cuprit when projects fai to deiver. The reationship between UNESCO and the IT/IS contractor is governed by the contents of the contract between the two parties. UNESCO shoud expect to receive precisey what is specified in the contract - no more and no ess. Therefore, the key to a satisfactory reationship with a software service firm ies in ceary underining and defining the contract and in providing adequate safeguards for UNESCO. Faiure on the part of UNESCO to specify desired items in the contract as deiverabe items wi generay resut in their being provided ony for additiona cost at ater date, if at a. UNESCO shoud aso bear in mind that ora rewesentations, no matter how we intentioned, have weigh in the eyes of the contractor (and of the aw) ony when they can be proven beyond question. Therefore, anything that is wanted in the contract shoud be incuded in writing. The rippe effect of incorrect and incompete requirements through the ife of an appication system is the major contributor to the widespread egendary woes: high costs, ow returns, eterna maintenance and dissatisfied users. A word of caution worth saying here: be aware, many outsourcers may overwomise and underdeiver. Prepared by UNESCO Inspectorate Genera

17 8.b) It is possibe to get what one wants at the price one expects by drawing up a statement ofwork for each IT service contract. The statement of work is an attachment to the contract between the Organisation and the service provider (the contractor). The more detai the Organisation incudes, the better contro and protection wi be over the project. It may aso serve as a ega document in the event of a dispute. The statement ofwork shoud incude the foowing matters: Summary project description; Tasks and responsibiities of each party; Time: in which period of time the project shoud be accompished; Estimated start and end dates; Hours of coverage each week; Resources required (hardware and software); Property rights (who owns the produced project); Work acceptance terms and conditions; Maximum amount to be paid to the contractor. Penaties to be appied to the contractor in case the service produced does not meet the requirements specified by the Organisation. Who is to determine acceptabiity of the deiverabe. Payment terms and conditions. kc) It is important that the anguage used in the statement of work be unambiguous, to avoid misinterpretation. For exampe, if the contractor is producing an appication system (software programs) for the Organisation, the property rights cause shoud ceary snecifv who wi own what after the competion of the nroiect. 8.d) By detaiing the criteria for work acceptance, one may strengthen auaitv and obiectivitv in determining whether the contractor s performance is in ine with the terms of the contract. 8.e) One shoud aso incude a time frame for acceptance, so that to avoid overpayments. The maximum payment cause is to protect the Organisation from excessive overruns on the contract. 8.f) Putting project detais in writing forces the contractor to ine up required resources ahead of time and saves the cost and troube of adding an attachment to or amending the contract at ater time. For instance, if the contractor is hired to deveop an appication software but he is not technicay conversant with LAN interface technoogies, a written nroiect specification wi make the contractor to think ahead of time about this important matter and gives him time to seek a person who can hande this task accordingy. Prepared by UNESCO Inspectorate Genera

18 The user shoud be we informed about the proposed hardware configuration and network architecture requirements to run the appication system. By hardware configuration it is meant the technica specifications of the computer, i.e., its operating system and storage (memory) capacity. This is to avoid having an appication system that requires a more upgraded hardware resources than the one that might be avaiabe, which woud incur further unforeseen expenditures. There may be hidden infrastructure costs when panning to run a system under a network architecture. Server instaation area may require to buy extra ines and routers to support that request. Where the servers are ocated has a big impact on network topoogy and costs, that is why it is important to think ahead of network architecture cost when panning mutipe-users appication systems. 8.g) Svstem s AcceDtance Criteria Acceptance of contractor s work (programs) sha occur as soon as the contractor demonstrates that the entire set of programs are performing in accordance with the specifications provided by UNESCO and that the documentation specified in the contract is in pace. A word of caution: Faiure to correcty process the system (in part or as a whoe) by wishing to process certain procedures not described or described incorrecty in the statement of work sha not bar acceptance. This means, in the event that the system s specifications are incorrect or incompete and, therefore, the programs do not do what UNESCO expects, it is not the contractor s faut. 8.h) User s training It shoud be foreseen in the contract end-user training provided by the contractor. UNESCO shoud ensure that the appication system be used in an efficient and cost effective manner. For this to be attained it is important that a users have a cear understanding of how the system works and be adequatey trained to use it. Knowedge and experience are vita factors for the proper use of a system, and this can ony be attained by providing proper training to the users. It is important to bear in mind that a comprehensive written documentation deveoped by the contractor is a vita resource for the users. Thus, the system manua, oueration manua and user manua provided by the contractor, shoud be reviewed by the EDP Auditor and Project Team in order to ascertain the quaity of this documentation, i.e., its eve of carity, transparency and understanding. A system s functions and options shoud be ceary expained in these manuas. Prepared by UNESCO Inspectorate Genera

19 9. Future svstem maintenance/uvgrading Every appication system wi need, eventuay, to be updated, modified or enhanced, in other words, wi need to be changed in the future. Thus, the user has to negotiate/define with the contractor the terms of system maintenance. Appication system maintenance can ony be carried out by someone who is technicay conversant with the software coding anguage. Either the Organisation wi have a staff member technicay quaified to do this task or it shoud negotiate/estabish a system s maintenance contract with the contractor. 10. Softiare Quaity Assurance Compiance of the software product with appicabe standards, procedures, and product requirements is independenty confirmed by the Eectronic Data Processing (EDP) Auditor. The Auditor sha work with the software project team starting from the project s eary stages to estabish pans and procedures that wi add quaity vaue to the software project. The Auditor shoud confirm the eve of reiabiity, confidentiaity and integrity of the system. 11. Contract visa Once the contract and the statement of work are prepared, these documents may be sent to IOM/EDP Auditor and/or DIT for a technica appraisa before negotiations with the contractors, shoud the party invoved fee necessary. 12. S&ninp the contract The Organisation shoud sign the contract ony after confirming that funding is avaiabe, and that in-house quaified personne are avaiabe to monitor the project. OBS. We ook forward to receiving your contribution/suggestion enhance the efficiency and effectiveness of this work. to If further information is needed, pease contact: *Ms. Carmen Beringeri - Eectronic Data Processing (EDP) Auditor IOM/Inspectorate Genera - UNESCO Headquarters - Paris, France Te.: (33.1) Fax: (33.1) Emai: c.beringeri@unesco.org Prepared by UNESCO Inspectorate Genera

20 Part 2: Contract Checkist Step Topics Page 1 Estabishment of Steering Committee and project team 2 Management awareness/commitments 3 Project specifications 4 Cost/benefit anaysis Responsibiities and payment conditions 6 Software property rights 7 Confidentiaity 8 Documentation: User Manua 9 Documentation: System Manua 10 Documentation: Operations Manua 11 System s acceptance terms and conditions 12 System maintenance/upgrading 13 Network concerns 14 Network administrator 15 Personne training 16 Software Quaity Assurance 17 Contract visa Prepared by UNESCO Inspectorate Genera

21 Prepared by UNESCO Inspectorate Genera

22 Part 2 Contract checkist Checkist for drawinp UD contracts for the deveopment of Information Svstems and Information TechnooPv (IS/IT) uroiects Whenever a decision is made to automate, to computerise, or to re-design a working segment such as some financia or administrative procedures for instance, its deveopment shoud be duy discussed with the personne responsibe for carrying out such procedures and a Steering Committee and Project Team shoud be estabished in order to ensure the proper panning, deveopment and foow up of the project by the Secretariat with the contractors. The foowing checkist has been prepared to faciitate writing mainy the technica terms of the contract, however not a captions may need to be appied extensivey to a contracts, nor is the ist considered to be exhaustive. Step 1: Estabishment Topics yes no n/a comments of Steering Committee and Project team Note: UNESCO shoud estabish a Steering Committee and designate a senior user to act as the Project Manager who, with other members of the Steering Committee, woud be responsibe for tracking and reviewing the contractor s performance and resuts. This Committee woud ensure that pans for the work are duy documented, the activities are performed satisfactoriy and that the software system deveoped by the contractor satisfy the user s acceptance criteria. 1) Has the Steering Committee been estabished? J) Has the project team been defined? :) Among the members of the project team, is it incuded at east one senior user (who knows the working procedures we) and the contractor? d) Has an end user being designated to be the officia contact ( the Project Manager) to work with the contractor? e) Is there a ceary defined system s user group? f) Has the working LANGUAGE (Engish, French, Spanish, other) being specified in the contract? Note: Workinp anpuaee is the anguage used to write the project documentation and non-reserved words (codes) used by the programmer when writing the software programs. Prepared by UNESCO Inspectorate Genera

23 Topics yes no n!a comments Step 2: Management awareness/commitments a) Are there two parties (contractors) engaged in the deveopment of the new system, i.e., has management engaged formay with a Main Contractor and a technica contractor to deveop the system? b) Has the main (or soe) contractor prepared a system Master Pan? :) Has the Master Pan been approved by the Steering Committee? d) Has the main contractor presented an accurate estimate of the fu cost of the project? :) Has management approved the system s budget? t-, Has the seection of the main contractor and/or technica contractor foowed the contract and bidding procedures specified in the UNESCO Manua? g) Are a agreements between UNESCO and the main contractor and technica contractor duy documented and approved? h) Has UNESCO s management specified in the contract that the contractor/s shoud submit a written progress report specifying the activities performed during the preceding week or another period agreed upon? i) Has UNESCO s management specified that the progress reports shoud aso enumerate any probems encountered that may adversey affect the foreseen schedue? Step 3: Project specifications Note: The work to be performed by the contractor/s ought be defined and panned according to documented procedures. a) Has the user specified in writing to the contractor/s the objectives to be accompished by the proposed project? b) Before putting in writing these objectives, has the Project Manager hed meeting/s with a users in order to discuss and confirm their rea needs in reference to the service that is going to be deveoped? c) With reference to segregation of conficting functions, has the Project Manager made cear to the contractor/s which information (if any) has to be treated differenty from genera data, by the system, in a manner such as not to aow a given person to create, update, change and deete the same information? d) Has it been made cear to the contractor that the system shoud et ony authorised users access the information in the computer? e) Has a functiona requirements document been prepared to provide a basic understanding between users and designers of the system? Step 4: Cost/Benefit anaysis a) Has the Project Manager carried out a cost/benefit anaysis? b) If yes, in this study has it been considered hidden costs, such as cabing (if appicabe), equipment acquisition such as servers and possibe UPS (uninterrupted power suppy), personne training, system s technica maintenance, back up equipment, equipment s instaation ocation such as different foors or different buidings, supporting software? Appication Software Systems Deveopment Guideines and Checkht Prepared by UNESCO Inspectorate Genera - 19% 24

24 step 5: Responsibiities Topics and payment conditions yes no n/a comments Note: Before writing the contract, UNESCO shoud ascertain that adequate resources and funding are avaiabe to pay for the entire deveopment and imvementation of the project. 1) Has the contract ceary specified the responsibiities and tasks of each party (UNESCO x contractor)? 1) Has the contract ceary specified the responsibiities of the Steering Committee? :) Has the price of the services been officiay agreed upon? 1) Has PRICE being specified with or without taxes? :) Have payment terms and conditions been ceary specified in the contract? F) Is there funding avaiabe to pay for the entire deveopment and impementation of the project - incudinn the avaiabiitv of vroder hardware eauidment and suddortinn software? ;) Have penaties been specified to be appied to the contractor in case the service produced does not meet UNESCO s requirements? h) Have penaties been specified to be appied to the contractor in case of abandoning the project before competion? i) Has the entire project deveopment and impementation time period been ceary specified? How ong wi it take to be deveoped? How ong wi it take for the testing stages? How ong wi it take to be fuy impemented? i) Have estimated project s start and end dates been fixed? k) Have system s testing stages been specified? I) Has a cause been written in the contract addressing the possibiity of UNESCO wishing to impement conceptua changes in the project - durinn its deveodment stage or changes in the terms and conditions of the contract? Step 6: Software property rights Note: In case UNESCO is paying for the deveopment of a specific software, the contract ought specify that UNESCO is the soe owner of the software source code and its corresponding object modues, and documentation. If not, the contractors wi be the soe party capabe of carrying out future maintenance/changes/updates to the system, because they wi own the source software that UNESCO has paid for its deveopment. a) Has the contract specified that UNESCO is the soe owner of the software source coding and its corresponding object modues as we as the documentation produced by the contractor? b) Has the contract specified that the contractor is not authorized to use the system (as a whoe or in part) without forma written consent from UNESCO? Prepared by UNESCO Inspectorate Genera

25 Topics yes no n/a comments Step 7: Confidentiaity 1) Has the contract specified that the contractor shoud hod confidentia any information beonging or pertaining to UNESCO? 1) Has it been made cear in the contract that faiure to maintain confidentiaity sha be considered a breach of contract? :) As for the contractor staff who are exposed to UNESCO s data - have they signed an agreement to keep such information confidentia? 1) Has the contract made cear whether the contractor may or may not use UNESCO s name and/or its ogo in saes iterature or in written proposas to prospective and current customers? step &Documentation: A users manua Note: the Project Manager shoud assure that this manua incudes the foowing captions: Ii) A narrative description of the computer-based system; Iii) A description of the step-by-step procedures required to initiate up to finaise the entire processing of the system; iii) Screen ayout descriptions and instructions on how to enter information on them; [iv) A description of input, fow of data through the processing cyce, and output of each programme (reports or data fies); [v) Specifications about restart and recovery procedures for each run. The contractor shoud provide in writing detaied instructions on how to re-process the system in case of system s hats, i.e., how to restore the fies and restart the processing of the system from the point where the probem occurred. a) Is it specified in the contact that the contractor has to deveop a users manua addressing the items mentioned in the above captions, mainy containing function descriptions (step-bystep) of the computer-based system, and instructions to the users on how to use the system? OBS. In sma systems, it may be the user who might perform the system restart/recovery procedures, thus he/she shoud be propery trained regarding svstem backw orocedures in order to perform system recovery and re-process procedures whenever necessary. In arger shared systems, this function shoud be deegated to the system s technica administrator (LAN Administrator). Prepared by UNESCO Inspectorate Genera

26 step 9: Documentation: Topics System manua yes no n/a comments Does this manua incude: 1) A genera system fowchart? 3) A genera description of the system s objectives? :) A narrative description of each program modue, i.e., its purpose, its ogic, formuas, decision tabes? 1) Are there data fie descriptions (expaining the meaning of each fied s contents, as we as whether the fieds are aphabetic, numeric or aphanumeric)? Step 10: Documentation: Operations manua Does this manua incude: a) Instructions on how to insta the system? 3) A diagram of the computer-based operation? 5) A description of the equipment needed to process the system? 3) A diagram indicating the sequence of operations of the computer-based system? :) An inventory of a programs incuded in the system? f) An inventory of each permanent fie that is referenced, created, or updated by the system? g) Instruction on how to run the system? h) Instructions on how to take fies and program ibraries back up? i) Instructions on how to restore fies and programs in order to re-start, re-process the system whenever necessary? Step 11: System s Acceptance terms and conditions a) Has it been specified in the contract the system s acceptance conditions from the Organisation s standpoint? b) Has a system s test pan been defined? c) Has intermediary system verification and tests been specified - to take pace during the various stages of its deveopment, such as conceptua design stage, deveopment stage and parae testing stage before its fina impementation in the operationa environment takes pace? d) Has the Project Manager panned to carry out exhaustive tests before officiay accepting the system as concuded? Appication Sqftwnre Systems &eveopment Gqideines and.cheekist Prepared by UNESCO Inspectorate Genera

27 Topics Step 12: System maintenance/upgrading Note: The system maintenance function requires the co-operation of various user departments, and the programming speciaist, as the users shoud a agree upon the changes that are to be made in the system by the programmer. yes no - n/a - comments Adequate contros shoud be present to prevent unauthorised changes from being made to production programs and to prevent unauthorised access to production data fies. Systems software executes appication program ogic, which in turn updates data fies. Therefore, if the system software can be purposefuy modified, it can process appication ogic, and thus the fies, in an unauthorised manner. Systems documentation is very important at maintenance times, as it faciitates the programmer s work when performing updating/corrections in the existing programme modues. Equay important is the documentation maintenance. Written procedures shoud be in pace for maintaining up-todate the system documentation itsef. a) Has it been made cear who wi be in charge of carrying out system maintenance functions? b) Have the system s change contro procedures been defined? c) If maintenance is to be made by the contractor, has this matter been specified in the contract? d) If maintenance is to be made in-house, can UNESCO count on the staff expertise as being technicay conversant with the system s software toos? e) Is UNESCO providing technica training to a staff member? f) Does the system documentation give the programmer sufficient information to understand the programs, their operating environment, and their maintenance procedures? g) Are the program ogic charts and/or decision tabes we documented? Prepared by UNESCO inspectorate Genera

28 Topics Step 13: Network concerns Wetwork architecture a) If the appication system is to be operated/used in a shared manner via a oca area network (LAN) or wide area network (WAN) has the network infrastructure been duy panned to ensure the avaiabiity of cabing, instaation of servers, -9 routers workstations, and specia teephone ines? yes no na comments Network environment b) Has the ocation of the buiding been identified for the pacement of the LAN server/s and the overa infrastructure instaation? Network trajjic c) Work oad and reiabiity is very important to the overa network requirements. Has data s averape and peak trafic voume been taken into account when panning the network capacity? Network growth and maintenance d) Network growth and maintenance are important requirements that affect panning. Growth is important to determine the requirements for network capacity and protoco architecture. Additiona & are exampes of network growth. Have these factors been taken into consideration when panning the network resources? e) Maintenance must be panned ahead because it may represent the singe argest cost over the network s ife. Requirements may dictate the need for network monitoring equipment to contro maintenance. Hardware and software might be required to be compatibe with standards so that repacements can be obtained easiy. Have these factors been taken into consideration when panning the network resource s requirements? Network operating environment Note: Once network requirements are identified, potentia security and privacy exposures in the overatinp environment must be evauated. Networks pose additiona exposures because of the teecommunication inks that connect the various network nodes. The physica security, access contros, and other measures for centraised systems aso appy to networks. Further, the systems are vunerabe to threats from authorised users (e.g., programmers and operators), unauthorised users (hackers) and to disaster (fire, food). f) Have potentia threats in the network environment been evauated, risk assessment been performed? If yes, have necessary network security measures been taken to compy with these matters? g) Has the project team performed a detaied risk assessment study and determined what security countermeasures must be impemented? h) Is there data encryption, protoco security or other countermeasures being empoyed to increase security of data in the network? Prepared by UNESCO nspectorate Genera