City of Cape Coral City Auditor’s Office ________________________________________________________________ TO: FROM: DATE: SUBJECT:
Mayor and Council Members Dona J. Newman, City Auditor January 18, 2008 Kronos Pre-Implementation Review Report by Transcendent Group
In accordance with the Annual Audit Plan, the Transcendent Group was hired to conduct a pre-implementation review of the City’s new personnel and payroll software. They provided advice to management throughout the implementation period in the areas of project management and controls. Their report is attached along with Management’s Response, which is included in Appendix I. We would like to thank the City Manager, Information Technology Systems Director, Human Resources Director, Financial Services Director, and their staff members for cooperation in the preparation of this report. If you have any questions or concerns, please contact me at 242-3380 or ext. 1380.
Attachment Xc: Terry Stewart, City Manager Dolores Menendez, City Attorney John MacLean, ITS Director Wayne Howard, HR Director Mark Mason, Director of Financial Services Linda Senne, Deputy Director of Financial Services (Project Manager) Bonnie Potter, City Clerk
________________________________________________________________________________________________ P O Box 150027 815 Nicholas Pkwy. Cape Coral, FL 33915-0027 Phone 239-242-3383 Fax 239-242-3384
City of Cape Coral
Kronos Pre-Implementation Review
January 2008
TRANSCENDENT GROUP – JANUARY 2008
EXECUTIVE SUMMARY Introduction The Kronos Human Resources and Payroll system was procured to replace the HTE Payroll system. The system is in the implementation stage with the first paycheck to be processed from the system on January 3, 2008. Transcendent Group has assisted the Cape Coral City Auditor in providing specialized project management and information technology audit services by performing a pre-implementation review of the new system. This project included an independent review that identified and assessed the project planning and project implementation. The timeframe of the work performed was from August 16, 2007 through December 6, 2007. A pre-implementation review is a review of a system currently being developed or the process of being implemented for a purchased system. The review is performed in order to evaluate the proposed control environment in the new system to ensure it will be implemented in a manner that meets business requirements, regulatory requirements (if applicable), organizational policies and procedures, and the system is implemented within the timeline and budget established by the business. The review is concluded when the new system is placed into production. The key benefit of this type of review is the timing of the assessment which leads into specific benefits as follows: • • • • • • •
Ensure adequate level of controls are designed into the system from the beginning It is cost-effective and easier to address issues and control concerns prior to implementation versus after the system is in production Ensure the system and controls are implemented in accordance with established policies Ensure functional and non-functional requirements are properly identified and implemented in a well-controlled environment Provide timely feedback to the project team regarding project management and IT control related concerns/issues Identify project related tasks that should be addressed prior to implementation From a project management perspective ensuring a realistic budget, comprehensive timelines, tasks (and responsibility) are established for project success.
Overall Conclusion In general, the Kronos project team is moving forward in its efforts to be able to meet the “go-live” goal of January 3, 2008. During our involvement with this project Transcendent Group has generated four separate memos addressing various project and system controls related concerns. These memos were sent to the project team to provide timely feedback so appropriate actions could be taken. Early concerns with the project pertained to the lack of documentation in the detailed project plan and the infrastructure of the test and production environments. As a result of our final on-site review during the week of December 3rd we generated the last two memos. One memo pertained to project management related concerns while the other memo focused on IT control issues. There were two areas of concerned noted in the project management memo and 15 areas for improvement identified in the IT controls memo. The two project management related issues pertained to testing and the large number of outstanding issues. These two concerns have been incorporated into the 15 recommendations generated in the IT controls memo. The detailed recommendations have been provided in Appendix 1 of this report while all four memos created during this project have been provided in Appendices
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
1(15)
TRANSCENDENT GROUP – JANUARY 2008
2 through 5. Specifically, it is highly recommended that the following four items be addressed prior to the first payroll run: • • • •
Interfaces – some interfaces have either not been completed and/or tested. Test Results – ensure that all system functions and data is properly tested, and process owners are aware of test results. Undocumented Action Items – there are a few outstanding items currently not in the project workbook. It is critical for them to be added and resolved by the team. Outstanding Action Items – these are key outstanding items that the City is waiting for the Vendor to provide solutions for and then must be tested.
We understand that a majority of items listed above were already known by the project manager and project team. However, at a minimum the project team needs to obtain concrete dates for solutions from the Vendor considering the implementation window is shrinking. There are two items that were considered general recommendations to assist the project team in enabling a smoother payroll run are as follows: • •
Communication Plan – ensure there is proper communication to employees regarding the new system and checks, and to have a process in place for addressing employee questions/problems. Choreograph First Payroll Run – document the process, timeline, and responsible person for each task during the first payroll run.
The remaining items were considered non-functional in nature and lower risk as it relates to the City’s ability to successfully perform the first live payroll run. However, it is important to realize that some of these items are critical to the overall control environment for the entire payroll process and should be treated as priorities from a risk and control perspective. Many of these items have been listed as recommendations so the project team does not forget to address them either before or shortly after the system is implemented. • • • • • • • • •
Procedures Audit Logging and Exception Reporting Security Segregation of Duties Backups Non-Kronos Related Items Training Future Phases of the System Lessons Learned
Strengths Although there were several concerns identified during all aspects of our review, there are several strengths associated with the project: •
• •
Members of the project team and employees within the areas impacted by the new system are very experienced professionals and highly knowledgeable of the current and “old” processes. This will be an asset during the first production payroll run and subsequent establishment of documented procedures. Members of the project team are passionate, customer service oriented, and highly committed to the success of the new Kronos system. The Kronos system will integrate into the City’s current database, storage area network, and backup architecture. The ITS Department has also brought experience into the application logging and application security processes, and will play a key role in establishing these controls.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
2(15)
TRANSCENDENT GROUP – JANUARY 2008
Next Steps Because of the uniqueness associated with a pre-implementation review the next steps associated with the concerns noted in this review should focus on two major items. The key objective is to obtain the necessary solutions from the vendor regarding outstanding action items impacting payroll processing. An equally important objective pertains to testing all aspects of the system prior to implementation. This should include testing unique payroll characteristics by employees, testing interfaces, and performing one final comprehensive parallel test run including all inbound and outbound interfaces along with balancing / reconciliation procedures. -/-
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
3(15)
TRANSCENDENT GROUP – JANUARY 2008
TABLE OF CONTENTS EXECUTIVE SUMMARY .............................................................................................................................................. 1 TABLE OF CONTENTS ................................................................................................................................................. 4 1
INTRODUCTION................................................................................................................................................... 5 1.1 1.2 1.3
2
OVERVIEW OF SYSTEM AND IT ENVIRONMENT...................................................................................... 8 2.1 2.2 2.3
3
INTRODUCTION................................................................................................................................................. 8 KRONOS HR AND PAYROLL SYSTEM................................................................................................................ 8 SUPPORTING IT ENVIRONMENT – ITS DEPARTMENT ....................................................................................... 9
SUMMARY OF RESULTS AND ISSUES ......................................................................................................... 10 3.1 3.2 3.3
4
OVERALL PROJECT DESCRIPTION AND BACKGROUND ..................................................................................... 5 SCOPE AND METHODOLOGY............................................................................................................................. 5 BENEFITS OF THE PRE-IMPLEMENTATION REVIEW ........................................................................................... 6
SUMMARY OF RESULTS FOR PROJECT MANAGEMENT REVIEW ...................................................................... 10 SUMMARY OF RESULTS FOR IT CONTROLS REVIEW ....................................................................................... 11 IDENTIFIED AREAS FOR IMPROVEMENT AND RECOMMENDED ACTIONS ......................................................... 13
LESSONS LEARNED .......................................................................................................................................... 15
APPENDICES Appendix 1: Appendix 2: Appendix 3: Appendix 4: Appendix 5:
Recommendations Kronos IT Controls Memo (dated 12/10/07) Project Management Memo #3 (dated 12/3/07) Project Management Memo #2 (dated 9/21/07) Project Management Memo #1 (dated 8/23/07)
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
4(15)
TRANSCENDENT GROUP – JANUARY 2008
1
INTRODUCTION 1.1 Overall Project Description and Background
Transcendent Group has assisted the Cape Coral City Auditor in providing information technology audit services by performing a pre-implementation review of the Kronos Human Resources (HR) and Payroll system. A pre-implementation review is a review of a system currently being developed or the process of being implemented for a purchased system. City Council approval was obtained in January 2007 for the Kronos HR and Payroll system with project efforts beginning shortly thereafter. The pre-implementation included an independent review of the overall project planning efforts and the identification and evaluation of the effectiveness of automated and manual controls over the Kronos HR and Payroll application. This project was comprised of the following:
Interviews with business owners, key ITS support personnel, and other significant users on the system. Gaining an overall understanding and analysis of key business operations, supporting technology, information flows, and general IT processes. Identification of all automated and manual controls over the DMS application and subsequent assessment of control design effectiveness. Identification of gaps in the control environment and quality of mitigating controls, if any. Developing recommendations for identified areas for improvement.
The pre-implementation review was performed during August 16, 2007 through December 6, 2007. The report begins with a description of the overall project, the scope and methodology, and the benefits of the Kronos HR and Payroll pre-implementation review. Chapter 2 provides an overall description of the system and IT environment. Chapter 3 provides a summary of the results of our pre-implementation review and an overview of the identified areas of concern. Appendix 1 provides the detailed recommendations while the remaining four appendices are comprised of the memos sent out during our review of the Kronos project implementation efforts.
1.2 Scope and Methodology The scope of this assessment focused on the overall project management plan and the identification and effectiveness of automated and manual controls over the Kronos HR and Payroll application. The following control objectives were assessed and included in the review: • • • • • • • • • • •
Data integrity controls Availability controls Data input controls Interface controls Change management controls Assess efficiencies of the system Review appropriateness of segregation of duties Security controls (access rights) Physical Access Controls Problem Resolution and Tracking Computer Operations – Backup and Restore
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
5(15)
TRANSCENDENT GROUP – JANUARY 2008
• • • • • •
Service Level Agreements Application Licensing Controls Audit logging and monitoring Infrastructure and Capacity Planning Controls Training and Documentation Application Security Auditing and Incident Management
We identified and assessed high risk areas and mitigating controls related to the Kronos application and conducted a number of interviews with various levels of management and end users from Accounting / Payroll, Information Technology Services, and Human Resources. The following main work steps were performed for this review: • • • • • •
Information gathering of project plan, application and IT environment, and business processes High level risk analysis Creation and execution of work program Assessment of controls related to control objectives Discussion and validation of identified risks Gap analysis, comparison to best practices and development of suggested actions
Identified controls and procedures were reviewed based on defined criteria for sound internal control and management. These criteria are defined in internationally accepted standards such as: ISO 27000-series, COBIT, and industry guidelines and requirements such as Project Management Institute (PMI). The resulting weaknesses were discussed and validated by key stakeholders and summarized in this report and attached appendix.
1.3 Benefits of the Pre-Implementation Review A pre-implementation review is a review of a system currently being developed or the process of being implemented for a purchased system. The review is performed in order to evaluate the proposed control environment in the new system to ensure it will be implemented in a manner that meets business requirements, regulatory requirements (if applicable), organizational policies and procedures, and the system is implemented within the timeline and budget established by the business. The review is concluded when the new system is placed into production. In contrast, a post-implementation review (also simply known as an application review) is performed after the system has been implemented into the production environment. The goal of this type of review is to test and evaluate the control environment along with ensuring the system meets business and regulatory requirements, and organizational policies and procedures. Essentially one of the major key differences between a pre- and post-implementation review is the timing. There are several benefits associated with performing a pre-implementation review. The benefits are as follows: • • • • • •
Ensure adequate level of controls are designed into the system from the beginning It is cost-effective and easier to address issues and control concerns prior to implementation versus after the system is in production Ensure the system and controls are implemented in accordance with established policies Ensure functional and non-functional requirements are properly identified and implemented in a well-controlled environment Provide timely feedback to the project team regarding project management and IT control related concerns/issues Identify project related tasks that should be addressed prior to implementation
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
6(15)
TRANSCENDENT GROUP – JANUARY 2008
•
From a project management perspective ensuring a realistic budget, comprehensive timelines, tasks (and responsibility) are established for project success
Although the general benefits of a pre-implementation review have been noted above, there were also a number of specific recommendations made by Transcendent Group during the review which provided timely feedback and input to the project team. These items were documented in four separate memos which have been provided in Appendices 2 through 5.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
7(15)
TRANSCENDENT GROUP – JANUARY 2008
2
OVERVIEW OF SYSTEM AND IT ENVIRONMENT 2.1 Introduction
This chapter of the report is used to provide an overview of the Human Resource (HR) and Payroll system, the key functions associated with the overall payroll process, the support functions of the ITS department, and a high level overview of the supporting technical infrastructure. The high level application overview includes the technical infrastructure, supporting systems, and data flow interfaces.
2.2 Kronos HR and Payroll System The Kronos HR and Payroll system will be the City’s primary system used to create employee paychecks. The system was procured to provide a more robust application than the current HTE payroll system that would support the HR, Benefits, and Payroll process for the City’s workforce. The Kronos system is in the process of being implemented with the HR portion currently considered to be in production while the payroll module is in the testing phase. The first production payroll checks will be distributed on January 3, 2008. The business owners and key users are the Human Resource (HR) and Financial Services Departments. Within the HR organization the main user groups are the Class/Compensation and Benefits functions. Within the Financial Services Department the main user groups are the Payroll and Accounting G/L functions. The initial approval of the contract by the City Council to purchase the software was awarded on January 22, 2007. The purchase included the application system and professional services to assist in the implementation of the system.
Kronos Human Resources – This application component is used to store and process employee information and employee benefit information that will be used in the processing of the City’s payroll. It will also store employee accruals and PTO amounts. Kronos Payroll – This application component will process the payroll and payment to the employees. It will also create the financial information for loading into the General Ledge system.
Currently, there are very clear job tasks, roles and responsibilities, and procedures for all of the functions performed in the current HTE payroll process. However, the specific roles and responsibilities for entering employee, benefit, and payroll related information for the Kronos system has not been finalized. The Kronos project team is in the process of redefining the roles, responsibilities, and procedures associated with the new process and system. It will be important for the project team to establish these items as quickly as possible to ensure a well-controlled environment for all payroll processing functions. The Kronos system will reside on a Microsoft Windows 2003 operating system and Microsoft SQL 2005 database operating system. The servers are maintained in the ITS data center on the second floor of City Hall. The new system will have 11 interfaces into the application comprised of both inbound and outbound interfaces. Some of the major interfaces are as follows: Inbound Interfaces: • Telestaff Time and Attendance for Public Safety (Police and Fire) employees • Kronos Time and Attendance for all other City employees Outbound Interfaces: • Payroll financial information to the HTE general ledger and to the Infosis general ledger CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
8(15)
TRANSCENDENT GROUP – JANUARY 2008
• •
File to the bank for payroll payments Employee information back to the Kronos Time and Attendance application for new employee and changes to employee information
2.3 Supporting IT Environment – ITS Department The ITS Department is a centralized function within the City of Cape Coral. The data center is physically located at City Hall on the second floor. The ITS Department is headed up by a director and subordinate managers with responsibilities for provisioning and maintaining all network and computing resources required by the Kronos HR and Payroll application. The Network and Telecommunications Division is specifically responsible for maintaining the wide area and local area network infrastructure, all associated hardware, operating systems, and mass storage subsystems necessary to support the system. Other responsibilities include daily backup operations and recovery efforts, and network and systems security defenses. The Business Applications Division is responsible for maintaining the application, associated databases, and logical security to the application. Other responsibilities include testing and installing Kronos application new releases and fixes. Individuals in the Business Applications Division have been assigned primary responsibility for maintaining and supporting the application.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
9(15)
TRANSCENDENT GROUP – JANUARY 2008
3
SUMMARY OF RESULTS AND ISSUES 3.1 Summary of Results for Project Management Review
During the project management phase of the pre-implementation review we interviewed several members of the Human Resource, Payroll, and ITS functions and evaluated various project documents. Multiple communications between Transcendent Group and City employees took place from the time of the first meeting on August 16th, to the last meeting on December 3rd. Over this period we generated three memos associated with project management related issues. The first memo was issued on August 23rd (Appendix 5) in which there was a concern about the City’s ability to successfully deploy the application based on the current timeline. There was no one single critical item, but rather an accumulation of medium items that warranted a high level of concern. Specifically, the medium items were: • • • •
Lack of agreement between Kronos and CCC on requirements that were in scope, and Kronos’ ability to deliver on the requirements, as reflected in Kronos’ Product Design document. Lack of planning and/or detailed instructions regarding data migration from current systems to Kronos systems. Plans for an HR “Proof of Concept” that were not in line with what was outlined in Kronos’ RFP response, and that deliverable would likely fall short of what the City needs in a “Proof of Concept”. Lack of planning / coordination for testing, in particular with regards to different testing needs between HR and Payroll (Finance).
The second memo was issued on September 21st (Appendix 4) resulting from additional meeting with project team members and a review of the project documentation. It was noted that a substantial amount of information in the Project Workbook was either null or stale. We recommended that the various tabs and fields within the Project Workbook be populated and kept current. This is important because the Project Workbook document serves as the track record for the project that would be used in the event there were disagreements between the City and Vendor. The third memo was issued on December 3rd in which additional interviews and a review of project documentation were performed. Two key areas were identified in the memo requiring attention: test planning and the prioritization of action items. Most of the concerns identified with these two items have been incorporated into the formal recommendations made in section 3.3 of this chapter and in Appendix 1. A brief overview of the two items has been provided below (the entire memo has been provided in Appendix 3): 1. Test Planning Shortfalls of testing that are currently underway or planned include: • The parallel testing approach being employed provides an enormous sample size for test scenarios since all checks (ledger entries) are being created and validated. However, it is possible that there are some scenarios, or even many scenarios, that are not included in the testing. Examples could include the following scenarios: o A hire midway through the pay cycle o A termination midway through the pay cycle o An employee taking time off without pay o Seasonal employees that are not receiving checks this season
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
10(15)
TRANSCENDENT GROUP – JANUARY 2008
There are three categories of employees, referenced later, that are definitely not included in the test The result of potentially not testing every scenario is that when the ledgers in the two environments balance, “victory” may be declared, yet not all scenarios have been tested. This is sometimes termed a “false positive.” Later, in production when an untested scenario occurs, one or many erroneous checks may be printed. The Testing Workbook identifies Test Scenarios, which is good. Further, it identifies Expected Outcomes, which is better. However, the same workbook has a level of detail that is too coarsegrained. For instance: o “Every employee is attached to appropriate position” o “Ensure that a Terminate Employee Action meets client’s needs and requirements.” Without enumerating all the possible Scenarios, and corresponding Expected Results, the City cannot be certain that the software will work correctly for all real-life scenarios, or even support various combinations at all. The current set of Test Scenarios in the Testing Workbook cover the “most likely outcomes in the most likely situations.” That leaves a substantial number of “outlier situations” not included in the planned testing. The interface testing was being performed in absence of a documented plan. We did not see a comprehensive list of interfaces and testing plans for each, nor did we see a test plan that shows a comprehensive test including all inbound interfaces and all outbound interfaces, all in one test. It is not a good idea (from a best practice perspective) to have the first time a complete payroll cycle with all inbound and outbound interfaces be the first real production run of payroll. o
•
•
2. Prioritization of Outstanding Action Items In the Project Workbook there is a tab called Open Action Items which contains 44 action items (as of 11/28). Each action item had a corresponding Priority level set to either blank, low, medium, high, or critical. The breakdown of the 44 action items is as follows: Priority Critical High Medium Low Blank Total
Count 10 22 7 2 3 44
The concern is that there was not a clearly documented definition for each of the priority levels, and that there is not an “above the line / below the line” way of distinguishing what action items must be included or addressed prior to deployment and what action items can be addressed AFTER deployment. We believe it is highly unlikely that all of the items will be addressed and closed before the target “go live” date based on the sheer number of outstanding action items, the length of time some have been outstanding, and the overall level of effort to complete some of the items.
3.2 Summary of Results for IT Controls Review In addition to reviewing the project management efforts of the Kronos project, we also reviewed the IT control environment. Transcendent Group identified and was informed by the project team of risk items related to both functional and non-functional requirements of the system. Functional requirements have a direct impact on how the system works and processes data while non-functional requirements typically CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
11(15)
TRANSCENDENT GROUP – JANUARY 2008
pertain to functions related to the control environment of the system. Examples of non-functional requirements include: audit logging, security, backup and recovery, etc. A small number of the risk items were functional in nature while a majority of the items are non-functional. We have also included two general recommendations to assist in making the first payroll run a little smoother and possibly less chaotic for all parties involved including employees. It did not appear as though there were any insurmountable items on our recommendation list. However, based on the large number of critical and high priority action items along with several issues identified during this review, collectively they could cause problems with the project timeline, payroll run and/or balancing/reconciliation process. Specifically, the items that need to be addressed prior to the first payroll run are as follows: • • • •
Interfaces – some interfaces have either not been completed and/or tested. Test Results – ensure that all functions and data is properly tested, and process owners are aware of test results. Undocumented Action Items – there are a few outstanding items currently not in the project workbook. It is critical for them to be added and resolved by the team. Outstanding Action Items – these are key outstanding items that the City is waiting for the Vendor to provide solutions for and then must be tested.
We understand that a majority of items listed above were already known by the project manager and project team. However, at a minimum the project team needs to obtain concrete dates for solutions from the Vendor considering the implementation window is shrinking. The two items that were considered general recommendations to assist the project team in enabling a smoother payroll run are as follows: • •
Communication Plan – ensure there is proper communication to employees regarding the new system and checks, and to have a process in place for addressing employee questions/problems. Choreograph First Payroll Run – document the process, timeline, and responsible person for each task during the first payroll run.
The remaining items were considered non-functional in nature and lower risk as it relates to the City’s ability to successfully perform the first live payroll run. However, it is important to realize that some of these items are critical to the overall control environment for the entire payroll process and should be treated as priorities from a risk and control perspective. Many of these items have been listed as recommendations so the project team does not forget to address them either before or shortly after the system is implemented. • • • • • • • • •
Procedures Audit Logging and Exception Reporting Security Segregation of Duties Backups Non-Kronos Related Items Training Future Phases of the System Lessons Learned.
Strengths Although there were several concerns identified during all aspects of our review, there are several strengths associated with the project: CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
12(15)
TRANSCENDENT GROUP – JANUARY 2008
•
• •
Members of the project team and employees within the areas impacted by the new system are very experienced professionals and highly knowledgeable of the current and “old” processes. This will be an asset during the first production payroll run and subsequent establishment of documented procedures. Members of the project team are passionate, customer service oriented, and highly committed to the success of the new Kronos system. The Kronos system will integrate into the City’s current database, storage area network, and backup architecture. The ITS Department has also brought experience into the application logging and application security processes, and will play a key role in establishing these controls.
3.3 Identified Areas for Improvement and Recommended Actions The identified areas of improvement, together with recommended actions in detail are presented below: Risk classification
Assessment of Significance
Risk Matrix Table Moderate
High
High
Low
Moderate
High
Low
Low
Moderate
Assessment of Likelihood
Each area has been risk classified according to the following criteria: 1. High risk level. Risk represents a high likelihood and will significantly impact the City’s ability to successfully implement the system by the go-live date. Potentially a high risk of fraud, security breach, access to or destruction of confidential data, or financial impact to the operations of the City when the system goes live. Very critical to the City’s efficiency and to the fulfillment of the goals of the operation in the short and long-term. and/or within a good internal control environment. 2. Moderate risk level. Risk represents a moderate level of likelihood and significance to the City’s ability to successfully implement the system by the go-live date. Potentially a moderate risk of security breach, access to or destruction of data, or impact to the operations of the City when the system goes live. Critical to a good internal control, efficiency and reliability in the City’s operations. 3. Low risk level. Risk represents a lower or no risk of likelihood and significance to the City’s ability to successfully implement the system by the go-live date. Still essential for a good internal control, efficiency and reliability in the City’s operations.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
13(15)
TRANSCENDENT GROUP – JANUARY 2008
Responsibility The areas of responsibility for each area of improvement have been defined as follows: A. Project Team (Manager and/or Team Members) B. Vendor C. Information Technology Services This classification of responsibility is based on the current project team organizational structure. Priority For each recommendation we provide the suggested priority level for implementation for each improvement item as support for the creation of an action plan. The following categories are used: I II III
Action prior to implementation Action within 3 months after implementation Action within 18 months
Classification of Risk, Responsibility and Priority Level for Recommendations Regarding the Kronos HR and Payroll Pre-Implementation Review at the City of Cape Coral
Areas for Improvement 1. Communication Plan 2. Interfaces 3. Test Results 4. Undocumented Action Items 5. Procedures 6. Audit Logging and Exception Reporting 7. Security 8. Segregation of Duties 9. Choreograph Live Payroll Run 10. Outstanding Action Items (Critical and High) 11. Backups 12. Non-Kronos Related Action Items 13. Training 14. Future Phases of System 15. Lessons Learned
1
*Risk 2 3 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9
Responsibility
Priority
A A,B,C A A,B A,C A,C A,B,C A,C A,C A,B,C A,C A,C A A,B,C A
I I I I I,II I,II I I I I I I,II II II II
* See Risk Matrix Table above to explain risk levels which are based on likelihood and significance. Each area for improvement is described in detail in Appendix 1.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
14(15)
TRANSCENDENT GROUP – JANUARY 2008
4
LESSONS LEARNED
The implementation of the Kronos HR and Payroll system is a key project for the City that has involved the efforts of several departments. The City also has plans for replacing the existing HTE core system in the future which will entail a similar project as the Kronos implementation. There were certain aspects of the Kronos project that went extremely well while other components were not as smooth. As a result, there were probably a number of lessons learned by the team that can be used for future projects. The value in discussing and identifying lessons learned is so that the items are documented in a central location for current and future team members to access. This will enable future projects to benefit from the learning’s obtained from the Kronos efforts resulting in an even smoother, more efficient and successful project. The following is a list of some of the lessons learned we noted and heard from team members during our review: •
• • • • • • •
Ensure project plans follow a formal systems development methodology which is documented and include the following: o Both functional and non-functional project tasks o Detailed project plan in which tasks have timelines and responsibilities Detailed conversion plan Develop detailed, documented test scripts and performing multiple parallel test runs Ensure all interfaces have been identified and tested o Maintained by the City and not the vendor o Setting of project milestones o Project reporting o Closing of tasks o Budget versus actual (time and costs) o Formal go / ”no-go” decisions From the start of the project use an experienced, hands-on Project Manager independent of the City business areas involved in the project. Conduct more formal project meetings, especially as the project nears completion. During system selection request bidder to provide more formal information on how the system will handle the items in the RFP, what will be included in the cost of the system, and what items will be considered an add-on cost. Have chosen vendor provide proof of concept prior to signing contract to ensure system can meet requirements. During system selection, visit other sites/City’s using the top two or three vendor’s system to see first-hand how the system is used, features available, limitations, overall experiences, etc. The RFP of the system should also include minimum security requirements and other requirements (i.e. audit logging, integration with other systems, architecture, growth projections) necessary to meet City policies. Graduated payment schedule with the vendor based on delivery of functionality, especially if there are modifications to the system. Payment schedule should also be more heavily weighted at the end of the project and based on successful implementation criteria.
The above list has been identified by Transcendent Group resulting from our exposure to the project as an external party. However, as stated in the recommendations appendix, we recommend that the project team have a “lessons learned” summary meeting shortly after the implementation of the system. This meeting might result in additional and more detailed items being identified. ./.
CITY OF CAPE CORAL – KRONOS PRE-IMPLEMENTATION REVIEW
15(15)
Transcendent Group – January 2008 Appendix 1 The identified areas of improvement, together with recommended actions in detail are presented below: Risk classification
Assessment of Significance
Risk Matrix Table Moderate
High
High
Low
Moderate
High
Low
Low
Moderate
Assessment of Likelihood
Each area has been risk classified according to the following criteria: 1. High risk level. Risk represents a high likelihood and will significantly impact the City’s ability to successfully implement the system by the go-live date. Potentially a high risk of fraud, security breach, access to or destruction of confidential data, or financial impact to the operations of the City when the system goes live. Very critical to the City’s efficiency and to the fulfillment of the goals of the operation in the short and long-term. and/or within a good internal control environment. 2. Moderate risk level. Risk represents a moderate level of likelihood and significance to the City’s ability to successfully implement the system by the go-live date. Potentially a moderate risk of security breach, access to or destruction of data, or impact to the operations of the City when the system goes live. Critical to a good internal control, efficiency and reliability in the City’s operations. 3. Low risk level. Risk represents a lower or no risk of likelihood and significance to the City’s ability to successfully implement the system by the go-live date. Still essential for a good internal control, efficiency and reliability in the City’s operations. Responsibility The areas of responsibility for each area of improvement have been defined as follows: A. Project Team (Manager and/or Team Members) B. Vendor C. Information Technology Services This classification of responsibility is based on the current project team organizational structure. Priority For each recommendation we provide the suggested priority level for implementation for each improvement item as support for the creation of an action plan. The following categories are used: I
Action prior to implementation
City of Cape Coral – Kronos Pre-Implementation Review
Transcendent Group – January 2008 Appendix 1 II III
Action within 3 months after implementation Action within 18 months
Classification of Risk, Responsibility and Priority Level for Recommendations Regarding the Kronos HR and Payroll Pre-Implementation Review at the City of Cape Coral
Areas for Improvement 1. Communication Plan 2. Interfaces 3. Test Results 4. Undocumented Action Items 5. Procedures 6. Audit Logging and Exception Reporting 7. Security 8. Segregation of Duties 9. Choreograph Live Payroll Run 10. Outstanding Action Items (Critical and High) 11. Backups 12. Non-Kronos Related Action Items 13. Training 14. Future Phases of System 15. Lessons Learned
1
*Risk 2 3 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9
Responsibility
Priority
A A,B,C A A,B A,C A,C A,B,C A,C A,C A,B,C A,C A,C A A,B,C A
I I I I I,II I,II I I I I I I,II II II II
* See Risk Matrix Table above to explain risk levels which are based on likelihood and significance. Each area for improvement is described in detail in Appendix 1.
City of Cape Coral – Kronos Pre-Implementation Review
Transcendent Group – January 2008 Appendix 1
INDEX OF RECOMMENDATIONS 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15.
Communication Plan ............................................................................................................................... 4 Interfaces.................................................................................................................................................... 5 Test Results................................................................................................................................................ 6 Undocumented Action Items.................................................................................................................. 7 Procedures ................................................................................................................................................. 8 Audit Logging and Exception Reporting............................................................................................ 10 Security .................................................................................................................................................... 11 Segregation of Duties ............................................................................................................................. 12 Choreograph Live Payroll Run............................................................................................................. 13 Outstanding Action Items (Critical and High)................................................................................... 14 Backups .................................................................................................................................................... 15 Non-Kronos Related Action Items ....................................................................................................... 16 Training.................................................................................................................................................... 17 Future Phases of System........................................................................................................................ 18 Lessons Learned ..................................................................................................................................... 19
City of Cape Coral – Kronos Pre-Implementation Review
Transcendent Group – January 2008
Appendix 1
1. Communication Plan AREA: OBSERVATION There is currently no documented plan for formally communicating to employees about the implementation of the new HR/payroll system resulting in a new paycheck format and what employees should do if there are questions or problems with their paycheck.
LEVEL OF RISK: 2 RISK Lack of communication to employees prior to the implementation would place undue stress and burden on the employee if there were any questions or incorrect information on their paychecks. RECOMMENDATION
Despite the email response, we recommend that the team develop a formal communication plan to employees about the implementation of the new HR/payroll system resulting in a new paycheck format. This will ensure In an email response from the project manager it all members of the team are clear about expectations. The communication plan should include the following was stated that Finance will prepare a memo to items: all employees that will be distributed to each • Establish means for communicating to all employees (email, intranet (pass downs), letter / stuffer in employee along with their last pay check of the paycheck, verbally through supervisors, etc.) calendar year on December 20, 2007. • Encourage employees to review paycheck and details thoroughly to ensure accuracy • Inform employees who they should contact and how in the event there are questions or problems with their paycheck • The Team should establish a single point of contact for payroll issues • Establish a vehicle for ensuring all issues are logged and tracked along with corrective action taken. This will enable the team to determine if issues are unique to an individual, a group of employees or a broader issue. MANAGEMENT COMMENTS/ACTION PROPOSED:
As stated in Transcendent Group’s observation, the City had plans and did distribute a memo dated December 20, 2007, from the Financial Services Director to all employees informing them that the City will be implementing the Kronos Human Resource Information System (HRIS) with an Integrated Payroll System with the intent of using Kronos Payroll with the first paycheck/direct deposit in January 2008. Employees were informed to contact the Payroll Supervisor, at 574-0483 (ext. 1483) if they identify discrepancies or have any questions. However, due to issues with adequate testing of the system, the City did not start using Kronos Payroll with the first paycheck/direct deposit in January. The Financial Services Department sent an e-mail to all city employees on December 27, 2007 informing them that the City expects to be using Kronos Payroll with the first paycheck/direct deposit in February 2008. As before, Financial Services encouraged all employees to review their paycheck/direct deposit with the first paycheck in February 2008. Financial Services will again provide notice in late January of the change over. All issues will be tracked and logged along with corrective action taken. City of Cape Coral – Kronos Pre-Implementation Review
4 (19)
Transcendent Group – January 2008
Appendix 1
2. Interfaces AREA: OBSERVATION
LEVEL OF RISK: 2
The Kronos system will have several interfaces, approximately 11 per discussion with the ITS department. Based on our review the following items exist related to interfaces: • The interfaces from the Kronos Payroll system to the HTE G/L and to Infysis for Charter Schools G/L were received the week of December 3rd. However, at the time of this memo the interfaces have not been tested. In addition, balancing by the Finance Department of the payroll related accounts and expense distribution has yet to be performed. • The interface from the Kronos Payroll system to the Kronos Time and Attendance system on the iSeries machine has not been completed as of the time of this memo. This is an interface the City is waiting for Kronos to complete. • There is no other documented test plan to ensure all interfaces are tested.
RISK Lack of complete and thorough testing of all interfaces could introduce unexpected results or data not being loaded into the system. This could lead to the inability to process the payroll or errors in pay and benefits.
RECOMMENDATION A documented test plan should be developed to ensure all interfaces are tested. The plan should identify who will test the interface and how the data will be validated / reconciled. More specifically, the Team should ensure that the new interfaces received going to the two G/L systems (HTE and Infysis) are tested. The Team should obtain a firm commitment from Kronos as to when the interface to the Kronos Time and Attendance system on the iSeries machine will be delivered. Once this is delivered, the interface needs to be tested. Finally, the Team should perform one comprehensive parallel test run of the new system including all inbound and outbound interfaces along with testing balancing /reconciliation procedures.
MANAGEMENT COMMENTS/ACTION PROPOSED: At the time of this pre-implementation review, not all the interfaces were written. We acknowledge and concur that all interfaces are to be tested and that a comprehensive parallel test be run of the new system including all inbound and outbound interfaces along with testing balancing/reconciliation procedures. ITS has prepared a spreadsheet – “Kronos HRIS Payroll – Interfaces.xls” which was originally taken from the Kronos Project plan but is now updated with the current status and defines which interfaces are mandatory for go-live. These are C1 (HR to iSeries T&A), C3 (iSeries T&A to WF payroll), C4 (Positive Pay), C5/C6 (the H.T.E. defined interfaces for GMBA & Infysis), C9 (Payroll to ICMA), C10 (Attendance to iSeries), C12 the CC developed spreadsheet download from Telestaff). These total 8 critical interfaces that are being statused daily. Progress/functionality was a part of the key decision on go-live. The City will start using Kronos Payroll after completion of testing all interfaces and a comprehensive parallel test run. The City expects to be using Kronos Payroll with the first paycheck/direct deposit in February 2008.
City of Cape Coral – Kronos Pre-Implementation Review
5 (19)
Transcendent Group – January 2008
Appendix 1
3. Test Results AREA: OBSERVATION The topic of testing has been documented in a Memo from Transcendent Group (John King) entitled “Cape Coral – 20071203 Memo v2” sent to the Team on Friday December 7th. This recommendation item provides additional detail to supplement the above memo. Based on our discussions with members of the project team the following items can be improved in the test area: • The testing worksheet is not being updated with the status of test results. Instead, only issues identified during testing are being documented. • There is limited communication of test results, action items added or removed, and testing status to the process owners (i.e. HR Manager and Benefits Manager). Process owners are not involved in testing (at the time of our visit). While their areas may be being tested, test results are not being communicated to them leaving them uncomfortable in knowing if their areas and concerns are being addressed. • Sign-off on the implementation of test results are not being formally performed by the Process Owner after proper verification. For example, information owners (Benefits and HR) have not balanced their information that is in the Kronos system to either HTE or other system reports to ensure benefit information is correct, payroll withholdings balance to withholdings and withholdings in payroll balances to vendor invoices. • Test scenarios are not being documented to ensure that all items are covered Testing is being performed on test data that currently resides in the test database. MANAGEMENT COMMENTS/ACTION PROPOSED:
LEVEL OF RISK: 2 RISK Incomplete and/or undocumented testing could result in a system that does not provide the expected results when processing information. In addition, if there are problems with the system it will be difficult to know if the problem areas were tested to assess root causes. RECOMMENDATION Based on our discussions with project team members we recommend the following items be improved in the test area: • Testing worksheet should be updated with the status of test results. Completion of this document would ensure all tests are being performed and the status of the testing can be easily viewed by all parties. • There should be more communication of test results, action items added or removed, and testing status to the process owners (i.e. HR Manager and Benefits Manager). • Sign-off on the implementation of test results should be performed by the Process Owner after proper verification. This will enable these individuals to be comfortable with the processing and reporting controls over their information. • Various test scenarios should be documented to ensure that all items are covered. Testing should be comprised both good and bad data to ensure the system processes both good and bad data as expected.
We acknowledge and concur that all items are to be tested. A testing workbook, which is posted on Sharepoint, was already started at the time of this preimplementation review. There are worksheets within the workbook for human resource processes and payroll processes. The testing worksheets include the test scenario, report/screen to review, building block, expected outcome, pass/fail, and notes. The notes section is utilized to document the details of the validation of information and test results. After tests are validated and verified the appropriate individual signs-off in the notes section. Communication of results is done daily between HR, ITS, financial services, and Kronos personnel via e-mails and phone conferences. City of Cape Coral – Kronos Pre-Implementation Review
6 (19)
Transcendent Group – January 2008
Appendix 1
4. Undocumented Action Items AREA: OBSERVATION Based on our review of the Action Item Report in the Project Workbook dated 11/28/07 there were several outstanding items communicated to us by members of the project team that could not be located in the Action Item Report. They include the following: • Life to date pension totals printed on checks • Group Term Life imputed income • Building of 5 additional 457 codes to accommodate the % election option • Tracking of arrears - Handling of negative balances and the priority of deductions • Pension calculators – can Kronos handle calculations on gross salary? • Handling of Accruals o PTO o Comp Time, Seasonal Bank, Swap Shift • Handling of “add pays” – how will the system handle expiration date for certifications and testing this feature • Will the Kronos system be able to handle expense distribution for budgeting purposes on the G/L side? This is asked since Kronos is set up at a position level and not an FTE level. MANAGEMENT COMMENTS/ACTION PROPOSED:
LEVEL OF RISK: 2 RISK Not having all Action Items listed and/or documented in the central repository could result in required features not being installed or properly tested. RECOMMENDATION We recommend that the project team improve communication with team members to ensure all outstanding action items are in the Project Workbook, especially the items noted in this observation. In addition, ensure the items have been appropriately prioritized, addressed with the vendor, properly assigned responsibility, a specific completion date has been established, and testing plans are developed.
We acknowledge and concur that communication is necessary amongst HR, ITS, Financial Services, and Kronos personnel. A Project Workbook was created at the beginning of the Kronos HRIS/PR implementation process. This Project Workbook includes an outstanding action items and issues list comprised of the application (HR, Payroll, ITS), priority (Critical, High, Medium), assigned to, description, target resolution, comments, and target completion date. This project workbook is posted on sharepoint with access to HR, ITS, and financial services. The City project manager e-mails completion of action items and issues to the Kronos project manager to update the project workbook. Communication of results is done daily between HR, ITS, financial services, and Kronos personnel via e-mails and phone conferences.
City of Cape Coral – Kronos Pre-Implementation Review
7 (19)
Transcendent Group – January 2008
Appendix 1
5. Procedures AREA: OBSERVATION Because this project is a pre-implementation review and not an audit we understand that most of the project team’s focus has been concentrated on conversion, testing, and preparation for the first live payroll run. Less emphasis has been placed on establishing new procedures in the payroll process. Some roles and responsibilities will be changing which is why new controls and procedures need to be developed. New procedures may not be developed until after the first production payroll run. Regardless, it is still important to ensure minimal controls, formal procedures and document are in place to ensure the first few payrolls are accurately completed until more comprehensive procedures and documentation is developed.
LEVEL OF RISK: 2 RISK Documented procedures ensure that roles and responsibilities have been defined and all processes are performed and approved according to management instructions. With a new system the lack of procedures could allow transactions to be entered into the system that are not proper or in other cases transactions could be entered without receiving required management review and approval. In addition, employees may not be aware of their roles and responsibilities, and necessary steps may not be performed. RECOMMENDATION We understand that the project team intends on developing comprehensive controls and procedures associated with the new payroll process. Therefore, this recommendation is being provided as a reminder for the project team to develop well-documented controls and procedures to ensure adequate controls are in place to either prevent or detect any errors or inappropriate activities associated with the HR, Benefits, and Payroll processing efforts at the City. It is ultimately the responsibility of the organization to ensure a comprehensive approach is followed to address controls. However, the listing below is an overview of some of the key controls and procedures that should be in place: • Balancing of Interfaces • Appropriate segregation of duties (both manual and systematically) • Balancing is performed for benefits • Balancing is performed for all general ledger postings • Only valid and approved employees are entered into the system • Appropriate audit logging and exception reporting to investigate irregularities • Only valid and correct deductions are selected and taken from employee paychecks • Payroll checks are accurate and complete • Control is maintained over check stock • Appropriate backup and recovery procedures • Develop business continuity procedures and update disaster recovery plan
City of Cape Coral – Kronos Pre-Implementation Review
8 (19)
Transcendent Group – January 2008
Appendix 1
MANAGEMENT COMMENTS/ACTION PROPOSED: The Financial Services’ current detailed procedures (which include the bulleted items above) surrounding the payroll process are documented; therefore we acknowledge and concur that procedures be documented. The Financial Services Department already had planned and does intend to document the detailed procedures surrounding Kronos payroll. Back-up & recovery procedures will be formally documented by end of January for this system, but they are physically in place. Production data will be stored on the SAN & be differential backed up nightly and a full backup weekly. SQL O/S on its own production server & backed up nightly. COOP/DR documentation will also be completed by the end of January. For both regular back-up & recovery & DR, a major step forward will occur within Jan/Feb timeframe when we real time replicate the SAN for critical business systems from City Hall to the EOC.
City of Cape Coral – Kronos Pre-Implementation Review
9 (19)
Transcendent Group – January 2008
Appendix 1
6. Audit Logging and Exception Reporting AREA: OBSERVATION As of the date of our on-site review, there was some confusion about the status of audit logging and exception reporting. Some team members were under the impression that audit logging had been activated. The reality is that the audit logging was not activated at this point on the production system for tracking any changes to the HR master files and data. In addition, the project team had not developed a plan for identifying which fields to log and the creation of exception reports.
LEVEL OF RISK: 2 RISK The lack of audit logging and reporting could allow unauthorized changes to be entered into the system without the knowledge of management. RECOMMENDATION We recommend that the project team develop a plan for identifying which fields to log and the creation of exception reports. There are several critical items that should be taken into account during this process: • The business should drive the discussion and communicate their needs to ITS • It is not a good idea to log all fields because of the potential impact on system performance. Instead, the focus should be placed on critical data and master files Audit logs are a good tool for research purposes. The organization should consider generating exception reports when critical data and master files are changed. The reports should be reviewed to ensure the changes are valid. If they are not, then the logs are valuable in researching who made the change, the date, before values, etc.
MANAGEMENT COMMENTS/ACTION PROPOSED: The City’s current procedures and processes include audit logs that generate payroll audit listings that track all changes made to an employee’s master file. Therefore, we acknowledge and concur that tables/fields should be logged for the Kronos system. HR, ITS and Financial Services personnel have agreed on the critical data that is to be logged. Audit listings will be generated and reviewed to ensure changes are valid.
City of Cape Coral – Kronos Pre-Implementation Review
10 (19)
Transcendent Group – January 2008
Appendix 1
7. Security AREA: OBSERVATION Based on our discussions with members of the project team including the ITS department, there appears to be limitations associated with the security of the Kronos system. The limitations include the following: • Password configuration settings do not meet the City’s policy on password configuration. Users are not automatically forced to change passwords every ninety days and do not have the ability to change their password. In addition, the system does not have the ability to take action after a specified number of unsuccessful logon attempts. • Data entry screens contain both HR and Payroll data and each department needs to view this data. However, to view the data on a screen would also give update to this information. The alternatives are to: o Provide two ID’s one for inquiry only and one with their update capabilities. o Another option would be to provide users with reporting capability and may not need view access to the screen.
LEVEL OF RISK: 2 RISK Improper security could result in unauthorized changes to or viewing of sensitive information. It can also result in the improper segregation of duties and not meeting City policies and management’s expectations. RECOMMENDATION We recommend that the project team work with the vendor to establish “work arounds” for the security limitations and enhancement requests should be submitted for addressing these limitations. The City should obtain a concrete date and details for the enhancements from the vendor. The City should be in a position of power considering the vendor would like to obtain a positive reference. In the short term while an enhancement is developed, the City should determine how to “work around” the security limitations. • With regards to the password configuration limitation, the ITS Department intends on manually changing user passwords every ninety days to meet the City’s password policy. • There have been two potential alternatives discussed regarding limiting user access rights. One is to provide users with two user Ids – one with update capability to the screens and one with view/inquiry only capability to the other screens. The second option would be to provide users with reporting capability and may not need view to the screens.
MANAGEMENT COMMENTS/ACTION PROPOSED: The Kronos HRIS/PR administrative system does not automatically prompt a person to change his/her password in 90 days. The change in passwords will be part of ITS’s quarterly update process. The appropriate security is established within the Kronos HRIS/PR system. HR employees have various access based on their job functions and responsibilities. HR employees do not have access to process payroll.
City of Cape Coral – Kronos Pre-Implementation Review
11 (19)
Transcendent Group – January 2008
Appendix 1
8. Segregation of Duties AREA: OBSERVATION Based on our preliminary review of the anticipated users and access permissions there are several users with view capability to the system. However, it appears as though some of the users have access to more data than needed for their job responsibilities. It was not possible for us to perform a detailed review of users and access permissions for two reasons. First, some of the job functions (roles and responsibilities) are still being established (some are being redefined) and second, the security on the system has not been finalized as of the time of our review.
LEVEL OF RISK: 2 RISK Improper segregation of duties could lead to individual having inappropriate responsibilities and lead to transactions that are improper and unapproved. These transactions could also have a financial impact on the City. RECOMMENDATION Once the job roles and responsibilities for the entire HR, Benefits, and Payroll process are finalized by the project team, access permissions to the system should be assessed. This should be performed for all access permissions including users with view only capabilities. Although inquiry capabilities are not deemed high risk, the City still may not want certain users to have view access to almost all data. For example, the project team should determine if CSR’s working the front counter need to know benefit elections of employees, OSHA information, FMLA details, amounts deducted for 457 plans, along with garnishments and other deductions.
MANAGEMENT COMMENTS/ACTION PROPOSED: The appropriate security is established within the Kronos HRIS/PR system. HR employees have various access based on their job functions and responsibilities. HR employees do not have access to process payroll.
City of Cape Coral – Kronos Pre-Implementation Review
12 (19)
Transcendent Group – January 2008
Appendix 1
9. Choreograph Live Payroll Run AREA: OBSERVATION Based on discussions with members of the project team it appears as though the project team has developed a plan to ensure all appropriate resources are available during the first production payroll run. Key members from the Business (Payroll, HR, Benefits), the ITS Department, and the Vendor will be on-site and/or accessible in the event there are any unforeseen problems. This is certainly a prudent approach. However, it does not appear as though the team has developed a specific timeline, area of responsibility, and order of activities that need to be performed for the first payroll.
LEVEL OF RISK: 3 RISK Without documenting the steps necessary for the processing of the payroll and benefits, especially for a new system, all processes may not be performed or information may not be verified leading to the incorrect processing of the payroll and benefit withholdings. RECOMMENDATION We believe it would be in the best interest of the project team to choreograph the first payroll. This is due to the importance of having accurate paychecks for employees along with the fact a new system is being used in which some roles and responsibilities will potentially change from the prior system/process. Specifically, we recommend that a timeline be developed with the activities to be performed during the payroll processing cycle. This would include the order of activities that need to be performed and the control verifications, balancing, etc. along with the area of responsibility for each task. Documentation should be maintained that these steps were performed and the results of any verification. These results may be helpful during the debriefing / lessons learned meeting.
MANAGEMENT COMMENTS/ACTION PROPOSED: The Financial Services’ current detailed procedures (which include the steps necessary for payroll processing) surrounding the payroll process are documented; therefore we acknowledge and concur that procedures be documented. The Financial Services Department already had planned and does intend to document the detailed procedures and payroll processing cycle surrounding Kronos. A comprehensive parallel test run of the new system will be conducted by payroll personnel that will include testing all the interfaces, validating and verifying information, accurate calculations, and balancing.
City of Cape Coral – Kronos Pre-Implementation Review
13 (19)
Transcendent Group – January 2008
Appendix 1
10. Outstanding Action Items (Critical and High) AREA: OBSERVATION However, because the system is only a few weeks away from the go live date and these are coding issues that are important, we have highlighted them in this memo: • Not all pay codes have been entered into the system. There may be issues as to whether or not the system can handle these pay codes. Answers must be provided by the vendor in order for the project team to either test the solutions and/or develop alternative controls and processing if they cannot be performed by the system. • Not all benefit codes have been entered into the system and there may be issues on how these will be handled in Kronos (net vs. gross or percent or $ amount). • Employees in multiple FEIN’s (Charter Schools and City Employees) are not in the system. • Step plans, automatic pay increases
LEVEL OF RISK: 2 RISK There is a risk that the Vendor may not have all critical and high system functions available at the go “live” date. These functions will require “work arounds” along with the implementation of additional manual controls. RECOMMENDATION Items in the Project Workbook dated 11/28/07. We recommend that the project team take a “hard stance” with the vendor to obtain a concrete date for how these issues will be handled by the system. In addition, it will be important for the team to establish test scripts for testing these items. If for some reason the system cannot handle these items, then alternative controls and processing will need to be developed. For those employees where the team knows the payroll may not be correct, the payroll should be validated for these individuals and appropriate alternative action taken to ensure their pay is correct.
MANAGEMENT COMMENTS/ACTION PROPOSED: A Project Workbook was created at the beginning of the Kronos HRIS/PR implementation process. This Project Workbook includes an outstanding action items and issues list comprised of the application (HR, Payroll, ITS), priority (Critical, High, Medium), assigned to, description, target resolution, comments, and target completion date. This project workbook is posted on sharepoint with access to HR, ITS, and financial services. The City project manager e-mails completion of action items and issues to the Kronos project manager to update the project workbook. A comprehensive parallel test run of the new system will be conducted by payroll personnel that will include testing all the interfaces, validating and verifying information, accurate calculations, and balancing. The City will start using Kronos Payroll after completion of testing all interfaces and a comprehensive parallel test run. The City expects to be using Kronos Payroll with the first paycheck/direct deposit in February 2008.
City of Cape Coral – Kronos Pre-Implementation Review
14 (19)
Transcendent Group – January 2008
Appendix 1
11. Backups AREA: OBSERVATION At this point the backup process for the Kronos system will be incorporated into the current backup schedule for server systems. Based on our discussions with the ITS Department, there are no specific plans in place to perform any other backups during the processing of the first payroll so there will be multiple roll-back points available.
LEVEL OF RISK: 3 RISK Having backups performed at critical roll-back points during the first payroll process enables the City to possibly save time and/or not lose data if reprocessing was needed or unexpected problems occur. Without the multiple roll-back points the system would need to be recovered from the last full backup. Testing the recovery process for backups also gives the City a level of confidence that the backup process will work in the event a restore is necessary at some point. RECOMMENDATION Consider increasing the number of backups during the processing of the first payroll so there will be multiple roll-back points available. In addition, the ITS Department should consider performing a recovery/restoration of the Kronos backup tapes prior to the live production payroll run to ensure tapes can be restored.
MANAGEMENT COMMENTS/ACTION PROPOSED: To clarify: Kronos operates with the Microsoft SQL database. MS SQL provides real time Transaction Logging – which we have turned on. Should the system fail or crash during the first “live” run, we can restart from the last transaction completed (or even reset to a desired clock time) using the Transaction Log. So we don’t need to perform discrete intermediate back-ups as might be required with a less sophisticated recovery architecture – we basically have continuous transaction logging. This will be the case for all subsequent live runs – the first one is no different than any other in this respect.
City of Cape Coral – Kronos Pre-Implementation Review
15 (19)
Transcendent Group – January 2008
Appendix 1
12. Non-Kronos Related Action Items AREA: OBSERVATION During our discussions with members of the project team, it was noted that some of the action items are not Kronos system related items. This means that the items are either not to be addressed by the vendor or by the system. In addition, some of the items may need to be addressed prior to the “go live” date while others can be resolved after the first production payroll run. Some examples of these items include audit logging, backups, the establishment of new policies, procedures and controls, an internal communication plan, and others. Some of the key items in this non-Kronos action list have been documented as separate concern areas outlined in this memo / report. However, based on our review of the current Action Item Report in the Project Workbook dated 11/28/07 it appears as though not all of the non-Kronos related items have been identified and documented. MANAGEMENT COMMENTS/ACTION PROPOSED:
LEVEL OF RISK: 2 RISK There is a risk that some of the non-Kronos critical and high priority Action Items may not be if they are not recorded and tracked. RECOMMENDATION It is important for the project team to ensure a comprehensive action item list is documented and maintained for non-Kronos related items that still need to be completed either before implementation or after implementation. Once this list is developed, the project team should establish a timeline and assignment of responsibility to ensure each item is addressed.
A Project Workbook was created at the beginning of the Kronos HRIS/PR implementation process. This Project Workbook includes an outstanding action items and issues list comprised of the application (HR, Payroll, ITS), priority (Critical, High, Medium), assigned to, description, target resolution, comments, and target completion date. This project workbook is posted on sharepoint with access to HR, ITS, and financial services. This project workbook includes non-kronos related action items since they relate to the Kronos implementation.
City of Cape Coral – Kronos Pre-Implementation Review
16 (19)
Transcendent Group – January 2008
Appendix 1
13. Training AREA: OBSERVATION During our discussions with project team members of the system, it was determined that some of the users do not feel comfortable with their level of understanding of how to use the system. This is primarily because training for some of the HR and Benefits employees has not taken place for a variety of reasons.
LEVEL OF RISK: 3 RISK Untrained employees may not know how to properly use certain features of the system or incorrectly process transactions that could cause the payroll or benefits to be incorrect. RECOMMENDATION It is important that all key users of the HR and Payroll system are properly trained. This will reduce errors and omissions and frustration for employees if they are properly trained on the system. In the short term, since there is no training offered prior to the first production pay run, it will be important for the HR and Benefits employees to test and use the system in a test version so they can improve knowledge and use of the system. These users should take advantage of on-line training sessions, user groups, and on-line help to gain the necessary short term knowledge of the system. These employees should also ensure they sign up for the next available in person training courses offered by the vendor.
MANAGEMENT COMMENTS/ACTION PROPOSED: We concur and acknowledge that employees need to be trained on the Kronos system. Employees of Human Resources have taken advantage of on-line training sessions, on-line help, and have had training from a Kronos application consultant to gain knowledge surrounding the system. In addition, a test data base is set up for employees to utilize and gain a better understanding of the system. Employees will be attending on-site training courses offered by Kronos.
City of Cape Coral – Kronos Pre-Implementation Review
17 (19)
Transcendent Group – January 2008
Appendix 1
14. Future Phases of System AREA: OBSERVATION The Self Serve module of the Kronos system will be implemented after the payroll system goes live. However, at this point there is no detailed, documented project plan and timeline for the Self Serve module
LEVEL OF RISK: 3 RISK Developing a detailed project plan will ensure the intended system meets the needs of the city and that system requirements and project planning is performed in a timely manner for the proper implementation of this system. RECOMMENDATION We recommend that once the payroll system has been successfully implemented and any critical issues are addressed, the project team should develop a detailed, documented project plan and timeline for the Self Serve module. Some of the key items that the project team will need to address include: interfaces, security, training, call center for employee questions, etc.
MANAGEMENT COMMENTS/ACTION PROPOSED: We concur and acknowledge that the City will document a project plan and timeline to implement the SelfServe module.
City of Cape Coral – Kronos Pre-Implementation Review
18 (19)
Transcendent Group – January 2008
Appendix 1
15. Lessons Learned AREA: OBSERVATION As part of our final report, Transcendent Group intends on providing a list of lessons learned based on our exposure to this project. However, at this point we did not see anything in the project plan that states the project team plans on having a “lessons learned” meeting.
LEVEL OF RISK: 3 RISK Similar development/implementation problems and issues may be repeated by future City project teams adding to the cost or timeline of the project. These items can be avoided by documenting improvements and efficiencies that were learned from prior project implementations. RECOMMENDATION
We recommend that the project team conduct a lessons learned meeting after the payroll system goes live and the first production pay is processed. It is important that this meeting be performed in a timely manner so issues are not forgotten. In addition, it is important to have the broad internal project team members at this meeting to obtain comprehensive feedback. An independent person should be assigned responsibility for documenting all comments. These comments should then be summarized and shared back with the team. This will benefit the City for future system conversion / implementation projects. MANAGEMENT COMMENTS/ACTION PROPOSED: A Project Workbook was created at the beginning of the Kronos HRIS/PR implementation process. This Project Workbook contains a worksheet for lessons learned. The City had planned and is intending to have a “lessons learned” meeting after the Kronos payroll system has gone live.
City of Cape Coral – Kronos Pre-Implementation Review
19 (19)
Appendix 2
December 10, 2007
IT Controls Memo To:
City of Cape Coral Management, and Dona Newman City Auditor City of Cape Coral, Florida
From: Transcendent Group, Inc. 2909 W. Bay to Bay Blvd., Suite 208 Tampa, Florida 33629 Dona and City Management,
Background During the week of December 3, 2007, we met with several people from the City of Cape Coral regarding the planning and progress of the Kronos project. In particular we conducted meetings with the following people: • ITS o John MacLean, John Lison and Troy Watson • Human Resources o Wayne Howard, Angie Cline, Bonnie McFadden • Payroll o Linda Senne, Jill Luecke and Deana Watson In addition, we have reviewed the following documents: • Outstanding Issues Spreadsheet (Project Workbook dated 11/28/07) • Testing Spreadsheet • HTE Payroll Manual • Kronos Security Manual • Security Templates/Spreadsheets created by ITS
Results Upon review of the Kronos project, Transcendent Group has identified and was informed by the project team of risk items related to both functional and non-functional requirements of the system. Functional requirements have a direct impact on how the system works and processes data while non-functional requirements typically pertain to functions related to the control environment of the system. Examples of non-functional requirements include: audit logging, security, backup and recovery, etc. A small number of the risk items are functional in nature while a majority of the items are non-functional. We have also included two general recommendations to assist in making the first payroll run a little smoother and possibly less chaotic for all parties involved including employees. It does not appear as though there are any insurmountable items on our recommendation list. However, based on the large number of critical and City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
1(11)
Appendix 2
high priority action items along with several issues identified during this review, collectively they could cause problems with the project timeline, payroll run and/or balancing/reconciliation process. Specifically, the items that need to be addressed prior to the first payroll run are as follows: • • • •
Interfaces – some interfaces have either not been completed and/or tested. Test Results – ensure that all functions and data is properly tested, and process owners are aware of test results. Undocumented Action Items – there are a few outstanding items currently not in the project workbook. It is critical for them to be added and resolved by the team. Outstanding Action Items – these are key outstanding items that the City is waiting for the Vendor to provide solutions for and then must be tested.
We understand that a majority of items listed above are already known by the project manager and project team. However, at a minimum the project team needs to obtain concrete dates for solutions from the Vendor considering the implementation window is shrinking. The two items that are considered general recommendations to assist the project team in enabling a smoother payroll run are as follows: • •
Communication Plan – ensure there is proper communication to employees regarding the new system and checks, and to have a process in place for addressing employee questions/problems. Choreograph First Payroll Run – document the process, timeline, and responsible person for each task during the first payroll run.
Finally, the remaining items are considered non-functional in nature and lower risk as it relates to the ability of the City to successfully perform the first live payroll run. However, it is important to realize that some of these items are critical to the overall control environment for the entire payroll process and should be treated as priorities from a risk and control perspective. Many of these items have been listed as recommendations so the project team does not forget to address them either before or shortly after the system is implemented. • • • • • • • • •
Procedures Audit Logging and Exception Reporting Security Segregation of Duties Backups Non-Kronos Related Items Training Future Phases of the System Lessons Learned
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
2(11)
Appendix 2
Recommendations: Item
Description
Recommendation
Communication Plan
There is currently no documented plan for formally communicating to employees about the implementation of the new HR/payroll system resulting in a new paycheck format and what employees should do if there are questions or problems with their paycheck.
Despite the email response, we recommend that the team develop a formal communication plan to employees about the implementation of the new HR/payroll system resulting in a new paycheck format. This will ensure all members of the team are clear about expectations. The communication plan should include the following items: • Establish means for communicating to all employees (email, intranet (pass downs), letter / stuffer in paycheck, verbally through supervisors, etc.) • Encourage employees to review paycheck and details thoroughly to ensure accuracy • Inform employees who they should contact and how in the event there are questions or problems with their paycheck • The Team should establish a single point of contact for payroll issues • Establish a vehicle for ensuring all issues are logged and tracked along with corrective action taken. This will enable the team to determine if issues are unique to an individual, a group of employees or a broader issue A documented test plan should be developed to ensure all interfaces are tested. The plan should identify who will test the interface and how the data will be validated / reconciled.
In an email response from the project manager it was stated that Finance will prepare a memo to all employees that will be distributed to each employee along with their last pay check of the calendar year on December 20, 2007.
Interfaces
The Kronos system will have several interfaces, approximately 11 per discussion with the ITS department. Based on our review the following items exist related to interfaces: • The interfaces from the Kronos Payroll system to the HTE G/L and to Infosis for Charter Schools G/L were received the week of December 3rd. However, at the time of this memo the interfaces have not been tested. In addition, balancing by the Finance Department of the payroll related accounts and expense distribution
More specifically, the Team should ensure that the new interfaces received going to the two G/L systems (HTE and Infosis) are tested. Finally, the Team should obtain a firm commitment from Kronos as to when the interface to the Kronos Time and Attendance system on the iSeries machine will be delivered. Once 3(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Description
Recommendation
has yet to be performed. The interface from the Kronos Payroll system to the Kronos Time and Attendance system on the iSeries machine has not been completed as of the time of this memo. This is an interface the City is waiting for Kronos to complete. • There is no other documented test plan to ensure all interfaces are tested. The topic of testing has been documented in a Memo from Transcendent Group (John King) entitled “Cape Coral – 20071203 Memo v2” sent to the Team on Friday December 7th. This recommendation item provides additional detail to supplement the above memo. Based on our discussions with members of the project team the following items can be improved in the test area: • The testing worksheet is not being updated with the status of test results. Instead, only issues identified during testing are being documented. • There is limited communication of test results, action items added or removed, and testing status to the process owners (i.e. HR Manager and Benefits Manager). Process owners are not involved in testing (at the time of our visit). While their areas may be being tested, test results are not being communicated to them leaving them uncomfortable in knowing if their areas and concerns are being addressed. • Sign-off on the implementation of test results are not being formally performed by the Process Owner after proper verification. For example, information owners (Benefits and HR) have not balanced their information
this is delivered, the interface needs to be tested.
•
Test Results
Based on our discussions with project team members we recommend the following items be improved in the test area: • Testing worksheet should be updated with the status of test results. Completion of this document would ensure all tests are being performed and the status of the testing can be easily viewed by all parties. • There should be more communication of test results, action items added or removed, and testing status to the process owners (i.e. HR Manager and Benefits Manager). • Sign-off on the implementation of test results should be performed by the Process Owner after proper verification. This will enable these individuals to be comfortable with the processing and reporting controls over their information. • Various test scenarios should be documented to ensure that all items are covered. Testing should be comprised both good and bad data to ensure the system processes both good and bad data as expected.
4(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Undocumented Action Items
Procedures
Description
Recommendation
that is in the Kronos system to either HTE or other system reports to ensure benefit information is correct, payroll withholdings balance to withholdings and withholdings in payroll balances to vendor invoices. • Test scenarios are not being documented to ensure that all items are covered Testing is being performed on test data that currently resides in the test database. Based on our review of the Action Item Report in the Project Workbook dated 11/28/07 there were several outstanding items communicated to us by members of the project team that could not be located in the Action Item Report. They include the following: • Life to date pension totals printed on checks • Group Term Life imputed income • Building of 5 additional 457 codes to accommodate the % election option • Tracking of arrears - Handling of negative balances and the priority of deductions • Pension calculators – can Kronos handle calculations on gross salary? • Handling of Accruals o PTO o Comp Time, Seasonal Bank, Swap Shift • Handling of “add pays” – how will the system handle expiration date for certifications and testing this feature • Will the Kronos system be able to handle expense distribution for budgeting purposes on the G/L side? This is asked since Kronos is set up at a position level and not an FTE level. Because this project is a pre-implementation review and not an
We recommend that the project team improve communication with team members to ensure all outstanding action items are in the Project Workbook, especially the items noted in this observation. In addition, ensure the items have been appropriately prioritized, addressed with the vendor, properly assigned responsibility, a specific completion date has been established, and testing plans are developed.
We understand that the project team intends on developing 5(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Description
Recommendation
audit we understand that most of the project team’s focus has been concentrated on conversion, testing, and preparation for the first live payroll run. Less emphasis has been placed on establishing new procedures in the payroll process. Some roles and responsibilities will be changing which is why new controls and procedures need to be developed.
comprehensive controls and procedures associated with the new payroll process. Therefore, this recommendation is being provided as a reminder for the project team to develop well-documented controls and procedures to ensure adequate controls are in place to either prevent or detect any errors or inappropriate activities associated with the HR, Benefits, and Payroll processing efforts at the City. It is ultimately the responsibility of the organization to ensure a comprehensive approach is followed to address controls. However, the listing below is an overview of some of the key controls and procedures that should be in place: • Balancing of Interfaces • Appropriate segregation of duties (both manual and systematically) • Balancing is performed for benefits • Balancing is performed for all general ledger postings • Only valid and approved employees are entered into the system • Appropriate audit logging and exception reporting to investigate irregularities • Only valid and correct deductions are selected and taken from employee paychecks • Payroll checks are accurate and complete • Control is maintained over check stock • Appropriate backup and recovery procedures We recommend that the project team develop a plan for identifying which fields to log and the creation of exception reports. There are several critical items that should be taken into account during this process: • The business should drive the discussion and communicate their needs to ITS
New procedures may not be developed until after the first production payroll run. Regardless, it is still important to ensure minimal controls, procedures and document are in place to ensure the first few payrolls are accurately completed until more comprehensive procedures and documentation is developed.
Audit Logging and Exception Reporting
As of the date of our on-site review, there was some confusion about the status of audit logging and exception reporting. Some team members were under the impression that audit logging had been activated. The reality is that the audit logging was not activated at this point on the production system for tracking any changes to master files and data. In addition, the project team
6(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Description
Recommendation
had not developed a plan for identifying which fields to log and the creation of exception reports.
Security
Based on our discussions with members of the project team including the ITS department, there appears to be limitations associated with the security of the Kronos system. The limitations include the following: • Password configuration settings do not meet the City’s policy on password configuration. Users are not automatically forced to change passwords every ninety days and do not have the ability to change their password. In addition, the system does not have the ability to take action after a specified number of unsuccessful logon attempts. • Data entry screens contain both HR and Payroll data and each department needs to view this data. However, to view the data on a screen would also give update to this information. The alternatives are to: o Provide two ID’s one for inquiry only and one with their update capabilities. o Another option would be to provide users with reporting capability and may not need view access to the screen.
•
It is not a good idea to log all fields because of the potential impact on system performance. Instead, the focus should be placed on critical data and master files • Audit logs are a good tool for research purposes. The organization should consider generating exception reports when critical data and master files are changed. The reports should be reviewed to ensure the changes are valid. If they are not, then the logs are valuable in researching who made the change, the date, before values, etc. We recommend that the project team work with the vendor to establish “work arounds” for the security limitations and enhancement requests should be submitted for addressing these limitations. The City should obtain a concrete date and details for the enhancements from the vendor. The City should be in a position of power considering the vendor would like to obtain a positive reference. In the short term while an enhancement is developed, the City should determine how to “work around” the security limitations. • With regards to the password configuration limitation, the ITS Department intends on manually changing user passwords every ninety days to meet the City’s password policy. • There have been two potential alternatives discussed regarding limiting user access rights. One is to provide users with two user Ids – one with update capability to the screens and one with view/inquiry only capability to the other screens. The second option would be to provide users with reporting capability and may not need view to the screens. 7(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Description
Recommendation
Segregation of Duties
Based on our preliminary review of the anticipated users and access permissions there are several users with view capability to the system. However, it appears as though some of the users have access to more data than needed for their job responsibilities.
Once the job roles and responsibilities for the entire HR, Benefits, and Payroll process are finalized by the project team, access permissions to the system should be assessed. This should be performed for all access permissions including users with view only capabilities. Although inquiry capabilities are not deemed high risk, the City still may not want certain users to have view access to almost all data. For example, the project team should determine if CSR’s working the front counter need to know benefit elections of employees, OSHA information, FMLA details, amounts deducted for 457 plans, along with garnishments and other deductions. We believe it would be in the best interest of the project team to choreograph the first payroll. This is due to the importance of having accurate paychecks for employees along with the fact a new system is being used in which some roles and responsibilities will potentially change from the prior system/process. Specifically, we recommend that a timeline be developed with the activities to be performed during the payroll processing cycle. This would include the order of activities that need to be performed and the control verifications, balancing, etc. along with the area of responsibility for each task. Documentation should be maintained that these steps were performed and the results of any verification. These results may be helpful during the debriefing / lessons learned meeting. Again, these items have been documented as outstanding Action Items in the Project Workbook dated 11/28/07. We recommend that the project team take a “hard stance” with the vendor to obtain a concrete date for how these issues will be handled by the system. In addition, it will be important for the team to establish test scripts for testing these items.
Choreograph Live Payroll Run
It was not possible for us to perform a detailed review of users and access permissions for two reasons. First, some of the job functions (roles and responsibilities) are still being established (some are being redefined) and second, the security on the system has not been finalized as of the time of our review. Based on discussions with members of the project team it appears as though the project team has developed a plan to ensure all appropriate resources are available during the first production payroll run. Key members from the Business (Payroll, HR, Benefits), the ITS Department, and the Vendor will be on-site and/or accessible in the event there are any unforeseen problems. This is certainly a prudent approach. However, it does not appear as though the team has developed a specific timeline, area of responsibility, and order of activities that need to be performed for the first payroll.
Outstanding Action Items (Critical and High)
The following two items are documented as outstanding Action Items in the Project Workbook dated 11/28/07. Therefore, the project team has done a good job identifying these items. However, because the system is only a few weeks away from the go live date and these are two coding issues that are important, we have highlighted them in this memo: • Not all pay codes have been entered into the system.
8(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Backups
Non-Kronos Related Action Items
Description
Recommendation
There may be issues as to whether or not the system can handle these pay codes. Answers must be provided by the vendor in order for the project team to either test the solutions and/or develop alternative controls and processing if they cannot be performed by the system. • Not all benefit codes have been entered into the system and there may be issues on how these will be handled in Kronos (net vs. gross or percent or $ amount). • Employees in multiple FEIN’s (Charter Schools and City Employees) are not in the system. • Step plans, automatic pay increases At this point the backup process for the Kronos system will be incorporated into the current backup schedule for server systems. Based on our discussions with the ITS Department, there are no specific plans in place to perform any other backups during the processing of the first payroll so there will be multiple roll-back points available.
If for some reason the system cannot handle these items, then alternative controls and processing will need to be developed. For those employees where the team knows the payroll may not be correct, the payroll should be validated for these individuals and appropriate alternative action taken to ensure their pay is correct.
During our discussions with members of the project team, it was noted that some of the action items are not Kronos system related items. This means that the items are either not to be addressed by the vendor or by the system. In addition, some of the items may need to be addressed prior to the “go live” date while others can be resolved after the first production payroll run. Some examples of these items include audit logging, backups, the establishment of new policies, procedures and controls, an internal communication plan, and others.
Consider increasing the number of backups during the processing of the first payroll so there will be multiple roll-back points available. In addition, the ITS Department should consider performing a recovery/restoration of the Kronos backup tapes prior to the live production payroll run to ensure tapes can be restored.
It is important for the project team to ensure a comprehensive action item list is documented and maintained for non-Kronos related items that still need to be completed either before implementation or after implementation. Once this list is developed, the project team should establish a timeline and assignment of responsibility to ensure each item is addressed.
Some of the key items in this non-Kronos action list have been documented as separate concern areas outlined in this memo / 9(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Training
Description
Recommendation
report. However, based on our review of the current Action Item Report in the Project Workbook dated 11/28/07 it appears as though not all of the non-Kronos related items have been identified and documented. During our discussions with project team members of the system, it was determined that some of the users do not feel comfortable with their level of understanding of how to use the system. This is primarily because training for some of the HR and Benefits employees has not taken place for a variety of reasons.
Future Phases of System
The Self Serve module of the Kronos system will be implemented after the payroll system goes live. However, at this point there is no detailed, documented project plan and timeline for the Self Serve module.
Lessons Learned
As part of our final report, Transcendent Group intends on providing a list of lessons learned based on our exposure to this project. However, at this point we did not see anything in the project plan that states the project team plans on having a “lessons learned” meeting.
It is important that all key users of the HR and Payroll system are properly trained. This will reduce errors and omissions and frustration for employees if they are properly trained on the system. In the short term, since there is no training offered prior to the first production pay run, it will be important for the HR and Benefits employees to test and use the system in a test version so they can improve knowledge and use of the system. These users should take advantage of on-line training sessions, user groups, and on-line help to gain the necessary short term knowledge of the system. These employees should also ensure they sign up for the next available in person training courses offered by the vendor. We recommend that once the payroll system has been successfully implemented and any critical issues are addressed, the project team should develop a detailed, documented project plan and timeline for the Self Serve module. Some of the key items that the project team will need to address include: interfaces, security, training, call center for employee questions, etc. We recommend that the project team conduct a lessons learned meeting after the payroll system goes live and the first production pay is processed. It is important that this meeting be performed in a timely manner so issues are not forgotten. In addition, it is important to have the broad internal project team members at this meeting to obtain comprehensive feedback. An independent person should be assigned responsibility for documenting all comments. These comments should then be summarized and shared back with the team. This will benefit the City for future system conversion / 10(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 2
Item
Description
Recommendation implementation projects.
11(11)
City of Cape Coral – Kronos HR and Payroll System
CONFIDENTIAL
Appendix 3
December 3, 2007
Memo To:
City of Cape Coral Management, and Dona Newman City Auditor City of Cape Coral, Florida
From: John King Transcendent Group, Inc. 2909 W. Bay to Bay Blvd., Suite 208 Tampa, Florida 33629 Dona and City Management,
Executive Summary Upon recent review of the Kronos project, Transcendent Group has a few concerns that may affect the current timeline. There are no insurmountable critical items, but there are two items in particular that require attention: • Test planning • Prioritization of outstanding action items, leading toward a “Go / No-Go” decision There are several small items, as well. The remainder of this document provides details for all items found during the recent review. All items listed include recommendations as to how each should be addressed. Transcendent Group strongly recommends the City address each of these items as soon as possible. The remainder of this memo will cover two things: 1. A Background description of the review process. 2. The Items Requiring Action or Follow-up that must be addressed to ensure a successful deployment.
12/11/2007
Page 1 of 5 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Background On Monday, December 3, 2007, I met with several people from the City of Cape Coral regarding the planning and progress of the Kronos project. In particular I met with the following people: • John MacLean, Director of ITS • Wayne Howard, Human Resources Director • Angela Cline, HR • Linda Senne, Deputy Financial Services Director, Jill Luecke, Deana Watson, Payroll • John Lison and Troy Watson, ITS In addition, I have reviewed the following documents: • Kronos’ response to City of Cape Coral’s RFP • City of Cape Coral SSLSA (contract document) • Professional Services Engagement Estimate (dated 12/20/2006) • Kronos Order Form • Product Design document version 1.3 (produced by Kronos) • Problem List (created by CCC outlining problems found in Product Design document) • Launch spreadsheets (produced by Kronos) • Kronos Project Workbook (dated 11/12/2007) • City of Cape Coral Testing Workbook HRPR v1
Detailed Recommendations Again, we identified two key areas at this time that require attention. Test Planning First, some test planning has been completed. In particular, three areas of testing were identified: • Ledger balancing based on parallel testing (test environment versus production) • Some functional testing, as identified in the Testing Workbook provided by Kronos • Interface testing Some of the above testing has been completed and some has yet to be started. Shortfalls of testing that are currently underway or planned include: • The parallel testing approach being employed provides an enormous sample size for test scenarios since all checks (ledger entries) are being created and validated. However, it is possible that there are some scenarios, or even many scenarios, that are not included in the testing. Examples could include the following scenarios: o A hire midway through the pay cycle o A termination midway through the pay cycle o An employee taking time off without pay o Seasonal employees that are not receiving checks this season o There are three categories of employees, referenced later, that are definitely not included in the test 12/11/2007
Page 2 of 5 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
The result of potentially not testing every scenario is that when the ledgers in the two environments balance, “victory” may be declared, yet not all scenarios have been tested. This is sometimes termed a “false positive.” Later, in production when an untested scenario occurs, one or many erroneous checks may be printed. •
The Testing Workbook identifies Test Scenarios, which is good. Further, it identifies Expected Outcomes, which is better. However, the same workbook has a level of detail that is too coarse-grained. For instance: o “Every employee is attached to appropriate position” o “Ensure that a Terminate Employee Action meets client’s needs and requirements.” Without enumerating all the possible Scenarios, and corresponding Expected Results, the City cannot be certain that the software will work correctly for all real-life scenarios, or even support various combinations at all. The current set of Test Scenarios in the Testing Workbook cover the “most likely outcomes in the most likely situations.” That leaves a substantial number of “outlier situations” not included in the planned testing.
•
The interface testing is being performed in absence of a documented plan. I did not see a comprehensive list of interfaces and testing plans for each, nor did I see a test plan that shows a comprehensive test including all inbound interfaces and all outbound interfaces, all in one test. It is not a good idea (from a best practice perspective) to have the first time a complete payroll cycle with all inbound and outbound interfaces be the first real production run of payroll.
In addition to the above, the following testing-related items were identified: •
Performance testing has not been planned. We heard second hand that Kronos stated turning on logging could negatively impact performance of the application (and worst case could “crash” the system). This could be based on how much logging is turned on. However, specifics were not provided to us. It is important to understand expected response times, for instance, if logging is turned on.
•
Recovery tests have not been planned, to the best of our knowledge. Backups are planned, but proving that the City has the ability to completely recover using those backups has not.
Recommendations for Test Planning: Transcendent Group has several recommendations: • In addition to the current parallel testing, identify additional potential real life scenarios and test for those, as well. • Consider reviewing the Testing Workbook and adding detail. The goal is to get it to a point where there are no vague Test Scenarios or Expected Outcomes. This will likely result in decomposing a vague, higher-level Test Scenario into several detailed Test Scenarios. Also include “out of the ordinary” (both good and bad data) Test Scenarios.
12/11/2007
Page 3 of 5 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
•
• •
Create an Interface Testing tab in the Testing Workbook. (Note this is partially, very simplistically treated in the Deployment Validation tab.) That tab should list each interface, specific test criteria for each interface, and the plan for a comprehensive test run that includes all inbound and outbound interfaces. Immediately determine what types of logging will be performed in the production environment. Turn those logs on in both current environments and monitor the change in end user and batch performance / experience. Plan a recovery test in some offline environment to ensure that with some catastrophic incident the City will be able to recover and continue running the Kronos application.
Prioritization of Outstanding Action Items In the Project Workbook there is a tab called Open Action Items. That tab contains 44 action items (as of 11/28). Each action item has a corresponding Priority, either blank, low, medium, high, or critical. The breakdown follows: Priority Critical High Medium Low Blank Total
Count 10 22 7 2 3 44
The concern is that there is not a clear definition of the difference between the various priorities, and that there is not an “above the line / below the line” way of distinguishing what action items must be included or addressed prior to deployment and what action items can be addressed AFTER deployment. We believe it is highly unlikely that all of the items will be addressed and closed before the target “go live” date based on the sheer number of outstanding action items, the length of time some have been outstanding, and the overall level of effort to complete some of the items. Recommendation: The City should create a clear definition of what each Priority means. Clearly identify which action items MUST be completed prior to going live and which can wait. This will be a long negotiation process, so starting sooner is better.
12/11/2007
Page 4 of 5 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Other Issues and Recommendations Additional items and recommendations are listed below: • Progress on several action items is being captured in emails. It is important to make sure all action items are listed and tracked in the Action Item tab of the Project Workbook. • There are at least three different types of City employees that according to HR will be difficult to correctly set up in Kronos. The City should perform contingency planning, such as manual checks, to determine how those employees will be handled in the event a correction is not available before going live. • It has not yet been determined what level of logging will be used in the production system. A determination should be made with the help of Kronos, possibly by viewing the types of logging reports that would be available, so that testing can be performed with logging turned on.
12/11/2007
Page 5 of 5 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Appendix 4
September 21, 2007
Memo To:
City of Cape Coral Management, and Dona Newman City Auditor City of Cape Coral, Florida
From: John King Transcendent Group, Inc. 2909 W. Bay to Bay Blvd., Suite 208 Tampa, Florida 33629 Dona and City Management,
Executive Summary I have reviewed what I believe to be the most recent update to the Kronos Project Workbook (titled Project Workbook 09-17-07.xls, with a “Project Summary as of” date of 9/4/2007, as noted on the Project Summary tab of the workbook). The above referenced workbook serves three purposes: 1. Status For instance, the first tab of the workbook lists various parts of the project, such as budget and schedule, and provides a “red / yellow / green” high level status. 2. Planning The first tab also lists milestones with corresponding “scheduled” and “actual” dates. Subsequent tabs document the project calendar, training plans, and other types of planning items. 3. Tracking Subsequent tabs also list change requests, open action items, and project decisions. Based both on my discussions with City of Cape Coral employees and on the breadth of coverage provided by the workbook, it is clear that Kronos uses the Project Workbook as the cornerstone project management document / tool. My concern is that a substantial amount of information in the Project Workbook is either null, template (no details for The City of Cape Coral as a client), or stale. Although a few areas are filled out quite well, and a new tab has recently been added, the other tabs of the workbook should be filled in, as well. Note that as I open the Project Workbook it attempts to link to a remote workbook. I have been unable to determine which tabs / cells are attempting to update, and so I also cannot determine if additional information is being added to the Project Workbook based on that link. Apparently the links go to the desktop of someone with a user ID of tkirkman. 12/11/2007
Page 1 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
In summary, there are 19 tabs in the Project Workbook. Below is my best estimate of the breakdown of information on each tab: State of Information Information appears at least somewhat up-to-date:
Number of Tabs 6
Information exists but it is clearly stale:
5
Information is Kronos template data and does not reflect The City of Cape Coral’s project, or the information is null:
8
Total Tabs:
19
Details of what I found in each tab, and occasional recommendations, are found in the following sections of this memo. In summary, if updated regularly the Project Workbook document serves as the track record for the project. In other words, at the conclusion of the project, everything in the Project Workbook document will be in the past. This memo is NOT suggesting that I see a potential problem with delivery. However, this memo is pointing out that should a problem with non-delivery arise and The City of Cape Coral finds arbitration a necessary step, then a well-documented Project Workbook will be the single best source of information for such an event. In order for The City of Cape Coral to mitigate such a risk, all tabs of the Project Workbook should be kept up to date. In addition, the lack of detailed project management information makes ascertaining an accurate status difficult, in turn making detailed recommendations or remedies more difficult. Please see the remaining sections for more details. Thank you. John King
12/11/2007
Page 2 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Tab-Specific Information Each of the following section relates to exactly one tab in the Project Workbook 09-1707.xls document.
Project Summary Tab • All “Overall High Level Status” items are marked green and “On Target.” Without supporting detail it is difficult to validate this status. • It appears the remainder of the tab has not yet been populated. o Escalated Issues, Risks, and Change Requests have not been filled in. This may be correct information, as none have been “Escalated.” o Professional Services Budget (in hours) by Resource contains budgeted hours, but not actual hours. • Recommendation: o At a minimum, have Kronos track the actual hours to budgeted hours on this tab. Contact Information Tab • This tab appears to be up to date. Tasks Tab This is a new tab – it was not in the previous version of the spreadsheet. It shows task, start date, complete date, and assignment. • This is a good list of detailed assignments. • Many task assignments are listed at the team name level. • Some of the tasks have an overlap of information that is on other tabs. • Recommendations: o Some of the tasks are granular enough that The City of Cape Coral should assign them to an individual instead of a team to ensure accountability. o The Task Tab in general is a much more detailed view of the Calendar Tab. The Calendar Tab should still be kept up to date to allow a high level view of major project activities. It appears the Calendar Tab is also being updated. o One area of overlap of tasks with another tab is in training. I strongly suggest that training items are moved to the training tab, even if they are duplicated, so that The City of Cape Coral will have a single page to review that comprehensive training (who, when, etc.) will be complete instead of sifting through more than 200 tasks in the Tasks Tab to find training line items. Calendar Tab • This tab appears to be up to date.
12/11/2007
Page 3 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Change Requests Tab • This tab appears to be stale. • Recommendation: o This tab tracks change requests as they go through the change request cycle (as noted by Priority and Status columns), not just the approved change requests. Maintain the change request Tab with all change requests. Open Action Items Tab Not knowing the Kronos methodology, it is unclear what items become “action items” versus “tasks” or some other denotation. • There are many OPEN action items dating back to the beginning of the project (February 2007). • There are four action items from August and September, indicating this tab is being used to some extent. o Of the four more recent items, the “Assigned To” column contains one blank and one “Team” • Recommendations: o Regularly use and review the Action Items Tab according to Kronos’ methodology. o Provide a single name in the “Assigned To” column to ensure accountability. Closed Action Items Tab • Very few items, possibly two, have been added to the Closed Action Items Tab since August. • Most of the items in the Closed Action Items Tab have a blank in the “Closed Date” column. • There is no standard way to show who from The City of Cape Coral agreed that the action item should be closed. • Recommendations: o Regularly use and review the Action Items Tab according to Kronos’ methodology. o Always fill in the “Closed Date” column for closed items. o List in the “Comments” column who from The City of Cape Coral agreed that the item should be closed. Custom Tab The Custom Tab contains identified reports and interfaces that will be customized specifically for The City of Cape Coral. • Based on information on the tab it appears that The City of Cape Coral identified nine custom items on August 1, 2007. • No new custom items have been added to the tab since then. • Kronos appears to have formally responded to only two of the items as of September 14, 2007, six weeks after the initial identification. • Therefore, it appears this tab contains stale data. • Recommendation: 12/11/2007
Page 4 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
o Work with Kronos to ensure all custom work is identified on the Custom Tab. Training Plan Tab • The Training Plan Tab information is null. • Recommendation: o Complete the Training Plan Tab. Training Budget Tab • The Training Budget Tab information is null. • Recommendation: o Complete the Training Budget Tab. Project Decisions Tab • This tab is stale. • Recommendation: o Complete the Project Decisions Tab if this is a key component of Kronos’ methodology. Risk Management Tab • This tab is stale. • Recommendation: o Complete the Risk Management Tab. Risk Assessment Tab • This tab contains template data. • Recommendation: o Complete the Risk Assessment Tab if this is a key component of Kronos’ methodology. Lessons Learned Tab • This tab is null. • Recommendation: o Complete the Lessons Learned Tab at the conclusion of each project phase if this is a key component of Kronos’ methodology. Customer Plan Phase Ck Tab • This tab is stale. • Recommendation: o Complete the Customer Plan Phase Ck Tab if this is a key component of Kronos’ methodology.
12/11/2007
Page 5 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Customer Assess Phase Ck Tab • This tab is null. • Recommendation: o Complete the Customer Assess Phase Ck Tab if this is a key component of Kronos’ methodology. Customer Sol Bid Ck Tab • This tab is null. • Recommendation: o Complete the Customer Sol Bid Phase Ck Tab if this is a key component of Kronos’ methodology. Customer Test Certify Phase CK Tab • This tab is null, which is probably appropriate at this phase of the project. • Recommendation: o Complete the Customer Test Certify Phase Ck Tab at the correct point in the project if this is a key component of Kronos’ methodology. Customer Deploy Phase Ck Tab • This tab is null, which is probably appropriate at this phase of the project. • Recommendation: o Complete the Customer Deploy Phase Ck Tab at the correct point in the project if this is a key component of Kronos’ methodology.
12/11/2007
Page 6 of 6 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Appendix 5
August 23, 2007
Memo To:
City of Cape Coral Management, and Dona Newman City Auditor City of Cape Coral, Florida
From: John King Transcendent Group, Inc. 2909 W. Bay to Bay Blvd., Suite 208 Tampa, Florida 33629 Dona and City Management,
Executive Summary Upon review of the Kronos project, Transcendent Group is concerned about the City’s ability to successfully deploy the application based on the current timeline. There is no one single critical item, but rather an accumulation of medium items that warrants a high level of concern. Specifically, the medium items are: • Lack of agreement between Kronos and CCC on requirements that are in scope, and Kronos’ ability to deliver on the requirements, as reflected in Kronos’ Product Design document. • Lack of planning and / or detailed instructions regarding data migration from current systems to Kronos systems. • Plans for an HR “Proof of Concept” that are not in line with what was outlined in Kronos’ RFP response, and that will likely fall short of what the City needs in a “Proof of Concept”. • Lack of planning / coordination for testing, in particular with regards to different testing needs between HR and Payroll (Finance). There are several other small items, as well. The remainder of this document provides details for all items found during the recent review. All items listed include detailed recommendations as to how each should be addressed. Transcendent Group strongly recommends the City address each of these items as soon as possible. Many of these items will require the City (and the City’s Project Manager) to take a firm stance with the vendor. The remainder of this memo will cover three things: 1. A Background description of the review process. 2. My understanding of the current Schedule and Status of the project based on what I have learned in various phone calls and meetings, and from reviewing the documents. 3. There are numerous Items Requiring Action or Follow-up that must be addressed to ensure a successful deployment. Each of those items will be listed, as well. 12/11/2007
Page 1 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Background On Thursday, August 16, 2007, I met with several people from the City of Cape Coral regarding the planning and progress of the Kronos project. In particular I met with the following people: • Meeting 1 – ITS o John MacLean, Director of ITS o Bryon Maine, IT Manager o Fidel DeForte • Meeting 2 – Human Resources o Wayne Howard, Human Resources Director o Angela Cline o Beverly Sample • Meeting 3 – Payroll o Linda Senne, Deputy Financial Services Director o Jill Luecke In addition, I have reviewed the following documents: • Kronos’ response to City of Cape Coral’s RFP • City of Cape Coral SSLSA (contract document) • Professional Services Engagement Estimate (dated 12/20/2006) • Kronos Order Form • Product Design document version 1.3 (produced by Kronos) • Problem List (created by CCC outlining problems found in Product Design document) • Launch spreadsheets (produced by Kronos)
Schedule and Status The following table shows a high level outline of the key project schedule items: Schedule Area
Status
Description
Production Environment
Installed in ITS
Testing Environment
Time TBD
Software Configuration
Product Design document created by Kronos reflects CCC requirements Kronos has supplied “launch spreadsheets” to capture data
Hardware ready. Kronos software installed (not configured). Will initially be used for the HR test environment. Appears to be overlapping needs for testing. John MacLean is aware of a complex test schedule. Several issues have been identified and forwarded to Kronos. Instructions have been received but are unclear. Timing, which is critical, is unknown. Instructions have not been received. Timing, which is critical, is unknown. Kronos has proposed a walk thru with 20 test subjects, meaning Kronos will enter the 20 new users while Cape Coral employees watch and validate that functionality is working properly.
Data Migration – HR
Data Migration – Payroll Proof of Concept – HR
Proof of Concept – Payroll
Kronos has supplied “launch spreadsheets” to capture data Time TBD. No details regarding environment, etc.
Not planned
12/11/2007
Page 2 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area
Status
Description
Testing – HR
Oct 1 – Dec 31
Testing – Payroll
Nov – Dec
Training – HR
Time TBD
Training – Payroll
Time TBD
Planned Start – HR
October 1, 2007
Planned Start – Payroll
January 1, 2008 (Actually January 3 payroll run)
HR’s “testing environment” will become the production environment. Currently planning three payroll runs – last three payroll runs of the year – in a parallel test with current production environment. Will compare / validate ledger entries to determine if Kronos run is correct. There are vague plans around training. Apparently Kronos is requesting that training happen at Kronos’ facilities. There are vague plans around training. Apparently Kronos is requesting that training happen at Kronos’ facilities. Will require dual entry of data as current HR system remains live until Dec 31, 2007. Clean start for W-2 information at the beginning of the year. Partial first pay period.
Items Requiring Action or Follow-Up The following require immediate attention or clarification: Schedule Area: Production Environment Item
Description
Recommendation
Insecure Remote Access
The Kronos architecture does not allow for secure remote access. Some of the selfservice features available today OUTSIDE Cape Coral’s firewall, but within the DMZ, will not be available after the Kronos golive date.
John MacLean was already aware of this problem and is working to resolve it. This item is included for informational purposes.
NeoGov Functionality
NeoGov is currently used for housing job descriptions and for applicant tracking. There is a substantial difference in the business process supported by Kronos and NeoGov. In short, current Kronos functionality will not work.
Wayne Howard says he is planning on retaining current NeoGov functionality. CCC should perform a long-term cost analysis to compare continued NeoGov support costs (personnel, licensing, etc.) to replacement costs or modifications to Kronos modules.
12/11/2007
Page 3 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area: Test Environment Item
Description
Recommendation
Test Environment Planning appears to have issues
ITS has two environments, as recommended by Kronos—a production and a test environment.
First, the Professional Services Estimate states that a test plan will be developed during the Assessment Phase of Kronos’ Momentum method. To our knowledge no detailed test plans depicting time and environment needs has been developed. Momentum documentation states that such a test plan is to be developed by CCC with the assistance of Kronos. (See page 11)
HR plans to use an environment to perform initial HR testing, then have that environment become production as of January 1, 2008. In other words, HR intends to use 4Q2007 to prepare live data in the Kronos environment. For some portion of 4Q2007 HR will be entering transactions in two environments—current production AND the Kronos environment— to ensure both are in synch on January 1, 2008. There are several problems: 1. Payroll needs to perform the “test payroll runs” in an environment that contains production-like data, but HR may not be done migrating / entering data to make the Kronos environment completely in synch with production at the time Payroll needs to run the first test (mid-November). 2. If Payroll performs a “test payroll run” in the environment HR is using (the environment that will become the Kronos production environment), there will be 2006 W-2 data in the production environment.
The test plan needs to address the conflict between HR testing needs and Payroll testing needs. In short, one of the following will have to occur: 1. The second Kronos environment installed and configured by ITS is used by Payroll for “test payroll runs.” To keep such an environment in synch so that ledger validations will match production, HR will be required to perform triple-entry of data—current production, HR Kronos test / to-beproduction, Payroll Kronos test. (Notes: Kronos may be able to provide assistance by way of logging transactions in one environment and then applying them to the second, or by way of backing up from one environment then restoring to the other. Please check with Kronos to determine what kind of support they can provide.) 2. “Test payroll runs” are performed in the HR test environment, then the payroll run data is “backed out”. (Note: Possibly a full backup can be taken just prior to the payroll run, then restored after the payroll run is complete and reports are completed. However, in this approach the “test payroll run” environment goes away, and problems found during validation cannot be researched. Please check with Kronos to determine what kind of support they can provide.)
12/11/2007
Page 4 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area: Software Configuration Item
Description
Recommendation
Problems with Kronos’ Design Document
Kronos has prepared a Design Document outlining how the Kronos application will be configured. 1. There are several items in the document that do not reflect CCC requirements as previously given to Kronos 2. Some functionality identified by CCC in meetings, and agreed to by Kronos, is apparently not supported by Kronos software 3. Several items important to CCC are listed as “out of scope” 4. Kronos is stating that CCC must sign off on the document for things to continue, however see bullet (5). 5. Several CCC employees have stated they are not comfortable signing off as the content is not easy to understand, so they don’t know what questions to ask
Once sign-off on the Design Document happens the change order process begins for any functionality changes. Each issue identified by CCC should be addressed prior to signing, regardless of the impact to the overall schedule. (In other words, do not rush to hit the date in exchange for not getting required functionality.) Issues that cannot be addressed by the Kronos implementation team should be escalated as necessary.
Schedule Area: Data Migration Item
Description
Recommendation
Data Migration Instructions
Kronos has delivered two sets of Launch Spreadsheets to support data migration— one for HR and one for Payroll. CCC personnel are supposed to fill in the Launch Spreadsheets as one part of the Data Migration effort.
Detailed instructions for filling in the Launch Spreadsheets have not been received. For HR, there is a sign-off checklist listing “required” and “optional” spreadsheets that CCC must fill out. In addition, there are instructions specifically for HR Position Codes. There are no instructions for Payroll. Kronos needs to provide detailed instructions.
Data Migration Plans
There are no detailed plans or outlines of the data migration strategy. The Kronos “schedule” (a series of spreadsheets) references some data migration events and milestones, but does not provide a plan, strategy, or instructions. It is currently not clear to Transcendent Group if ITS is participating by populating the launch spreadsheets in an automated fashion.
CCC should require that Kronos provide a plan for data migration. The plan should include: 1. Timing for data collection from current systems 2. Timing for loading data into Kronos applications 3. Strategy for tracking transactions that occur between (1) and (2) above, to keep data in synch 4. Strategy to ensure dual entry is completed properly
12/11/2007
Page 5 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area: Proof of Concept Item
Description
Recommendation
Proof of Concept Goals – HR
Kronos has proposed an HR walk thru with 20 test subjects, meaning Kronos will enter the 20 new users while Cape Coral employees watch and validate that functionality is working properly.
According to the Kronos RFP Response, page 34, the Proof of Concept is the last opportunity that CCC has to cancel the contract. Not that Transcendent Group recommends such an action. Instead, Transcendent Group recommends a thorough Proof of Concept that will provide satisfactory assurance to CCC that Kronos will provide required functionality. Kronos’ recommendation for the Proof of Concept does not comply with what is stated in the RFP Response, page 34. Instead of having Kronos drive the Proof of Concept effort, CCC should clearly delineate Proof of Concept Goals, provide those to Kronos in advance, and have Kronos demonstrate requested functionality. Further CCC should develop a scoring checklist to come to an orderly conclusion of what parts of the Proof of Concept were satisfactory, which were not, and a mechanism to document notes and shortfalls. Before the conclusion of the Proof of Concept effort, clearly document any action items and responsibilities to correct identified shortfalls.
Proof of Concept – Payroll
There is currently no Payroll Proof of Concept scheduled. However, the first production payroll run, January 3, 2008, will be for a partial week—a non-standard situation that will require special attention.
CCC should work with Kronos to identify alternatives. Part of the last pay period will be in current systems so that those systems will have all W-2 data. The most important decision will be in which system does the January 3, 2008 payroll occur: • If in current systems, Accumulating Entries must be made in Kronos to account for W-2 data for the first few days of the year. • If in Kronos, then Kronos Payroll technically goes live for the entire final pay period for 2007, starting on or about December 20, as pay will be accumulating from that point.
12/11/2007
Page 6 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area: Testing Item
Description
Recommendation
Payroll Parallel Testing
Payroll needs to perform more than one “test payroll run” (exact number TBD) in an environment where the data equals that of production. Payroll’s goal is to do a parallel test, validating Kronos environment ledger results against current production ledger results.
A successful Kronos Payroll run (one that can assure validation against production data) requires that all HR data has been entered accurately.
Kronos states in the Professional Services Estimate that they will support only 2 payroll runs. Payroll would like to perform 3 payroll runs.
Transcendent Group recommends four “test payroll runs.” Considering the “possibility" (not “likelihood”) that payroll test runs are met with major problems, there is a chance that CCC will run out of time to test prior to the end of the year. The goal, of course, is to make sure there is one satisfactory run PRIOR to the first live run on January 3, 2008. It is conceivable that the first several test runs will yield these results: RUN 1: Disaster, does not complete RUN 2: Completes with major problems RUN 3: Completes, many minor problems RUN 4: Satisfactory Completion Using this conceivable timetable, and knowing the Satisfactory Completion MUST happen on or before December 20, 2007, that would make the first payroll run November 8, 2007. If RUN 2 or RUN 3 reaches a Satisfactory Completion then CCC will have a simple path to get to the end of the year. See page 15 of the Professional Services Agreement for Kronos’ parallel testing obligations.
12/11/2007
Page 7 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
Schedule Area: Training Item
Description
Recommendation
Lack of Training Plans
There are unclear plans around training. Apparently Kronos is requesting that training happen at Kronos facilities. Exactly what is planned for training is not currently known.
The Momentum Implementation high-level model shown on page 9 of the Professional Services Estimate includes a task called “Complete End User Training” in the Deploy and Support Phase of the project. However, later in the same document where the Deploy and Support Phase detail is given there is no mention of training. Further, CCC has purchased access to Knowledge Pass, the online, static training manuals (screenshots and text), but there does not seem to be a plan for specific users to train in specific areas. CCC should work closely with Kronos to outline a training plan to ensure successful deployment and use of the applications.
In addition, there are a few other items that are not related to schedules and assignments: • There is an issue log on the CCC Sharepoint in the folder Project Workbook Checklist entitled ActionItemsAndIssues.xls. This document is stale. The last entry is from April 2007. A new list of issues have been identified by both HR and Finance. Those issues need to be entered into the spreadsheet. In addition: o A single person should be place in charge of the spreadsheet o A cyclic meeting (possibly weekly) should be scheduled to review the items in the spreadsheet with Kronos o The spreadsheet was provided by Kronos, but should be modified to CCC’s liking. At a minimum, each item in the spreadsheet should have a unique number that never changes to make it easier to track issues over time. • It is reasonable to believe there will be change requests. However, similar to the ActionItemsAndIssues.xls document, CCC should consider funneling all change requests through a single person and managed in a single document. This will help CCC manage the “nickel and dime” problems that were frequently mentioned during my interviews, in addition to allowing CCC to track the magnitude of ALL change requests. • ITS is currently planning to manage requests for custom reports. However, I have not seen a list of standard reports, or any determination of whether Kronos’ standard reports encompass all of CCC’s current production reports. The result could be a large number of potentially critical custom report requests going to ITS immediately after deployment. Reviewing Kronos standard reports and CCC reporting needs as soon as possible will give ITS an opportunity to begin creating reports long before deployment.
12/11/2007
Page 8 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
•
It appears that many documents CCC is expecting from Kronos are late. For instance, an updated schedule / plan document was originally expected on August 10, but to our knowledge has still not been delivered. CCC should address this matter with the Kronos senior consultant / project manager and escalate if it is not corrected.
12/11/2007
Page 9 of 9 Memo to Dona Newman, City Auditor, and City of Cape Coral Management Proprietary and Confidential Transcendent Group
