IT Project Management in Virginia IT Project Management Audits in Virginia _____________________________________ NSAA IT Conference October 3, 2013 Tracy Surratt, CISA, PMP Auditor of Public Accounts

IT Project Management in Virginia Discussion Points IT Project Management Specialty Team –Who we are, what we do, and why we do it Examples of development and project management reviews –Findings and risks identified during the eHHR (electronic Health and Human Recourses) Program review. Page 2

IT Project Management in Virginia Why Virginia has an IT Project Management specialty? In the Beginning: $500 million spent on duplicative accounting systems Prevalence of system development failures Current Day: 57 projects at a cost of $669 million included in the Commonwealth Budget Bill An additional 27 projects recommended for funding at a cost of $83 million Page 3

IT Project Management in Virginia IT Project Spending Trends in Virginia Page 4

IT Project Management in Virginia Detect problems at the earliest possible point and inform and alert decision makers so that they can take action to reduce potential failures Legislative interest for unbiased information Understand controls & plan future work Why create an IT Project Management specialty? Page 5

IT Project Management in Virginia IT Project Management Team Objectives Eliminate costly failures Support Code of Virginia requirement Assist other specialty teams Monitor legislative and policy developing entities to identify and follow any issues affecting IT and systems development in the Commonwealth Page 6

IT Project Management in Virginia What do we do and who are we? Monitor the development and implementation efforts throughout the project life cycle Ensure project management standards and industry best practices are followed Optimum team size of 7, including director Average 400 project hours assigned annually (about 30% of availability) Page 7

IT Project Management in Virginia Qualifications Demonstrated knowledge of the Systems Development Life Cycle (SDLC) and industry best practices Good communication skills and auditor awareness 40 hours of specialty related training Project Management Professional (PMP) Certified Information Systems Auditor (CISA) Page 8

IT Project Management in Virginia Who issues Project Management best practices? The Project Management Institute (PMI) issues Project Management Body of Knowledge (PMBOK) PMI administers Project Management Professional (PMP) exam The Virginia Information Technologies Agency (VITA) has statewide Project Management Standards which mirrors PMBOK Page 9

IT Project Management in Virginia What is a Project? Definition: A project is a temporary endeavor undertaken to create a unique product, service, or result. TEMPORARY – has a beginning and an end UNIQUE – not a routine operation, but a specific set of operations designed to accomplish a single goal Page 10

IT Project Management in Virginia Examples of projects under review in Virginia Statewide Financial System Replacement Retirement System Modernization Employment Commission Unemployment Insurance Modernization Medicaid Modernization Solution, eHHR Program Page 11

IT Project Management in Virginia 2010 – Patient Protection and Affordable Care Act (PPACA) passed – the Centers for Medicare and Medicaid Services (CMS) increased federal reimbursement percentages for certain projects from 50% to 90%. The eHHR Program: Where did it come from and how does it impact YOU? Page 12

IT Project Management in Virginia PPACA Impact to State Government: –Medicaid expansion, including the mandate that states improve their Medicaid eligibility application process – October 2013 –Health Benefit Exchange, an online market place where individuals and small businesses can compare and purchase healthcare insurance policies – January Patient Protection and Affordable Care Act Page 13

IT Project Management in Virginia How did many states approach PPACA? Page 14

IT Project Management in Virginia $152 million joint investment between Virginia and the federal government individual projects making up the eHHR Program 2 Secretariats and the Commonwealth CIO involved At least 6 agencies involved High Risk? YES!! Virginia’s approach: eHHR Program Office Page 15

IT Project Management in Virginia To oversee projects that will implement information technology systems, business processes, and organizational changes. To ensure that Virginia improve its administrative effectiveness and reduce errors in social service programs through the modernization efforts. eHHR Program Office Scope Page 16

IT Project Management in Virginia  Healthcare Reform Uncertainty and Timeline Flexibility Report Results: The Supreme Court ruled on the Patient Protection and Affordable Care Act in June 2012, therefore the program requirements and deadlines became official. Program Risks identified - June 2012 Review Page 17

IT Project Management in Virginia  Operationalizing Program Office After Beginning Projects  Blurred organizational structure  No Critical Path to Support the Feasibility of Meeting Deadline Report Results: Program office developed and finalized a structure and tools to control, monitor, and enhance working relationships with individual projects. Program Risks identified - June 2012 Review Page 18

IT Project Management in Virginia  Fast and tight deadlines –Federal Mandate of October 1, 2013 –Ten month timeline for implementation –Need for contingency planning Report Results: Issue continues to exist and compounded by additional resource constraints Identified Program Risks that Continue on… Page 19

IT Project Management in Virginia  Agencies Must Be Allowed to Share Commonwealth citizen information to fully realize the strategic goals of the eHHR Program. Report Results: This is an ongoing issue. Identified Program Risks that Continue on… Page 20

IT Project Management in Virginia  Project documents do not meet best practices  Required documentation was not completed prior to moving into the next stage of development. IT Investment Management Standards AND IT Project Management Standard are not being followed! Report Results: This is an ongoing issue. Identified Program Risks that Continue on… Page 21

IT Project Management in Virginia The Program Office relies too heavily on self reporting from individual projects –Lack of coordination, communication, interdependencies, and interaction between the projects. Program Risks identified August 2013 Review Page 22

IT Project Management in Virginia The Program Office has no close-out plans. –Is the Program Office providing benefits? –Are the remaining projects still related? –Is the Program Office removing redundant work requirements or adding additional requirements? –Do the added benefits received from operating the Program exceed the added costs? Program Risks identified August 2013 Review Page 23

IT Project Management in Virginia Program Management: the process of managing several related projects, often with the intention of improving an organization’s performance. Portfolio Management: a method for analyzing and collectively managing a group of current or proposed projects Program vs. Portfolio Page 24

IT Project Management in Virginia Address the close out process at the beginning of the review Ensure the program team is looking at future work, not just current work, to identify and respond to potential Ensure auditors have appropriate training in the program/project management discipline used. Lessons Learned Page 25

IT Project Management in Virginia More Program Offices More coordination across Secretariats Newly developed Program and Portfolio Standards Changes to Project Management Standards to address “new” project management methodologies What will the future bring? Page 26

IT Project Management in Virginia Tracy Surratt IT Program Management Virginia Auditor of Public Accounts (804) Luis Toledo Assistant State Auditor NC Office of the State Auditor (919) Page 27