Audit Report On The Development And Implementation Of The City Automated Personnel System By The Department Of Citywide Administrative Services

AUDIT REPORT IN BRIEF

We performed an audit on the development and implementation on the New York City Automated Personnel System (NYCAPS) by the Department of Citywide Administrative Services (DCAS). The goal of the system was to make available to users more accurate and accessible personnel-related information.

Audit Findings and Conclusions

Despite spending more than $50 million on its development and nearing its estimated completion date, NYCAPS is not complete. (City officials estimate that it will cost another $70 million to complete NYCAPS and if the City decides to include the Department of Education and other enhancements in NYCAPS’ development it will cost an additional $35 million, which would bring the total cost of developing the system to $155 million.) Consequently, we are unable to determine whether NYCAPS as a finished product meets the overall goals stated in the system justification, whether its system design allows for future enhancements and upgrades, and whether it meets initial DCAS business and system requirements. We did find, however, that DCAS did not adequately define the business and system requirements for the four NYCAPS applications that were completed.

In addition, although DCAS followed a formal system development methodology when it began developing NYCAPS, it did not successfully implement that methodology. Moreover, while NYCAPS was generally procured in accordance with PPB Rules and City Charter provisions, deficiencies in the procurement process led to DCAS’ failure to complete NYCAPS in a timely manner and within its original budget. In addition, DCAS has not incorporated the completed NYCAPS applications into its disaster recovery plan. Finally, the information presented about NYCAPS to the public in the Mayor’s Management Report (MMR) for Fiscal Years 2000 through 2002 gave the impression that development of the system was progressing smoothly.

Audit Recommendations

To address these issues we recommend that DCAS should:

• Comply with all applicable provisions of Directive 18. In particular, DCAS should ensure that the formal systems methodology for developing NYCAPS is implemented.
• Ensure that sufficient staff is assigned to undertake all remaining development tasks.
• Ensure that business and system requirements are adequately defined for the remaining NYCAPS applications. In that regard, requirements should contain definitions of each phase or definitions of the standards for determining whether the system meets the objectives of the applications, safety and security requirements, user-interface requirements, and performance requirements. In addition, test plans for the applications should contain all essential details.
• Develop formal disaster recovery plans for each of the completed NYCAPS applications and incorporate them into the DCAS agency-wide disaster recovery plan.
• Develop formal disaster recovery plans for each new phase or application of NYCAPS and incorporate them into the DCAS agency-wide disaster recovery plan upon completion.
• Address the user concerns noted in this report. In addition, DCAS should perform user surveys during testing and after each module has been in production to identify user concerns with the new modules.
• In conjunction with the NYPD, address any security concerns with the NYPD Shields application. Any outstanding problems should be promptly corrected so that the application can be reactivated.
• Employ an independent quality-assurance consultant to oversee and monitor the entire development process from its inception. The development of testing models and tests should be performed by the quality-assurance consultant.
• Employ an approved and properly solicited systems integrator from a project’s inception for system programming and testing.
• Ensure that business and system requirements are adequately defined before commencing development. In that regard, sufficient staff and resources should be allotted to defining system requirements.
• Ensure that contracts for system development projects contain specific deliverables with due dates and provisions for acceptance testing and nonperformance penalties.
• Ensure that only approved vendors are selected when using State contracts.
• Ensure that new system applications are justified before commencing work and expending development costs. In that regard, DCAS should consider requiring agencies to conduct cost-benefit analyses for prospective new applications.
• Ensure that it provides complete and reliable information to the Mayor’s Office of Operations for inclusion in the MMR.