Table of Contents

Audit report

Audit of Information Technology Planning and Development Risks
Projet # 09/10 01-04

prepared by
the Audit and Evaluation Directorate

March 2010

Table of Contents

• 1.0 Summary
  • 1.1 Audit Objectives
  • 1.2 Audit Opinion
  • 1.3 Statement of Assurance
  • 1.4 Summary of Recommendations
• 2.0 Audit Report
  • 2.1 Background
  • 2.2 Audit Objectives, Scope and Approach
  • 2.3 Findings, Recommendations and Management Responses
• APPENDIX - Detailed Table of Findings, Recommendations and Management Responses

1.0 Summary

1.1 Audit Objectives

The objective of this audit was to evaluate whether existing information technology (IT) planning and development processes and procedures align IT with user needs.

1.2 Audit Opinion

In our opinion, the IT planning and development processes and procedures have moderate issues requiring management focus.

1.3 Statement of Assurance

In my professional judgment as Chief Audit Executive, the audit procedures followed and the evidence collected are sufficient and appropriate to support the opinion stated in this report. This opinion is based on a comparison of the circumstances, as they existed at the time, with pre-established audit criteria approved by management. This opinion is only applicable to the subject examined.

1.4 Summary of Recommendations

We noted a number of good practices in IT planning and development. We noted that the Canadian Space Agency (the Agency) placed a high priority on the Information Management and Information Technology (IMIT) strategic planning process and developed a four-year plan. A five-year equipment replacement plan was also developed to cover future needs.

As a result of our testing of existing IT planning and development processes and procedures, we recommend that the Agency:

• Consider resuming CIMIS Committee meetings or implementing a new user committee to prioritize project proposals related to Agency applications;

• Document and keep test plans and results, release approvals and rollback plans;

• Review developer access rights and improve task segregation by restricting write-mode access to production environments.

 

Signature of Chief Audit Executive

Original signed by Dominique Breden

_________________________________________

Audit team member

Pierre Lapointe, Associate Partner, Samson Bélair/Deloitte & Touche s.e.n.c.r.l.
David Liberatore, Senior Manager, Samson Bélair/Deloitte & Touche s.e.n.c.r.l.
Stephanie Ranno, Senior Auditor, Samson Bélair/Deloitte & Touche s.e.n.c.r.l.
Anne Turski, Senior Auditor, Samson Bélair/Deloitte & Touche s.e.n.c.r.l.
Ndeye Astou Ndao, Senior Auditor, Samson Bélair/Deloitte & Touche s.e.n.c.r.l.

2.0 Audit Report

2.1 Background

The Agency's mission is to lead the development and application of space knowledge for the benefit of Canadians and humanity. Its mandate is to promote the peaceful use and development of space, to advance the knowledge of space through science and to ensure that space science and technology provide social and economic benefits for Canadians.

The Agency has some 635 employees with about 90% of them employed at the John H. Chapman Centre, the Agency's headquarters located in St-Hubert, Quebec. There are 90 positions in the IMIT sector (79 employees and 11 vacancies). About 30 of the 79 employees are assigned to information management and the rest handle IT management. They perform traditional IT duties including :

• designing and implementing telecommunications systems, networks and storage systems,

• installing and configuring work stations, applications and databases, and

• providing associated technical support.

About 85% of the Agency's information systems run in a Windows environment and 15% in a UNIX environment. Their network now has from 900 to 1,000 users, most of them working at the Agency's headquarters in St-Hubert, Quebec.

The Agency's organizational structure reflects the global context. Space activities are increasingly service-oriented and mainly focus on the needs of end users and the integration of technologies with terrestrial applications. The scope of the IMIT Directorate's responsibility includes managing applications, data and technologies for corporate systems. Approximately 60 applications, either commercial or internally developed, are managed by IMIT.

IMIT's role is to understand requirements and circumstances and develop and implement policies, procedures, programs and activities in response to these requirements.

There are risks involved in achieving IMIT's objectives, such as the quantity and scope of the data it manages. Given the volume of data managed by IMIT, adequate backup and data retention are a significant risk. Systems and data access security is also a significant risk.

2.2 Audit Objectives, Scope and Approach

The purpose of the audit was to evaluate whether existing IT planning and development processes and procedures enables IT to meet user needs. The audit examined IT planning and development processes and activities. More specifically, we examined the following elements:

• IT planning and development

• - Change management:
• • i. Applications;
  • ii. Database management systems;
  • iii. Operating systems;
  • iv. Network equipment.

The audit only covered corporate systems, including applications, database management systems, operating systems and underlying network equipment, which are under IMIT's responsibility, thus excluding specific technological environments such as those of Satellite Operations and the International Space Centre's Mission Control Centre. Moreover, certain corporate systems including SAP are not managed by IMIT and were not covered by this audit. The audit was mainly performed at the Agency's headquarters in St-Hubert, Quebec.

Audit procedures were carried out from January to March 2010. The audit tests we performed consisted of interviewing the different stakeholders, examining existing documentation, examining existing equipment configurations and comparing procedures and controls implemented by the Agency against industry practices and their application.

2.3 Findings, Recommendations and Management Responses

The findings, recommendations and management responses are presented in detail in the following Appendix.