EVALUATION OF THE DESIGN AND

IMPLEMENTATION OF PAY-VA

Report No.: 7D2-G07-019

Date: February 14, 1997

Office of Inspector General

 Washington DC 20420

The PAY-VA system development

effort holds significant potential to

streamline VA’s human resource and

payroll functions
Memorandum to:

Assistant Secretary for Management (004)

Assistant Secretary for Human Resources and Administration (006)

Evaluation of the Design and Implementation of PAY-VA

1. The purpose of the evaluation was to provide an early assessment of the Department

of Veterans Affairs (VA) design, development, and implementation process for the new

PAY-VA system. The Department is in the initial stages of the PAY-VA system

development initiative, which includes identifying customization requirements. We

evaluated the adequacy of the development of operating procedures and controls for the

system. The project focused on (i) assessing the high risk components of the system

development project encompassing the system life cycle, costs, project management, and

user participation, (ii) assessing key business decisions and assumptions, and (iii)

evaluating the coordination and control over the project and over the system’s data

integrity including the adequacy of controls to prevent unauthorized use or release of

privacy data.

2. The PAY-VA system development effort is a joint project of the Office of Financial

Management and the Office of Human Resources Management. PAY-VA’s primary

objectives are to (i) replace VA’s current antiquated payroll system which processes over

$11 billion annually and supports approximately 260,000 employees, and (ii) define and

assess options for new system technology. The PAY-VA team has focused on

documenting current human resources and payroll practices, procedures, and processes,

defining a new human resources and payroll model, and identifying administrative

mechanisms and implementation strategies in order to reengineer more efficient

procedures and business practices for the Department. This represents a significant

Department information technology initiative with substantial system life-cycle costs

estimated at approximately $115 million. System operating benefits are estimated by the

Department at about $205 million over time which are primarily attributable to staffing

reductions that will be achieved by consolidating support services, eliminating redundant

service delivery functions, and fully leveraging technology.
ii

3. Department managers expect the PAY-VA initiative to result in an integrated system

with a full range of capabilities and features required to support VA’s functional

requirements for human resource administration, payroll, benefits administration, and

management reporting. The PAY-VA system is being implemented through the

acquisition of a Human Resource (HR)/Payroll “Commercially-Off-The-Shelf” (COTS)

product. In addition, software development support services are being acquired for the

customization, deployment, and maintenance of the COTS product. Hardware and

software will also be acquired to support the customization and deployment of the new

system. The planned system has a contract life equal to 10 years. The initial 5 years

provides for obtaining the necessary software development support services and includes

a 4-year phased approach for deployment. The remaining 5 years provides for future

product maintenance releases and upgrades and software development support. The

Department has taken delivery on the initial HR and benefits modules and anticipates

delivery of two additional software modules to provide payroll and time and labor system

functionality by July 1997.

4. The PAY-VA system development effort holds significant potential to streamline

VA’s human resource and payroll functions. Our evaluation found that the PAY-VA

project managers have established management control over the multi-faceted details this

system development effort entails, and user involvement was significant. We identified

opportunities to enhance PAY-VA implementation efforts concerning project

documentation and workplans, cost information, contract deliverables, system security,

correction of identified material weaknesses, training, and Contracting Officer’s

Technical Representative (COTR) duties.

5. We found that project documentation and workplans need more regular revisions to

identify and better coordinate the interdependencies associated with significant project

changes. Strengthening project documentation and workplans can provide Department

officials with better information on the overall status of project accomplishments, future

milestones, contract deliverables, and changes to the overall project and costs.

6. While the majority of project related costs are adequately tracked, project

expenditure information also needs to be identified and accumulated for costs incurred

through the Delegation of Procurement Authority and for the Department’s in-house

system development efforts. Effective accumulation of this cost information will help

assure that VA’s system development costs are identified and future franchising

initiatives accurately address the costs of services to be sold. In response to our findings,

the project team took action during the course of our evaluation to begin tracking and

accounting for these expenditures to ensure that all project costs are captured.

7. Our evaluation also found that the workscope in VA’s contract with its COTS vendor

needs to clearly define what type of products can be acquired under the contract. This
iii

contract provides for the purchase of approximately $1 million in products from the

COTS vendor without describing product specifications or prices. More specific

definitions of the contract deliverables are needed to provide the opportunity for

enhanced oversight of contractor performance and future determinations of price

reasonableness.

8. We found that a PAY-VA system security plan and associated project workplans

need to be completed. Additionally, there is a need to strengthen coordination on the

PAY-VA security team and to ensure the timely development of an adequate security

plan. This will ensure the Department is in the best position to address the risks

associated with this decentralized system and to implement controls to mitigate the

associated risks. New features associated with the PAY-VA system such as, paperless

processing, readily accessible information, and interconnected systems increase the

vulnerability of operations and data to unauthorized modification and disclosure and to

potentially devastating interruptions in service.

9. The PAY-VA initiative is expected to address the systemic weaknesses that are in the

Department’s current Personnel and Accounting Integrated Data (PAID) system.

However, our review could not clearly establish how project implementation efforts will

ensure that the Federal Managers Financial Integrity Act reported instances of material

non-conformance and reported deficiencies in VA’s 1991 Crossroads Study associated

with the PAID system had or will be addressed. These issues need to be corrected in

order to ensure that VA’s system is in compliance with the core Federal system

requirements. As a result of the project’s phased deployment schedule, the PAY-VA

project team should document the basis of specific corrective actions taken. This will

help ensure that the systemic deficiencies in the PAID system are fully addressed so that

existing material weaknesses and internal control vulnerabilities will not be carried

forward to the new PAY-VA system.

10. Our evaluation found that formal training is needed for staff tasked with system

testing, certification, and acceptance responsibilities to ensure a better understanding of

how to audit state-of-the art client server system technology. The PAY-VA COTR also

needs formal training to effectively fulfill the ongoing duties and responsibilities of this

position.

11. The report includes recommendations to address the issues which are discussed

above. These recommendations can enhance the Department’s PAY-VA implementation

project as it moves beyond the current implementation efforts and addresses other key

project phases and activities such as system customization, testing, prototyping, and

deployment. The Assistant Secretary for Management and the Assistant Secretary for
iv

Human Resources and Administration noted that our early review will be helpful in

ensuring the success of the initiative, agreed with the report recommendations directed to

their offices, and provided acceptable implementation actions. We consider the report

issues resolved and will follow up on planned actions until they are completed.

 For the Assistant Inspector General for Auditing

[Signed]

Mr. Stephen L. Gaskell

 Director, Central Office Operations Division
TABLE OF CONTENTS

Page

Memorandum to:

Assistant Secretary for Management (004)

Assistant Secretary for Human Resources and Administration (006)................i

RESULTS AND RECOMMENDATIONS

1. Project Documentation and Workplans Should be

Enhanced to Help Assure Adequate Tracking

of Key Implementation Efforts .............................................................................1

Conclusion ...........................................................................................................2

Recommendation 1................................................................................................2

2. Complete Project Cost Information Needs to be Maintained..................................4

Conclusion ...........................................................................................................5

Recommendation 2................................................................................................5

3. Contract Deliverables Need to be Sufficiently

Defined .................................................................................................................6

Conclusion ............................................................................................................6

Recommendation 3................................................................................................6

4. A Project Security Plan is Needed to Address Security Controls for the

 PAY-VA System...................................................................................................8

Conclusion ............................................................................................................8

Recommendation 4................................................................................................8
TABLE OF CONTENTS (Continued)

5. FMFIA Reported Instances of Non-Conformance and Previously

Reported Issues in VA’s 1991 Crossroads Study Need

to be Addressed................................................................................................... 10

Conclusion .......................................................................................................... 10

Recommendation 5.............................................................................................. 11

6. Formal Training is Needed for Staff Tasked

With Completing System Software Testing, Acceptance, and

Certification Requirements for the PAY-VA Project ........................................... 12

Conclusion .......................................................................................................... 12

Recommendation 6.............................................................................................. 12

7. The Contracting Officer’s Technical Representative Needs

Formal Training on COTR Duties....................................................................... 14

Conclusion .......................................................................................................... 14

Recommendation 7.............................................................................................. 14

APPENDICES

I OBJECTIVES, SCOPE, AND METHODOLOGY.............................................. 16

II BACKGROUND................................................................................................. 18

III IMPLEMENTATION OF A SHARED SERVICE CENTER............................... 22

IV COTS SOFTWARE COMPONENTS PURCHASED

BY THE DEPARTMENT................................................................................... 23

V KEY PAY-VA SYSTEM SECURITY CONSIDERATIONS............................... 27

VI ASSISTANT SECRETARY FOR MANAGEMENT AND ASSISTANT

SECRETARY FOR HUMAN RESOURCES AND ADMINISTRATION

JOINT COMMENTS...............................................................................................30

VII FINAL REPORT DISTRIBUTION..................................................................... 35
1

RESULTS AND RECOMMENDATIONS

1. Project Documentation and Workplans Should be Enhanced to Help Assure

Adequate Tracking of Key Implementation Efforts

Our review found that project documentation and workplans need more regular revisions

to identify and better coordinate project activities associated with significant project

changes. We found that project managers were tracking project activities from start to

finish based on the percentage of completion, however workplans needed to identify and

show how significant project changes were affecting the overall project status, costs, and

schedule. We found that some project changes needed to be addressed in more detail

within the workplans, such as a plan for building a temporary interface1 between the

Personnel and Accounting Integrated Data (PAID) and PAY-VA systems. The project

has also increased significantly in size and cost due to the Department’s initiative to

establish a Shared Service Center (SSC) and to add functionality such as expert systems

to augment the core HR/Payroll software including additional software for interactive

voice response, position classification, and resume processing capability. As a result,

project documentation and workplans need to be enhanced to provide better information

addressing project phases and accomplishments, major milestones, and schedule changes.

(A summary of the Department’s efforts to establish a SSC is included in Appendix III on

page 22.)

Because project changes, such as building a temporary interface, present a new

challenge2, costs, and additional risks to the project, workplans need to reflect current

information regarding changes to the project. During the course of the audit, PAY-VA

officials began initiating actions to update their project workplans, but the revised plans

were not complete at the time we concluded our evaluation. Given the significance of the

project’s costs, complexities, risks, and the long term nature of the PAY-VA system

design and implementation phases, project documentation and workplans need to provide

key information addressing project phases, major milestones, and accomplishments.

Summary level documentation addressing the project in terms of key activities or phases

is needed. This information can help identify and support major modifications, additions

and deletions affecting the project’s scope, budget, cost, and schedule.

 

1

 The interface between PAY-VA and PAID environments is temporary and will be used during the interim period that PAY-VA HR and benefits

modules are in production without the payroll software module. This interface is needed as a result of using the phased implementation approach and

will be phased out of the production environment as the PAY-VA payroll and time and labor modules are implemented.

2

 Some of the significant challenges which the PAY-VA project team will face will be to ensure that the information in both the PAY-VA and PAID

system remains synchronized while using the temporary interface and to support and maintain an extra system interface.
2

Conclusion

Project Documentation and Workplans Should be Enhanced

The review found that the project’s workplans were tracking project activities, however,

the workplans need more regular revisions to identify and better coordinate the

interdependencies associated with significant project changes that have occurred. We

found that some of these changes were not fully addressed in the workplans such as the

implementation of the SSC and the need to establish a system interface between the PAYVA and PAID systems. Strengthening project documentation and workplans can provide

Department officials with better information on the overall status of project

accomplishments, future milestones, contract deliverables, and changes to the overall

project and costs.

Recommendation 1

We recommend that the Assistant Secretary for Management and the Assistant Secretary

for Human Resources and Administration coordinate completion of required actions to

ensure that project documentation and workplans are sufficient to identify and support

major changes affecting the project’s scope, budget, cost, and schedule.

Assistant Secretary for Management and Assistant Secretary for Human Resources

and Administration Comments

We concur. At the time of your review, the decision on the establishment of the single

Shared Service Center (SSC) had not been approved. In the absence of this decision, the

PAY-VA team was primarily focusing on the replacement PeopleSoft system

implementation. When the Secretary approved the establishment of the SSC in late July,

the PAY-VA team moved to quickly develop an integrated plan for VA’s new HR/payroll

delivery system, which included the SSC, the replacement system, and other technology

applications. As a result, they have developed a master plan which identifies four

prototype phases for the new delivery system and the associated high level target dates

for testing the functionality and applications of each phase.

Implementation Plan

Detailed work plans have been developed for Phase 1 and actions are underway to

develop the detailed work plan for Phase 2. Detailed plans will be developed for each

phase.

(See Appendix VI on page 30 for the full text of the joint comments provided by the

Assistant Secretaries.)
3

Office of Inspector General Comments

The comments and implementation actions presented by the Assistant Secretaries are

acceptable and responsive to the recommendation. We consider the issue resolved and

will follow up on planned actions until they are completed.
4

2. Complete Project Cost Information Needs to be Maintained

We found that while the PAY-VA project members are tracking the majority of project

related costs, they also need to identify and accumulate cost information for project

expenditures made against the Delegation of Procurement Authority (DPA) approval level

and for the Department’s in-house system development efforts. The project team

provided budget schedules which identified estimated project expenditures through the

year 2001. However, we were unable to identify a project accounting report which

accumulated and reported all of the project expenditures including the direct efforts of the

PAY-VA field team members supporting the overall project needs from field facilities.

Because the PAY-VA project team has implemented multi-disciplinary teams with

specific tasks and responsibilities and relied heavily on using the technical expertise

available within the Department to support this major initiative, the costs associated with

the in-house system development efforts are considered significant and should be

identified.

It is important that all project costs be adequately tracked to identify cumulative

expenditures made against the DPA. VA developed and submitted a request to GSA to

support the purchase of Commercially-Off-The Shelf (COTS)3 software, contractual

support, hardware, and workstations. (A summary of the COTS software components

purchased by the Department is in Appendix IV on page 23.) GSA approved a DPA of

$37 million to acquire resources for Department-wide implementation, deployment, and

maintenance of the PAY-VA system.

Our review of expenditure records did not find that the DPA expenditures were readily

identifiable for reporting purposes. Given the significant expenditures involved and the

long term nature of this system development project, accountability over project

expenditures can be better assured by providing a means to identify costs associated with

the DPA and tracking the expenditures against the DPA’s approval levels. In response to

our findings, PAY-VA project officials took action during the course of the evaluation to

identify and track expenditures associated with the DPA.

The review also found that VA in-house system development costs for the project were

not accounted for to the extent possible. We did find that project direct support costs has

been accounted for within the Offices of Financial Management and Human Resources

including other direct contracts, travel, and supplies expenditures associated with various

PAY-VA teams. However, we found that costs associated with the support effort of

VA’s in-house personnel working on PAY-VA project teams has not been accounted for

and over the course of this project the costs associated with this effort could be

significant. This type of information is needed to determine the Department’s total

 

3

 An off-the-shelf software package is a program for performing some specific function or calculation, which is useful to more than one computer

user, and which is sufficiently documented to be used without modification on a defined computer configuration. Such a package may be used on

many hardware platforms, or it may be used on a single type of hardware. Off-the-shelf applications perform specific tasks such as compiling high

level languages, network management support, word processing, financial spreadsheets, and database management.
5

system development costs. The Department’s ability to identify the full cost of providing

HR/Payroll services will also be needed to ensure that future franchising initiatives

accurately address the cost of services the Department plans to sell.

Conclusion

Enhanced Tracking of PAY-VA Project Costs is Needed

The PAY-VA project team has a mechanism in place to monitor the majority of project

related costs, however, cost information needs to be identified and accumulated for

project expenditures approved by the DPA and for the Department’s in-house system

development efforts. In response to our findings, action was taken during the course of

the evaluation to begin tracking and accounting for these expenditures to ensure all

project costs are captured.

Recommendation 2

We recommend that the Assistant Secretary for Management take action to ensure that

PAY-VA project costs are identified and accounted for involving expenditures under the

Department’s Delegation of Procurement Authority (DPA) and for in-house system

development costs.

Assistant Secretary for Management Comments

Concur. The PAY-VA team worked with the Office of Information Resources

Management to develop a spreadsheet for tracking DPA costs. That action was

completed during the course of the OIG review.

Implementation Plan

The PAY-VA team is currently developing a mechanism to track the time and associated

payroll costs for the part time and intermittent field personnel involved on the project.

That mechanism will be implemented to begin collecting data starting in February 1997.

(See Appendix VI on page 31 for the full text of the Assistant Secretary’s comments.)

Office of Inspector General Comments

The Assistant Secretary’s comments and implementation actions are acceptable and

responsive to the recommendation. We consider the issue resolved and will follow up on

planned actions until they are completed.
6

3. Contract Deliverables Need to be Sufficiently Defined

Our evaluation found that the workscope in VA’s contract to its COTS vendor needs to

more clearly define the products that can be acquired under the contract. The contract

provides for the purchase of approximately $1 million in products from the COTS vendor

without describing product specifications or prices. More specific definitions of these

contract deliverables are needed to provide the opportunity for enhanced oversight of

contractor performance and determinations of price reasonableness. Orders had not been

placed under this contract at the time of our review because the contract had just been

awarded. Efforts to ensure the adequacy of price reasonableness determinations can be

further enhanced by defining the products provided on this contract as to the specific type

of work provided and the level of expertise needed to ensure an acceptable level of

performance. There are also opportunities to better ensure the value and prices the

Department will pay for the products within this contract by using cost and price analysis

techniques to selectively evaluate future delivery task orders.

Conclusion

Contract Deliverables in the Cots Vendor Contract Need to be Defined

We found that contract deliverables need to be better defined in a contract award to the

COTS software vendor. This will provide the opportunity to enhance assessments of

price reasonableness relating to the purchase of these additional products.

Recommendation 3

We recommend that the Assistant Secretary for Management take action to assure that the

contract deliverables associated with the Department’s COTS vendor contract are

sufficiently defined and consider using cost and price analysis techniques to selectively

evaluate future delivery orders.

Assistant Secretary for Management Comments

Concur. The contract is structured as a task-order based, indefinite quantity contract.

The labor categories are priced in a not-to-exceed amount and represent the categories of

personnel which the VA requires for these professional support services. Although the

Contract Officer’s negotiation position at contract award was limited because only one

responsible source could maintain the existing system, the rates were negotiated. Further,

although many of the same services were available under the original General Services

Administration (GSA) negotiated contract, VA was paying added fees to GSA and did not

enjoy a direct contractual relationship with the vendor. With this contract, VA totally

controls the process through implementation of negotiated task orders. Further, the

Statement of Work, Section C, clearly defines the services and products available under

this contract.
7

Implementation Plan

As task orders are developed under this contract, the Contracting Officer will thoroughly

assess the scope of work and the types of contractual staff being requested to perform that

work. This will allow the Contracting Officer to assess the contractor’s price and

negotiate accordingly prior to issuance of each task order. Historical models can also be

applied in evaluating price reasonableness. We believe that these aspects of the contract

and the process for issuing task orders will ensure that the task order scope is well

defined and VA’s costs are reasonable and appropriate.

(See Appendix VI on page 31 for the full text of the Assistant Secretary’s comments.)

Office of Inspector General Comments

The Assistant Secretary’s comments and implementation actions are acceptable and

responsive to the recommendation. We consider the issue resolved and will follow up on

planned actions until they are completed.
8

4. A Project Security Plan is Needed to Address Security Controls for the PAY-VA

System

Our review found that a PAY-VA system security plan and associated project workplans

need to be completed. We found that the security team assigned was in the initial stages

of planning and addressing the need for system security controls. However, from our

observations, the security team lacks sufficient team coordination to effectively address

the system security needs within the project’s planned schedule. In addition, the

Department’s security team leader was unable to locate a copy of the PAID and PAID

Redesign security plans which should be reviewed and considered in the development of

security controls for the PAY-VA system. We also found that the security team is using

teleconference meetings to disseminate weekly information to other PAY-VA team

members, but there are no minutes of these meetings and the individuals who participated

in the conference calls were not always the same team members listed as PAY-VA

security team members. As a result, we see a need to improve overall coordination on

this team.

As the security team moves toward identification and development of system security

controls, a number of key areas need to be addressed. In general, security plans should

incorporate a definition of basic security needs which identifies sensitive information and

applications, systems concepts, and basic security objectives. The plan should estimate

security related costs, benefits, and identify security alternatives. It should also contain

the establishment of quality assurance mechanisms for ensuring security with an

appropriate mix of security controls, including contingency plans. (A summary of key

PAY-VA system security considerations is included in Appendix V on page 27.)

Conclusion

A Project Security Plan Needs to be Developed

Our review found that project managers had not completed a security plan and updated

associated project workplans. There is a need to strengthen coordination on the PAY-VA

security team and to ensure the timely development of an adequate security plan. This

will help ensure the Department is in the best position to address the risks associated with

a decentralized system and to implement controls to mitigate the associated risks.

Recommendation 4

We recommend that the Assistant Secretary for Management and the Assistant Secretary

for Human Resources and Administration coordinate completion of a project security

plan to address security controls needed for the PAY-VA system.
9

Assistant Secretary for Management and Assistant Secretary for Human Resources

and Administration Comments

We concur. At the time of the OIG review, the project implementation plans were at the

preliminary stages and had not sufficiently reached the point requiring the development

of the new delivery system’s security requirements. A security plan has been developed

for Phase 1 of the project implementation plan. This plan will be updated to

accommodate security requirements as part of the planning for each of the remaining

phases.

Implementation Plan

The PAY-VA project will implement an entirely new HR/payroll delivery system which

will offer new security challenges with the advent of the SSC and employee/managerial

self servicing. Because of this radically new environment, the PAY-VA team contracted

with an independent contractor to perform a risk and internal control assessment. The

purpose of the assessment was to get an early assessment of the PAY-VA project’s plans

for security and internal controls in compliance with Federal requirements such as A-130,

A-123, and A-127. The assessment was completed in December and the final report will

be distributed in January 1997. This early assessment will ensure that all security aspects

are identified as we move to implement the new delivery system.

(See Appendix VI on page 31 for the full text of the joint comments provided by the

Assistant Secretaries.)

Office of Inspector General Comments

The comments and implementation actions presented by the Assistant Secretaries are

acceptable and responsive to the recommendation. We consider the issue resolved and

will follow up on planned actions until they are completed.
10

5. FMFIA Reported Instances of Non-conformance and Previously Reported Issues

in VA’s 1991 “Crossroads Study” Need to be Addressed

A November 1994 decision paper supporting the replacement of VA’s current PAID

system stated that it was reported to the Office of Management and Budget (OMB) as

having instances of material non-conformance and not meeting the requirements of the

Joint Financial Management Improvement Program with respect to ease of adaptability,

completeness of documentation, and other requirements of modern financial systems.

The paper emphasized that these deficiencies must be corrected in order to ensure that

VA’s payroll system is in compliance with the core Federal financial system

requirements.

Our review found that the project implementation plans need to be expanded to include

how the PAY-VA project will address the Federal Managers Financial Integrity Act

(FMFIA) reported instances of material non-conformance associated with the PAID

system. In addition, the implementation plans need to show how issues reported in VA’s

1991 Crossroads Study have or will be addressed. The PAY-VA initiative is expected to

address many of the systemic weaknesses found in the Department’s current PAID

system. The Crossroads Study also identified other problems such as erroneous data in

retirement records and noted a review must be accomplished even if the new system is

adopted. There is a need to ensure that all of the pre-existing management deficiencies

will be effectively addressed in the new PAY-VA system.

In addition, our review found that certain HR and payroll system functionality needed by

the Department is being deferred, and is expected to be included in later software releases

from the COTS contractor. As a result, the Department’s ability to ensure that all of the

Federal rules and regulations are met is conditional upon the contractor meeting its

contractual requirements and providing a complete Federalized product. The Department

needs to ensure that the final delivered product incorporates all core Federal system

requirements that provides reasonable documentable assurance that information processed

in the new system will be accurate, timely, complete, authorized, and that the system

itself is secure and auditable.

Conclusion

There is a Need to Ensure That Previously Reported PAID System Issues Are Not

Carried Forward to the PAY-VA System

The PAY-VA initiative is expected to correct many of the systemic weaknesses which

were found in the Department’s PAID system. However, the project implementation

plans need to show how the FMFIA reported instances of material non-conformance and

other reported deficiencies have or will be addressed so that existing material weaknesses

and internal control vulnerabilities will not be carried forward to the new system.
11

Recommendation 5

We recommend that the Assistant Secretary for Management take action to ensure that

previously identified material weaknesses and internal control vulnerabilities in the PAID

system are addressed by the PAY-VA system.

Assistant Secretary for Management Comments

Concur.

Implementation Plan

We will review prior management reviews and reports on the legacy system (PAID) and

document how the PAY-VA solution will resolve these identified weaknesses. We plan

to complete that assessment by March 30, 1997.

(See Appendix VI on page 31 for the full text of the Assistant Secretary’s comments.)

Office of Inspector General Comments

The Assistant Secretary’s comments and implementation actions are acceptable and

responsive to the recommendation. We consider the issue resolved and will follow up on

planned actions until they are completed.
12

6. Formal Training is Needed for Staff Tasked With Completing System Software

Testing, Acceptance, and Certification Requirements for the PAY-VA Project

Managers of the Systems Integrity Staff (SIS) located at the Austin Automation Center

(AAC) acknowledged during the review that their staff lacked experience in auditing

client/server systems, which is the new software technology the PAY-VA project is

acquiring. Given the significant testing, acceptance, and certification requirements

associated with this project, formal training should be provided to the SIS staff tasked

with this assignment to help ensure the adequacy of system security controls.

The SIS is responsible for ensuring that proper internal controls, including independent

validation and verification, are an integral part of all automated financial and related

systems under the purview of the Office of Financial Management.

Conclusion

Training is Needed for Staff Tasked With System Testing, Acceptance, and

Certification Requirements

The SIS staff located at the AAC, tasked with completing system testing, acceptance and

certification requirements for the PAY-VA project need training to help ensure that

system test plans are adequately developed and implemented.

Recommendation 6

We recommend that the Assistant Secretary for Management take action to ensure that

appropriate training in auditing client server solutions is provided to the SIS staff who are

tasked with testing, acceptance, and certification of PAY-VA software.

Assistant Secretary for Management Comments

Concur. At the time of this review, the PAY-VA team was just beginning work to define

an appropriate testing strategy and approach for the new delivery system. At that time,

the SIS staff expressed their concerns since the project was relying heavily on

commercial software and a new client server environment as compared to VA’s and the

SIS staff’s current mainframe system focus.

Implementation Plan

Since that time, a testing strategy for the entire new delivery system has been developed

which addresses the various testing cycles and roles and responsibilities for those who

will participate in the testing. The SIS staff helped develop the approach and are

comfortable with it and their defined roles and responsibilities. Further, a member of the

SIS participating in the PAY-VA testing has also attended a class on auditing client server
13

applications. With these actions, we believe that the SIS staff are prepared and have

appropriate experience, knowledge, and comfort to participate in the testing and ensure

the new system meets system and customer requirements.

(See Appendix VI on page 31 for the full text of the Assistant Secretary’s comments.)

Office of Inspector General Comments

The Assistant Secretary’s comments and implementation actions are acceptable and

responsive to the recommendation. We consider the issue resolved and will follow up on

planned actions until they are completed.
14

7. The Contracting Officer’s Technical Representative Needs Formal Training on

COTR Duties

The Contracting Officer’s Technical Representative (COTR) for this project needs COTR

training. Project officials explained that the COTR took over the responsibilities due to

project turnover without the benefit of formal training. We found that the COTR acted

outside of the procurement authority and did not follow appropriate procedures when

acquiring PAY-VA computer equipment in June and July 1996 on the open market. The

purchase of 21 Pentium-133 computer systems and accessories costing $36,051 was split

into three orders to stay within the COTR’s commercial credit card single purchase

threshold and within his basic contracting authority. The COTR’s single purchase

threshold is $25,000 or less, per purchase not to exceed $75,000 per month and his

contract authority permits him to make expenditures up to and including $25,000 or the

maximum order limitation for orders placed against established contracts. To help

enhance the performance of his duties, the COTR should receive appropriate training

which PAY-VA project officials agreed would be scheduled in the near future.

Conclusion

The COTR Needs Training Relative to the Role and Responsibilities of This Position

A COTR has technical and administrative responsibilities which support the contracting

officer. These responsibilities are significant for the PAY-VA project because of the

multiple procurement mechanisms used and the numerous contractors supporting the

project. The COTR needs formal training in order to effectively fulfill the ongoing duties

and responsibilities of this position and ensure that future purchase orders are not split.

Recommendation 7

We recommend that the Assistant Secretary for Management take the following actions to

enhance the function of the Contracting Officer’s Technical Representative by:

a. Providing formal training related to the role and responsibilities of this 

position.

b. Taking necessary actions to ensure future purchase orders are not split.

Assistant Secretary for Management Comments

Though our review of the COTR’s actions do not confirm a purposeful splitting of orders,

we do concur that he should receive appropriate training to ensure that he is

knowledgeable of the federal procurement rules and requirements of his position.
15

Implementation Plan

Training is scheduled for the week of February 24, 1997.

(See Appendix VI on page 31 for the full text of the Assistant Secretary’s comments.)

Office of Inspector General Comments

The Assistant Secretary’s comments and implementation actions are acceptable and

responsive to the recommendation. We consider the issue resolved and will follow up on

planned actions until they are completed.
APPENDIX I

16

OBJECTIVES, SCOPE, AND METHODOLOGY

Objectives

The purpose of the evaluation was to review the Department of Veterans Affairs (VA)

design and development process for the new PAY-VA system. The project focused on (i)

assessing the high risk components of the development project encompassing the system

life cycle, costs, project management, and user participation, (ii) assessing key business

decisions and assumptions used for the PAY-VA system design and development, and

(iii) evaluating the coordination and control over the project and over the system’s data

integrity including the adequacy of controls to prevent unauthorized use or release of

privacy data. The evaluation included an assessment of the adequacy of operating

procedures and controls being developed for the system. Since the Department is in the

initial stages of the PAY-VA system development initiative, our evaluation focused on

providing an early assessment of the implementation efforts.

Scope and Methodology

Project work included an evaluation of the Department’s system development

methodology, efforts, controls, timeliness, and cost for the implementation of the PAYVA system. Work was performed in VA Central Office (VACO) involving VA’s Office

of the Assistant Secretary for Management and the Office of the Assistant Secretary for

Human Resources and Administration. Interviews were conducted with various PAY-VA

project team members in addition to appropriate VACO officials in the Veterans Health

Administration (VHA), Veterans Benefits Administration (VBA), Office of National

Cemetery Service, Office of Information Resources Management, and the Office of

Acquisition and Materiel Management. Independent contractors and system users

supporting this initiative were also interviewed. Project documentation including key

decision papers was obtained and reviewed as deemed necessary.

Field visits were made to the Austin Automation Center (AAC) and the Austin Finance

Center (AFC) to meet with PAY-VA project team members and the current Personnel and

Accounting Integrated Data (PAID) system support staff. Assessments were conducted

by interviewing appropriate project officials to obtain necessary documentation and to

observe the current project team activities.
APPENDIX I

17

We also reviewed the results of various studies addressing PAY-VA issues and

documentation relating to VA contract award to its COTS vendor and held discussions

with appropriate acquisition support staff. The evaluation considered Federal

Information Processing Standards (FIPS), VA ADP Policy, Federal government ADP

guidance, Federal procurement standards, and public laws defining requirements for

security protection of information maintained in government ADP systems.

The evaluation was conducted in accordance with the Standards for Evaluation Practice

published by the Evaluation Research Society.
APPENDIX II

18

BACKGROUND

VA’s Current System

The Department’s personnel and payroll requirements have been supported by VA’s

PAID system since the early 1960s. PAID is a Department-wide integrated data

processing system encompassing human resources, payroll, other fiscal operations, fiscal

reporting, and human resources statistical reporting. The system supports approximately

260,000 employees and provides the requisite processing and reporting to meet legislative

and administrative requirements. It processes an estimated $11 billion in annual salary

payments. PAID also provides mandatory reporting and audit controls required by

government agencies having input into VA’s budgetary and appropriation cycle. Every

organizational element in VACO and VA field facilities uses the system. Human

resources and payroll office input and processing are provided at more than 250 sites

across the United States, Puerto Rico, and the Philippines.

Previous Efforts to Replace the PAID System

In 1991, VA completed a 10-year effort called PAID Redesign which was originally

expected to replace PAID with a modern system. That effort resulted in several system

enhancements to PAID, however, VA officials determined that PAID still could not meet

the Department’s present or future needs. VA officials issued a 1991 report, entitled

Crossroads Study PAY-VA Project which found that there were numerous errors in

employee pay, retirement records, and reports to Internal Revenue Service and the Office

of Personnel Management. It noted that the system was virtually unmaintainable, VA

was at risk of experiencing a catastrophic system failure, and the payroll system lacked

appropriate internal controls and audit trails. The report concluded that VA was incurring

excessive system maintenance expenses of approximately $3 million a year. The

Crossroads Study recommended that VA stop the PAID Redesign project.

New PAY-VA Team Established

In 1992, an interdisciplinary team, called PAY-VA was tasked to determine and analyze

alternatives to PAID. PAY-VA is a joint project of the Office of Financial Management

and the Office of Human Resources Management and is a component of the Department’s

long-term strategy for improving resource management systems and services.
APPENDIX II

19

The team identified the following four major options for replacing PAID:

• Custom Development.

• Outsourcing to either a private vendor or another government agency.

• Importing and running in-house Federal software.

• Purchasing and adapting commercial off-the-shelf software product(s).

The team concluded their study to evaluate options and alternatives to the PAID system

and recommended to Department officials that VA acquire and customize a mature

software system available in the commercial marketplace. The Assistant Secretary for

Finance and Information Resources Management (currently the Assistant Secretary for

Management) and the Assistant Secretary for Human Resources and Administration

accepted that recommendation and attempted to secure budgetary support for the project,

called PAY-VA.

In 1994, new senior management within the Office of Financial Management began to

assume responsibility for the project in anticipation of Fiscal Year (FY) 1995 funding and

initiated actions to acquire a Human Resource/Payroll Commercially-Off-The Shelf

(COTS) product. The initial project funding was not appropriated until FY 1995. A

COTS HR/payroll software product was purchased in September 1995 for approximately

$6 million. Expert systems software such as interactive voice response, position

classification and resume processing has also been purchased for approximately

$650,000. In addition, the Department has awarded a contract to its COTS vendor valued

at approximately $9.3 for support services, maintenance, and additional products which

can support the customization and deployment of the new system through the year 2001.

Hardware to support the new system has been estimated at $12 million. The minimum

client platform for the PAY-VA users is a Pentium-based PC with 16 Mbytes of RAM, 1

Gbyte of disk storage, 1.44 Mbyte floppy disk drive, CD-ROM, and a 32-bit PCI Ethernet

network interface card for accessing the field station LAN. The COTS product will

eventually replace the Department’s current PAID, On Line Data Entry, and Electronic

Time and Attendance systems.

The PAY-VA team is comprised of a core PAY-VA team averaging approximately 15 full

time VACO members, augmented by approximately 5-10 full time Austin Automation

Center team members, and 20-30 field station team members and various subject matter

expert working as needed. The Department’s HR/Payroll subject matter experts are

participating on an as needed basis. In addition, approximately 10-15 full time staff from

independent contractors are supporting this project initiative. Subteams were formed

with a mix of varied resources to address specific tasks as needed.
APPENDIX II

20

PAY-VA Plans for Phased Deployment

The PAY-VA initiative is expected to replace the current PAID system by incorporating

commercial off-the-shelf software with client server and cooperative processing

technologies. The PAY-VA project team is working to capitalize on the features of

commercial software, streamline current procedures, and improve business practices and

processes. It is expected to result in an integrated system with full range of capabilities

and features required to support VA’s functional requirements for human resource

administration, payroll, benefits administration, and management reporting.

The new system has a contract life equal to 10 years. The initial 5 years provides for

obtaining the necessary software development support services and includes a 4-year

phased deployment. The remaining 5 years provides for future product maintenance

releases, upgrades, and software development support. The Department has taken

delivery on the initial human resource and benefits software and anticipates delivery of

two additional software modules which are expected to provide payroll and time and

labor system functionality by July 1997.

Project Schedule and Major Milestones

The milestones (i.e. completion dates and/or primary period of performance) for PAYVA are identified in the chart below. The commercial releases for the payroll and time

and labor Federal products which the Department has purchased were still under

development at the time of this evaluation. Project plans identify the following key

milestones for each product release identified relating to the four basic software modules

purchased as part of the COTS HR/Payroll integrated package.

Item/Activity COTS

Product

Federalized

COTS (HR)

Federalized

COTS

(Benefits)

Federalized

COTS

(Payroll)

Delivery 10/95 4/96 10/96 8/97

Training Start 10/95 12/96 2/97 10/97

Design, VA unique

customizations

10/96-

2/97

10/96-

6/97

8/97-

12/97

Customization(s) 2/97 7/97 10/97

Pilot(s) Start Date 4/97 7/97 10/97

Deployment 1998-1999 1998-1999 1998-1999

Maintenance &

Enhancements

2000 2000 2000
APPENDIX II

21

System Life-Cycle Cost and Benefit Projections

Projections as of June 1996 show that the life-cycle costs for PAY-VA are estimated at

approximately $115 million. The single site Shared Service Center (SSC) increases the

projected life cycle cost approximately $50 million. The projected life cycle benefits of

the new system were estimated at about $65 million and are now expected to increase to

approximately $205 million with the establishment of the SSC. The significant increase

in life cycle benefits are primarily attributable to staffing reductions which can be

achieved by consolidation of support services, eliminating redundant service delivery, and

fully leveraging technology.
APPENDIX III

22

IMPLEMENTATION OF A SHARED SERVICE CENTER

As part of this major PAY-VA initiative, significant efforts were made by the PAY-VA

project team to examine existing HR/Payroll business processes, apply lessons learned

“best practices” of leading organizations, and to streamline the Department’s future

business environment. As a result of the Department’s efforts to ensure HR/Payroll

support is delivered effectively, the PAY-VA reengineering team4 examined how

HR/Payroll support was being delivered in environments external to the Department,

analyzing a cross section of private industry, Federal, and state governments

organizations. The team recommended the Department implement a new Shared Service

Center (SSC) as VA’s new HR/Payroll service delivery mechanism. The establishment of

a single HR/Payroll SSC was approved by the Secretary of Veterans Affairs in July 1996.

The initial project for the SSC staffing level is estimated at approximately 350 Full Time

Equivalent Employees. Establishing the SSC will require direct investment costs of

approximately $29 million. The investment costs include such items as building lease,

communications, staff relocation, and training. PAY-VA officials project that the SSC

can be ready for operational prototyping by January 1997, and that Department-wide

deployment would begin around July 1997, with phased implementation to be completed

by the end of FY 1999.

The majority of HR/Payroll transactional and informational activities for the entire VA

will be consolidated at a single site in order to:

• Provide “tiered” services (three increasing levels of expertise).

• Consolidate support services and eliminate redundant service delivery.

• Concentrate functional and technical expertise.

• Facilitate and enable employees to effect certain personnel transactions that have

previously required processing by HR and other office administrative personnel.

 

4

The reengineering team consists of a diverse, multidisciplinary representation of VHA, VBA, VACO and other support organization staff involved in

the HR/Payroll and information resources management activities. The team identified the mission and critical success factors for HR/Payroll,

performance measures, business issues, and recommendations for the design team.
APPENDIX IV

23

COTS SOFTWARE COMPONENTS PURCHASED

BY THE DEPARTMENT

The Department has purchased four primary software modules, including human

resources, benefits administration, time and labor, and payroll. The components of these

modules include the following:

Human Resource Module

Action Requests The Actions Request component will provide employees, supervisors and

managers the ability to request specific actions be taken upon their or a

subordinate’s request. This module will include action requests such as the

Standard Form (SF) 52 Personnel Actions, awards request, health benefit

changes, and life insurance requests.

Career Planning The career planning component provides a comprehensive approach to

managing employee career planning. Within the career plan, the position

path, ranking and potential, goals, mentoring, strength, development areas,

associated training plan, and development plan are provided. Additionally, an

inventory of employee skills is available for review and modification.

General Tables General tables affect all modules. Examples would include location table,

locality rate table, paygroup table, department tables, installation tables, and

agency tables.

Health and Safety The Health and Safety component provides for the tracking and management

of injury/worker’s compensation management. Within this component,

incidents and associated information are tracked. This provides management

with injury and illness costs as well as source information. A comprehensive

claims management panel (i.e., system menu or screen) group is provided.

Tracking of required examinations is also available.

Performance

Management

The performance management component provides for comprehensive

employee evaluation. This component includes appraisals, performance

standards, and numerous reports/summary panels which identify the appraisal

rating breakout and reporting.

Personnel

Administration

The personnel administration component will contain the basic employment,

personnel, and employee history for each employee. This component will also

include basic employee data, such as education, work experience, adverse

actions, testing, and employee photo.

Personnel

Administration Tables

The personnel administration tables component contains tables of information

which are unique to the personnel administration component. Examples of

tables which are covered are nature of action codes, legal authority codes, and

bargaining unit.
APPENDIX IV

24

Human Resource Module (Continued)

Position Management Position management focuses on two primary areas: positions and position

descriptions. The position description panel group provides for the entry of

key position description data; such as grade, pay plan, occupational series,

supervisory level, and position description. The position panel groups

provides for tracking individual positions which support one or more

employees. This component also provides for position history and budget

control.

Recruitment The recruitment component tracks both applicants and vacancies. Under

applicant tracking, the applicants prior work experience, skills, and

reasonable accommodation requirements are tracked; as well as, any

positions for which the applicant would like to be considered. Also included

are applicant checklists and any activity that has occurred on the applicant

(e.g., jobs considered, status, when considered, etc.). This component also

includes vacancy announcement processing, which includes supporting the

creation and maintenance of vacancy announcements, associated expenses,

and search capabilities. Search capabilities provide for job ranking and

identification of skills; education and experience for employees, applicants,

and candidates.

Regulatory Compliance Provides for the tracking and reporting of reasonable accommodations and

for affirmative action plans, adverse actions, equal employment, veterans,

and work force analysis.

Salary Administration This component includes salary planning, salary budget and approval, salary

matrix and merit increase, salary grade and step tables, and mass salary

increases.

Skills Inventory The skills inventory component provides for skills tracking by employee.

This component also provides tracking of tests, languages, licenses,

certificates, memberships, honors, special projects, and training completed.

Succession Planning The succession planning component provides management with the ability to

fill key positions by using succession plans to identify potential successors.

Managers can also perform on-line searches for other qualified candidates,

both current employees and external applicants. Succession planning can

also help identify leadership gaps, anticipate staffing requirements, and build

a pool of highly qualified employees.

Training Administration This component provides for the tracking and maintenance of employee

training information and training plans (i.e. Individual Training Plans). The

module provides for internal course and session management and supports

all key/critical components such as vendor, facility, cost, and materials

tracking. This component also supports the administration and tracking of

non employees and provides for comprehensive training administration.

Employee and Labor

Relations

This component focuses on the ability to track and report against disciplinary

actions, grievances, and union activity. The disciplinary actions component

provides the mechanism to track and report against each stage of the

disciplinary process. It also provides a comprehensive grievance tracking

panel group which addresses the grievance from the initial report to

conclusion and final resolution. Union activity is tracked to ensure union

participation is recognized and managed properly.
APPENDIX IV

25

Benefits Administration Module

Benefits This component provides for the definition of the benefits plans. As part of

the benefits plan definitions, are rules based processing and rate schedules

which are defined solely from on-line processing capabilities. Within this

component, all leave plans (sick, holiday, annual, etc.) are also defined with

their associated rules and accrual rates. The benefits component also provides

for provider identification and reporting.

Benefits Administration This component is an extension of basic benefits which adds the capabilities

for mass enrollment and interactive voice response interface.

Payroll Module

Employee Payroll Data This component addresses all employee based information associated with

payroll. The module leverages the integrated design to only require input of

payroll specific information, while using the HR based information to control

changes to salary, positions, etc. Employee payroll data includes additional

pay, direct deposit, tax elections, garnishments, deductions, payroll specific

information, and savings bonds elections. It has on-line balances and

accumulators for deductions, garnishments, savings bonds, etc. to include W-2

information.

General Ledger

Interface

This interface is provided with the system and can be customized using SQR,

the tool used to write the interface. The account structure and summaries can

be controlled within the interface. The general ledger interface is, in essence,

a standard report that extracts data from the database and formats it into a

format acceptable to a general ledger system.

Pay Process Tables Contains all of the standard tables which support payroll processing. The

COTS vendor provides and maintains many of these tables, to include federal,

state, and local tax tables, federal and state garnishment rules, earnings and

deductions plans, and deduction priorities.

Payroll Reporting The COTS product delivers a comprehensive set of standard tax and payroll

reports. These reports include a tax deposit summary, quarterly state reports

in paper and magnetic tape, local tax reports, and W-2 reporting. Additional

reports include retroactive pay, employee earnings, and leave accruals.

Paysheets The paysheets component provides for time entry of employee hours. For

those employees’s who are full time salaried or hourly, hours are

automatically posted, to provide for exception based entry. Paysheets provide

for the entry of additional earnings and payroll messages. Paysheets provide

for direct deposit processing, pay calculation, the pay calendar, pay

confirmation, and actual paycheck creation.
APPENDIX IV

26

Time and Labor Module

Time and Labor This module will facilitate the recording of any required information by an

organization that can be attributed to an employee and expressed in hours.

The time and labor module addresses scheduling, time collection,

compensation, attendance, distribution and costing, payroll interface, and

labor distribution. Its design is based upon both exception and paperless

processing techniques.

Other Development Tools

The COTS purchase also includes a rapid development tool kit which the COTS vendor

used to design and build its product. The capabilities of these tools are provided through

pull-down menus and explicit prompts.

Expert Systems Purchased by the Department

The Department is also in the process of acquiring additional system capabilities to

facilitate the efficient delivery of HR/Payroll services. These technologies are referred to

as expert systems, and include the following:

Automated Resume

Processing

This technology will enable resumes to be scanned or faxed into a system and

processed by optical recognition software. Text files are created, checked for

errors and stored in an indexed text-retrieval database. High volumes of

resumes can be searched by word or phrase with matching of candidates to

positions. This technology can facilitate the recruitment and staffing

processes.

Automated Classification

Processing

This technology integrates position description, performance plan, training

requirements, and knowledge skills and abilities for classifying duties and

responsibilities. It enables electronic position classification via artificial

intelligence and removes many of the manual and paper intensive activities

associated with position classification and management.

Interactive Voice

Response (IVR)

IVR enables the distribution, gathering and processing of information through

home or business touch tone phones. The system can answer calls through

one or more 800 numbers and guide callers through a structured HR, benefits,

and payroll information exchange process.

KIOSKs Provide an alternative user interface for accessing the main COTS application.

The KIOSK will provide access to many of the same self service options as the

IVR and those available through a desktop computer. KIOSKs can be placed

in high traffic assessable locations at each field station and in VACO. It will

consist of a 20-inch display with touch-screen technology that walks an

employee through the self service options.
APPENDIX V

27

KEY PAY-VA SYSTEM SECURITY CONSIDERATIONS

Security Focus Areas

The evaluation found that the PAY-VA project team was in the initial stage of preparing a

security plan and initiating a risk assessment5. The PAY-VA project managers recognize

that system security6 measures are critical to maintaining good internal controls for this

system. The system needs to assure that appropriate electronic access controls are in

place so that unauthorized individuals do not gain access to sensitive or privacy

information maintained and have the opportunity to manipulate or improperly disclose the

information, causing a significant potential loss to VA. Because payroll is potentially a

highly vulnerable area for fraud, waste, and abuse; the importance of controls can not be

overstated and these controls should be considered as an integral part of all functions

within the new PAY-VA HR/Payroll system.

Management control processes need to ensure security controls are incorporated into new

applications and significant system modifications. Early review of basic security needs

should be accomplished to identify sensitive information and applications, security, and

controls. This can help provide managers with a better understanding of the wide variety

of threats, vulnerabilities, and risks so that appropriate security alternatives can be

considered and implemented.

Computer security certification7 and accreditation8 is a form of quality control that is used

for applications, such as PAY-VA, with a significant potential for loss. It benefits the

Department by providing managers with technical information needed to make critical

decisions and increases an awareness of computer security throughout the organization.

The process can help protect against fraud, illegal practices, mission failures,

inappropriate disclosure of information, and legal action while it provides added

assurances that a computer application satisfies its defined functional, performance,

security, quality, and reliability requirements. Certification and accreditation of the new

PAY-VA computer application needs to be accomplished as part of this major

Departmental initiative.

 

5

An assessment of the threats to and vulnerabilities of, an automated information system or an installation. The analysis may vary from an informal

review of a microcomputer installation to a formal, fully quantified risk assessment of a large scale computer center. The model framework initiation

and definition system development phases require the following documentation: needs statement, feasibility study, risk assessment, cost/benefit

analysis, system decision paper, project and internal audit plans, and functional and data requirements documents.

6

The quality exhibited by a computer system or application that embodies its protection against internal failures, human errors, attacks, and natural

catastrophes that might cause improper disclosure, modification, destruction, or denial of service. Computer security is a relative quality, not an

absolute state to be achieved.

7

Certification consists of a technical evaluation of a sensitive application to see how well it meets security requirements.

8

Accreditation is the official management authorization for the operation of the application and is based on the certification process as well as other

management considerations.
APPENDIX V

28

In general, security plans should incorporate a definition of basic security needs which

identifies sensitive information and applications, system concepts, and basic security

objectives. The plan should estimate security related costs, benefits, and identify security

alternatives. It should also contain the establishment of quality assurance mechanisms for

ensuring security with an appropriate mix of security controls, including contingency

plans. Since each organization faces different risks and unique exposures designing and

implementing security controls into a system such as PAY-VA, normally management is

faced with making decisions regarding a series of choices which balance the level of

protection needed against the ease of use and cost.

Federal System Development Requirements, Guidance and Policy

Guidelines and requirements which need to be considered in the system development

process include the Privacy Act of 1974 as amended, and the Computer Security Act of

1987 which contain provisions requiring agencies to protect the confidentiality and

integrity of the sensitive information that they maintain. Also, Office of Management and

Budget (OMB) Circular No. 130, Appendix III, entitled “Security of Federal Automated

Information Resources” and Federal Information Processing Standards Publication (FIPS)

102, Guideline for Computer Security Certification and Accreditation provide specific

guidance addressing security for automated information systems. Department procedures

to address these requirements are included in MP-6, Part I, Chapter 2, revised February

24, 1992 entitled “Automated Information System (AIS) Security Policy.”

In addition, the adequacy of controls over computerized data is addressed indirectly by

the Federal Managers Financial Integrity Act (FMFIA) of 1982 and the Chief Financial

Officers (CFO) Act of 1990. FMFIA requires agency managers to annually evaluate their

internal control systems and report to the President and Congress any material

weaknesses that could lead to fraud, waste, and abuse in government operations. The

CFO Act requires agency CFOs to develop and maintain financial management systems

that provide complete, reliable, consistent, and timely information.

A provision of MP-6 Part I, Chapter 2, added a requirement that system development is to

be consistent with the life cycle documentation requirements of the model framework for

management control over automated information systems issued by OMB in January

1988. The model framework provides a methodology that Federal managers can use to

ensure adequate control over automated systems.
APPENDIX V

29

OMB is responsible for developing information security policies and overseeing agency

practices. OMB Circular A-130 requirements include the following:

• Agencies establish a management control process to assure that appropriate

administrative, physical, and technical safeguards are incorporated into all

applications, and into significant modifications to existing applications.

• Agencies shall define and approve security requirements and specifications prior to

acquiring or starting formal development of the applications.

• The results of risk analyses performed should be taken into account when defining

and approving security specifications for the applications.

• Other vulnerabilities of the applications, such as telecommunication links, shall also

be considered in defining security requirements.
APPENDIX VI

30

ASSISTANT SECRETARY FOR MANAGEMENT AND ASSISTANT

SECRETARY FOR HUMAN RESOURCES AND ADMINISTRATION

JOINT COMMENTS

Department of

Veterans Affairs Memorandum

Date: January 22, 1997

From: Assistant Secretary for Management (004)

 Assistant Secretary for Human Resources and Administration (006)

Subj: Comments on Evaluation of the Design and Implementation of PAY VA

To: Michael G. Sullivan, Assistant Inspector General for Auditing (52)

1. We appreciate the opportunity to comment on your draft report. Our

comments are attached.

2. Your early review of the PAY VA project’s design and development

process and the associated recommendations are helpful and will assist us

in ensuring that this critical Department initiative is a success.

3. Please feel free to contact Sandra Weisman on (202) 273-9485 if you have

any questions about our reply.

[Signed] [Signed]

D. Mark Catlett Eugene A. Brickhouse

Attachment

VA Form 2105

Mar 1989
APPENDIX VI

31

EVALUATION OF THE DESIGN AND

 IMPLEMENTATION OF PAY VA

004/006 Comments

Recommendation 1 - The Assistant Secretary for Management and the

Assistant Secretary for Human Resources and Administration should

coordinate completion of required actions to ensure that project

documentation and workplans are sufficient to identify and support major

changes affecting the project’s scope, budget, cost, and schedule.

We concur. At the time of your review, the decision on the establishment of the

single Shared Service Center (SSC) had not yet been approved. In the absence of

this decision, the PAY VA team was primarily focusing on the replacement

PeopleSoft system implementation. When the Secretary approved the

establishment of the SSC in late July, the PAY VA team moved to quickly

develop an integrated plan for VA’s new HR/payroll delivery system, which

included the SSC, the replacement system, and other technology applications.

As a result, they have developed a master plan which identifies four prototype

phases for the new delivery system and the associated high level target dates for

testing the functionality and applications of each phase. Detailed work plans

have been developed for Phase 1 and actions are underway to develop the

detailed work plan for Phase 2. Detailed plans will be developed for each phase. 

Since the beginning of this project, the PAY VA team has been required to

develop a tactical plan which identifies high level project scope and

milestones/completion dates. On a monthly basis, the team submits a status

report on project progress, achievements, and changes in scope or direction

against the plan. Further, the PAY VA team periodically briefs the Assistant

Secretaries for Management and Human Resources and Administration on

project status or as part of key decision points. The PAY VA project is a critical

Department initiative which we believe has an appropriate level of management

review and oversight and with the development of the master plan and the

detailed supporting plans, will help us to ensure project scope, budget, cost and

schedule.
APPENDIX VI

32

Recommendation 2 - The Assistant Secretary for Management should take

action to ensure that PAY VA project costs are identified and accounted for

involving expenditures under the Department’s Delegation of Procurement

Authority (DPA) and for in-house system development costs.

We concur. The PAY VA team worked with the Office of Information Resources

Management to develop a spreadsheet for tracking DPA costs. That action was

completed during the course of the OIG review. The PAY VA team is currently

developing a mechanism to track the time and associated payroll costs for the

part time and intermittent field personnel involved on the project. That

mechanism will be implemented to begin collecting data starting in February

1997.

Recommendation 3 - The Assistant Secretary for Management should take

action to assure that the contract deliverables associated with the

Department’s COTS vendor contract are sufficiently defined and consider

using cost price analysis techniques to selectively evaluate future delivery

orders.

We concur. The contract is structured as a task-order based, indefinite quantity

contract. The labor categories are priced in a not-to-exceed amount and

represent the categories of personnel which the VA requires for these

professional support services. Although the Contract Officer’s negotiation

position at contract award was limited because only one responsible source

could maintain the existing system, the rates were negotiated. Further, although

many of the same services were available under the original General Services

Administration (GSA) negotiated contract, VA was paying added fees to GSA

and did not enjoy a direct contractual relationship with the vendor. With this

contract, VA totally controls the process through implementation of negotiated

task orders. Further, the Statement of Work, Section C, clearly defines the

services and products available under this contract. As task orders are

developed under this contract, the Contracting Officer will thoroughly assess the

scope of work and the types of contractual staff being requested to perform that

work. This will allow the Contracting Officer to assess the contractor’s price and

negotiate accordingly prior to issuance of each task order. Historical models can

also be applied in evaluating price reasonableness. We believe that these aspects

of the contract and the process for issuing task orders will ensure that the task

order scope is well defined and VA’s costs are reasonable and appropriate.
APPENDIX VI

33

Recommendation 4 - The Assistant Secretary for Management and the

Assistant Secretary for Human Resources and Administration coordinate

completion of a project security plan to address security controls needed for

the PAY VA system.

We concur. At the time of the OIG review, the project implementation plans

were at the preliminary stages and had not sufficiently reached the point

requiring the development of the new delivery system’s security requirements.

A security plan has been developed for Phase 1 of the project implementation

plan. This plan will be updated to accommodate security requirements as part

of the planning for each of the remaining phases.

The PAY VA project will implement an entirely new HR/payroll delivery

system which will offer new security challenges with the advent of the SSC and

employee/managerial self servicing. Because of this radically new environment,

the PAY VA team contracted with an independent contractor to perform a risk

and internal control assessment. The purpose of the assessment was to get an

early assessment of the PAY VA project’s plans for security and internal controls

in compliance with Federal requirements such as A-130, A-123, and A-127. The

assessment was completed in December and the final report will be distributed

in January 1997. This early assessment will ensure that all security aspects are

identified as we move to implement the new delivery system.

Recommendation 5 - The Assistant Secretary for Management should take

action to ensure that previously identified material weaknesses and internal

control vulnerabilities in the PAID system are addressed by the PAY VA

system.

We concur. We will review prior management reviews and reports on the

legacy system (PAID) and document how the PAY VA solution will resolve

these identified weaknesses. We plan to complete that assessment by March 30,

1997.
APPENDIX VI

34

Recommendation 6 - The Assistant Secretary for Management should take

action to ensure that appropriate training in auditing client server solutions is

provided to the SIS staff who are tasked with testing, acceptance, and

certification of PAY VA software.

We concur. At the time of this review, the PAY VA team was just beginning

work to define an appropriate testing strategy and approach for the new

delivery system. At that time, the SIS staff expressed their concerns since the

project was relying heavily on commercial software and a new client server

environment as compared to VA’s and the SIS staff’s current mainframe system

focus. Since that time, a testing strategy for the entire new delivery system has

been developed which addresses the various testing cycles and roles and

responsibilities for thosewho will participate in the testing. The SIS staff helped

develop the approach and are comfortable with it and their defined roles and

responsibilities. further, a member of the SIS participating in the PAY VA

testing has also attended a class on auditing client server applications. With

these actions, we believe that the SIS staff are prepared and have appropriate

experience, knowledge, and comfort to participate in the testing and ensure that

the new system meets system and customer requirements.

Recommendation 7 - The Assistant Secretary for Management should take the

following actions to enhance the function of the Contracting Officer’s

Technical Representative by: providing formal training related to roles and

responsibilities of this position and taking necessary actions to ensure future

purchase orders are not split.

Though our review of the COTR’s actions do not confirm a purposeful splitting

of orders, we do concur that he should receive appropriate training to ensure

that he is knowledgeable of the federal procurement rules and requirements of

his position. That training is scheduled for the week of February 24, 1997.
APPENDIX VII

35

FINAL REPORT DISTRIBUTION

VA Distribution

Secretary of Veterans Affairs (00)

Under Secretary for Health (105E)

Acting Under Secretary for Benefits (20A11)

Director, National Cemetery System (40)

General Counsel (02)

Assistant Secretary for Management (004)

Assistant Secretary for Human Resources and Administration (006)

Assistant Secretary for Policy and Planning (008)

Assistant Secretary for Congressional Affairs (009)

Deputy Assistant Secretary for Public Affairs (80)

Deputy Assistant Secretary for Congressional Affairs (60)

Deputy Assistant Secretary for Information Resources Management (045)

Network Directors, VISN 1-22

Associate Deputy Assistant Secretary, Office of Financial Systems (047E)

Director, Human Resources Planning & Organizational Effectiveness (05C)

Director, Austin Automation Center (200/00)

Director, Austin Finance Center (104/00)

PAY-VA Co Managers (047E2/047E2A)

Non-VA Distribution

Office of Management and Budget

U.S. General Accounting Office

Congressional Committees:

Chairman, Senate Committee on Governmental Affairs

Ranking Member, Senate Committee on Governmental Affairs

Chairman, Senate Committee on Veterans' Affairs

Ranking Member, Senate Committee on Veterans' Affairs

Chairman, House Committee on Government Reform and Oversight

Ranking Member, House Committee on Government Reform and Oversight

Chairman, House Committee on Veterans' Affairs

Ranking Democratic Member, House Committee on Veterans' Affairs

Chairman, Senate Subcommittee on VA, HUD, and Independent Agencies,

Committee on Appropriations

Ranking Member, Senate Subcommittee on VA, HUD, and Independent Agencies,

Committee on Appropriations

Chairman, House Subcommittee on VA, HUD, and Independent Agencies,

Committee on Appropriations

Ranking Member, House Subcommittee on VA, HUD, and Independent Agencies, 

Committee on Appropriations