DAS Report on Employment Dept.

1






An Organizational Assessment of the
Oregon Employment Department




July 3, 2013






















2

Introduction

In March of 2013 Michael Jordan, Chief Operating Officer for the State of Oregon,
and Laurie Warner, Director of the Oregon Employment Department,
commissioned a team to do an organizational assessment of the Oregon
Employment Department (OED). The assessment was focused on the work
environment and staff morale, Information Technology and Finance, which
included budget, accounting and procurement.

The team was led by Clyde Saiki, Interim Chief Human Resource Officer for the
Department of Administrative Services, and was composed of the following
members with the following goals and objectives:

Human Resources
Clyde Saiki
Interim Chief Human Resource Officer
Department of Administrative Services

Krista Fegley
Human Resources Manager
Oregon Department of Forestry

Larry Merritt
Human Resource Analyst 3
Department of Human Services

The HR Team assessed the OED work environment and employee morale. The HR
team interviewed employees and reviewed pertinent HR information provided by
employees and the OED HR office. A particular area of emphasis was the way
employees were being treated by management and their peers.

Finance
Chuck Hibner, Team Lead
Administrator, Office of Payment Accuracy and Recovery
Department of Human Services

Traci Cooper
Chief Financial Officer
Oregon Business Development Department

3

April Carpenter
Legislative Budget Analyst
Oregon Department of Transportation

The Finance Team conducted a review of the accounting, budget and procurement
sections of OED. The team interviewed employees, reviewed contracts, looked at
fund transfers, reviewed fiscal documentation and reviewed financial systems.

Information Technology
Virginia Ellwanger, Team Lead
Chief Information Officer
Oregon Department of Transportation

Sandy Wheeler
Chief Information Officer
Department of Consumer and Business Services

Ron Winterrrowd
Manager, Transportation Application Development
Oregon Department of Transportation

The IT team assessed a variety of issues including, IT governance, IT procurement,
strategic planning and IT project management. The team also interviewed
employees, reviewed IT contracts, quality assurance reports and reports from IT
contractors.

Background

OED was created in 1993 and is an active partner in developing the state’s
workforce. The agency’s mission is to promote employment of Oregonians through
developing a diversified, multi-skilled workforce, promoting quality child care,
and providing support during periods of unemployment.

The department has 38 Worksource Oregon field offices across the state that serve
job seekers and employers by helping workers find suitable employment;
providing qualified applicants for employers; supplying statewide and local labor
market information. Three call centers provide unemployment insurance benefits
to workers temporarily unemployed through no fault of their own. In the 2011-13
biennium OED had approximately 1400 employees and a biennial budget of 3
billion dollars of which 2.5 billion was payment of unemployment benefits.
4

The department offers a number of services. It serves employers through timely
recruitment of a qualified workforce, customizing state and local labor market
information for use as a business planning tool, and by offering job-matching
services based on the need of each employer. Labor market economists and
research analysts identify major workforce policy areas that require additional
research and present their findings and ideas for solutions to decision makers.
Statewide, regional, and local economic information is prepared for use by
employers, community leaders, and policy makers. The department helps job
seekers find jobs that match their skills and employers' needs, provides them with
up-to-date information about trends in occupations and skills needed for success in
the job market, and works with other agencies to direct them to appropriate
training programs and job experiences. The Employment Department's Child Care
Division promotes and regulates child care. The Office of Administrative hearings
provides contested case hearings for 66 agencies, boards and commissions.
The Department is divided into five divisions; Unemployment Insurance, Business
and Employment Services, Labor Market Information, Child Care and the Office
of Administrative Hearings.

George Dunford is the Chief Administrative Officer and Louis Melton-Breen is the
Deputy Director. The Budget, Finance, Procurement Units and, temporarily, IT
report to Mr. Dunford. HR, Facilities, ITSC Project, Child Care, Internal Audit,
Government Relations, and Communications report to Ms. Melton-Breen. They
both report to Laurie Warner, the Director.

Limitations to Assessment

The major limitation to this project was the time allotted for the team complete the
assessment. While the average audit can take six months to a year, this assessment
was limited to 45 days, which has kept the findings at a summary level. In the
summary below, the team has provided an overview of our findings,
recommendations and several areas where we feel further study and evaluation is
necessary.

Methods

Findings were based on interviews with current and former OED employees,
contractors, employees from other agencies and the review of contracts, financial
records and other documents.


5

HR Team Findings

The HR team interviewed a total of 33 current employees, five former employees,
and a contractor. The team also reviewed pertinent information provided by
employees and the OED HR office.

Work Environment

 OED employees we interviewed fell into three groups. Most of the
employees interviewed fell into one of the first two groups. The first group
of employees felt that things were fine and getting better. They attributed the
contention and turmoil to employees who were afraid of change and who
were unwilling to look at doing things differently. The second group
consisted of employees who were very concerned about the work
environment and culture of the agency. They reported instances of bullying,
disrespectful behavior, and targeting of employees. Employees reported
seeing other employees being yelled at, being criticized in front of other
employees, and having work assignments withheld. The third group of
employees was hesitant to talk to us and did not share very much
information.

 The first group of employees who felt that things were fine and getting better
was primarily employees who worked in the Budget, Finance and
Procurement sections and some of the employees in the IT section. They felt
that management had begun to hold people accountable and were trying to
improve systems and processes. They did not report any instances of being
treated disrespectfully or being targeted.

 The second group of employees reported a work environment in which they
disliked coming to work, they were ostracized by other employees, they felt
they were treated disrespectfully, and they felt their contributions were
demeaned. They reported either personal or observed incidents of being
treated disrespectfully, bullying and employees being targeted by the Chief
Administrative Officer (CAO). At least four of these employees either left
the department or were removed from their positions.

These same employees reported multiple instances of inappropriate
comments being made by the Chief Administrative Officer and the Manager
of the Policy and Program Unit to and about employees in meetings.
6

These employees reported feeling uncomfortable speaking out in the work
environment and if they did they felt they were subject to negative
repercussions.

 The third group of employees was very hesitant to talk to us and their
interviews were relatively short. They did not share much and seemed
reluctant to voice their opinions.

 There is a definite lack and absence of trust between the groups. Multiple
employees in the functions that reported to the Deputy Director told us that
they did not trust the things said by employees who reported up to the CAO.
Multiple employees in the functions that reported to the CAO told us that
they did not trust the things said by employees who reported up to the
Deputy Director. This is a major issue that must be addressed before the
department can begin to function at an appropriate level. The lack of trust
contributes to the dysfunctional work environment that was relayed to the
HR Team by many of the employees we interviewed.

Recommendations

 There needs to be immediate action to remedy the divisive environment.
This may mean employee removals, changes or reassignments to remove the
divisive elements from the department. At a minimum we would recommend
the Director remove the CAO.

 A plan has to be developed and implemented to bring employees together
and rebuild trust. The barriers between the three groups have to be addressed
and broken down. The department may need to bring in an outside entity to
assist with this effort.

 Clear, concise and uniform expectations need to be set for employees at all
levels of the department on how they communicate, interact and treat each
other and then employees should be held accountable for meeting those
expectations.

This is especially true for Executive Team members and managers who
should be held to a very high standard in these areas. It is unacceptable for
employees to be targeted, treated inappropriately or treated disrespectfully
so that they see no other alternative but to leave the department.
7


Communication and Transparency

 Based on the team’s interviews, communication and transparency seem to be
major issues in the department and need to be improved.

 Employees at all levels feel that communication is selective. Multiple
employees we interviewed feel that they are ‘out of the loop,’ and some of
them volunteered that they believe their coworkers also feel ‘out of the
loop.’ Many of the employees we interviewed had not heard about the
assessment and did not know why they were being interviewed. Other
employees outside of the Executive Team told us that in the absence of
information there were many rumors about why we were there and what we
were doing.

 Multiple employees reported that the CAO communicated differently with
employees that he liked or favored, compared to those employees he did not
like or trust. For example, the CAO told one higher-level manager that he
could not trust her because she reported to the Deputy Director. Multiple
employees perceive that the CAO withholds information and does not
acknowledge employees that he felt were not aligned with his agenda.
Multiple employees communicated that they are afraid to challenge and
speak out against the CAO because they saw him take actions that they
perceived resulted in employees who did not support him being removed
from their positions or the agency.

 Employees expressed concerns about transparency. One example they gave
was the budget. Two Executive Team members expressed concern that they
had trouble getting budget information from the OED Budget Unit. At times,
these two employees asked why their budget was being reduced and were
not given any information or reason for the action. One employee who was
responsible for the budget in their Division reported trying to get budget
information for 8 months and never being given the information.

Recommendations

 Steps need to be taken to improve communication within the department. An
inclusive communication strategy must be developed and implemented so
that employees don’t feel that they are “out of the loop”. The Director
8

should implement a consistent and systematic method of communicating
with employees on an ongoing basis. The Director needs to increase her
visibility, interaction and communication with employees.

 There needs to be transparency in the budget process. Division
Administrators and key employees should receive regular budget reports and
be involved in decisions on their budget.

 Expectations need to be set for Executive Team members for the way they
communicate with employees. Executive Team members hold critical
positions within the agency and open and transparent communication should
be a basic expectation of these positions. Expectations in this area should be
set for the Executive Team members and they should be held accountable
for meeting these expectations.

Executive Team

 There appeared to be divisions among the department’s Executive Team
members. Communication and trust has broken down between some team
members.

 Two members of the Executive Team expressed concerns that they were
going to be targeted by the CAO for talking to us.

 Employees reported that they were in meetings where the CAO belittled and
made inappropriate comments about another Executive Team member.

 One Executive Team member reported that there is the appearance of
favoritism on the Executive Team and that it creates a very divisive situation.

 Executive Team members reported that their standing meetings were not
always forums for decision making. There was concern that some critical
agency decisions are made by small groups behind closed doors by a few
members with no communication back to the entire team.



9

Recommendations

 There needs to be a more in depth assessment of Executive Team members
and their roles within the organization. With the breakdown of trust and
communication there needs to be a restructuring of the team or some team
members may need to be reassigned or removed from their positions.

 Expectations need to be set for Executive Team members on how they
communicate, interact and treat each other and employees. Executive Team
members need to be held accountable for meeting those expectations.

 A plan has to be developed and implemented to rebuild communication and
trust within the Executive Team. The department may need to bring in an
outside entity to assist with this effort.

Budget and Finance Team Findings

The Budget and Finance team interviewed Executive level program managers as
well as managers and employees from each of the business support areas of budget,
accounting and procurement. In summary and similar to the conclusions reached
by the HR team, we found that employees fell into three groups. The three groups
were those who felt everything was fine; those who felt things were really bad; and
those who did not share much at all.

Although the team was not able to spend much time analyzing each support area,
an in depth review of capabilities and current practices for the budget and
procurement areas is recommended.

Organizational Issues from budget / finance / purchasing interviews

 Employees expressed concerns about communication and trust and reported
that these were problem areas.

 Several employees mentioned that there is high tension throughout the
organization. Further, multiple employees mentioned that they feel they
can’t question or push back because troublemakers are managed out of the
organization (and gave several examples of where they felt that this had
actually happened).

10

 Employees in these work areas perceive that the Deputy Director and the
CAO don’t get along and the department had devolved into two distinct
camps in the organization (warring factions).

Recommendations

 Define clear, concise and uniform expectations for acceptable behavior
through definitive agency leadership actions. Address change management
from the top level of the organization all the way through to line staff.

 Conduct advanced training for leadership development and exercises
focused on building trust. Consider adopting the DHS leadership model.

 The Department needs to establish responsibility and ownership for
managing sub-leases, lease contracts and collection of rent from tenants and
set up processes to properly manage these activities.

 Clearly define and communicate roles & responsibilities (including decision
making) for: the Contracting Unit, Accounting Unit, and Budget Unit as
service delivery areas.

 Implement an agency-wide customer satisfaction survey for administrative
functions. Anonymity should be an option for those surveyed. This would be
a tool to open lines of communication and foster a responsive atmosphere.

 Provide organized internal training from the support services to their
customers to standardize processes and service levels.

 The service delivery to internal business lines needs improvement in all
assessed areas, to some degree, and a metric for improvement is necessary.


Procurement Unit Issues

 The lack of knowledge and expertise in particular types of contracts appears
to be an issue.

11

 At times rubber stamping of purchases and contracts was an acceptable unit
practice due to workload issues and not wanting to slow down the
procurement process.

 There are workload issues due to understaffing and turnover in the
Procurement Unit.

 IT contracting expertise needs to be improved. It appears that there is no
systemized training and employees are expected to learn on the job.

 Policies and procedures are out of date. There is a lack of training for
customers on the procurement process and contract administration
responsibilities.

 Program staff expressed concerns that the Procurement Unit has a
compliance-based approach rather than a collaborative, problem-solving
approach geared toward helping program staff meet their goals. However,
there is little explanation of what steps or actions are necessary to meet these
expectations. This has created a communication breakdown between the
Procurement Unit and program staff. The result is program staff feels that
they are subjected to the “find the rock” treatment by the Procurement Unit.

 Communication is an issue. Often the exchanges between purchasing and
program employees are unpleasant and unproductive.

Recommendations

 There needs to be a more in-depth assessment of the Procurement Unit. The
assessment should include a closer look at process and capabilities of unit
employees. The results of the assessment should be used to design individual
specific training plans for procurement employees and to improve the OED
procurement process.

 Conduct communication training for procurement employees and develop
expectations for the unit as a provider of service to the program units.

12

 Continue the efforts to update procurement policies and procedures. Design
customer training modules, and modify each to incorporate lessons learned
from the in-depth assessment mentioned above.

 Conduct an assessment with the OED program units to identify workload
volume and negotiate agreements regarding levels of service and
expectations with Service Level Agreements (SLA).

 Migrate to “deliverables based” contracts to help ensure successful outcomes
of projects.

Budget Issues

 The transparency of budget activities is an issue both internally, budget to
program, and externally, budget to CFO/BAM and LFO.

 Current budget reports to divisions and programs are short on detail and not
granular enough for program manager use.

 Budget Unit activities around the movement of limitation and budget within
the agency are not transparent which increases the risk of mismanagement
and non-compliance. Significant budget decisions are made by the Policy
and Program Manager without knowledge of the affected programs. Further,
often interpretation of significant rules and grant requirements are handled
by the Policy and Program Manager which increases the risk that these
decisions could lead to outcomes not acceptable to agency leadership and
others internal and external to the organization.

 Employees expressed concerns regarding comments made by the Budget
Unit and their belief that they run the show versus their role as a service
provider to the service delivery programs.

 It is unclear (unknown) as to what the budget and payback ramifications are
of the Federal funds expended on IT projects that did not result in programs
that were functional for users.

 In some program areas staff feels that assigned budget analysts do not
understand the business well enough to be helpful.
13

 Communication is an issue. As with procurement employees, there are
unpleasant exchanges between budget and program employees. This was a
mixed bag as some program areas had no issues and others said they try to
avoid interaction with the Budget Unit.

 Trust is broken between the Budget Unit and the DAS Chief Financial
Office (CFO, formerly BAM) as well as with the Legislative Fiscal Office
(LFO). These strained relationships could, and to some extent have,
hindered the agency’s legislative budget process.

Recommendations

 There needs to be a more in-depth assessment of the budget process and the
Budget Unit. This assessment should include an evaluation of recent budget
transactions to ensure that the risk to the agency of inappropriate or
unacceptable expenditures is minimized.

 Use the results of the assessment to design individual specific training plans
for Budget unit staff and process improvements that will allow staff to
handle the work load at peak times.

 Conduct communication training for employees and develop an expectation
that the unit is a service provider to the program units.

 Conduct an assessment with the OED program units to identify workload
volume and negotiate agreements regarding levels of service and
expectations with Service Level Agreements (SLA).

 Conduct budget training to bridge the gap of “misunderstandings” between
Business units and the Budget Unit. Discuss process, timelines, and roles &
responsibilities of each team.

 Repair trust issues with DAS/CFO and LFO and increase transparency of the
OED budget. Shift relationship and attitude to that of partners, rather than
opponents by increasing communication, inclusion and transparency.
Provide ample review time for submitted requests and documentation.

14

 Restructure budget to capture administrative functions in one Summary
Cross Reference (SCR) budget structure, per multiple requests by CFO. This
will support transparency and ease of Policy Package application.

 When budget adjustments are made that adjust limitation, or operational
targets for the programs, promptly provide a report illustrating the budget
change and narrating why the change was administered.

Accounting Unit Issues

 There is a heavy reliance on transactional approvals by external parties (e.g.
budget manager, project manager, program manager sign-offs) to ensure
appropriateness of the transaction they are accounting for.

 There are concerns about the movement of administrative expenditures
between grant funds within Unemployment Insurance (UI) that deserves
further review.

Recommendations

 Maintain healthy skepticism and utilize contracts, purchase agreements,
budget documents and grant agreements, as needed, as a secondary
verification source.

 Conduct training with business units (including IT) about the importance
and process of recording time accurately and timely to programs and
projects. This should decrease the amount of adjustments necessary.

Information Technology Team Findings

Introduction

Over the last 5 years OED IT systems have come under pressure due to the severe
recession and the increased workload to deliver unemployment related services.
The department’s IT systems are old and need to be updated and modernized.
Several IT projects were initiated to address issues with these systems. The IT
projects strained relationships internally between IT and the business units. They
have also strained relationships externally with the Department of Administrative
Services and the Legislative Fiscal Office.
15


The IT Team interviewed 3 former employees, and 13 current employees. Eleven
of the current employees were in IT. The others were in Auditing and
Administrative Services. Two additional IT employees provided written documents
to us after we completed our interviews. We also interviewed four people outside
OED, who were from LFO, Online Business Systems, Public Knowledge and
Enterprise Technology Services (DAS).

General documents reviewed by the IT Assessment team included: quality
assurance documents, contract documents, project artifacts including meeting
minutes, project status reports and project close reports, IT procurement documents,
contracts and work orders, organizational charts, external and internal audit reports,
documents submitted to the Oregon Chief Information Office, IT Strategic Plan
documents and staff submitted interview preparation notes.

The Information Technology department of the Oregon Employment Department
(OED) is in need of leadership, governance, priority setting, methodology, contract
administration, and appropriate HR practices. There is heavy turnover in IT staff
and the morale should be improved quickly to prevent losing any more trained staff
or the department risks its ability to respond to system outages and may be unable
to continue serving the public with their existing systems.

The IT team reviewed the OED Information Technology Services (ITS)
organization and provided the following findings and recommendations regarding
the health of the department, IT program/project management practices, and the
department’s new IT governance structure. As part of the assessment the team also
provided a perspective on the Identity and Access Management project.

Work Environment Issues

 The IT assessment team concluded that HR practices contributed to low
employee morale and placement of employees in positions that were not
well suited to their skill set. Employees are appointed to positions that they
may or may not be suitable for, they are not coached and then their job
duties were significantly changed. There appears to be little coaching or
mentoring; employees are just moved to other positions and they resign or
retire.

 There are multiple reports of managers threatening the jobs of other
managers and employees at meetings. Three people reported that at a
16

meeting regarding I&AM status, they were asked to provide their resignation
letter with a future date so that when the system failed, they could be
terminated. Three people reported that they felt like they had a “target on
their back”. One person reported that a chair was thrown across the room
during a meeting by the Budget Manager. One person reported that he was
continually asked about being on trial service and felt he was going to be
released.

 Dissenting views appear to be discouraged. In the technical arena, it is very
important to have open, honest discussions with various viewpoints. Only
then can you reach solutions that all can agree on, that meet requirements
and have employee buy-in.

 There are indications that the ITS Management team does not work together
as a team. The ITS Management team did not seem to have a clear
understanding of the authority and duties of the CAO in his role as Interim
CIO.

 The current leadership team of the Director, Deputy Director and CAO is
making changes to help improve the IT organization, but they are not
making the changes in a manner that helps the entire agency buy-in to the
change. For example, the IT governance committee does not include IT
Managers. Such a committee has little chance of success at educating and
informing IT employees of business needs and priorities, and no chance of
them buying into the desired direction.

 It is unclear to the IT organization what the role of Transformation Systems
International and Online Business Services (contractors) are. The team asked
for, but did not receive the deliverables from the Transformation Systems
International contract; therefore, it is unclear as to what services they are
providing to the department. The deliverables of the Online Business
Systems contracts have caused confusion and mistrust among OED IT
employees because of their questionable accuracy.

Recommendation

 Review all IT positions. The review should include MQ’s and skill sets to
determine if people are in their positions appropriately. We recommend that
leaders skilled at being change agents be brought in to drive changes at OED.
17


 Appoint an experienced CIO and evaluate where ITS should be placed
organizationally within the department.

 Evaluate contract performance and deliverables provided by Transformation
Systems International and Online Business Systems. Determine whether or
not contractual performance and deliverables are consistent with the
contractual requirements agreed to by these vendors.

 Begin team building across ITS and charge the ITS managers with
coordination of resource planning across the various areas of ITS.

Transparency and Communication Issues

 Communication and transparency are issues within ITS. There were
numerous reports of closed-door meetings regarding IT issues that did not
include ITS line managers. Little to no communication occurs as to the result
of these meetings. Documents are prepared and not shared with ITS line
Managers and employees. The Strategic Plan was developed with little or no
ITS input. There was turn-over in positions, both in business and ITS, and
transfer of knowledge did not take place.

 Two employees reported that ITS employees were instructed by the CAO
not to meet with external parties without an Executive Manager present.

 External communications with the DAS Chief Information Office and
Legislative Fiscal Office (LFO) were lacking and not timely.

 One employee reported that he was instructed by the CAO to modify a
report with information that he knew was inaccurate. He had meeting
minutes and project status reports that validated that what he was being
asked to report was incorrect.

 Two employees reported that reports produced by vendors did not accurately
reflect input or status provided by employees. They stated that the vendor
that provided the I&AM assessment report, “wrote the report they were told
to write”.


18

Recommendations

 Encourage open and transparent communication throughout ITS and
between ITS and the rest of the department. Require managers to
communicate meeting results and other pertinent information to employees.
Post meeting minutes to increase transparency and communication to ITS
and department employees.

 ITS managers and employees should be included in IT strategic planning
efforts.

 Develop clear expectations that employees will provide clear, prompt, and
transparent communications with LFO, DAS CFO, EISPD and the State
CIO’s Office.

IT Governance Issues

 IT Governance was at too low of a level in the organization during the 2009
-2011 time frame. When the recession hit, multiple projects were added to
the IT workload, senior managers left with poor hand off and no continuity
with regard to IT sponsorship work. These projects were not prioritized and
IT was left relatively unsupported. The CIO and Deputy CIO left the
organization. Project sponsors and attendees to the Governance briefings and
status updates changed. Project expectations and commitments were not
passed on.

 Currently, IT Governance has been reformed but does not include ITS line
management or employees.

 Business units are acquiring IT products and services without going through
the IT governance body.

Recommendations

 Restructure the current IT governance model to include ITS managers.
Initially all sections of ITS should be represented on the governance board.

 Results of Governance Board meetings should be shared with all ITS and
department employees.
19

 Include IT employees in the oversight of all IT contracts and purchases.

Contract Management Issues

 Contract administration is not in line with best practices. IT contracts appear
to have multiple amendments for multiple purposes, some that are not in
line with the original statement of work. On several of the IT contracts that
the team reviewed, OED created amendments detailing work that utilized
contractors that might not be the most qualified for that additional scope of
work. It was not clear whether this was done for expediency or other
reasons, but the practice we believe leads to poor contractor selection
decisions.

 It is unclear that what OED contracted for was actually delivered. A number
of the reports pertaining to IT projects were not sent to the team as
requested. Some of the QA reports the team received were not final copies,
did not have signatures and one had draft comments included in the
margins, although the report was from October 19, 2012 and should have
been already finalized. The revision and signature page was missing in
seven of the eleven QA reports provided to the team.

Recommendations

 The contract administration process needs to be reviewed and brought in
line with contracting best practices. This includes reviewing and
restructuring the contract library in a manner that allows for easy
tracking of projects, contract deliverables and payments. Appropriate
retention policies should be applied and any revisions should be subject
to an authorization and approval process. The team also recommends
contract administration training for the Project Management Office. ITS
needs to work closely with the OED Procurement Office to implement
these changes.

 Review and evaluate existing vendors and determine if they are meeting
the deliverables set forth under their contracts. The review should also
include an evaluation of the quality of the deliverables they have
produced for the department.


20

IT Management Practices Issues

 It appears that a number of IT Management practices are lacking
including:
o Project Management
o Software System Development Lifecycle
o IT Capacity Planning
o IT Standards and Procedures
o Work Management

Recommendations

 Continue and encourage development of best practices in the Project
Management Office.

 Hire a consultant that has expertise in IT business processes such as ITIL
and CMM and have the consultant work with ITS leadership to
implement best practices.

 Train and support ITS and business staff that work on IT projects using
appropriate IT methodology.

Identity and Access Management Project

The State of Oregon had begun a project on Identity and Access Management as a
state enterprise project. The project had not moved forward and OED required such
a system for their business partners and so undertook the project on their own.

The IT assessment team was asked to review the I&AM project due to budget
overruns, delays in deployment, reports of unsatisfied customers and inconsistency
in information provided by the technical staff on the status of the OED project. The
project was cancelled yet the system was in production for approximately 50
business customers.

The OED OPRS system that was undergoing development required the
functionality of an I&AM system to be completed and so it was imperative that an
I&AM project be completed for OED in a timely manner.


21

I&AM Project

 The team understands that there are three major components to I&AM:
Oracle I&AM products, Registration and Org Affiliation. It is important
to note that when doing a system assessment, these specific components
need to be evaluated separately.

 The Registration and Org Affiliation were written in-house and appear to
be the basis of the issues. The Oracle I&AM products are stable products
and OED has other Oracle databases and IT employees to support them.

 There are proposed system fixes to the in-house developed products
currently residing in the test environment that were not allowed to be put
into production.

 The system is in production now and being utilized by OED staff,
partner agency staff and about 50 businesses that were part of the pilot
project. Because it takes a significant amount of time for businesses to
use the Registration and Org Affiliation components the I&AM system
has not been made widely available to Oregon businesses. If the system
is shut down, a solution must be found for these users.

 The I&AM Assessment points to the OED solution as “monolithic” and
gives the recommendation that this project should be separated into parts
that each system can use when needed. Rather, the solution should be
considered as an overarching strategy with the systems staged to take
advantage of the final solution. The value of having an enterprise I&AM
solution is that different applications can take advantage of that one
unified approach.

 The I&AM Assessment did not report on what it would take to make the
system workable.

 The I&AM Assessment stated that “documentation from the I&AM
project initiation would indicate that Microsoft based IAM solutions or
solution components were not evaluated or considered”. We believe that
there was not a mature Microsoft solution available at the time of the
original product selection and is not clear today whether or not this
22

Microsoft solution will meet OED requirements, nor why the vendor
singled this product out.

 The I&AM Assessment did not do a cost comparison regarding licenses.
They noted that the cost to move to a Linux platform was significant as
Linux licensing was on a “per user basis”. Consideration was not given
to the OED license agreement which, according to State Data Center
personnel is on a “per processor” basis. The “fragility” of the AIX
architecture was noted in the report; however, Oracle runs on AIX for
other state agencies as well and it is considered to be a reliable platform.

 The Statement of Work for the I&AM Evaluation Report has the
following tasks for OBS:
1) Evaluate and Assess the I&AM solution
2) Prepare written analysis of alternatives for moving forward….
Including but not limited to: what alternatives exist for fixing I&AM
and creating a path to a clear, favorable outcome? What are the pros
and cons of each alternative: What are the resources required,
including but not limited to skills, staff hours, tools schedule, cost and
risks?
3) Prepare written recommendations…. How can the Department obtain
the best value from the investment already made in I&AM? Which
alternative is recommended and why?

The final report did not provide alternatives for fixing I&AM, nor did it
provide the resources required, nor the cost and risks for alternatives.
Costs would have been a major factor in the decision making process for
any alternative, and yet none were detailed in the report.

Recommendation

 Form a team of non-OED, state employees with the requisite skills, giving
them access to Oracle, Zirous, etc. to review and evaluate the current
architecture and system. Educate business users on the technology and
security considerations and work to meet their requirements. There appears
to be a similar situation occurring with the Document Management System
project and we recommend a similar evaluation of this project also be
completed.