Implementing COBIT And COSO Frameworks In Queensland Health Payroll Essay.

Discuss frameworks (COBIT and COSO) and controls which should be used in a project such as the Queensland Health Payroll system.

Discuss if any or all of these frameworks and controls were implemented in the Queensland Health Payroll project by

Health Department of the state of Queensland

IBM

Other contractors or parties

Discuss the work carried out in this project in the first 2 stages of the System

Development Life Cycle as described in text book.

Overview of the Queensland Health Payroll System Project

According to Grosser (2013), the implementation and development of any project is largely influenced by the use of a definite framework of operations. The information system implementation in any organization requires following SDLC or system development life cycle. The SDLC consists of many phases and processes that help in developing and implementing a concise and standard information system. The formation of a concise system had resulted in accurate and definite completion of the project undertaken.

The following report has been made on the use of IT frameworks for implementing any project plan and carrying out the operations of the project. The case study selected for the report is of Queensland payroll system project. The assignment would highlight the use of COBIT and COSO framework for the implementation of any project. The second part would show whether these frameworks were implied by the major contractors and departments in the Queensland project.

Queensland Payroll System Project was formed by the Queensland Health Department, Australia for implementing an information system. It was one of the largest IT system implementation projects of the world (Glass 2013). Queensland health provides the facilities of medical, dental, and aged cure in the state. They have approx 85000 employees who provide medicinal services to over 40000 people across the 300 sites of the healthcare. However, to manage the payment facilities and transaction records of such amount of people, the health department decided to install an information system for the operations of payroll activities in the organization. The combine decisions and works of Queensland Health Department, IBM, and some other contractors had helped in implementing the project. According to Grosser (2013), the project proved to be a catastrophic one as the overall project was 300% over budget and it lagged for 18 months too.

Control frameworks are recognized systems that consist of some strategies for covering the internal controls required in the organization. There are many types of framework for controlling the operations of the project such as COSO, COBIT, GAAP, IFRS, and PCAOB. These frameworks and standards are helpful for aligning the technology with business practices. Among these frameworks and standards, COSO and COBIT holds a very significant position for developing the operations for the activities of project. They had been used widely for all the major project These two frameworks have been explained below,

The COSO framework works as an evaluation framework for the purpose of the annual control evaluation of the management and disclosure of the requirements. The framework of COSO consists of Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring (Bruwer and Van Den Berg 2015). The framework had been shown in the diagram below,

Explanation of COSO and COBIT frameworks

Figure 1: Framework of COSO for the control operations

(Source: Kitching, Pevzner and Stephens 2013, p.C30)

The COSO framework consists of five elements that can be used for managing the control of the IT project operations and system development. The elements of the framework are control environment, risk assessment, control activities, information and communication, and monitoring.

The COBIT framework is also known as control objectives for information technology and it is helpful for implementing the IT governance framework (De Haes, Van Grembergen and Debreceny 2013). The COBIT framework is helpful for implementing IT governance in the project operations and software development. The use of COBIT framework had assisted in forming the bridge the gap between control requirements, business risks and technical issues. The following diagram shows the COBIT framework for the implementation of the control unit at the project operations,

Figure 2: Framework of COBIT for the control operations

(Source: Bartens et al.2014, p.405)

The framework of COBIT consists of four operations and it includes plan and organize, acquire and implement, monitor and evaluate, and deliver and support (Weber 2014). All the above mentioned phases comprise of the framework of COBIT for the control actions of the project operations.

The control frameworks of COBIT and COSO could have been used in the operations of the Queensland project control system. The benefits of COBIT and COSO that would have been achieved after implementing these two frameworks for the Queensland Payroll Project are mentioned below,

Formation of controlled environment and operations: These two models would assist largely in controlling the activities and operations of the project. The deployment of COBIT and COSO would help in decreasing the chances and probabilities of errors due to the operations being done in a controlled and more successful environment (Nugroho 2014). The limitation of the outcomes for the project would be tended to be limited as per requirements.

Ease of operations and successful completion: The deployment of the frameworks would help in easing the operations of the Queensland Payroll Project. The frameworks would be helpful for the successful completion of the project operations. According to Lenawati and Winarno (2017), COBIT and COSO are the control frameworks that work best for the IT governance project and software development operations.

The Queensland Payroll Project requires implementation of the payroll system that requires operations related to IT system. There are probabilities of occurrence of errors and issues for the Queensland Payroll Project that should be managed and controlled. Hence, the two frameworks, COSO and COBIT would be helpful for the completion of the operations of the project.

Use of COBIT and COSO in Queensland payroll project

The Queensland Payroll Project had not implemented any of the COSO or COBIT frameworks for their project operations. The main contractors of the project were Queensland Health Department and IBM. They had used Brownfield and Work Brain strategies respectively for their operations. However, if these two frameworks would have been followed by each of the contractors of the project had

The Health Department had implemented the use of Brownfield strategy for their operations and the housing department had not even followed that strategy for implementation. The following are the benefits that the Health Department might have got if they would have implemented the two frameworks,

Controlled environment: The control environment is useful for forming a controlled environment for the project operations (Seyal, Poon and Tajuddin 2016). The health department had been benefitted by the use of controlled environment for their project operations.

Risk Assessment: The risk assessment provides the benefit of analyzing and evaluating the risk factors of the project (Heise, Strecker and Frank 2014). The advent of the risk factors and their impacts could have been narrowed by the deploying the implementation in smaller and less complex agencies instead of the large government sectors.

IBM had deployed the use of Work Brain strategy for their operations and functions for the project of Queensland Payroll. The following are the benefits that IBM might have got if they would have implemented the two frameworks,

Control of the activities: The control activities of the framework would help in developing some actions and strategies for the operations of the project (Chang et al. 2014). IBM could have used the frameworks for gaining control of the activities of the project.

Monitor the processes: IBM could have been able for monitoring the processes in the Queensland Payroll project and making the final review for the project operations.

The other contractors might have got the benefit of improved communication and information analysis if they would have implemented the two frameworks. The information and communication area covers the operation where the analysis of the information and communication related to the project operations would be completed.

The Queensland Payroll Project was carried on in a number of phases and processes such as project planning and scoping, implementing strategies, acceptance testing, and closure of the project (Afiah and Azwari 2015). The project timeline had been provided below,

Figure 3: Project Timeline for the Queensland Payroll Project

(Source: Raza, Clear and MacDonell, 2015, p.5)

Frameworks used in Queensland Health Payroll Project

From the above timeline it is evident that the project operation was not so successful in making the payroll system as required in the project. The commencement of the project was followed by the phase of planning and scoping of the project operations.

The project planning and scoping phase was done for making a suitable plan after analysis of the operational and functional requirements of the project (Brown 2014). The Queensland Payroll Project consists of developing and implementing a plan for the payroll system of the health care. The planning phase consists of making a plan and scheduling the operations of the project. The project team had made some requirement analysis to form the project plan. The operations in this phase include,

1. Requirement analysis: The requirement analysis had formed the primary factor for the construction of any project operation. The operations of the project had been largely dependent on the analyzed data in this phase (Raza, Clear and MacDonell, 2015). The requirement analysis had helped in ensuring the system performance. However, the requirement analysis had not been documented properly that had resulted in bringing about the functionality and user acceptance issues.
2. Scope defining: According to Lenawati and Winarno (2017), it is imperative for making a detailed scope for any project and its operations. The defining of scope must be done by keeping in mind the requirements of the project. The project scope definition should be done for ensuring that the operations of the project had been made following the objectives of the project.
3. Plan making: The first phase of the Queensland project ended with the formation of an approximate plan for the operations of the project. The plan made had covered the operations of the project and it would be made for keeping track of the operations of the project. However, for the project the plan was not appropriate as it lacked the collateral definite project scope.

The second phase for the project of Queensland Payroll was implementing the strategies for the operations of the project (Chang et al. 2014). The project of Queensland was part of government solution and the risk of the project could have been narrowed by developing proper strategies. The advent of the risk factors and their impacts could have been narrowed by the deploying the implementation in smaller and less complex agencies instead of the large government sectors. The lack of testing the strategies in smaller scale had resulted in decreasing the functions of the project. The deployment of the main project driver i.e. LATTICE system became unsupported for the vendors (Heise, Strecker and Frank 2014). The implementation strategy that was due to be used in the project was Brownfield and it was to be tested by implementing the strategy at department of Housing. However, the department did not follow the strategy and had not implemented the Work Brain with the help of consultant engagement strategy.

Conclusion

It can be concluded from the report that the operations of the project require proper planning and organizing the processes of the plan for the project operations. The Queensland Payroll Project had used planning and organizing for explaining the formation of a plan for the operations of the project. However, the project had failed to comply with the estimated budget and scheduled time as it had lagged by 18 months and over budgeted by 300%. The report had shown that it is important for forming a detailed planning process and it would help in acquiring and implementing the framework operations for the operations of the project. The deployment of COBIT and COSO in Queensland payroll project would have brought the benefits of Formation of controlled environment and operations, ease of operations and successful completion, risk assessment, monitor the processes, and improved communication and information analysis. The final conclusion had shown that the process of monitor and evaluation phase by testing had been helpful for analyzing the project and evaluating the operations.

Benefits of COSO and COBIT framework for Health Department

References

Afiah, N.N. and Azwari, P.C., 2015. The Effect of the Implementation of Government Internal Control System (GICS) on the Quality of Financial Reporting of the Local Government and its Impact on the Principles of Good Governance: A Research in District, City, and Provincial Government in South Sumatera. Procedia-Social and Behavioral Sciences, 211, pp.811-818.

Bartens, Y., De Haes, S., Eggert, L., Heilig, L., Maes, K., Schulte, F. and Voß, S., 2014, May. A visualization approach for reducing the perceived complexity of COBIT 5. In International Conference on Design Science Research in Information Systems (pp. 403-407). Springer International Publishing.

Brown, D.R.B., 2014. An exploration of the role of ethics in leadership decision-making in change initiatives in Queensland government owned corporations (Doctoral dissertation, University of Southern Queensland).

Bruwer, J.P. and Van Den Berg, A., 2015. The influence of the control environment on the sustainability of fast food Micro and Very Small Enterprises operating in the Northern suburbs. Journal of Leadership and Management Studies, 2(1), pp.50-63.

Chang, S.I., Yen, D.C., Chang, I.C. and Jan, D., 2014. Internal control framework for a compliant ERP system. Information & Management, 51(2), pp.187-205.

De Haes, S., Van Grembergen, W. and Debreceny, R.S., 2013. COBIT 5 and enterprise governance of information technology: Building blocks and research opportunities. Journal of Information Systems, 27(1), pp.307-324.

Glass, R.L., 2013. The Queensland Health Payroll Debacle. Information Systems Management, 30(1), pp.89-90.

Grosser, M., 2013. Legal lessons from the Queensland health payroll report. Government News, 33(5), p.20.

Heise, D., Strecker, S. and Frank, U., 2014. ControlML: A domain-specific modeling language in support of assessing internal controls and the internal control system. International Journal of Accounting Information Systems, 15(3), pp.224-245.

Kitching, K.A., Pevzner, M. and Stephens, N.M., 2013. Comments by the Auditing Standards Committee of the Auditing Section of the American Accounting Association on the COSO request for comments on Internal Control over External Financial Reporting: Compendium of Approaches and Examples: Participating Committee Members and Other Contributors. Current Issues in Auditing, 7(1), pp.C30-C33.

Lenawati, M. and Winarno, W.W., 2017. Tata Kelola Keamanan Informasi Pada PDAM Menggunakan ISO/IEC 27001: 2013 Dan Cobit 5. Speed-Sentra Penelitian Engineering dan Edukasi, 9(1).

Nugroho, H.E.R.U., 2014. Conceptual Model of IT Governance for higher education based on COBIT 5 Framework. Journal of Theoretical and Applied Information Technology, 60(2), pp.216-221.

Raza, B., Clear, T. and MacDonell, S.G., 2015, July. Onshore to near-shore outsourcing transitions: unpacking tensions. In Global Software Engineering Workshops (ICGSEW), 2015 IEEE 10th International Conference on (pp. 1-6). IEEE.

Seyal, A.H., Poon, S.H. and Tajuddin, S., 2016, November. A Preliminary Evaluation of ICT Centers Performance Using COBIT Framework: Evidence from Institutions of Higher Learning in Brunei Darussalam. In International Conference on Computational Intelligence in Information System (pp. 235-244). Springer International Publishing.

Weber, L., 2014. Addressing the incremental risks associated with adopting a Bring Your Own Device program by using the COBIT 5 framework to identify keycontrols (Doctoral dissertation, Stellenbosch: Stellenbosch University).