ARTICLES

E-Governance Risk Assessment Alignment of Business Needs and IT Requirements

State Audit Institution-Oman*

The paper outlines the methodology of evaluation of e-governance strategy and implementation adopted by SAI Oman.

1. Background
SAI Oman presented a paper on E Governance in the V Performance Audit Seminar conducted by INTOSAI IT Audit Committee in Moscow in April 2004. This paper was on the theme -'Risk Assessment" and covered the experiences of SAI Oman in assessing the risks involved in the audit of the e government initiatives of the government of Oman. This paper was widely appreciated, as it provided a real life perspective to the theoretical framework of risk assessment.
An abstract of the paper as presented in Moscow is presented below:

1.1 Scope
In the past decade, e-government has been touted as a panacea against bloated, inefficient and costly governance, and Oman is no exception to this trend, with increasing acceptability and adoption of e-government. However, the benefits have been hyped up on the basis of anecdotal evidence, as no systematic reviews and evaluations have been conducted as yet.

SAI-Oman planned to conduct a systematic review of e-government to validate the benefits and justify the enormous interest and sizeable investments being made in this area. As part of this review, a risk assessment of the e-government process has been conducted, to generate a detailed audit plans, as well as a preliminary audit hypothesis of the e-government initiative.

Our preliminary assessments indicated a mismatch between business needs and IT requirements as one of the major risk areas for the successful planning and implementation of e-governance. This paper represents the first phase of SAI-Oman's review of e-government, covering the strategic and policy issues, leading up to a risk assessment ¹.

We have modeled our audit review of e-government on the basis of a framework, which is depicted below.

2. Introduction

Conceptually, the e-Government paradigm may be taken as covering the following:
E-Government, which represents the delivery of Governmental services electronically (essentially the Internet) primarily to the citizens and residents, but also secondarily to other internal clients within Government
E-Governance framework, which covers the legislative and regulatory mechanism to ensure effective and secure delivery of e-government services; and
Digitally-enabled and connected society, with easy and affordable access to such e-Government delivery systems to all sections of society.

These three aspects dynamically interact with each other at any point of time. It has been the objective of all countries including Oman to ultimately achieve a digital society, with increased connectivity, enabling e-Government and e-Commerce under a tested regulatory framework.

3. Development Approach to E-Government & Digital Society
Web-enabling or computerizing existing government applications is often mistaken for e-government. In fact, this has to be only a part of an integrated strategy for e-government.

3.1 Strategic Aspects
A successful e-government initiative and ultimately a digital society in a third world country would involve profound strategic shifts, which are as follows.

Vision	Developing a vision for Government as a whole
E-Government Services Delivery Model	Design a model for E-Government services delivery crossing traditional departmental boundaries.
E-Governance Framework	Develop an e-governance framework, covering legislation, regulations, standards, and infrastructure for supporting e-government services delivery.
Socio-Economic Initiatives	Develop socio-economic initiatives for universalizing affordable digital access for all.
Organisational Structure	Put in place an organizational framework cutting across Departmental silos for planning, implementing and managing e-Government.

3.2 Operational Aspects

In order to implement the strategy, the following operational aspects should be considered:

Detailed Plans	These strategies have to be translated into clear measurable deliverables, involving development of applications and provision of infrastructure, which should be supported by detailed analysis of business needs, re-engineering of business processes and cost-benefit analysis.
Organisational Design Issues	From an organizational perspective, decisions have to be taken on assignment of responsibilities, and degree of centralization and integration and interface between Departmental systems. The Communities of Interest (COI) approach enables such integration to facilitate a one-stop shop for the users of Government services
Implementation, Management and Co-ordination	The above plans for application and infrastructure development will have to be implemented and managed effectively, with coordination across Departments. Key decisions would include centralized procurement, software licensing, outsourcing, and maintenance

4. The Omani Perspective

The Government of Oman is committed towards developing a digital society, providing e-government services. In fact, it considers development of a digital society as an important aspect of the socio-economic development of the country. Several key initiatives have been taken up towards achievement of this objective, including the setting up of a Ministerial IT Committee, supported by a high-level Task Force, with representation from top management in different Departments.

The Government commissioned a leading international IT consultancy firm to develop a strategy for e-governance; this was further extended to cover the strategy for development of a digital society. As part of this study, a detailed readiness survey of all Government entities was also carried out.

4.1 Pre-existing IT Systems

The Government of Oman has a centralized IT system for payments and accounting, as well as basic personnel functions like payroll; this is supported by a robust computing infrastructure and dedicated telecom links in all Government offices throughout the country. All payments and receipts are made and accounted centrally, and the payroll for the entire Government is managed centrally.

This application is a legacy application on an IBM mainframe systems on a DB/2 database, but has been running efficiently for the last two decades. Transaction processing is very effective, with MIS functionality being somewhat limited. While there are other IT systems in individual Government Departments, almost all of them are confined to organizational boundaries.

The other significant features include:

Networking and computing infrastructure in Government Departments is widespread and is not a bottleneck for E-Government initiatives.
Government Departments have computerized almost all their administrative functions, and in many cases their core business and support functions.
Almost all departments have a presence on the web, providing varying degrees of information.
Web-based querying facilities have been provided on certain key systems to the public.
In a few cases like electricity and water billing, the third-party billing agent has link-ups with commercial banks for internet-based payments.

There is no IT Law in place, and paper documents are necessary for validation, and supporting applications for Government services.

4.2 E-Governance Plan

A strategic plan for e-governance was finalized in end-2002, covering the following components:

Digital Society Readiness
E-Government Architecture
IT infrastructure
Applications and Communities of Interest (COI)
Telecommunications, Networking and E-Payment Infrastructure
Quick-win applications
Budgeting
Implementation Structures
Security, PKI, Audit and Business Continuity Planning
E-Legislation
Education and Development

5. SAI's Risk Assessment
The SAI commenced its evaluation of e-governance in Oman, by reviewing the strategy for e-governance as well as the status of implementation of the strategy. We identified the following key risk areas for e-government, based on our review:

Lack of Clarity of Vision	The business section of the strategy documents were focused on theory and methodology, rather than on identification of specific issues in the Omani context. However, in our view the strategy should have commenced with an analysis of : · The important services or categories of services, presently being rendered by Government Departments, as well as those planned to be rendered · The current mode and processes of such service delivery for a few key services · An economic model to justify the movement of IT-enabling these services · A strategy for review of all services from a BPR perspective - before IT enabling, combined with an actual review for a few key services · A migration strategy for IT enabling services
Communities of Interest Model for Oman not developed	The study focused on the business case for COIs, rather than developing COI models specifically for Oman. The study focused a framework for classifying COIs, rather than developing actual COI models for Oman. There was a brief listing of suggested COIs. However, there is no discussion of the benefits arising from breaking down departmental barriers for the suggested COIs, let alone an analysis of the existing systems within the suggested COI boundaries and a plan for migration of these systems and data to the integrated COI-based applications.
Lack of Business Focus	The study did not adequately analyse existing business processes and the scope and need for Business Process Re-engineering (BPR). All its studies focused on the technical aspects of computerization, but totally ignored the business aspects.
Lack of Economic Cost-Benefit Analysis	We recognize that introduction of e-government would result in both direct and indirect benefits to individual Government Departments as well as the country as a whole. However, like any other developmental project, it is necessary to quantify or. estimate the indirect benefits as a whole. This may also be done taking the Community of Interest as a base, instead, the strategic documents used anecdotal evidence from Ireland and case studies in the USA to support the business case for introduction of e-government. While it is instinctively felt that e-government will facilitate economic development, an economic impact study is important requirement to deploy valuable financial and human resources on such a project, as well as to decide the prioritization and timing of various COIs.
Lack of Integrated Approach	Despite a centralized strategy, the e-government task force could not force an integrated approach for quite some time. The Task Force was not suitably empowered to enforce its decisions on various government departments. When this task was delegated to the Task Force, the government departments had already moved on, leaving Task Force to play catch up.

6. Further Action

Our review of the Government of Oman's e-government strategy revealed several risk areas related to non-alignment of business needs and IT Requirements. This review also enabled us to identify entities / subjects for detailed audit.
The second phase of our review will comprise IT audits of selected IT applications forming part of the e-government framework. For this phase, we are presently preparing detailed audit plans, based on the risk areas and entities/ subjects identified by the SAI in the first phase.

Footenotes:

[1] 'Since the SAI's audit mandate precludes it from making its audit findings publicly available, we are constrained in our ability to provide details of findings. We are therefore concentrating on the audit methodology and strategy, rather than on details of individual findings.