Objective

To determine if the Office of Information Technology Services (ITS) is adequately monitoring information technology (IT) services procured from consultants and contract staff to ensure compliance with contract terms and deliverables. The audit covered ITS agreements between April 1, 2015 and July 12, 2018 and subsequent documentation and information provided by ITS through April 29, 2019.

About the Program

ITS provides statewide IT strategic direction, directs IT policy, and delivers centralized IT products and services that support the mission of the State. ITS procures services through consultants and contract staff and is responsible for monitoring services to ensure compliance with contract terms and deliverables. ITS has a contracts and procurement unit that oversees the procurement of contracts and other purchases, including those for IT services provided by consultants and contract staff. ITS procures IT consultants or contract staff services through a variety of mediums, including: Office of General Services centralized contracts, ITS agency contracts, discretionary contracts, and stand-alone purchase orders. In the fiscal year ended March 31, 2018, ITS had 747 contract employees supporting ITS functions and spent $50 million on contract labor.

Generally, contracts contain reporting requirements for contractors (e.g., performance metrics), which serve as a means for ITS to accurately monitor contractor deliverables. In addition to the deliverables and terms outlined in their contract or task order, contractors and consultants must comply with the predefined standards – generic terms and conditions for all ITS contracts – outlined within the State ITS Standard Contract Clauses.

Key Findings

• We found that, in general, ITS is monitoring IT services procured from consultants and contract staff to ensure compliance with contract terms and deliverables. For 14 of the 20 contracts we reviewed, ITS provided adequate oversight to ensure that the contractor or consultant was meeting the deliverables.
• For the remaining six contracts, for which ITS paid out more than $156 million, deficiencies in contract monitoring – primarily of contractors’ reporting and documentation requirements – create a risk that ITS may not have received the required deliverables.
• Most notably, we found significant monitoring deficiencies for the International Business Machines (IBM) Service Desk contract as compared to the others in our sample that also had monitoring deficiencies. ITS did not require IBM to submit summary reports that contained all the information required under the contract and that was necessary to monitor contract deliverables. Furthermore, one year after the contract start date, ITS executed a Project Change Request (PCR), including a pricing rate change. The PCR removed Service Level Credits, which eliminated the opportunity to reduce payments to IBM if certain performance metrics were not met. ITS did not provide documentation showing the PCR was necessary or in the best interest of the State. Furthermore, ITS did not obtain appropriate OSC approval for the PCR, as required.
• For the five other agreements, ITS similarly did not obtain required reports or other documentation from contractors or consultants or did not verify contractor or consultant performance.

Key Recommendations

• Strengthen monitoring of all agreements so that there is more consistency across ITS, and ensure that all deliverables are met and received within the required time frame in order to protect the interests of the State.
• Formally evaluate the IBM Service Desk contract and take necessary steps to ensure that the IBM contract staff are in compliance.