SA Health urged to expedite Oracle rollout

SA Health has been urged to restart the second phase of a troubled $35 million Oracle implementation as a "high priority" to address continuing concerns over financial management and reporting.

The renewed pressure came from the state's auditor-general Simon O'Neill after the health department tabled account statements for the last financial year (pdf) six months later than required.

Health's delay was blamed on a range of factors, including the centralisation of finance functions with the department and the implementation of the whole-of-Health single general ledger based on Oracle.

The technical capability of the software did not appear to be an issue. Rather, the auditor-general said there was "inadequate management attention to the timely and effective implementation of financial accounts reconciliation and review processes" associated with the Oracle system.

This led to "unexplained" general ledger and bank account discrepancies that were investigated by O'Neill, delaying the finalisation of the department's 2010-11 accounts.

AdelaideNow reported late last year that about $90 million in unreconciled amounts were holding up the finalisation of the accounts. External accountants were engaged to try and sort out the issue.

O'Neill said that the reconciliation issues needed to be resolved to avoid similar reporting delays for 2011-12.

Last year, the auditor-general tabled a review of the Oracle project that criticised a lack of information on whole-of-life costs and benefits and delays in implementing aspects of the system - which meant legacy systems were kept running, adding to costs.

The first phase of the project commenced in July 2010 and was based on financial modules.

A second phase - broken into an undisclosed number of 'releases' - aimed to introduce more finance modules, while adding procurement and supply chain capabilities, such as warehouse management, inventory management and ordering.

Release one of phase two occurred at five sites in December 2010. It was to have continued in the second half of 2011-12, after scoping, planning and costing work was delivered to Cabinet.

However, O'Neill noted in a report last week that phase two "had not recommenced and Cabinet had not been advised of updated costs and benefits since the 2009 business case".

"It had also not been provided a formal update on the project status," O'Neill noted.

O'Neill urged SA Health to "continue to treat the planning and recommencement of the phase two rollout as a high priority".

"Until the legacy [finance] systems are decommissioned, the Department will require significant resources to maintain concurrently both the [Oracle] and legacy systems," he said.

"In addition, the continued delay in full implementation of the system and associated processes and controls heightens the risk that appropriate standards of financial management, reporting and accountability are not able to be met by the Department and health services".

Security and controls

Last week's long-awaited financial reports also disclosed details of a separate audit of financial and IT controls around the Oracle system that was conducted by O'Neill and submitted to SA Health last October.

The review found weaknesses in reconciliation processes and mapping between the Oracle system and legacy systems and a lack of formal documentation.

The Department acknowledged some of those weaknesses would not be "completely removed" until the Oracle rollout was completed.

O'Neill also uncovered system control discrepancies, including Oracle default accounts with unchanged passwords, accounts that had slipped into disuse or "appeared to belong to terminated staff and/or contractors" and access privileges that were above and beyond employee responsibility.

SA Health noted it had kickstarted a number of technical reviews of its own and had "appointed a new technical support vendor" for the Oracle project.

Telco bill management

The financial reports also provided a glimpse of an externally commissioned report into telecommunications management that was completed last year and supplied to O'Neill in January 2012.

The report built on the work of O'Neill last year that criticised SA Health for relying too heavily on the accuracy of invoices from telcos, exposing it to overcharging.

According to the new report, SA Health's billing management for telecommunications "appeared to be in a state of confusion”.

The external report also noted:

• Inadequate management of mobile radio systems that were critical for emergency/backup communications.
• Unsatisfactory backup and redundancy of services, that led to recent "prolonged service outages".
• Ageing PABX assets that were at capacity, "presenting a potentially unplanned capital replacement project ahead".

SA Health said PABX replacement would be discussed with the Office of the Chief Information Officer (OCIO).

It also said that some risks had been "remediated" and others would be remediated this year, though some of that work did not have timeframes attached.