In FY 2006-2007, the City and County of San Francisco spent more than an estimated $173 million on its information technology systems, including personnel, hardware and software, and contracts with third-party vendors. This amount of $173 million was approximately 3.0 percent of the City's total FY 2006-2007 budget of $5.7 billion and was more than the budgets of 45 of the City's 53 departments.

The City's expenditures for information technology are increasing at a faster rate than expenditures overall. From FY 2004-2005 to FY 2006-2007, the City's total information technology expenditures increased by $41 million, or 31.0 percent, from $132 million in FY 2004-2005 to $173 million in FY 2006-2007. At the same time that information technology expenditures increased by 31.0 percent, the City's total budget increased by 14 percent, from approximately $5.0 billion in FY 2004-2005 to approximately $5.7 billion in FY 2006-2007.

The City's information technology expenditures have a total annual cost just slightly more than the annual budgets of the City's Sheriff's or Recreation and Park Departments, and yet these information technology expenditures have little central oversight. Departments are left to develop and implement information technology systems with inconsistent guidance on such things as total cost of new systems; type, quantity, and quality of operating systems and hardware; project management; maintaining inventories; and information security. Rather than the City taking a forward-thinking approach and implementing systems that coordinate efficiently across departments and that are responsive to the dynamic industry of information technology, the City continues to leave its departments to attempt to maintain basic functionality on their own, barely managing to keep up with a dynamic and exponentially growing industry and the demands of a citizenry that expects more and more with each new technological development.

City departments, and by extension the City overall, place a higher priority on immediate service delivery over long-term information technology systems functionality. As a result, most technological upgrades happen only when required to do so by law or because the existing systems have failed. Departments have little incentive, financial or otherwise, to willingly develop or deploy information technology systems that exceed a bare minimum threshold and few departments have a mature enough approach to their information technology to have the necessary planning processes which would allow them to plan with a long-term approach. As a result, citywide information technology planning, processes, and projects occur quite differently from department to department, resulting in redundant systems and lost opportunities for best practices improvements.

The Committee on Information Technology

In June of 1997, the Board of Supervisors created the Committee on Information Technology, or COIT, (Ordinance 223-97) and gave it the following responsibilities:

(1) Take a leadership role in encouraging and coordinating departmental efforts in the use of new technology;

(2) Promote interdepartmental cooperation and City information technology standards; and,

(3) Review major interdepartmental and citywide information technology projects and make recommendations on those projects.

The Committee on Information Technology is comprised of 10 people, including (a) six department heads, one from each of six service areas; (b) the Mayor's Finance Director; (c) the Controller; (d) the Director of the Department of Telecommunications and Information Services; and, (e) one member of the Board of Supervisors. For the past year, the Committee has been chaired by the Director of the Department of Telecommunications and Information Services.

Reorganization of the Committee on Information Technology

Since its creation, the Committee on Information Technology has been the body responsible for promoting information technology standards and taking a leadership role in the use of new technology. The original Committee included two subcommittees: (1) a Strategic Management Planning Group, which kept track of progress in the development of information technology systems across the City; and, (2) an information technology managers group, although the information technology managers group dissolved six years ago. The new Chair has created four subcommittees, as follows: (1) Planning and Budgeting, (2) Performance and Project Management; (3) Resources, which includes efficiency in procurement and staffing efficacy; and, (4) Architecture, which includes policies, procedures, and security protocols. These four subcommittees, while organized around basic concepts, were provided no clear direction from the Chair at their inception and have spent their first few months primarily developing work plans and organizing principles.

In 2006, the Committee on Information Technology met twice, and the Committee has no minutes for any meetings from 2003 through 2005. However, in 2007, the Committee has already met seven times in the first seven months. This appears to be a direct result of the reorganization of the Committee under the new Chair and the hiring of new full-time staff in the Department of Telecommunications and Information Services to support the Committee, including a new Director. However, the four new subcommittees have been experiencing logistical challenges holding meetings on a regular basis.

The Committee on Information Technology's Important Role for Oversight of Information Technology Systems

The Committee on Information Technology is the only City body tasked with a leadership role in coordinating departmental efforts in the use of new information technology systems. The Committee's virtual absence from this role for several years until its recent reorganization has resulted in departments operating with no guidance or direction in the development of their information technology systems during that time. The intent of the Committee's reorganization is that it will now provide the guidance that has been lacking for City departments as they make their information technology budget and project decisions.

The Department of Telecommunications and Information Services

The Department of Telecommunications and Information Services was created in 1997 through a merger of functions that were previously subsumed within other City departments, including Information Services, under the Controller, and Electricity and Telecommunications, under the Office of the City Administrator. Telecommunications and Information Services provides departments with access to basic communications tools, such as telephones and high-speed internet. The department further offers project management as a service to departments, although the utilization of such service is not required of departments. Indeed, while departments work with Telecommunications and Information Services during the annual budget process to determine their total project management needs for the upcoming budget year, once the budget has been approved, any projects that come up mid-year are likely to involve project management by some entity other than Telecommunications and Information Services, whose annual staffing levels are predicated on that year's budget negotiations between Telecommunications and Information Services and all City departments.

While Telecommunications and Information Services has positioned itself as a service provider to departments for their information technology needs, many departments reported project delays or other issues in which they relied upon Telecommunications and Information Services for project management, development, and implementation. As a result, many City departments prefer to pursue information technology projects either with their own internal staff or through third-party vendors.

The City's Chief Information Officer

For about the past year, the Director of the Department of Telecommunications and Information Services has been serving in the role of the City's Chief Information Officer, or CIO. The purpose and function of the Chief Information Officer has not been established or defined by the Board of Supervisors or the Administrative Code. The need for and function of a Chief Information Officer, whether the Chief Information Officer is a technical or policy position, and who should fulfill that function are all issues that need to be discussed by the Committee on Information Technology.

Most of this report's recommendations are directed to the Chair of the Committee on Information Technology, who is also the Director of the Department of Telecommunications and Information Services and the Chief Information Officer. These recommendations are directed to either the Chair of the Committee on Information Technology or the Director of the Department of Telecommunications and Information Services, depending on whether the recommendation is intended to provide policy and oversight or operational improvements, to ensure that a specific official is responsible for implementation.

Budget Analyst's Recommendations

This report contains six findings and 32 recommendations, of which 29 are directed to the Chair of the Committee on Information Technology or the Director of the Department of Telecommunications and Information Services. According to the Director of the Department of Telecommunications and Information Services, the Department agrees with the 29 recommendations, of which many are in the process of being implemented through the reconstituted Committee on Information Technology or by the Department.

The Budget Analyst recommends that the Director of the Department of Telecommunications and Information Services, who also serves as the Chair of the Committee on Information Technology, report back to the Government Audit and Oversight Committee in March 2008 on the status of these recommendations, to ensure that implementation is in fact occurring in a timely manner and in accordance with the findings and recommendations of this report.

Although the Budget Analyst has not addressed specific recommendations to the City's departments, the departments will need to implement procedures and policies on their own initiative. The Administrative Code assigns a leadership role to the Committee on Information Technology, but neither the Committee on Information Technology nor the Department of Telecommunications and Information Services has the authority to oversee departments' information technology processes. The City departments will need to be responsible for implementing three key recommendations - developing information technology strategic plans, conducting information systems security assessments, and implementing information technology inventory policies and procedures. Therefore, the Budget Analyst recommends that each City department report to the Board of Supervisors during the FY 2008-2009 budget review on the status of (a) preparing their information technology strategic plans, (b) conducting information systems security assessments and implementing security procedures, and (c) implementing information technology inventory policies and procedures.

Methodology

In order to provide a comprehensive overview of citywide information technology, the Budget Analyst conducted this management audit as follows:

• A survey was administered to all 53 City departments, to which 45 departments responded, representing approximately 96.5 percent of the City's entire FY 2006-2007 budget;
  
  
• 14 departments were selected for further scrutiny by information technology topical area, based on service area, as follows:
  
  Public Protection: Fire and Juvenile Probation;

  Public Works: Airport, Building Inspection, and Municipal Transportation;

  Human Welfare & Neighborhood Development: Human Services;

  Community Health: Public Health;

  Culture and Recreation: Recreation and Park; and,

  General Administration and Finance: Assessor-Recorder, City Planning, Elections, General Services, Human Resources, and Treasurer-Tax Collector;

• The 14 departments selected for additional scrutiny were administered additional questionnaires and interviewed around the following topical areas: Planning and Procurement, Project Management, Resource Allocation, Security, and Asset Management; and,

• A separate case study was conducted for a closer examination of the process surrounding implementation of the City's Justice Information Tracking System, or JUSTIS, which involved interviews of all criminal justice departments.

In addition to these surveys, questionnaires, and interviews of numerous City departments, the Budget Analyst interviewed several City officials with responsibility over citywide functions, such as the Controller and the Director of the Department of Telecommunications and Information Services, and reviewed relevant documents and data.