TECHNICAL SERVICE PROVIDER (TSP)

AUDIT AND INSPECTION AUDIT REPORT ON TINGA RURAL BANK DATA MIGRATION

25TH May 2010

Table of Contents

1.0 BACKGROUND......................................................................................................2 2.0 OBJECTIVES OF THE AUDIT...................................................................................3 3.0 METHODOLOGY ...................................................................................................3 4.0 OBSERVATIONS, IMPLICATIONS AND RECOMMENDATION....................................3 4.1 SERVICE PROVIDER TECHNICAL SUPPORT.........................................................3 4.2 DATA MIGRATION COMMITTEE...........................................................................4 4.3 DATA MIGRATION METHODOLOGY....................................................................5 4.4 STAGE/PHASE REPORT.......................................................................................5 4.5 DATA MIGRATION REPORT.................................................................................6 4.6 USER TRAINING ................................................................................................6 4.7 TESTING AND VALIDATION................................................................................7 5.0 CONCLUSION......................................................................................................10

1.0 BACKGROUND This audit was included in the 2011 Internal Audit Strategic Plan. The Internal Audit undertook the audit of the recently concluded data migration done by the MIS team. The computerisation of the banks operations was in

line with the restructuring requirement of the Bank and it involves the migration of data from manual system of operations to computerized system using BANK WIZ software. The data migration scope requirement was to be bank-wide programme. The installation of the BANK WIZ software was to enhance speed, accuracy and reliability of the information system for the smooth operations and reporting framework of the bank. 2.0 OBJECTIVES OF THE AUDIT The objectives of the audit are as follows: To ascertain the appropriateness of the entire migration process; To verify the integrity of the data populated in the software; To verify the completeness and accuracy of data migrated; To ascertain the accuracy and completeness of the report generated b y the system;

3.0 METHODOLOGY Because of the voluminous and manual nature of the data migrated, we carried out our tests on sample basis for transactions of such nature e.g. customers account balances. Records of customers account balances were also viewed from Bank WIZ software. We vouch manual records with system generated printouts to ascertain completeness and accuracy of general ledger accounts. We also carried out interview with key users and a member of the data migration team to establish the appropriateness of the data migration process. 4.0 OBSERVATIONS, IMPLICATIONS AND RECOMMENDATION 4.1 SERVICE PROVIDER TECHNICAL SUPPORT Observation We observed the data migration of the bank was solely carried out by 4 RBs recruited IT staff and IT Manager (Team Leader) without the technical support of service provider or it representative.

Implication

The presence of the software provider during data migration is very crucial, as their technical support is inevitably required throughout the entire process. Hence their absence in the data migration of the bank leaves the entire process questionable in terms appropriateness of the pre conversion technical arrangement such as the ensuring the appropriateness of the software set up and migration methodology or approach. Recommendation We recommend that the service providers who are the owner of the software should take the leading role in terms of the providing the technical support regarding the software set up, configuration, customization etc to ensure smoothness of the migration process. Benefit The full participation of the service provider in the data migration process will save time and ensure accuracy and reliability of the software. 4.2 DATA MIGRATION COMMITTEE Observation We observed that there was no committee established for providing oversight on the data migration team and it activities, such project requires thorough supervision and monitoring to ensure accuracy, cost effectiveness and reliability of the entire process. Implication Lack of supervision and monitoring of the data migration process by an established committee leaves the entire process unsupervised and hence a recipe for inefficiency and irregularities in the process as critical issues may arises, for which no proper scrutiny of solutions adopted is done. Recommendation We recommend that a data migration committee comprising key stakeholders (i.e. Board, TSP representatives, and banks management representative) be established to oversee the migration process. Benefit

This will ensure appropriate supervision and monitoring of the data migration process and thus the achievement of the objectives of the project.

4.3 DATA MIGRATION METHODOLOGY Observation We observed that there was no defined and approved data migration methodology to serve as blueprint which should have encompasses type of migration, Risk assessment, Pre conversion arrangement such as ensuring the integrity of the data to be migrated, Post migration activities (i.e. provision for inputting data that were not inputted during the migration phase) and Validation etc. Implication The non availability of a defined and approved data migration methodology may lead to inconsistency and chaos in methodology used in the process which can increase the error level and hence makes the integrity of data populated in the system doubtful. This was obtained clearly as the cut off for balances brought forward was modified from 2009 balances to 2010 balances for customers account balances. Recommendation We recommend that the data migration methodology should be defined, approved and documented before data migration to ensure quality of the process. Benefit The direction, scope and quality of the process will be ensured. Benefit This will ensure accuracy and reliability of data migrated. 4.4 STAGE/PHASE REPORT

Observation No evidence migrated stages reports was sighted. Implication The none existence of migrated stages reports makes accountability and transparency of the process opaque, hence decisions made on matters arising during the process cannot be ascertained for review.

Recommendation Data migration report should be submitted for every phase completed in the process by the project or team leader. Benefits This will ensure accountability ad transparency in the process. 4.5 DATA MIGRATION REPORT Observation We observed that there was no summary documentary report on the completion of the entire data migration project of the bank. Implication This makes independent review very difficult as major amendments in approach may have taken place that cannot be clearly explained if not properly documented. Recommendation Summary documentary report should be done at the end of the data migration project. Benefit This will give clear explanation for major modifications made during the migration process. 4.6 USER TRAINING

Observation We observed that user training was not conducted for some key users of the software before the full operation of the software. As a result, Customer Service Clerk cannot do account opening and Accountant cannot do back office posting hence depicting a very critical skills gap. All postings are observed to be done by the Teller. Implication This is a very serious operation risk for the bank, as the segregation of duties and dual controls preventive mechanism is completely lacking, hence leaving the bank exposed. Recommendation We recommend that upon fixing up of the system, all users must be properly trained before full operations of the system. Benefit This will ensure effective use of the system. 4.7 TESTING AND VALIDATION In carrying out this procedure we compare system printout to data migrated on a sample basis. Observations From the walkthrough test we employed to validate data migrated, we observed the following discrepancies:
a) Account Balance: - We review a sample of accounts balances and we

observed that some current account (especially, current account holders that have OD facilities e.g. Samah Beah, Salim Murlim) balances in the GL are inconsistent with the individual accounts in the system.
b) Building:-No opening balance was brought forward from the 2010

balances in the manually generated Trial Balance in the BANK WIZ system for accumulated depreciation-building;

c) Motor Vehicle:- No GL account was opened in the BANK WIZ system

for accumulated depreciation-motor vehicle; furthermore, there was inconsistency in the Motor Vehicle GL account with the manual Trial Balance;
d) Safe:-No opening balance was brought forward from the 2010

balances in the manually generated Trial Balance in the BANK WIZ system for accumulated depreciation-safe, furthermore, the balance brought forward for the safe account in the BANK WIZ is also inconsistent with the manual Trial Balance;
e) Plant:-The accumulated depreciation balance for plant in the BANK

WIZ is inconsistent with the balance in manual generated Trial Balance;

f) Computer Suspense Account: - we observed a continuous increase

in the balance in this account (stood at Le190, 701,370.93 as at 20the October 2011) with descriptions ranging from miss-postings reversal, late posting transactions, reversal of excess postings etc.
g) Loans Account: - we observed that the loan account were not

properly posted into the BANK WIZ, such that the system takes the disbursement date to be the date of postings and because the loan term was not adjusted for the outstanding loans posted, the system over charged the loan repayment for loan customers whose loans cleared, thereby overdrawn their personal accounts whilst reducing the loan portfolio. Examples of such are below:

DATE

ACCOUNT NO.

OVERDRAWN AMOUNT

20-Oct11

001-754270-01

636,083.68

20-Oct11 20-Oct11 20-Oct11 20-Oct11 20-Oct11

001-754670-04 001-754690-03 001-754362-01 001-754943-01 001-7544721-02

612,616.13 355,795.64 596,423.97 269,482.00 45,756.37

h) Furthermore, the postings of periodic provision for depreciation were wrongly charged to the assets accounts instead of the provision for depreciation and Accumulated depreciation accounts. In addition an incorrect charge with description as cost of depreciation is debited in the assets accounts e.g. safe, office equipment.
i) Opening Balances: - Opening balances of some GL accounts were

transposed such that accounts were debited instead of being credited and vice versa e.g. Motor Vehicle A/C, Accumulated DepreciationPlant.
j) Report generated: - Based on the above errors identified, without

exaggeration financial reports generated are found to be incomplete and inaccurate. Implications The numerous errors mentioned above are clear indication; Poor data migration approach; Probable improper system set up;

Lack of the required accounting skill for uploading of GL balances; The use of un-cleaned data;

lack of technical and oversight support by service providers and data migration committee respectively;

Lack of stages testing and validation.

Recommendations Data validation is a very crucial component of data migration and adequate safeguards have to be built in the migration process to ensure that the exact status of the records before and after the migration is captured. 5.0 CONCLUSION From the above observations, we recommend that the entire process be recreated as it is crystal clear that the data migration was controlled based on the fact that there are lots of critical errors as aforementioned hence appropriate corrective measures is required to ensure proper performance of the software. In this vein, we recommend the following steps amongst other be incorporated in the data migration methodology;
1. First and foremost a data migration plan must be established,

documented and approved by key stakeholders (Data Migration Committee) to serve as blueprint for the entire process. The migration plan components should include, but are not limited to: o Migration strategy and key activities o Dependencies o Required equipment and migration tools o Customer expectations (customer operational requirements) business, technical and

o Test plan (Testing should be carried out at specific stages in the process) o Verification procedures should be defined. o Risks and contingency plans o Change control procedures

o Project schedule o Post implementation activities/responsibilities o Migration completion criteria

2. Pre Conversion Activities: This activities should involves:

The service provider must ensure that bank-wide static global data and module-wise and product related set up is appropriate (i.e. Software by appropriately customized in line with banks policies for respective modules of it operations. Cleaning of the banks books of account to establish the integrity of the data to be migrated. This will involve reconciliation between GL accounts, source documents and Income Statement ; User training prior migration to facilitate participation of bank staff if deemed necessary or to ensure correction of the application software.

3. Data Validation: Data testing and validation is an important

component of data migration and adequate safeguards have to be built in to ensure that the exact status of the system before and after the migration is captured. This can be accomplished by using reports to compare data migrated and should be done for every modules migrated.

4. Post-conversion Activities The data that could not be converted due to reasons like unavailability in the extraction file or due to erroneous source values needs to be manually maintained as a post-conversion activity. The procedures for post conversion activities must be incorporated in the migration plan. 5. Regularly report on progress made against migration plan should be communicated to the Data Migration Committee for verification and certification. 6. Detailed project document of the entire process should be prepared and submitted upon completion for verification by the Data Migration Committee.

Submitted By: Team A2 Audit and Inspection-TSP