1st Session - 41st Legislature, Public Accounts 3, Aug 17, 2016

LEGISLATIVE ASSEMBLY OF MANITOBA

THE STANDING COMMITTEE ON PUBLIC ACCOUNTS

Wednesday, August 17, 2016

TIME – 9 a.m.

LOCATION – Winnipeg, Manitoba

CHAIRPERSON – Mr. Matt Wiebe (Concordia)

VICE-CHAIRPERSON – Mr. Reg Helwer (Brandon West)

ATTENDANCE – 11 QUORUM – 6

Members of the Committee present:

Messrs. Bindle, Helwer, Johnston, Ms. Klassen, Messrs. Maloway, Marcelino, Mrs. Mayer, Mr. Michaleski, Ms. Morley-Lecomte, Messrs. Wiebe, Yakimoski

APPEARING:

Mr. Norm Ricard, Auditor General

WITNESSES:

Hon. Blaine Pedersen, Minister of Infrastructure

Mr. Lance Vigfusson, Deputy Minister of Infrastructure

Mr. Scott Sinclair, Associate Deputy Minister, Finance (by leave)

MATTERS UNDER CONSIDERATION:

Auditor General's Report–Annual Report to the Legislature, dated March 2014

Chapter 10–Waiving of Competitive Bids

Auditor General's Report – Follow-up of Recommendations: Waiving of Competitive Bids, dated November 2015

Auditor General's Report – Follow-Up of Recommendations, dated May 2016

Waiving of Competitive Bids

* * *

Mr. Chairperson: Good morning. Will the Standing Committee on Public Accounts please come to order.

This meeting has been called to consider the following reports: Auditor General's Report–Annual Report to the Legislature, dated March 2014, chapter 10–Waiving of competitive bids; Auditor General's Report–Follow-up of Recommendations: Waiving of Competitive Bids, dated November 2015; and the Auditor General's Report–follow-up of previously issued recommendations, dated May 2016–Waiving of competitive bids.

Are there any suggestions from the committee as to how long we should sit this morning?

Mr. Jim Maloway (Elmwood): Well, I gather we have some time constraints in that we have to finish at noon anyway, so, if we're finished with the report, we could pass it before that period.

Mr. Chairperson: Okay. Is it agreed from the committee that we'll sit until noon unless the business of the committee is finished before that time? [Agreed]

Are there any suggestions as to the order in which we should consider the reports?

Mr. Maloway: I would suggest we deal with the report dealing with competitive bids.

Mr. Chairperson: In a global fashion? The–all through the global reports.

An Honourable Member: Sure. In a global fashion.

Mr. Chairperson: Okay. Is it agreed by the committee that we should consider the reports in a global fashion? [Agreed]

At this time, I'd like to invite the ministers and deputy ministers to the table, and could you please introduce your staff that are with you today.

Good morning.

Hon. Blaine Pedersen (Minister of Infrastructure): Welcome to the PAC, members. Hope we have a very constructive session.

I will introduce Mr. Lance Vigfusson, who is Deputy Minister of Infrastructure. And he will do his–okay.

Mr. Chairperson: And do you have any staff that are with you this morning?

Mr. Lance Vigfusson (Deputy Minister of Infrastructure): Yes, I do. I have Lynn–

Mr. Chairperson: Deputy minister. Pardon me.

Mr. Vigfusson: Yes, I do: Lynn Zapshala-Kelln, secretary to Treasury Board; and Scott Sinclair, he's acting deputy minister for Finance this week. And alongside of him is Francisco–Fernando Francisco, also from Procurement Services branch.

Mr. Chairperson: Thank you, Mr. Vigfusson.

We'll now move to opening statements.

Does the Auditor General wish to make an opening statement?

Mr. Norm Ricard (Auditor General): Yes, I do, Mr. Chair.

Hi. First I would like to introduce the staff member that I have with me. Behind me is Erika Thomas. She was the audit principal responsible for the original audit and for the subsequent follow-ups.

Mr. Chair, our initial follow-up report for the recommendations included in the waiving of competitive bids audit report was tabled on December 1st, 2015, and it was discussed at a Public Accounts Committee meeting on December 14th, 2015. The follow-up was conducted as at October 30th, 2015. We determined, at that time, that eight of the 25 recommendations had been implemented and that significant progress had been made on implementing a further eight.

We reproduced the waiving of competitive bids, follow-up report, in the May 2016 multi‑chapter follow-up report, in order to include, in one volume, all follow-up reviews of recommendations that came from our March 2014 report to the Legislature. It does not represent a more recent follow-up but it does include a brief discussion on a significant subsequent event that impacts the comments we included in the follow-up report for recommendations 7, 8, 11 and 13.

On November 30th, 2015, the day before we released our follow-up report, the contract disclosure regulation was registered. Section 6 of the regulation states that a contract for which the total expenditures from the Consolidated Fund will be less than $10,000 is exempt from the reporting requirement of section 80 of The Financial Administration Act. As a result, contracts issued subsequent to November 30th, 2015, with values between $1,000 and $9,999, will not be disclosed on the Procurement Services Branch website or on the public access database.

Mr. Chair, the second follow-up on the status of recommendations included in the waiving of competitive bids report will be assessed as at September 30th, 2016.

That concludes my opening comments. Thanks.

Mr. Chairperson: Thank you, Mr. Ricard.

Does the deputy minister wish to make an opening statement?

Mr. Vigfusson: Yes I do.

So I'd just like to acknowledge that I'm joined today with Lynn Zapshala-Kelln. I'm also presenting this opening statement on behalf of Manitoba Infrastructure, as well as my colleague from Finance, the Associate Deputy Minister Scott Sinclair, who's attending on behalf of Jim–Deputy Minister Jim Hrichishen.

On December 14th, 2015, this committee met to review the status of the previous Auditor General's follow-up of previously issued recommendations related to chapter 10, waiving of competitive bids, in the March 2014th annual report to the Legislature. The competitive tendering process ensures the interests of the public are protected. Departments must use this process as much as possible to avoid the risk of procurement improprieties. We are working to ensure that we mitigate this risk with strong and effective policies on untendered procurements. Further, the Province wants to ensure that all those involved in procurement are complying with these policies.

As part of the follow-up review, the Auditor General, through inquiry, analytical procedures and discussions with management, made conclusions as to the plausibility of the reported status of the 25 recommendations from the March 2014 report. As of October 30th, 2015, eight out of the 25 recommendations were implemented. Of significance, Treasury Board Secretariat now requires the department executive financial officer to complete and sign a financial overview form to accompany all Treasury Board submissions. The financial overview form contains a section on competitive procurement which must be completed when goods and services requiring Treasury Board approval are not completely or competitively tendered. This section requires documentation of the actual consultation with Procurement Services Branch.

Procurement Services Branch, or PSB, now requires that purchase orders for contracts greater than $1,000 be entered into SAP, which requires the input of a contract amount. SAP is then used to generate the proactive disclosure report on all contracts greater than $10,000.

PSB has made untendered contracts available on the Internet for public access.

* (09:10)

Of the remaining 17 recommendations, the Auditor General's October 30th, 2015, assessment concluded that the Province has also made significant progress on eight of the recommendations; that progress has continued. For example, PSB has amended the Procurement Administration Manual, or the PAM, to require that departments make public their intent to award a sole‑source contract over a set amount. Procurement Services Branch has updated the PAM with fair‑market-value methodologies and tools, requiring departments and SOAs to analyze and document how the price quoted on an untendered contract represents fair market value prior to contract signing.

PSB has also implemented a risk-based process to monitor compliance with policies on the waiving of competitive bids. They have updated the PAM to reflect the types of documentation required to form a valid record of procurement, including a checklist to assist departments, and reinforced by compliance evaluation added to the monthly contract review process.

PSB has also developed and implemented a communication strategy to ensure that the department and SOA officials are aware of and understand the PAM requirements. They've added a new section on ethical procurement and amended various other sections of the PAM. They've drafted a governing principles of procurement document, and once the governing principles are approved, it will be posted on both the internal and external websites as an educational resource to both vendors and to government staff.

Treasury Board Secretariat has completed a jurisdictional review of delegated authorities for untendered contracts during emergency events. They've also completed a review of whether the threshold for the reporting of untendered contracts is consistent with the disclosure objectives. And, with the passage of The Budget Implementation and Tax Statues Amendment Act, or BITSA, in 2015, and the contract disclosure regulation, TBS has established a disclosure threshold of $10,000 per contracts. We will continue to make progress on all the recommendations by the OAG going forward.

And, in closing, I would like to acknowledge the office of the Auditor General's continued professional and collaborative relationship with the departments of Finance and Infrastructure. I would also like to acknowledge their completion of the follow-up report.

Thank you very much.

Mr. Chairperson: Thank you very much, Mr. Vigfusson.

I'd also like to indicate at this time, if you'd like to bring any of your staff to the table to assist you in answering the questions, feel free to do so. [interjection] Yes.

Before we proceed further, I'd like to inform those who are new to this committee of the process that is undertaken with regards to outstanding questions. At the end of every meeting, the research officer reviews the Hansard for any outstanding questions that the witness commits to provide an answer and will draft a questions-pending-response document to send to the deputy minister. Upon receipt of the answers to those questions, the research officer then forwards the responses to every PAC member and to every other member recorded as attending that meeting. At the next PAC meeting, the Chair tables the responses for the record.

Now, before we get into questions, I would like to remind members that questions of an administrative nature are placed to the deputy minister and that policy questions will not be entertained and are better left for another forum. However, if there is a question that borders on policy and the minister would like to answer that question or the deputy minister wants to defer to the minister to respond, that is something that we would consider.

The floor is now open for questions.

Oh, Mr. Vigfusson.

Mr. Vigfusson: I'd like to seek permission as well.

This report that the OAG did was aimed at Procurement Services Branch, which now falls under the Department of Finance. It was under the Department of Infrastructure before. It also was directed at Treasury Board as well as departments and SOAs. We're going to confer with our answers, but I was–I'm seeking permission that on the questions related to procurement services and Department of Finance, if Mr. Sinclair could respond directly.

Mr. Chairperson: Is there leave of the committee to allow the assistant deputy minister of Finance to answer questions that pertain to that department? [Agreed]

Thank you very much, Mr. Vigfusson. Oh, Mr. Vigfusson.

Mr. Vigfusson: Just to acknowledge Scott's title, it's associate deputy minister.

Mr. Chairperson: Thank you very much, Mr. Vigfusson.

The floor is now open for questions.

Mr. Maloway: I'd like to begin by asking questions about the disclosure levels that have been established as $10,000 and ask why that level was chosen. I understand Alberta and Canada have that level, but what level do the other provinces have?

Mr. Scott Sinclair (Associate Deputy Minister, Finance): The jurisdictional scan we have actually shows that many jurisdictions have a disclosure level greater than $10,000. Quebec has it as high as $25,000. Canada is over $10,000. We actually follow the Auditor General's recommendations to increase the level from what it was at $1,000, which it had been at that level for several years, and decided to look at the $10,000 threshold as being as–a reasonable number to disclose it at, as reflecting business of a significant level that should be disclosed.

Mr. Maloway: I'd like to follow up, then, as to why the department couldn't have stayed at the $1,000 level that, as you say, you had for many, many years.

Mr. Sinclair: The threshold that was established at $10,000 in regulation is consistent with the Auditor General's recommendations on thresholds.

The Auditor General noted that Manitoba's previous threshold for disclosing contracts was set 20 years ago and that it should be periodically reviewed and adjusted. And compared to other jurisdictions, the $1,000 disclosure threshold was too low. The Agreement on Internal Trade actually establishes the disclosure for most jurisdictions at $25,000 and we have been operating significant lower than that. And, doing so, created a large administrative burden and contributed to significant reporting delays and inaccuracies, and the priority was put on putting information out into the public and making it available in a timely manner.

Mr. Maloway: Well, it seems to me that–you know, I want to go back to the ERP that was chosen, the SAP system that was chosen, I'm guessing, about 17, 18 years ago. It might have been by the Filmon government, but it was about that time period.

And the promise of the ERP and purchase of SAP over Oracle or other programs was, in fact, that this system was the most robust system out there. It had never been tried in a government environment up to that point. I mean, SA–the SAP system was used to–you know, in pulp plants and other plant situations, but no government anywhere in the world had an SAP system. So we were the first people to implement this system.

Now, the promise of this system was that this system was going to be very robust. We were going to be able to find out stuff in a moment, at very minute detail, and, if that is the case, then why do we have difficulty pulling out information on contracts of $1,000 or more when the system promised to deliver that and more?

* (09:20)

And I recognize that the module–and I'd like to know the–about how the system is configured at the moment, but, in the beginning, we didn't have all the modules. And I don't think we had this module at the beginning, so I'm not sure what year you started loading this stuff in there. But, if it's all loaded in there from $1,000 up, then what is the difficulty in producing a disclosure report?

Mr. Sinclair: The system itself, the RP system of SAP is not the 'precluser' or preventing us from producing a policy decision that was done in legislation to put it at $10,000 to be consistent, again, with the recommendations by the Auditor General and practices across other jurisdictions that have thresholds that are somewhat higher than that.

Mr. Maloway: Well, to me, that's not really a good answer here, because, I mean, I don't know what system the other jurisdictions are using.

If the other jurisdictions are operating on a legacy system that may be 20-plus years old, then I can understand that there would be a difficulty in maybe getting all those contracts on the system. But you have the best system in the world, supposedly. So, if you're inputting contracts from $1,000 and up, all contracts on the system, and you have the most powerful system, then why wouldn't you have a lower level of disclosure than these other jurisdictions who may not have the same system as you?

Mr. Sinclair: So Nova Scotia, for example, is an SAP jurisdiction like Manitoba and their disclosure is $25,000. So, again, it's not a system's function as to whether the data is in SAP; it's there. The total percentage of the spend that's represented by contracts under $10,000 or under–and that thousand is very low, and it was a decision–a policy decision was made that the effort to put into pulling that information and publishing it vastly outweighed the value that would have been in putting it up there so.

So, again, a policy decision was made based on recommendations by the OAG to set the threshold at $10,000.

Mr. Maloway: So, clearly, what you're telling us, then, that it's not a system problem; it's not SAP's problem. The contracts are all entered into the system; that's done, and the system is very efficient at pulling out all your information.

So the question then is: Why can't we have that level of disclosure that–if it's that easy to pull out, then–I mean, you're picking a limit of $10,000. You're entering all the contracts. What is the difference between putting a parameter of $10,000 or a parameter of $1,000? To me, it takes the same one or two minutes to do that. It's just a different parameter. The system will pull the information,

Mr. Sinclair: So, in the Auditor's Report and in the questioning around that, the OAG noted that the current low threshold rate captures many small transactions that account for only a small percentage of the total value dollar disclosed.

The OAG further recommended that $10,000 be considered for public recording as it would cut administrative workload by two thirds from what it currently was. And although the new system provides for increased automation, it still required that all contracts to be publicly disclosed are reviewed by departmental staff and central agency staff for accuracy and error.

Increasing the volume contracts that require review increases cost for what is, in effect, a very small percentage of the total government spend, is neither appropriate for risk-based monitoring or ensuring value for public expenditures, including allocation of staff resources and time.

Mr. Maloway: So what you're saying, then, is that system can provide the information. If you want the information, you can get it, but because there's a requirement that staff have to physically sit down and read these contracts before they enter them–I don't get it. I mean, they have to look at these contracts. How do they get into the system in the first place if they don't read them? Like, why is there an additional cost and staff time in fulfilling the disclosure part of the requirement? I mean, you're actually putting the system, putting these–this information on the system; it has to be done. So you've just arbitrarily picked a level at which you're going to disclose. But this–but the information's on there. They're already looked at this stuff, presumably before they put it on there. Surely they don't just make up numbers and put it on the system. They look at the contract; they put the information on there. Now it's on the system. Once again, what is the problem? Why would there be additional cost here?

Mr. Pedersen: Mr. Chair, I think we're venturing into policy areas, and the–it was the policy of the previous government that set the $10,000 level as based on the recommendations from the Auditor General. So, if the member is suggesting that we should review this as a policy, this government will certainly take that under consideration. But, just so that everyone on the committee is aware that this policy was set by the previous government at the level of $10,000, based on the Auditor General's recommendations.

Mr. Ricard: I just want to clarify a matter, because I'm hearing the minister and the associate deputy minister indicate that we had recommended a $10,000 threshold; in fact, we did not. We comment that a $10,000 threshold is in place in Alberta and Canada. What we recommended was that the Province periodically review whether the threshold for reporting untendered contracts is consistent with its disclosure objectives and to adjust it if necessary. So it's a policy decision. I just want to be very clear that our office did not recommend a policy level. Thank you.

Mr. Maloway: I appreciate that clarification. I understand why that would be the case. I mean, part of the disclosure problem, presumably, is a function of the computer system that you have running in your jurisdiction. If you have a legacy system that's 25 years old, then, presumably, it maybe cannot produce the reports that you would need and you would be spending a huge amount of staff time, you know, inputting a $1,000 contract. But that's not the case here at all. You–the module–I mean, originally, when we bought SAP, we didn't have that module. I think you'll confirm that. I don't know what year. Can you tell me what year that the government did purchase the module that we're discussing today?

Mr. Sinclair: The module that you're referring to has always been a part of the original licences that were purchased as part of the ERP system.

Mr. Maloway: So, in the original purchase, that module was purchased. Was it activated? Was it implemented in the first go-round?

Mr. Sinclair: I just wanted to respond initially to the Auditor General's comment, that we do stand corrected on that, that it was our misunderstanding that the interpretation was based on the auditor's reference to a $10,000 threshold and not an explicit recommendation of such on that front.

To answer your question, the materials management module has always been activated from the day that we initiated the use of SAP as the Province's ERP system.

Mr. Maloway: So, if it was there from the beginning of the SAP implementation, were there problems in using that module from day one, or did–was it a smooth transition?

* (09:30)

Mr. Sinclair: So the–just wanted to clarify that the SAP system, while it produces the information, that that isn't what is directly provided into the public for it to review. That would be–a look into the ERP system would be a security issue, or looking at those, so people aren't going into SAP and looking at the contracts; they are pulling the information out, putting it in a different format. And then staff review that to ensure that there are no human errors, to ensure that the information that is being posted publicly is what needs to be posted in that sense.

Mr. Maloway: I'd like to know whether–you mentioned earlier that Nova Scotia has SAP system as well. And what you probably do know about that is that Nova Scotia leveraged their SAP system in, I think, better fashion than we did here in that they got a much lower per-user cost by getting the city of Halifax and the big–I think the biggest hospital in Halifax on the system.

And I don't think that has happened here. I think that the City of Winnipeg went and bought Oracle. I think there was an effort, on the part of the government, to try to get the city into SAP as well. And there's a recognition that, whatever system you go with, whether you go with SAP, whether you go with Oracle, at the end of the day, having one system and more and more jurisdictions on it will produce a much better cost factor.

Now, I don't know where we're at right now with that in Manitoba. Are we still confined to the government, or have we made any efforts to get the city, any of the municipalities on this system? Or any of the hospitals? What are the hospitals doing right now? Can you give me an overview on where we're at with this?

Mr. Sinclair: So there are a number of different ways that SAP can be implemented as an ERP solution. And, certainly, Nova Scotia has done it in a way, and Manitoba has done it in a somewhat different way. And we regularly communicate, with our colleagues in Nova Scotia, about their successes as they look to us for some of the successes that we've had in our implementation. And we're constantly looking at and revisiting how best to leverage our ERP system to derive the best value for government enterprise.

We're also talking to, actively, the Winnipeg Regional Health Authority and Manitoba Hydro, who are also SAP users in the province of Manitoba. The City of Winnipeg is not an SAP user. They don't use that as their enterprise system, so we wouldn't be having that conversation. But, certainly, the WRHA, eHealth Manitoba and Manitoba Hydro are open and interested, very interested, in how we can partner in the use of SAP and leverage the–our common asset for the benefit of Manitobans.

Mr. Maloway: And, surely, at some point in time over the last 17 years, somebody's done a review of this system to see whether we have any savings as a result of going this route.

I do recall that upon implementation of the system, it seemed like just a year went by and we had to buy a really expensive upgrade. This system, as you know, is constantly being upgraded and every time we upgrade, we're stuck with a whole bunch more costs. And the promises that were made were that we were going to have all these efficiencies relative to where we were before, and we were going to be able to have staff reductions and stuff like that.

And what kind of studies have been done, if any, and when, and what were the results of those studies?

Mr. Sinclair: So procurement services and Treasury Board Secretariat have developed a reporting tool that interfaces with SAP that's designed to extract the information directly from SAP to fulfill the reporting requirements that were recommended by the OAG. This was released on September 28th, 2015, and contract information's posted online and includes monthly summaries of purchase orders and outline agreements worth $10,000–or more at the threshold that we've discussed. Details including the name of the vendor, the purpose of the contract, the value, the duration and significant contract amendments.

So this is a reporting tool that rests outside of SAP. It's not an SAP solution, but it draws its data from SAP. Furthermore, the existing untendered contracts reports have been posted online as well as on the procurement branch website. As I said before, in the context of SAP more broadly, beyond the contract, or the materials management module, we are always looking at the best uses of our ERP system for system delivery and our IT needs, and having conversations with other entities in the province.

But, at this point, we don't have information available to us today on the savings that have been derived from the implementation of SAPs in ERP system.

Mr. Maloway: But presumably, when the government purchased the system, they did it on the basis that–this is an expensive proposition. So they did it on the basis that, over time, it would pay for itself, presumably. That's how these things are sold. You know, you don't come to your customer and sell a multimillion-dollar system and–on the basis that their costs are going to go up as a result of you buying the system. The–surely, they've told the government that they would save staff; they would save money by buying the system.

And presumably, after like seven–after a number of years, there would be some auditing done on this or reviews done on this system to see how things are working, to see, was it successful, was it not successful. And you've talked about your different modules and how you–you know, conferring with Nova Scotia and other places, so, clearly, there's some hit and miss in this–in the development of this system. So I'd like to get some information as to what sort of reviews have been done within the department.

Mr. Pedersen: Again, this is more policy related, and both my department and the Department of Finance will take these recommendations under review. And our red-tape review, this is an ideal chance to have it under the red-tape review.

* (09:40)

You know, obviously, we've been in government for 100 days; we haven't got all the problems fixed for the last number of years, so we'll take that recommendation as under advisement for the red-tape review to see if there is a better reporting system out there, then, as the member is suggesting there may be.

Mr. Blair Yakimoski (Transcona): I'm new to this, so there are some what we call TLAs, three-letter acronyms, being thrown around. I know what SAP is. What's–is it ERP?

Mr. Sinclair: It's–ERP is an enterprise resource product. So it's a central system that you use for the entirety of a– [interjection]

Mr. Chairperson: Mr. Yakimoski?

Mr. Yakimoski: It is a program just like SAP that works with it?

Mr. Sinclair: SAP is an ERP, is an example of an ERP.

Mr. Chairperson: Mr. Maloway.

Mr. Maloway: Well, I think Blair wanted to–

Mr. Chairperson: Oh, sorry. Mr. Yakimoski.

Mr. Yakimoski: So, in a contract, how quickly is it entered into SAP?

Mr. Sinclair: So all bids that are received in response to a tender are entered into SAP, and then a contract is issued against–or entered in SAP against the awarded bid or the successful bid.

Mr. Yakimoski: What is the policy regarding–or timeline? How quickly are they entered?

Mr. Sinclair: All proposals–tendered-response proposals received are entered immediately into SAP upon receipt.

Mr. Yakimoski: Immediately means days? Weeks?

Mr. Sinclair: Within a couple of days received.

Mr. Yakimoski: I read, within the reports, some places that there were some previously awarded untendered contracts that weren't entered into the system for quite some time. Was there direction to not enter them? Was it a misstep, a procedure not applied properly? Can you elaborate on that?

Mr. Sinclair: So there would never be any direction provided to departments to not enter information on contracts into SAP, but there has been significant–sorry–significant work has been ongoing. Communications with departments on contracting policies and reporting requirements have been undertaken since the Auditor General's Report to–as well as tightening of controls. Treasury Board secretary is developing further systematic administrative policy communication protocols to ensure effective development and dissemination of policy changes to all appropriate audiences in government, and some elements in progress are in place to improve policy. And developments in communication include improved communication and collaboration through a SharePoint site was developed, memos to executive financial officers and senior financial officers communicating the changes, and the financial administration information circulars have been created to document, communicate, and track all changes to the GMA related to this.

Mr. Yakimoski: So you're saying that you received no direction from a minister to not enter or to delay entry, at any time, of any untendered contracts?

Mr. Sinclair: My initial–so my comments were that we are not aware of any central direction from government to not enter any new contracts into SAP and not aware of any specific direction to–from elected officials to not include anything.

Mr. Yakimoski: In your opinion, is the SAP system being utilized properly and effective for the needs of the province?

Mr. Sinclair: Yes.

Mr. Ted Marcelino (Tyndall Park): I'm new in this process, and, yes, this role, and one problem that I have is that I seem to gather that there's no security precautions as to who has access to the SAP.

How many people have access and have passwords to the licensing authority of the SAP, if you know?

Mr. Sinclair: One of the benefits of SAP as the RP system is the security components to it, and the SAP security is based on roles that are defined by the comptroller in consultation with department EFOs–executive financial officers. Executive financial officers in departments make determination as to which individual jobs have what roles and can see what information in SAP, so information is controlled quite stringently from that perspective, and there are very few roles that have a corporate view. Most of SAP–or the vast majority of SAP information is within a department, so those roles are only able to see information from within their departmental roles that are assigned to them.

* (09:50)

Mr. Marcelino: So would we have any number of government employees who would have access? Let's talk about your department. How many people are allowed to have access to the computer system and have a password to change, delete, amend or delete any information from the SAP system?

Mr. Sinclair: We would need to get back to you with a specific number of users that use SAP. And, just to note, that users use SAP in very different ways. So a number or a count of how many people can use SAP tell–may tell different things.

But, just to speak further on the security aspects of it, there is no ability to delete a record from SAP. There is a tracking around every transaction that is done. There will be a record of what transaction by whom did that. And there is also something within the SAP security framework called segregation of duty so that it takes more than one person in many instances of financial transactions to actually execute that financial transaction. So it isn't a singular person that could do that, in many cases, not all cases.

Mr. Marcelino: So I understand, from your answer, that there's no way that a–let's say an untendered contract of 10,000 or more–could be split up so that it would show in the system as being 5,000 each.

Is that possible? If you know.

Mr. Sinclair: It–I mean, a contract can be set up in SAP. SAP doesn't define how those contracts are put in; the user enters the information into the system in those sense. Doing so would be outside of the comptroller framework that we have for contracts.

Contracts aren't supposed to be broken up into its component pieces in order to avoid thresholds. And there are various thresholds, whether they're tendering thresholds under the Agreement on Internal Trade, or disclosure thresholds that your–parcelling of contracts, or breaking up of contracts, is outside the comptroller frame–comptrollership framework for the province. [interjection]

Mr. Chairperson: Mr. Marcelino.

Mr. Marcelino: Sorry; still new.

Are there any tracking systems as to who made the deletions or changes or amendments under the system?

Mr. Sinclair: Yes. As stated earlier, all transactions that are done in SAP, there is a tracking or an audit function that you'll be able to identify if what transactions were done and by whom they were done by. So, if something was removed or taken out of or entered into, we would have a report to–that could be produced on that.

Mr. Marcelino: So, if I were to ask a technical question regarding how the accounting process in the government–all government departments, you–we are dealing with cost centres, aren't we?

Mr. Sinclair: Yes. Budgets are divided up by cost centres, yes. [interjection]

Mr. Chairperson: Mr. Marcelino.

Mr. Marcelino: Sorry. If I were to access a certain contract that I want to change, what is the index that I can use in order to penetrate that–to access that specific contract?

Is it the cost centre, or is it the one who put in the direct data entry?

Mr. Sinclair: Could you just repeat the question? I'm not sure we quite heard all of it or understood it.

Mr. Marcelino: Sorry. If I were to access a certain untendered contract, and if I wanted to know the information that's in that entry, do I use the cost centre or do I have to go through the one–the person who made the direct data entry?

Is it a specific employee only who has access?

Mr. Sinclair: So, in order to get to a certain contract, that is back to the discussion we had around the roles. So it's a specific role within a specific department that would have the ability to access and view those contracts.

Mr. Maloway: Follow up on the member's questions here, I wanted to deal with the vulnerabilities of your SAP system. And, as you know, there's certainly attacks against systems all over, and we have instances where entire governments have been shut down. I think BC government, British government, you know, for a period of time. Our security system here has been very robust, and–but I can tell you that if you look at the boards in the security department, it's lit up. There's attacks every day. I just want to know what is–what your current situation is regarding security. Have–has your system been attacked successfully or unsuccessfully over the past while?

Mr. Sinclair: So, generally, we can speak to that, yes, we–much like most governments, there's a constant look to see what can be gotten into by outside individuals. I can happily report back, as you said, that we have a very robust security system, and the SAP system itself has not had a compromise with respect to an external threat on that front.

Mr. Maloway: So you're confirming, then, that your part of the system then has been immune from successful attacks, not that it hasn't been attacked. I'm sure there has been attempts made. But your system has been not successfully attacked. Is that what you're saying?

Mr. Sinclair: Yes, there's a system in place in order to track attempts, and we're not aware of any attempts–or successful attempts on the SAP system.

Mr. Maloway: So, then, the question becomes the issue with the superusers. How many superusers right now are there in the system?

Mr. Sinclair: Yes, I don't actually have the information on how many superusers we have available to me right now.

Mr. Maloway: So, I mean, I think you would want to know–I think, at some point, there were maybe six superusers. The question would be, are some of them from SAP. Like, where are these superusers? Whatever number there are, where are they? Are they here in Manitoba? Are they in Germany?

* (10:00)

You know, where and who are the superusers, like–and what are the number of the superusers?

You know, that–that's an important question, because, you know, once again, when the system was implemented, there were certain entities that would not participate in SAP. And I think, maybe, the Auditor General's Office is one of them, perhaps, but there's, you know, I don't know which–whether you know which system–which entities are not part of SAP, but there's certainly two or three anyway. And it was for that very reason that they were worried about the superusers of SAP being able to access their system. So they bought their own system–totally different system, and it’s all walled off. It was then and it probably is today.

Mr. Sinclair: So, just to reiterate, that–I don't have that information, but we'd certainly–business transformation technology is very aware of how many there are and who they are.

Also, just to clarify again that superusers are not outside of the controls within SAP with respect to the tracking of transactions done within SAP, so superusers–their transactions would be also tracked and reportable. The concept of the superuser allows them to do more within SAP but doesn't create them outside of the security controls within SAP.

Mr. Maloway: But you're talking about superusers within your department, or you're talking about superusers who have access to the entire system?

Mr. Sinclair: With respect to the tracking of the transactions piece?

Mr. Maloway: Well, I'm asking about your department itself, like, how many superusers would be right at the top that could see everything in the department, versus how many are at the very top of the SAP system in Manitoba, which I understood were six, you know, years ago, but there has to be somebody in Germany that can fix the system, you know, that would have to come in, could see the entire system as well. I can't believe that there wouldn’t be any superusers–that they would all be just within the SAP system here in government. Surely, they're not that experienced. There could be a problem develop that you'd need technical advice from the head office, and they would have to have access, would they not?

Mr. Sinclair: Yes. So–I mean, you're asking a level of technical detail in the system that I simply don't have an awareness of, and the province's chief information officer could certainly provide those answers, which is in the Department of Finance, but I don't have those answers available right now.

Mr. Maloway: I recognize that we're trying to deal with this report, but it–when you get into the whole, the ERP system, you know, there's questions that go beyond probably what your department is involved in.

But, you know, perhaps the committee, because most of the committee is new, and you know even I'm new to the committee; I've been away from it for a while now. We could have a–maybe an in camera meeting with the OIT people. They put on a great presentation. They can have a, you know, a half-hour section on the security system. It's a really interesting presentation. It gives the whole overview of how many denial-of-service hits we get on a daily basis and the whole, you know, government online programs and all sorts of stuff. So that in itself is a very interesting presentation, so–but that would be at the level of the Chair of the committee here and the Vice-Chair to work that out. But, if people are willing to do that, it would be very helpful, because we've had presentations in the past, you know, from Hydro and so on. They give presentations to caucuses and so on, so it might be worthwhile having that. And then we could–then we would have the experts in front of us; we could ask all of these questions then. It would make sense, right?

Because I'm concerned, at a certain point, the Auditor General department will have to be, you know, taking a look at the whole program, like, how is it working, how are the costs, and so on, and, you know, is there something better. Not that we should move, but is there something better out there, because, I mean, if you just pull out ERP systems, I mean, you know, the computer business is changing by the day almost, and there's names in here of ERPs that are available now that probably didn't even exist 10 years ago, you know.

Mr. Pedersen: I believe that question was directed to the committee. So I'll leave the committee to–of PAC to answer that question.

Mr. Chairperson: Thank you for the clarification.

Mr. Marcelino: Yes, as a corollary to the previous questions and regarding the security of our databases and considering the complexity of government nowadays, do we have any backup in writing or somewhere in print within the system? We used to have the archives, and, if the data that we have are all electronic, am I correct in saying that we are vulnerable in some ways if there is a total collapse of the database system?

Mr. Sinclair: I think today I'm not able to actually comment and speak to the level of security that's in place, but I can say that there are security processes in place for the data to protect it as well as backups are done on a regular basis to ensure data is there; it's safe.

Mr. Marcelino: So regarding the infrastructure of our databases, the–I know that there are some computer banks where we use outside of province. Where are our data stored?

Mr. Sinclair: The servers that the government of Manitoba currently uses are located in the province of Manitoba.

Mr. Marcelino: And are they in some form of a contract with the government or are they run by the government?

Mr. Sinclair: We have a series of owned and contracted server services in the province.

Mr. Marcelino: And is there any way that we could have access to the amount of money that the government pays to whoever is contracted to take care of our database?

* (10:10)

Mr. Sinclair: So, given the value of the contracts we'd have for server services, those contracts would be on the disclosure website, could be found there. Any more details beyond that, we would need to bring in staff from Business Transformation and Technology to make sure that the answers are.

Mr. Chairperson: Mr. Yakimoski. [interjection]

Oh, sorry. Mr. Marcelino.

Mr. Marcelino: Thank you. So has that been–that contract with that server, has that been recently renewed?

Mr. Sinclair: We're actually–we're just currently, recently tendered for server services, so those contracts are out in the public right now–or those tender opportunities are out in the public right now.

Mr. Yakimoski: Thank you. Again, a learning question for myself. At what threshold is Treasury Board approval required for contracts?

Mr. Sinclair: So the level of authority that's required from Treasury Board depends on the department and the type of contract that's being tendered or sought. Goods and services contracts and consulting contracts are specifically outlined in the GMA, the General Manual of Administration, and we can come back with those specific amounts and provide that.

Mr. Yakimoski: I had a question for the Auditor General. Did you find, in general, that the policy, within the certain limits, was not followed regularly? Or was–did they tend to follow the policy and go through Treasury Board when it was required? Or was it circumvented, essentially?

Mr. Ricard: So, as included in section 1.2 of our March 2014 report, we noted that proper approvals for the awarding of untendered contracts–like, just to recall that this report focused on untendered contracts–that proper approvals for the awarding of untendered contracts were not always obtained. In particular, I would–where we found–there's–I'm just trying to remember the details here. In figure 7 of our report, we summarized where required approvals were not obtained, and we found, in our sample–I believe it was 50 contracts–11 contracts where proper approvals had not been obtained.

Most of those related to–trying to remember. We had a little bit of an extra sample. We increased our sample because we found that there were instances where approvals weren't being obtained, so, for instance, on page 424 of our original report, we talked about, to assess whether other untendered MIT emergency contracts were properly approved. So there were emergency contracts in our original sample that weren't being properly approved, and so we looked–we enhanced our sample to take a better look at that. And there we found–I'm just trying to–that 10 contracts were approved by the executive director, but because all 10 contracts were over $50,000, Treasury Board approval was required but it hadn't been obtained.

So, long answer short, there were–there are instances, particularly for emergency contracts, where proper approvals of Treasury Board, for instance, were not being obtained. And that's where we do have a recommendation; recommendation 4 was that Treasury Board Secretariat develop guidelines for delegating purchasing authorities for untendered contracts and related extensions during emergency events, in particular, the purchasing authorities for Treasury Board ministers and deputy ministers, and that they subsequently require comprehensive reporting after an emergency event on how the delegated authority was used–so.

Mr. Yakimoski: And where–what is the status of recommendation 4?

Mr. Ricard: Recommendation 4, as at October 30th, 2015, we note that Treasury Board Secretariat had completed a jurisdictional review of delegated authorities for untendered contracts during emergency events but that it had not yet determined how it wanted to proceed.

Mr. Yakimoski: So, in the past, we've just heard from the Auditor General that, during some emergencies or other reasons, Treasury Board was circumvented.

Can you tell me why that would have happened? Why the policy was–they did an end-around and didn't go through the proper channels. How difficult is it to go through Treasury Board and get the proper approval?

Mr. Vigfusson: So let me add, this was–report was primarily related to the period from, I think it was April 2011 to September 2012. The–a lot of untendered contracts were unreported at that time. Primarily, that was the period we were going through the 2011 flood and the massive flood that hit the province that year.

So there are requirements in the tendering for emergency requirements: must be an actual, imminent, life-threatening situation or a disaster resulting in a significant loss or damage to Crown property. The exception here ensures that goods and services needed in emergency are obtained in a timely matter, including emergency services for flooding or forest fires.

So, in those situations that we were under, we were working closely with Treasury Board in terms of getting–we had some increased delegated authorities for emergency situations, but there was also times where we had to react to either protect life or to protect property–both Crown property and private property. In those cases, we made the best decisions we could under those circumstances, dealing with a massive flood, one-in-300-year event, and then we would advise Treasury Board afterwards of what we did.

Mr. Yakimoski: In an emergency such as that, how long would it take to get Treasury Board approval, timeline wise?

* (10:20)

Mr. Vigfusson: Generally, within a week, there's a normal process where you're filling in TB submissions, providing information. But it can be as short as a day or two to a week. [interjection] Yes, depending on the situation and the timelines.

Mr. Yakimoski: Is recommendation 4 and the approval of such things being implemented into the PAM?

Mr. Sinclair: So Treasury Board conducted a scan in 2014 and covered several jurisdictions in Canada, including the federal government, Quebec, Yukon, Ontario, BC and Saskatchewan. And that scan found that most jurisdictions have provisions to waive competitive processes in certain circumstances that include specified thresholds for certain types of goods and services, emergency expenditures with no specific limit on contract amounts, circumstances where the public tender would not serve or would compromise the public interest and some thresholds that were prescribed in various trade agreements that they may be a party to.

Treasury Board is using this jurisdictional information, undertaking revisions to the GMA, the General Manual of Administration, and its policies on delegated authority for expenditures during emergency events and related reporting requirements; and this includes redefining the criteria for an emergency expenditure, revising the delegated authorities associated with those and clarifying the monitoring and reporting requirements.

Ms. Janice MorleyLecomte (Seine River): I just–on the same line as emergency, a definition of an emergency timeline, what you would consider to still be an emergency, and if it were an emergency in one part of the year, would you still consider it an emergency in another part of the year if you're purchasing for that specific place?

Mr. Sinclair: So an emergency is defined as the imminency of it, so the immediacy of it and the timing of it. And actions are taken around that time. The establishment of emergency going forward doesn't then eliminate the requirements for–to follow the other guidelines in the GMA at that point going forward.

Ms. Morley-Lecomte: So, if one community were in an emergency in April, would them getting support in September still be considered an emergency if there had been no tendered contract for that?

Mr. Sinclair: Under that scenario, the answer would be no; it would no longer be considered an emergency at that point.

Ms. Morley-Lecomte: So, then, any contracts entered upon should have been entered in a timely manner and been considered tender–not untendered, right?

Mr. Sinclair: So the emergency–the ability to award a contract untendered, based on emergency is–again, it's based on the imminent risk to life or property. And the government can then enter into a contract to deal with the imminent–that imminent risks associated with that emergency. Any of the subsequent contracts that may need to be entered into as a result of that emergency, once the imminency is gone, would then be required to follow the regular process as outlined in the GMA and the PAM.

Mr. Scott Johnston (St. James): My question is regards to tendered versus untendered contract. Would it be fair to say that the best practice for your department is to utilize tendered contracts?

Mr. Sinclair: Yes.

Mr. Johnston: When you find yourselves in a situation when, as indicated, circumstances may dictate that you have to act, in view of history and in view of experience, would you not have a stable of operations or–for possibilities that you could have some further discussion with–in selection in your department and with your minister? In other words, is the–it would appear that–I'm specifically talking about Tiger Dams–it would appear that there was no other options considered. It would appear that the department did not offer up any solutions to the minister and the minister just proceeded based on awarding these contracts.

Mr. Vigfusson: I think the OAG report has uncovered some of the weaknesses in the processes, and since the report has been prepared, that's why we've taken–undertaken a number of these steps to ensure that we have better processes in place to deal with emergency situations.

Mr. Johnston: Well, certainly, we can appreciate the fact that this has triggered further consideration of the issue, but, again, it's an expectation that the department be in a situation to seek real solutions with options advising the minister, and that appeared not to take place.

So the other thing that concerns me, Mr. Chairman, is that when the department–if–I'm hoping that this was an error by the minister versus the department–was that when there is a history of problems there, there are certainly–should be a stable of expertise to rely on, and that appeared not to take place. And, when the contracts are awarded untendered, and it appears that there may be some conflict with who the contract was awarded to, it concerns me that the department wasn't making further recommendations to the minister on different venues to be able to carry it out.

* (10:30)

Mr. Vigfusson: I'll use the same response as I just did for the last question in terms of the processes that we have in place as a result of the OAG report. Do provide us with better opportunities to ensure that doesn’t happen again.

Mr. Kelly Bindle (Thompson): We can all agree that by waiving bids the government cannot ensure fair market value, and, in the Auditor General's report, eight of the 30 untendered contracts examined from the special operations agencies were not justified, have competitive bids waived and two did not obtain approval; 87 per cent of the untendered contracts that should have been disclosed were not, totalling a value of $183 million.

My question is: Are there any outstanding contracts that were untendered above the $10,000 threshold that are still yet to be disclosed?

Mr. Sinclair: Not to our knowledge. Since the Auditor General's report and the processes that have been put in place that we've been discussing, there's been extensive communication with departments and the department's SOAs as to the requirements for reporting all contracts over $10,000.

Mr. Reg Helwer (Brandon West): So, looking back at this report and knowing some of the things that were going on, it would appear that there was an individual or individuals that were actively directing contracts to a–companies that they favoured. And now you've put some safeguards in place so that, presumably, wouldn't happen again.

Do you feel that we have adequate safeguards, at this point, that an individual in a department would not be able to direct an untendered, undisclosed contract to a favoured supplier?

Mr. Vigfusson: I have to say yes to that question. We've been striving for improvements ever since the OAG report came through, both in terms of the work that Procurement Services Branch is doing, the work that Treasury Board does to provide oversight, as well as to communicate to the departments in terms of their responsibilities. We've got clear direction on how tendering should be done going forward and we're following those processes.

Mr. Helwer: Does the department use prequalified suppliers and how does one obtain that status?

Mr. Vigfusson: Can I get you to clarify which department?

Mr. Helwer: The Department of Infrastructure.

Mr. Vigfusson: So we–for Infrastructure, we use a prequalified list of consultants for our engagement. That has been our practice for–since about 2008.

We went through a Treasury Board process to–as it relates to hiring consultants to do our engineering work, there's a limited community that can do them. We have a process where we'll have a wide open selection for our larger projects. For our smaller valued ones, medium valued ones, we really want to make sure that we match the consultants' capabilities with the type of work we need to do, so we have a consultant registry that we invite consults to come in and get prequalified, and the we use that prequalified list of consultants to help us in selecting consultants to work–to do work for us.

Mr. Helwer: So you have a prequalified list. How long does that list–is it something that's active? Is it something that people can come and join as it occurs, or is it something that you close off and use for a year? How does one actually–a new supplier potentially get on one of these lists?

Mr. Vigfusson: So we go through–we went through a process starting on 2008 to undertake a qualification–an assessment of each of the consultants that wanted to apply in all the different categories of work that we do.

It's an ongoing registry. Consultants are–can–new consultants or consultants new to Manitoba can solicit–or put in an application process to get involved in it. If there's changes, we require them to give us their changes and then we evaluate whether or not they still meet the qualifications required for–to be considered for engineering work.

Mr. Helwer: So this is just for engineering? For consulting, there is no prequalification list, say, for roadbuilding or anything of that nature, construction?

Mr. Vigfusson: Generally not. We usually–on our roadbuilding, we'll go to open tender to the industry. We do have limited opportunities or examples of where we've gone to prequalification. An example, I believe, on that would have been the Lake St. Martin emergency channels where we needed to prequalify on an immediate basis so that we could go and undertake the channel work within two-month period.

The other examples of where we do prequalification for construction is the current project that's under way under 59 and 101 interchange, where we went for a request for quotations–not quotations, for qualifications from the industry to ensure that the group that was going to be bidding on it had the necessary qualifications to keep going.

Mr. Helwer: Well, on a slightly different prequalification, I want to look back at Assiniboine Community College which, when it was rebuilt in the nurses' residence, was under the Department of Infrastructure.

That particular contract, I understand, was not issued for construction, but was issued for financing, and the company that was successful or was the sole financing agency chose on who would build or who would work on that project. So there was no tendering essentially done.

* (10:40)

Is that the department's understanding of how that project occurred?

Mr. Vigfusson: The Accommodation Services group that would have looked after that moved over to the Department of Finance, in April of 2015. My time as a deputy started at April of 2015, so, if it happened before April 2015, I don't have the knowledge of that. So, if the MLA would like to have the information, we'd have to take that under advisement and return.

Mr. Helwer: Well, I would be interested in your understanding how that project occurred, and I'm wondering if–now, of course, it's in Accommodation Services now; it's not in Infrastructure. But I hope that when we look at how we're awarding contracts, it is in the light of the Auditor General's report and that it is open and accountable. And I understand that departments are working on that process, and it sounds like you made a good amount of progress. But I'm also interested in the Auditor General commenting on things that you feel haven't been fulfilled yet, and the most important ones that you feel the departments have to work on.

Mr. Ricard: I guess I would be more comfortable, you know, directing your attention to the follow-up report that we did, you know, dated–a little bit dated now in terms of its–as at October 30th, 2015. And there we did note that–did feel that the department was making reasonable progress in implementing the recommendations.

So the next follow-up report is scheduled to occur as at September 30th, 2016, in a couple months' time. And we hope to–we're intent on issuing our follow-up reports now, in a more timely manner. So we are planning to issue that follow-up report, along with many others, in January–early February of 2017. At that point, I would be able to comment on the progress that we feel the department has made in implementing our recommendations.

Mr. Helwer: So, when the department conducts its follow-up report, I mean, things change. You have circumstances–different circumstances now that happened then.

Does the department bring new ideas to you in the follow-up that says, you know, we looked at this process and we would like to do it this way, and do you comment on that, or is that something that would be a new report altogether?

Mr. Ricard: The focus of our follow-up reports is strictly on the recommendations made. Now, the recommendations that we make are based on an underlying issue, so our primary concern would be is the underlying issue being properly addressed. We offer a recommendation to assist the department to do that. If they choose an alternate route to addressing the underlying issue, we're fine with that. That's where one of the categories that we have in our follow-up is, you know, we say implemented resolve being either the recommendation was implemented or an alternative solution was pursued and implemented.

If they chose to do an alternative solution, we would record what that alternative solution is in our follow-up report and indicate whether we think it was sufficient to address the underlying issue that prompted the recommendation in the first place.

Mr. Chairperson: Seeing no further questions from the committee, does the committee agree that we have completed consideration of chapter 10, Waiving of competitive bids of the Auditor General's Report, Annual Report to the Legislature, dated March 2014? [Agreed]

Auditor General's Report–Follow-up of Recommendations: Waiving of Competitive Bids–dated November 2015–pass.

Does the committee agree that we have completed consideration of the item on waiving competitive bids included in the Auditor General's Report–follow-up of previously issued recommendations, dated May 2016? [Agreed]

This concludes the business before us.

Committee rise. [interjection]

My apologies. Before we rise–I'm going to follow the script here–it'd be appreciated if members would leave behind any unused copies of the reports so they may be collected and reused at the next meeting.

The hour being 10:46, what is the will of the committee?

An Honourable Member: Call it 12.

An Honourable Member: We're calling it 12.

Mr. Chairperson: Committee rise.

COMMITTEE ROSE AT: 10:46 a.m.