Public Accounts Committee on June 14th, 2018

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

You said, “I don't agree”.

[Marie Lemay]

I said I didn't really have the same information as him. I do not have the information that Mr. Ferguson has. I do not know what the employees said or didn't say to my predecessor.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Ms. Lemay, that is the heart of the problem. The final decision was made based on misinformation, because three executives didn't give the information they were aware of.

[Marie Lemay]

That's what Mr. Ferguson said in his report.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Do you agree with that or not?

[Marie Lemay]

I cannot agree or disagree, because I was not in that office. I do not have that information. When I ask the question, I don't get the same answer.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Of these three people, two are still under your responsibility. Are they telling you this isn't true?

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Deltell.

[Marie Lemay]

They do not agree with Mr. Ferguson's findings.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Okay, in that case, we would like to hear what they have to say on this issue.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Ms. Lemay and Mr. Deltell.

Mr. Christopherson, you have seven minutes.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you very much, Chair.

My apologies to you and my colleagues. I think it was mentioned that I was in the House for the tribute to my former leader and, as one of his former deputies, I definitely wanted to be there. I hope you understand.

This is one of those times—after 14 years—when you read this report, and you're still like, how can this be?

I recognize and I'm going to do my best to keep separate the issue of the one-off here, versus the broader cultural issues that we'll pick up on Tuesday. There might be some overlap, but my intent will be as much as possible to stay focused on this report.

Having said that, you can't escape certain words that have been used. I've been around long enough in the public accounts business, and done enough international public accounts business, to know that when an Auditor General of the rank and status in the world that our Auditor General has, Mr. Ferguson, uses words like an “incomprehensible failure”, in that world, that's about as close to swearing as you can get.

I would like to ask Mr. Ferguson something, and the other two reps can get ready, because I'm going to be coming to them next.

That's a huge statement. The last time I saw anything that wide in its scope and that scathing was, quite frankly, the sponsorship scandal, where virtually every rule that was there was broken. You really have to go back that far to find something that is this big in its breathtaking failure.

Mr. Ferguson, you said “incomprehensible failure”. Obviously you're speaking to a lot of the checks and balances that didn't work, because we've heard that there are robust systems in place, and check and balances. I want to give you an opportunity, for my opening remarks, to put a little more flesh on the term “an incomprehensible failure”. Why the word “incomprehensible”, sir?

[Michael Ferguson]

As I explained earlier, you can go through all the different decision points in the steps, and it is comprehensible to understand those decision points and when different decisions should have been made to correct the problem.

What's incomprehensible, as you said, is how nobody said that this was not going to work. How did nobody say that this needs to be delayed, that it needs to be stopped? Why was it that all of the checks and balances that had built up over the years, many probably coming out of Auditor General report recommendations to put more checks and balances in place, were not sufficient to be able to stop Phoenix?

To me, that is what is incomprehensible.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you.

To the secretary and the deputy, help me understand how you presided over something that could be such an incomprehensible failure. How did virtually all the checks and balances fail?

[Marie Lemay]

First of all, neither of us presided over that, because we were not there. However, I will tell you the lesson for me in this, and that's what we have put forward.

It's very clear that, as I said, we manage a lot of projects. We have rules and we have playbooks for projects. This was an enterprise-wide IT implementation, a transformation, and clearly we didn't have, in my opinion, the proper playbook and the proper gating.

Now what we're doing at PSPC is that, when we have big projects like that, we look at the project and we ask ourselves, “Is this one of the projects that can go through with the process, or is this one that needs to have a different way?” Do we need to have a different approach on governance? Not every project needs deputy-level involvement, for example. An enterprise-wide project needs attention at a different level. What kind of oversight do we need when it's enterprise-wide?

We are developing that. It is a big lesson learned and, in my opinion, that's part of the reason, one of the points, why that was missed, so we will develop that.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you.

That's not very satisfactory, I'm afraid.

Go ahead, Mr. Wallace. Give it your best shot.

[Peter Wallace]

I do want to pick up and echo the language, in terms of the respect for the AG, and I do want to emphasize that this is an incredibly important set of findings that we take extraordinarily seriously.

The reality is that information technology projects are high risk, and many of them do fail. The literature is pretty clear that a very high percentage fail. The challenge is not in failure. The challenge is in catastrophic failure. We understand that the path to that catastrophic failure was long and complex. The corrections will be long and complex.

We have, of course, put in a large number of additional steps, like enterprise gating and a variety of other things. We can go through them. They are simply additional steps. As the Auditor General correctly points out, if those controls failed, we need to understand what would actually happen with additional controls.

We are, in fact, undertaking a very serious conversation internally as well, about something fundamental. The Auditor General has used this language as well. The controls and processes we put in place cannot only be followed in form. They need to be followed in substance as well. That is a rich, incredibly appropriate, and necessary dialogue. We are engaged in that.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you. I appreciate your brevity.

I hear you. I've been involved in IT implementation from the beginning, when I was back on city council in the 1980s, as these things came in. I understand how complex they are, but that's not going to cut it.

I want to refer you to page 10 of the Auditor General's report, where they're talking about the human rights that staff have to have their personal information taken care of. That has nothing to do with IT alone. That has to do with whether or not you consider, as a government on the bureaucratic side, personal information. I mean, take a look at what was said here:

The Department did not complete a final privacy impact assessment before implementing Phoenix. The Privacy Commissioner of Canada has reported numerous privacy breaches of federal employees’ information in Phoenix after it was put in place.

That's got nothing to do with IT. That's not taking seriously the privacy rights of the people that work for this government.

Give me a better answer than just saying that IT is difficult.

[Peter Wallace]

I will answer this carefully and respectfully, because in no part of my answer am I trying to minimize the depth of privacy rights, impact on taxpayers, impact on employees, and loss of value for the Government of Canada. We fully accept that and are deeply concerned about that.

There are incredibly important lessons to be learned from this. They are lessons that are technical, in terms of the way we establish governance. They are also lessons that relate to how we run the system, including the culture. We understand and accept that. We are undertaking the dialogue to ensure that this fundamental notion.... I will echo your language around respect. I will echo the Auditor General's language around substance and not just form. I will echo some other language that's not tunnel vision, that we actually walk the talk and do the job. It's absolutely, completely essential that we do that.

We stand accountable for those errors. I will work as hard as I possibly can to make sure that those elements do not happen again. With respect, and to be very clear, there will always be risks. The challenge is not whether it's IT or other things. The challenge is not that projects are difficult. The challenge is that when we do not act appropriately, we do not find the ways of addressing those challenges and we make the fundamental errors. We have made them. We will learn from that.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Wallace.

We will now move back to Mr. Lefebvre, please, for seven minutes.

[Paul Lefebvre, Liberal, Sudbury, ON]

Thank you, Mr. Chair. Thank you everyone.

Ms. Lemay, I would first like to thank you for your report. You gave us information on what's to come, on the way you will fix the system, and on the measures you have taken to this end.

Mr. Ferguson, did you hear Ms. Lemay tell us about measures that were taken to fix the system? Do you believe that the department is on the right track?

[Michael Ferguson]

Once again, it's hard for me to answer that, because we haven't done any audit work on those figures, or on the work accomplished since our audit.

Clearly, there seems to be progress, but it is very important for the department to clearly describe it, and provide all the appropriate information.

[Paul Lefebvre, Liberal, Sudbury, ON]

Okay, thank you.

We're here because in your report you said how we got here. Now we're asking how we make sure that it never happens again.

Madam Lemay, in her opening statement, showed that the department is putting in measures to make sure that this doesn't happen again. It will obviously be to history to judge that, and to us to make sure it doesn't happen again.

One of the questions we're always asking is how this happened. Madam Lemay mentioned in her opening statements—your conclusion, Madam Lemay—that cost and timelines were prioritized and constrained the outcomes of this project, and that in this context, poor decisions were made.

Mr. Ferguson, in your opening remarks you said the decisions by PSPC to remove critical pay functions, critical system tests, and forego a pilot implementation of the system led to the failure of the opening of this project.

On one hand, we have Madam Lemay saying the cost and the timelines were why the PSPC decided to remove critical pay functions, critical system tests, and forgo a pilot implementation of the system.

Do you agree with that, Madam Lemay?

[Marie Lemay]

Yes.

[Paul Lefebvre, Liberal, Sudbury, ON]

Do you also agree with that, Mr. Ferguson?