Let me be very clear. You will never get an absolute assurance from me, because life is messy. There are enormous challenges. I say that not, frankly, to duck accountability but to indicate to you that we will do everything we can to mitigate risk. However, risk is a reality. The challenge here is how we prevent small problems from becoming enormous, incomprehensible problems.
Let me go through a number of steps that we have already undertaken, and then speak to something a little more fundamental than that.
We have, of course, put in place a stronger role for the chief information officer. We have updated our information technology and management policies. We put in place much stronger governance in terms of deputy ministers' committees with clearer lines of accountability. We have ensured that Treasury Board is engaged in a much more meaningful way in two forms of the challenge function: the fiscal challenge function, and now a much stronger role for the IT challenge function as well. We have created a number of very important digital standards around interoperability, access to cloud, and a whole variety of things absolutely critical to avoiding these things and allowing for broader vendor interface as well.
We have put in place an enormous amount of work on a project management strategy under the office of the comptroller general. We have put in place a variety of multi-level governance models associated with all those things.
However, to very clear, those are all hurdles. They are all step points. They could become bureaucratic friction unless we take the core lesson seriously. The core lesson here is that these things are not there to be manoeuvred around. They are there so that we actually understand what we are doing. We take appropriate risk but not disproportionate risks with taxpayer values, with the privacy of our employees' information, with our fundamental need to pay our employees accurately and on time, or any other IT project.
We are putting all those measures in place. They will be very helpful, but what they will require is vigilance all the way through to make sure that those values, what those policies represent, are actually part of the lived experience of the organization. That will never provide you with the absolute assurance that you seek, as you will understand, but it will provide you with, and I hope to provide parliamentarians with, an understanding that we are learning these absolutely critical lessons.
We take them fantastically seriously, as you are correct that we do not enjoy this experience. We understand the absolute imperative of getting these things right on a going-forward basis.
I need to add one other piece. I do need to reiterate that accountability is fundamental and it is our belief that we can increase and augment the accountability regimes as well.
