SEND ME NO PAPER! - Office of the Auditor General · 2013. 6. 3. · SEND ME NO PAPER! 4 Executive...

SEND ME NO PAPER!

Electronic commerce – purchasing of goods and services

by the Western Australian public sector

Report No 10 – November 1998

W e s t e r n A u s t r a l i a

A U D I T O R G E NA U D I T O R G E N E R A LE R A L

SPECIAL

REPORT

© 1998 Office of the Auditor General Western Australia. All rights reserved.This material may be reproduced in whole or in part provided the source is acknowledged.

4th Floor Dumas House

2 Havelock Street

West Perth WA 6005

Telephone: (08) 9222 7500

Facsimile: (08) 9322 5664

E-mail: [email protected]

http://www.audit.wa.gov.au/

A U D I T O R G E N E R A L


The Office of the Auditor General is acustomer focused organisation and is

keen to receive feedback on the qualityof the reports it issues.

Through Performance Auditing enable the Auditor General

to meet Parliament’s need for independent and impartial

strategic information regarding public sector

accountability and performance.

MISSIONMISSIONof theof the

Office of the Auditor GeneralOffice of the Auditor General

VISIONVISION

Office of the Auditor GeneralOffice of the Auditor Generalof theof the

Leading in Performance Auditing

Report No 10 – November 1998

SEND ME NO PAPER!

Electronic commerce – purchasing of goods and services by theWestern Australian public sector


A U D I T O R G E N E R A L

AUDITOR GENERAL

Western Australia

THE SPEAKER THE PRESIDENTLEGISLATIVE ASSEMBLY LEGISLATIVE COUNCIL

SPECIAL REPORT — SEND ME NO PAPER! – Electronic commerce – purchasing of goods

and services by the Western Australian public sector

This Report has been prepared consequent to examinations conducted under section 80 of the

Financial Administration and Audit Act 1985 for submission to Parliament under the provisions

of section 95 of the Act.

Performance examinations are an integral part of my overall Performance Auditing Program and

seek to provide Parliament with assessments of the effectiveness and efficiency of public sector

programs and activities, thereby identifying opportunities for improved performance.

The information provided through this approach will, I am sure, assist Parliament in better

evaluating agency performance and enhance Parliamentary decision making to the benefit of all

Western Australians.

D D R PEARSON

AUDITOR GENERAL

November 18, 1998

Contents

Executive Summary 1

Background 1

Summary of recommendations 6

Introduction 9

Background 9

Examination focus and approach 13

Electronic purchasing – national and State overview 14

National developments 14

Western Australian overview 16

Recommendations 19

Redesigning the purchasing cycle 20

High volume/low value purchasing 20

Recommendations 26

Electronic purchasing within the Western Australian public sector 27

The fuel card 27

The corporate credit card 29

Electronic funds transfer 30

Electronic data interchange 32

The Electronic Marketplace 39

Recommendations 41

Electronic purchasing – the way forward 43

Leadership and coordination 43

Developing a business case 46

Agency next steps 50

Recommendations 51

Appendix I – Purchasing in the year 2002 52

Appendix II – Summary of key electronic commerce controls 54

Corporate credit card 54

ReserveLink EFT 55

Internet electronic commerce 55

Appendix III – Developing an electronic commerce business case 60

Appendix IV – Glossary of terms and acronyms 61

Performance Examination Reports 64

1

Electronic commerce – purchasing of goods andservices by the Western Australian public sector

Executive Summary

Background

Electronic commerce is here to stay. ‘In Australia we long ago accepted that

the Information Age is a reality; a reality evidenced by Organisation of

Economic Co-operation and Development (OECD) rankings which place us

second in the world in terms of computer penetration and roughly eighth in

the world in terms of installed computer power.’1

The Western Australian public sector spends about $3 billion per annum on

goods and services, excluding construction. This special report focuses on

the public sector purchase of goods and services from private sector suppliers

using electronic purchasing, part of the wider field of electronic commerce.

However, many of the topics covered in this report are relevant to all forms

of ‘online services’. Within the Western Australian public sector, ‘online

services’ is an umbrella term comprising both electronic commerce and the

delivery of government services online to the public. The Western Australian

Government is committed to public sector online services.

Electronic purchasing – national and State overview

Electronic commerce raises legal and regulatory issues that cut across regional

and national boundaries. Within Australia, there is recognition of the need

for governments to agree on some common national principles, standards

and protocols when implementing electronic purchasing. The Western

Australian Government, and a number of its public sector agencies, are active

participants in initiatives to establish a national approach towards supplier

registration and tender management.

The Office of Information and Communications (OIC) has been established,

within the Department of Commerce and Trade, to take the lead role in

facilitating and coordinating the development of online services within the

Western Australian public sector.

1 Introduction to the Gatekeeper report, Office of Government Information Technology, Canberra,May 1998.

Auditor General WA

SEND ME NO PAPER!»»

2

Executive Summary

A Chief Executive Officers’ (CEOs) Online Services Consultative Group has

recently been formed to facilitate the adoption of online services within

Western Australia. It comprises mainly State public sector CEOs with some

local government representation.

The Department of Contract and Management Services (CAMS) provides a

range of electronic purchasing infrastructure and support services to assist

public sector agencies implement OIC online service strategies.

Western Australian public sector agencies operate in a devolved management

environment. Increasingly, therefore, agencies will likely seek to compare

the services offered by CAMS to those offered by other providers, and choose

the option(s) that best suits their needs.

Redesigning the purchasing cycle

Common purchasing processes are typically complicated, requiring multiple

approvals, and generate paperwork. Moreover they are often applied to all

purchases, irrespective of their value, complexity and degree of risk. High

volume/low value purchasing remains a significant activity for some Western

Australian public sector agencies. Electronic purchasing offers the opportunity

to cut costs, improve customer service and implement more effective

purchase and payment control.

These gains are not obtained by simply automating existing manual processes.

Leading organisations are demonstrating that it requires redesigning all

phases of the purchasing cycle, as illustrated in a case study of the Victorian

Department of Natural Resources and Environment (VDNRE). This process

redesign also seeks to maximise the capture of purchasing data within

financial management information systems (FMIS) for improved expenditure

analysis and control.

Electronic purchasing initiatives within the Western Australianpublic sector

Past and present electronic purchasing initiatives within the Western

Australian public sector include:

� the fuel card;

� the corporate credit card;

3


Executive Summary

� electronic funds transfer (EFT);

� electronic data interchange (EDI);

� an electronic commerce gateway (the Gateway);

� the developing government contracting information bulletin board; and

� a CAMS sponsored Electronic Marketplace, currently under development.

The fuel card, introduced within the Western Australian public sector during

the mid 1980s, is a simple form of electronic purchasing that is now the

accepted method for purchasing fuel within the Western Australian public

sector. It has proved to be effective because significant work process redesign

resulted in time and cost savings for both agencies and suppliers.

The corporate credit card, introduced nearly ten years ago, has enjoyed less

public sector wide acceptance. Nevertheless, it is an effective purchasing

and payment tool, providing that appropriate management controls are in

place and usage is monitored. The corporate credit card is superior to its

traditional alternative, the local purchase order form (LPO). For many agencies,

the credit card has simplified purchasing procedures and reduced the number

of cheques issued. However, some agencies experience bottlenecks at the

invoice approval and payment phase. This is often because work process

redesign may not have preceded implementation.

EFT is replacing traditional forms of payment, such as cheques and cash.

During the 1990s, agencies have been making increasing use of EFT to pay

for goods and services, some through their own systems and many through

an arrangement provided by the Treasury Department (the Treasury). The

future development of EFT within the Western Australian public sector lies

in its better integration within the purchasing cycle through agencies’ FMIS.

EDI is a means for trading partners to electronically exchange, computer to

computer, predefined commercial documents using international standards

and formats. The history of the public sector’s experience with EDI has been

one of limited success, yet a case study, of the Western Australian company

Atkins Carlyle Group (Atkins), demonstrates the productivity gains that

modern Internet based EDI applications can now bring to both purchasers

and suppliers.

Auditor General WA


4

Executive Summary

The Gateway, a facility in use since October 1997, can convert electronic

purchase orders to an appropriate form that can be accepted by any supplier,

be it EDI, fax or post. The Gateway is also used by some agencies to

electronically exchange non-purchasing operational data within a secure and

controlled environment.

CAMS is currently developing two main online service initiatives that will

support across government electronic purchasing.

� The government contracting information bulletin board – an Internet

web site that aims to facilitate public access to current and recently

awarded government tenders, and eventually provide other tender

management functions.

� The Electronic Marketplace – an Internet based electronic commerce

system for use across government that aims to provide online functions

such as cataloguing, ordering, invoicing, payment and management

reporting. The Electronic Marketplace is currently under development

and is to undergo pilot testing prior to tendering and wider public sector

rollout.

CAMS is actively consulting with agencies in developing its plans for the

Electronic Marketplace. However, it is a key strategic procurement initiative

within government and past experience suggests that its future success will

depend upon:

� a shared vision and joint ownership between policy making bodies, CAMS

and participating agencies;

� a clear understanding of respective roles, responsibilities and

commitments;

� robust inter-agency service level agreements that include details of

deliverables, funding arrangements and methods for dispute resolution; and

� ongoing liaison and consultation with industry.

The successful implementation of the Electronic Marketplace would be

assisted by further high level strategic oversight, and support, from across

government.

5


Executive Summary

Electronic purchasing – the way forward

Electronic purchasing is a tool that can assist the public sector get better

value for its purchasing dollar. To be effective, it needs to be implemented

as a part of strategic business and procurement planning both within agencies

and, where applicable, across government.

Electronic purchasing is also part of a wide ranging change process occurring

within society. When managing change, the people issues are often the hardest

to deal with. Agencies need to recognise and manage this change process,

particularly where it impacts on their staff, suppliers and customers.

Work process redesign needs to be embraced. High value-added strategic

procurement and financial management activities need to be distinguished

from low value-added transaction processing activities.

Action is required by key agencies to identify and overcome constraints

including:

� legal issues – the more complex legal issues will need to take account

of national and international developments. Often law making and

regulation lags behind technological changes and agencies need to

carefully consider this as a business risk;

� public sector purchasing and payment regulations – OIC and the Treasury

plan to work with agencies, in consultation with the Auditor General,

to identify and amend outdated regulations based on paper documents

and written signatures; and

� telecommunications infrastructure – the provision of adequate carrying

capacity is critical for electronic commerce implementation, particularly

to rural and remote areas. OIC and CAMS are currently evaluating the

infrastructure requirements, and associated funding implications, and

aim to go to public tender by early 1999.

Auditor General WA


6

Executive Summary

As with any computer system implementation, or significant change to

business practice, agencies need to consider the data integrity and system

control implications of Internet based electronic commerce. The essential

pre-requisite is an organisational commitment to information security,

reinforced from senior management down, that includes:

� sound internal information security practices;

� protecting information when connecting to the world through the

Internet; and

� ensuring that the data received is the same as the data sent and that

information is protected and kept private before, during and after

transmission.

Agency electronic purchasing initiatives should be soundly based around a

business case that takes into account the ability and willingness of suppliers,

particularly small business, to participate.

For many agencies, particularly if their experience with electronic purchasing

to date is limited, a phased approach that provides some immediate and

easily obtainable gains may be a preferred option. Agencies that purchase

few goods and services, but have a more significant role in the provision of

information to the public, may find it more productive to focus upon improving

and redesigning these information services.

Smaller agencies, with limited resources and expertise, may find it effective

to piggyback upon electronic commerce developments within CAMS and/or

other larger public sector agencies.

Summary of recommendations

�� Agencies should:

� recognise that electronic purchasing is part of a significant long

term change process and manage accordingly;

� adopt work process redesign as an essential and ongoing requirement;

� base initiatives on a comprehensive business case;

� examine their purchasing profiles, as part of strategic procurement

and business planning, to identify opportunities for productivity

improvement;

7


Executive Summary

� consider the willingness and ability of their suppliers to participate;

� optimise purchasing data capture within their financial management

information system;

� look for opportunities to better utilise simple electronic purchasing

tools, such as the corporate credit card;

� consider a range of options and suppliers when implementing more

advanced electronic purchasing applications;

� comply with public sector wide electronic commerce principles,

standards and protocols;

� address fundamental information security issues, especially when

utilising public networks (such as the Internet) that potentially open

up their private computer systems to the world; and

� carefully consider gaps in the law regarding the legal status of

electronic transactions as part of broader business risk.

�� The Office of Information and Communications (OIC) should lead and

facilitate the implementation of electronic purchasing within the public

sector by:

� carrying out its online service strategies and action plans;

� developing, in consultation with the State Supply Commission (SSC)

and the Department of Contract and Management Services (CAMS),

public sector wide principles, standards and protocols that facilitate

agency choice and are consistent with national agreements;

� working with agencies and the Treasury Department (the Treasury),

in consultation with the Auditor General, to identify and amend

outdated payment regulations;

� arranging high level strategic oversight, and support, within

government for relevant CAMS projects and contracts;

� identifying and facilitating initiatives with significant across

government costs, savings and/or other benefits that are difficult

for individual agencies to address; and

� identifying and resolving policy and practice issues that arise,

referring more complex or contentious issues to Government.

Auditor General WA


8

Executive Summary

�� SSC should ensure that its State supply policies support OIC online

service strategies and agency electronic purchasing implementation.

�� CAMS should support OIC online service strategies and agency electronic

purchasing implementation by:

� developing the government contracting information bulletin board,

in partnership with agencies and OIC in order to identify and address

associated design, management, security and legal issues;

� facilitating, in consultation with the Treasury, OIC and agencies,

more effective utilisation of the corporate credit card;

� working with the Treasury, OIC and agencies to identify opportunities

for Smartcard common-use-contracts; and

� continuing to work with OIC and agencies to determine where it

can best add value in arranging for the provision of needed

infrastructure and support services and where it can best leave

agencies to make their own arrangements.

9


Introduction

Background

The term electronic commerce can be broadly defined as any commercial

activity conducted electronically.

Australia has been receptive to electronic commerce. In 1997, Australians

conducted an estimated 1.5 billion electronic financial transactions -

excluding those made through automatic teller machines (ATMs) – worth an

estimated $16 trillion.2 While most of this value was processed through

financial markets and wholesale banking, much of the volume was processed

through:

� electronic funds transfer point of sale (EFTPOS) – 0.5 billion transactions;

� electronic funds transfer (EFT) – 0.3 billion transactions; and

� credit cards – 0.1 billion transactions.

Electronic commerce can be ‘business to consumer’ or ‘business to business’.

Business to consumer, or retail electronic commerce, focuses upon marketing

and gaining a new customer base. Although predictions vary, retail electronic

commerce is expected to grow rapidly through the Internet. Business to

business electronic commerce focuses upon improving the efficiency of

processing common commercial transactions, such as making purchases and

payments.

The fundamental need to control these commercial transactions has not

changed, although the means by which this control can be achieved has.

Electronic controls have the potential to be more efficient, effective and

timely than traditional manual ones, although they are less visible being

built into the computer system.

However electronic commerce also poses new security, legal and privacy

risks that must be identified and resolved if consumers and traders are to

have confidence in this emerging business medium.

2 ‘Electronic Commerce – Statistical Survey’ Commonwealth Department for Industry, Scienceand Tourism 1998.

Auditor General WA


10

Introduction

Online services

The Western Australian Government is committed to public sector online

services as part of its broader aim to position the State to gain the benefits

and competitive advantages associated with the Information Age. Within

the Western Australian public sector, online services comprises:

� electronic service delivery – the electronic delivery and enhancement of

government services; and

� electronic commerce – commercial transactions conducted in whole, or

in part, electronically.

This special report deals with electronic purchasing from suppliers, an

important part of business to business electronic commerce for the Western

Australian public sector. The relationship between electronic purchasing

and the Government’s wider online services strategy is shown in Figure 1.

Figure 1: The focus of this special report is electronic purchasing

This special report deals with electronic purchasing from suppliers. Electronic purchasing is

an important part of electronic commerce for the Western Australian public sector, which

spends about $3 billion per annum on goods and services, excluding construction.

Source: OAG and OIC

Can be closely linked

Online ServicesGovernment connects

to community

Other Electronic

CommerceApplications

Wider

Community

ElectronicService

Delivery

ElectronicCommerceut

pp

p

Electronic Purchasingfrom Suppliers

11


Introduction

Although distinguished conceptually, electronic commerce and electronic

service delivery can be closely linked. They both entail new ways of doing

business that often require a radical redesign of existing business processes.

Many of the computer system development and work redesign steps that

need to be addressed are common and they both aim to improve cost efficiency

and customer service.

Electronic purchasing

The State Supply Commission’s (SSC) statistics for 1997 indicate that,

excluding construction, the Western Australian public sector spent nearly

$3 billion in financial year 1996–97 on goods (about $1 billion) and services

(about $2 billion).

As electronic commerce gains pace, markets that were once local and regional

increasingly become national and international. The way the public sector

spends this $3 billion will further benefit Western Australian businesses,

especially if it can facilitate their adoption of technology, that will assist

them to compete in developing global electronic marketplaces.

The way organisations, both public and private, undertake purchasing is

changing. Leading organisations are embracing the opportunities that

technology provides to radically redesign the way they do business rather

than, as in the past, mainly automating their existing manual processes.

Common purchasing activities, such as raising requisitions and processing

invoices, are being redesigned or eliminated if they are not adding value to

the process.

The process of making purchases and payments - known as the purchasing

cycle - is part of wider organisational business and procurement planning.

The purchasing cycle comprises four principal phases as follows:

� purchase planning;

� ordering

� paying; and

� record keeping and monitoring.

Auditor General WA


12

Introduction

The purchasing cycle is an iterative process – the outcome of today’s

purchasing decision should feed into tomorrow’s purchase planning. The

four principal phases of the purchasing cycle, and their associated activities,

are shown in Figure 2.

Figure 2: The purchasing cycle

The purchasing cycle comprises four principal phases: purchase planning; ordering; paying;

and record keeping and monitoring. It is part of wider organisational business and

procurement planning. Leading organisations are looking to redesign essential activities

and eliminate non-essential ones.

Source: OAG

The above diagram has been condensed, as a margin note, to assist the

reader interpret case studies and purchasing methods presented later in this

report. The above four phases of the purchasing cycle have been presented in

a pie chart as follows, with shading to indicate the degree of process redesign/

enhancement:

PHASE 1Purchasing

Planning

PHASE2Ordering

PHASE 3Paying

PHASE 4Record Keepingand Monitoring

� define a purchasing need

� purchasing policy compliance

� market search

� seek bids: quality/price

/delivery

� supplier past

performance

�� approve order�� place order�� confirm order

�� receive goods/services�� match receivals to order�� approve payment�� make payment

�� supplierperformancemonitoring�� budgeting and

management�� exception reporting�� reliable audit trail

12

34

13


Introduction

Examination focus and approach

The examination comprised:

� an overview of the electronic purchasing environment within the Western

Australian public sector;

� an analysis of purchasing data from three comparable Western Australian

public sector purchasing agencies to provide an indication of purchase

order volumes and values;

� a review of electronic purchasing developments within selected private

and public Australian organisations; and

� consideration of the issues to be addressed as electronic purchasing

gains pace within the Western Australian public sector.

Work/job redesign is an integral part of electronic purchasing. This special

report therefore addresses the need for public sector agencies to effectively

manage the associated people issues. However, broader issues associated

with society’s transition to the Information Age, for example taxation, trade,

social and employment impacts, were beyond the scope of the examination.

Although this special report deals with electronic purchasing, much of its

content is relevant to the broader issues and challenges facing the Western

Australian public sector as it moves towards the delivery of online services.

Significant redesign/enhancement

Partial redesign/enhancement

Little or no redesign/enhancement

1

2

3

4

u

u

u

Auditor General WA


14

Electronic purchasing – nationaland State overview

� There is recognition of the need for national agreement on some common

electronic purchasing principles, standards and protocols.

� Agencies within the Western Australian public sector operate in an

increasingly devolved management environment. They will therefore need

to be advised of the key principles, standards and protocols to be applied

when implementing electronic purchasing.

� The Office of Information and Communications (OIC) has the lead role

in coordinating electronic purchasing implementation within the Western

Australian public sector.

� The Department of Contract and Management Services (CAMS) provides

electronic purchasing infrastructure and service support to assist public

sector agencies implement OIC online service strategies.

National developments

International organisations such as the United Nations, the Organisation of

Economic Co-operation and Development (OECD), the Group of Seven nations

(G7) and Asia Pacific Economic Co-operation (APEC) are addressing the global

trade, legal, economic and taxation impacts of electronic commerce that cut

across international boundaries.

Within Australia, there is recognition of the need for governments to agree

on some common national principles, standards and protocols when

implementing electronic commerce. The Australian Government has

established the Online Council as a forum for Commonwealth, state and

territory ministers, and local government, to agree on national strategic

approaches to government use of information and communication services.

The Online Council first met in March 1997 and includes relevant

Commonwealth and state government ministers and the president of the

Australian Local Government Association.

15


Electronic purchasing – national and state overview

A national Australian Procurement and Construction Ministerial Council

(APCMC) has been formed to facilitate a nationally consistent approach to

public sector purchasing, contracting and electronic commerce. It comprises

a relevant minister from each state and is presently chaired by the Western

Australian Minister for Works and Services. Two of APCMC’s key objectives

are to facilitate:

� the development of a simple and unified approach to online catalogues,3

through which Australian government agencies can place orders with

suppliers. As electronic commerce becomes more common, having an

online catalogue could become as important as having a telephone listing

in the Yellow Pages; and

� a single point of entry and registration requirements for all suppliers,

including those from New Zealand. Once registered, a supplier will use

the same unique identifying code when dealing with any government

within Australia and New Zealand. This is intended to facilitate a range

of commercial, taxation and regulatory dealings with governments. For

electronic purchasing, supplier registration could provide a solution to

the problems of authorisation and identification, particularly when

trading over the Internet. Suppliers will not want to have to separately

register with individual governments, much less with individual

government agencies.

In July 1998, the Victorian and Western Australian State Governments signed

an agreement to jointly develop contracting and purchasing skills and services,

including electronic commerce initiatives, through the Procurement and

Contracting Centre for Education and Research (PACCER). Other state and

territory governments have also expressed interest in joining.

3 An online catalogue contains a description and price list of goods and/or services offered. Itrequires each good or service to have a unique identifying code or, if this proved too difficult toachieve, a standard text description that could be located by an appropriate Internet searchengine.

Auditor General WA


16


Western Australian overview

The Office of Information and Communications’ (OIC) role is ‘to lead, facilitate,

coordinate and work in partnership with agencies, businesses and

communities in order to maximise Western Australia’s transformation to

the Information Age’4. OIC became fully operational in January 1998 and is

located within the Western Australian Department of Commerce and Trade.

It reports through that Department’s Chief Executive Officer (CEO), and its

Minister, to the Cabinet Standing Committee for Information and

Communication Issues.

In line with the priorities and strategies approved by the Cabinet Standing

Committee, OIC has recently issued a number of useful action plans that it

is now progressing to tender for implementation. They include:

� electronic service delivery – the provision of government services online

to the community;

� electronic commerce – the conduct of business transactions electronically.

This covers both business to business (e.g. government buying from

suppliers) and business to consumer (e.g. government collecting revenue

from the public) electronic commerce; and

� building confidence, trust and acceptance – a plan to address and minimise

the legal, audit, security and management risks arising from electronic

commerce and service delivery.

A CEOs Online Services Consultative Group has recently been formed to

facilitate the adoption of online services within Western Australia. Its scope

of responsibilities include providing input to OIC policies and providing

periodic reports to the Cabinet Standing Committee for Information and

Communication Issues and other relevant bodies. It is chaired by the CEO of

the Department of Commerce and Trade and comprises mainly State public

sector CEOs with some local government representation.

An Information and Communications Policy Advisory Council (ICPAC) has

also been formed to provide further input to Government on the development

4 Strategic direction of OIC approved by cabinet in March 1998.

17



of information, information technology, communications and

telecommunications strategies and policies. ICPAC has representatives from

industry, the public sector and academia. Part of ICPAC’s role is to

independently advise Government, through the Cabinet Standing Committee

for Information and Communication Issues, on strategies and policies

recommended by OIC.

Agencies within the Western Australian public sector operate in an

increasingly devolved management environment. This environment aims to

progressively free agencies from prescriptive central agency control and

direction, while still providing an overall framework of key principles and

policies that serve as a guide to agency decision making.

Within this devolved management environment, OIC has the primary

responsibility for providing agencies with guidance on key electronic

purchasing principles, standards and protocols. These guidelines will be

needed by agencies when implementing more advanced electronic purchasing

implementations, particularly if they choose to do so independently of the

Department of Contract and Management Services (CAMS).

CAMS provides a range of procurement and asset management services for

government and specialises in contract management. CAMS is one of two

Western Australian agency representatives on the Australian Procurement

and Construction Council (APCC), the support body to APCMC.

CAMS is currently developing a number of infrastructure and service support

initiatives, in consultation with OIC and agencies, in order to support online

services within government. Two initiatives of particular relevance to

electronic purchasing are:

� the government contracting information bulletin board – an Internet

web site that aims to facilitate public access to current and recently

awarded government tenders. It is already linked to other Australian

government bulletin boards and will develop links to other Western

Australian agency bulletin boards. It has the potential to provide cost

effective options for future tender preparation, advertisement and

management; and

Auditor General WA


18


� an electronic marketplace (the Electronic Marketplace) – an Internet based

electronic commerce system for use across government. It aims to provide

a range of online functions and services such as ordering, cataloguing,

invoicing, payment and management reporting. The Electronic

Marketplace is discussed later in this report.

All agencies, excepting government trading enterprises, are likely to be

required to utilise, or interface with, the government contracting information

bulletin board5. CAMS will therefore need to work with agencies to agree:

� the structure of the government contracting information bulletin board,

including how it will interface with existing agency bulletin boards;

� how to consolidate across government tender data and facilitate seamless

access for users; and

� a process for working through the management, security and legal issues

that will arise, particularly as additional tender management functions

are added.

Other agencies have important roles to play in specific aspects of electronic

purchasing implementation. These agencies include:

� the Small Business Development Corporation (SBDC), which provides

services and support to small business. It has an important role in

promoting electronic commerce to small business and in ensuring that

small business is a participant in government electronic commerce

initiatives;

� the Department of Commerce and Trade, which is the host agency for

OIC and, through its various functions, has many interactions with the

Western Australian business community;

� SSC, which has the role of administering the devolution of purchasing

authority to agencies and setting purchasing policy. SSC is, along with

CAMS, represented on APCC;

� the Treasury Department (the Treasury), which regulates the financial

regulatory framework through the Financial Administration and Audit

Act 1985 (FAAA) and its Treasurer’s Instructions (TIs); and

5 The government contracting information bulletin board aims to meet a recommendation fromthe Commission on Government (COG) to make public the awarding of government contracts.

19



� the Auditor General, who is responsible under the FAAA for auditing

agency financial statements and performance indicators and for examining

broader public sector compliance, control, accountability and

performance issues.

Recommendations

�� Agencies should comply with public sector wide electronic commerce

principles, standards and protocols.



sector by:

� carrying out its online service strategies and action plans; and

� developing, in consultation with the State Supply Commission and

the Department of Contract and Management Services (CAMS), public

sector wide principles, standards and protocols that facilitate agency

choice and are consistent with national agreements.

�� CAMS should support OIC online service strategies and agency electronic

purchasing implementation by developing the government contracting

information bulletin board, in partnership with agencies and OIC, in

order to identify and address associated design, management, security

and legal issues.

Auditor General WA


20

Redesigning the purchasingcycle

� Common purchasing processes are typically complicated, requiring

multiple approvals, and generate paperwork. They are often applied to

all purchases, irrespective of their value, complexity and degree of risk

� High volume/low value purchasing remains a significant activity for

some Western Australian public sector agencies. Electronic purchasing

provides tools to improve the productivity of this relatively low risk

activity.

� Business process redesign is essential to effective electronic purchasing

implementation.

� Electronic purchasing has highlighted the need to change outdated public

sector regulations, based on the physical checking of paper documents.

High volume/low value purchasing

Electronic purchasing is part of society’s transition from the Industrial Age

to the Information Age. It has been said that the twentieth century office

was modelled on the factory, with paper documents as the output, and that

office technologies have been applied accordingly.

Common purchasing processes, and their associated activities, have evolved

in accordance with the requirements and technological constraints of the

time. They are typically complicated, requiring multiple approvals, and

generate paperwork that moves backwards and forwards between different

staff and functional areas. All of the steps are candidates for process redesign,

and some for elimination, when implementing electronic purchasing.

A traditional purchase cycle process is shown in Figure 3. Until relatively

recently, this process would have been fairly typical for any large Australian

company or public sector agency. Not all organisations would include all

steps, nor in the same sequence. Some organisations, for example those

with a central store for receiving goods, would have additional steps and

processes.

21



Figure 3: A traditional purchasing cycle in large public or private organisations

Common purchasing processes are typically complicated. They involve multiple approvals

and generate paperwork that moves between functional areas. When implementing electronic

purchasing, all of the processes are candidates for redesign and some can be eliminated.

Source: OAG

A further feature of the traditional purchasing cycle is that most of the

processes and practices are applied to all purchases, irrespective of their

value, complexity and degree of risk. This means that the cost of making

low value purchases can sometimes exceed their value.

End User SupervisorPurchasing

SectionAccountsSection

Supplier

��

Completesrequisition

Approvesrequisition

Enter into

supply system

Identifies sources

of supply

Obtain quotes

Raisespurchase order

Retains copy ofpurchase order

Receives copy

of purchase order

Receives copyof purchase order

Receivespurchase order

Confirms

purchase order

Acknowledges

purchase order

Delivers goodsand services

Receives goodsand services

Validates purchase

order for paymentAuthorises purchase

order for payment(1)

Matches invoice to

purchase order(2) Sends invoice

Pays invoice

Updatesbudget

UpdatesFMIS

Updates supplysystem

Receivespayment

Notes:(1) Incurring officer signature (Western Australian public sector)(2) Certifying officer signature (Western Australian public sector )

� �

ut

t

t

u

t�

Auditor General WA


22


In order to compare individual purchases by number and value, the examination

obtained purchase order data from three comparable agencies for the calendar

year 1997. The combined result of this data extraction and analysis is shown

in Figure 4. All three agencies showed a similar purchasing profile.

As a further check, and to account for purchasing undertaken without a

purchase order being raised, the examination also analysed the agencies’

invoice data from their financial management information systems (FMIS)

for calendar year 1997. Again, a similar profile emerged.

Figure 4: Purchase orders raised in 1997, by number and value, in three comparable public

sector agencies

More than 90 per cent of purchase orders raised by the three agencies were for amounts less

than $5 000. However, a few large purchase orders (about one per cent of total orders raised)

comprised about 80 per cent of total purchase order expenditure.

Note: The purchasing patterns across the public sector may differ.

Source: OAG and agencies

The analysis suggests that high volume/low value purchasing remains a

significant activity for some public sector agencies. Any productivity

improvements that can be made to this relatively low risk activity can

potentially free resources for use in areas of greater risk and/or need.

$80M

$70M

$60m

$50M

$40M

$30M

$20M

$10M

14 000

12 000

10 000

8 000

6 000

4 000

2 000

0$0–5 000 $5 000–20 000 $20 000–50 000 >$50 000

Purchase Orders – Grouped by Value

Num

ber

of P

urch

ase

Ord

ers Total E

xpenditure

Number of Purchase Orders

Total Expenditure

23



Case Study – Redesigning the purchasing cycle

The examination sought to find an Australian public sector agency that had

implemented electronic purchasing to improve the efficiency of its high

volume/low value purchasing. With the aid of a consultant, the Victorian

Department of Natural Resources and Environment (VDNRE) was identified.

VDNRE was one of a group of agencies that undertook pilot electronic

commerce projects in conjunction with the Victorian Government

Procurement Board.

Prior to 1998, VDNRE redesigned its existing purchasing cycle processes to

reduce its invoice processing cost to an estimated low $7 per invoice.

Nevertheless, VDNRE estimated that it could reduce its costs by a further

$840 000 per annum, if it could eliminate 80 per cent of its 150 000 annual

invoices. It has four main strategies to achieve this aim:

� special supplier agreements – linked to electronic invoicing;

� expanded use of corporate credit cards;

� Internet purchasing - linked to invoice elimination; and

� a longer-term strategy to replace petty cash purchases with Smartcards.

Special supplier agreements – linked to electronic invoicing

VDNRE is negotiating special payment processing and reconciliation

arrangements with key suppliers that will provide a number of benefits

including a large reduction in invoices. For example VDNRE has:

� negotiated with its telecommunications supplier to reduce the current

3 000 invoices per year to only 12. Furthermore, these 12 invoices will

be provided in an electronic format suitable for direct entry into VDNRE’s

FMIS. This will permit reconciliation and emailing to appropriate sections

for verification, monitoring and approval. VDNRE intends to expand the

process to include a range of other utility providers, such as electricity

and gas; and

� developed a system with a large stationery supplier through which it

receives one invoice per month for up to 1 000 purchases. The invoice

information is supplied, reconciled and processed electronically thus

eliminating the need for re-keying invoice data. Further developments are

being investigated which will provide closer links between the vendor’s

VDNRE Case Study

1. Purchase planning integral toreform

2. Ordering simplified

3. Invoices reduced and eliminated

4. Electronic data capture in FMIS

12

34

Auditor General WA


24


Internet catalogues and the Department’s Internet based purchasing

application. This is intended to streamline the process further and

provide a standard for negotiation with other suppliers.

Expanded use of corporate credit cards

VDNRE anticipates that approximately 50 per cent of current invoices will

eventually be replaced by the expanded use of the corporate credit card.

VDNRE has negotiated, and implemented, an arrangement whereby its credit

card provider forwards a single electronic credit card statement each month,

that contains all purchases made by all agency credit cards. Individual

cardholders log on to the system to electronically approve purchases and:

� input supporting information, if required, that further describes the type

or purpose of individual purchases; and

� amend or allocate an expense code for each purchase.

The cardholder’s supervisor also receives an electronic copy of the statement,

which they are required to electronically acknowledge and approve. All

electronic purchasing data in the monthly credit card statement, and

information added by the cardholder, is captured and stored in the agency

FMIS.

VDNRE has contractually committed to pay its credit card provider the billed

amount on a set day each month. VDNRE’s internal checking and approval

processes do not delay this payment. Any incorrect charges identified are

followed up with the provider and adjustments made to the following month’s

statement.

Internet purchasing – linked to invoice elimination

Authorised personnel enter purchase orders directly into an Internet based

purchasing application. The orders are then processed by the FMIS and

e-mailed direct to the supplier. On delivery of goods or services, the order

originator confirms receipt in the purchasing application and the FMIS

automatically matches this receipt to the purchase order. It is a paper-less

process that relies upon the checks and balances built into the system.

25



System implementation was accompanied by a significant work redesign

exercise resulting in 1 600 of VDNRE’s 5 000 staff being authorised to approve

expenditure according to various authorisation levels. After initial piloting

and refinement, the system is currently being rolled out to all departmental

locations in the State.

The main savings result from eliminating invoices and simplifying the ordering

process.

Replacing petty cash with Smartcards

Smartcards differ from credit cards in that they contain a computer chip

capable of storing value and recording transactions. VDNRE recognises that

purchasing with Smartcards is a longer-term strategy that will take time to

implement. In particular the rate at which it can introduce Smartcards will

depend upon their level of acceptance by private sector suppliers.

The ability of Smartcards to store, and then download into the FMIS, detailed

purchasing transaction data should also lessen the future need for cardholders

to retain supporting paper documents for petty cash and credit card purchases.

Changes in government regulations

The initiatives being pursued by VDNRE have necessitated the review of the

Victorian Government’s regulations for certifying and authorising officers.

The elimination of invoices through Internet purchasing requires a change

to Government regulations to enable the authorisation of payments to be

made by electronic rather than physical signatures.

VDNRE was also used in a lead role by the Victorian Government to pilot the

elimination of invoices, thereby reducing the overall cost to the public sector

of introducing new business methods.

Summary

The case study illustrates that:

� organisations can often make improvements to the efficiency of existing

purchasing functions with little or no introduction of new technology;

Auditor General WA


26


� the implementation of electronic purchasing needs to be ‘business’ rather

than ‘technology’ driven as it involves strategic decisions of how the

organisation will do business with its suppliers;

� business process redesign is essential to effective electronic purchasing

implementation;

� electronic purchasing can enable more comprehensive capture of

organisational purchasing data; and

� within government, existing rules and regulations based on paper

documents can be an obstacle to electronic purchasing implementation.

Recommendations

�� When implementing electronic purchasing, agencies should:

� examine their purchasing profiles, as part of strategic procurement

and business planning, to identify opportunities for productivity

improvement;

� consider the willingness and ability of their suppliers to participate;

� adopt work process redesign as an essential and ongoing requirement;

and

� optimise purchasing data capture within their financial management

information system.



sector by working with agencies and the Treasury Department, in

consultation with the Auditor General, to identify and amend outdated

payment regulations.

�� The State Supply Commission should ensure that its State supply policies

support OIC online service strategies and agency electronic purchasing

implementation.

27


Electronic purchasing within theWestern Australian public sector

� The fuel card is a simple form of electronic purchasing that has resulted

in significant productivity improvements.

� The corporate credit card has not achieved the same level of acceptance

across the public sector as the fuel card, and its introduction was not

accompanied with the same extensive redesign of the purchasing cycle.

� The introduction of EFT has provided a number of benefits. Its future

lies in its better integration within the purchasing cycle.

� The history of the public sector’s experience with electronic data

interchange (EDI) has been one of limited success, yet real gains are

available through modern Internet based EDI purchasing applications.

� CAMS is sponsoring and cooperatively developing the Electronic

Marketplace, a major across government procurement initiative. The

successful implementation of the Electronic Marketplace would be

assisted by further high level strategic oversight, and support, from

across government.

This chapter discusses past and current electronic purchasing initiatives

within the Western Australian public sector. These initiatives include:

� the fuel card;

� the corporate credit card;

� EFT;

� EDI; and

� the CAMS sponsored Electronic Marketplace initiative.

The fuel card

Fuel cards were introduced into the Western Australian public sector during

the mid 1980s. The fuel company card contracts, managed by CAMS, currently

have a turnover of around $19 million per annum. This turnover comprises

an estimated 850 000 individual purchase transactions per annum with an

average value of about $22.

Fuel Cards

1. Purchase planning in contract


3. Payments consolidated

4. Usage monitoring and audit

12

34

Auditor General WA


28

Electronic purchasing within the Western Australian public sector

Prior to their introduction, many agencies operated their own bowsers to

fuel their passenger vehicles within the Perth metropolitan area. Within

country areas, local purchase order forms (LPOs) were widely used to purchase

petrol and other vehicle consumables. Country service stations billed

government agencies separately and had to make sure they sent the LPO

account to the right agency at the right address. Payment could take a couple

of months from purchase or longer. Some service stations were therefore

reluctant to accept LPOs because of the amount of paperwork involved and

payment delays.

Agency approval and payment of LPO fuel purchases was labour intensive.

Separate invoices from individual service stations were manually matched

to individual LPOs. Time consuming follow-up was required if drivers had

not forwarded them to accounts payable or if they had been lost in transit.

By contrast the electronic processing of fuel card purchases has considerably

reduced the amount of paperwork processed by both agencies and service

stations. Potential for error is much reduced, resulting in fewer time

consuming queries and follow-ups. Agencies and/or their fleet managers

receive one invoice per month for all fuel card purchases – service stations

receive regular monthly payments. Fuel cards are accepted by participating

dealers throughout the State.

Importantly, controls are built electronically into the fuel card. These specify

what the card can and cannot be used for; including what type and grade of

fuel may be bought. Authority to use the card can be cancelled immediately

if it is lost or stolen. Supporting electronic billing information enables ready

monitoring of card use to identify exceptions, such as unusually high fuel

consumption.

Although there is no cost data available to estimate the savings resulting

from the introduction of the fuel card, the gains are such that a return to the

previous system is hard to contemplate. For example:

� all phases of the fuel purchasing cycle, from placing an order to final

payment, have been streamlined while, at the same time, providing

mechanisms for better control and accountability; and

� agency capital and resources, required to operate and maintain bowsers

and fuel inventory, have been freed for more productive uses.

29



The corporate credit card

The government corporate credit card (the credit card) was introduced into

the Western Australian public sector in 1989. The credit card contracts,

managed by CAMS, had a turnover of about $34 million in 1997–98. This

turnover comprised an estimated 140 000 individual purchases per annum

with an average value of about $240.

The credit card has not achieved the same level of acceptance across the

public sector, as has the fuel card. Levels of usage vary widely between

agencies, with some agencies still making limited use of the credit card by:

� only issuing them to senior executive and other staff who do little

purchasing; and/or

� restricting their use to a narrow range of purchasing, typically

accommodation, air travel, stationery and hospitality.

The Auditor General has long considered that purchasing with the credit

card is a secure purchasing method, providing that management controls

are in place and monitoring is adhered to6. Issuing a credit card to an employee

involves a degree of trust, as does issuing an LPO. An LPO is equivalent to

a ‘blank cheque’ that can be used to purchase just about anything – it is

certainly not fraud-proof.

The implementation of the credit card has resulted in efficiency gains for

agencies when making purchases and payments.

� Instead of preparing and issuing requisitions or LPOs, the cardholder

needs to only present or quote the card number to make the purchase.

� Rather than have to process and issue a cheque for each individual

purchase, many purchases are consolidated on a single monthly account.

Some agencies are committed to reducing their reliance on LPOs by making

greater utilisation of credit cards. They also recognise the importance of

redesigning the purchasing cycle in order to maximise efficiency gains and

improve control.

6 See Appendix II for a summary of key credit card controls.

Corporate Credit Cards

1. Little impact on purchase

planning


3. Payments consolidated, though

payment approval process canbe time consuming

4. Computer assisted monitoring

techniques not widely used

12

34

Auditor General WA


30


However, in other agencies, invoice approval and payment practices have

not significantly changed from those applied to LPOs. This can lead to

bottlenecks at the payment approval phase of the purchasing cycle. This in

turn can contribute to ineffective or inconsistent application of controls as

staff strive to maintain work throughput.

Traditional controls that rely on checking each individual transaction are

time consuming and expensive. In addition, they often do not work because

workload pressures encourage circumvention. A more modern approach to

maintaining effective control is to focus on exceptions by, for example, using

a computer to scan electronic records of transactions and search for unusual

or inappropriate patterns of use. Purchasing and payments made by credit

cards are more readily captured and analysed electronically than purchases

and payments made by LPOs.

The current credit card contracts provide options for agencies to receive

electronic reporting for an additional fee. CAMS advise that 13 agencies

have taken up various levels of electronic reporting options since the facility

became available. Depending on the level of reporting required, set-up costs

have ranged from about $2 000 to $13 000 together with further varying

ongoing maintenance and support costs.

CAMS is looking to work with a selected agency or agencies, together with

credit card providers, to better identify the constraints to wider credit card

utilisation and how these may be overcome. If achieved, this will not only

lead to direct productivity improvements but may pave the way for future

implementation of Smartcards within the Western Australian public sector.

Electronic funds transfer

EFT is a form of electronic commerce that is increasingly replacing traditional

forms of payment, such as cheques and cash. The Western Australian public

sector’s first introduction to EFT occurred many years ago when public sector

salary and wages payments, previously paid in cash or by cheque, were

replaced by direct credits to employees’ bank accounts.

Electronic Funds Transfer

1. & 2. Not applicable

3. Lower payment costs, but not

integrated with purchasing cycle

4. Potential for improved reportingand control

12

34

31



During the 1990s, agencies have been making increasing use of EFT to pay

for goods and services, some through their own systems and many through

an arrangement provided by the Treasury. Until June 30, 1997, the Treasury

provided a cheque production facility free of charge to agencies through the

government accounting system (GAS). When this service was discontinued,

the Treasury provided an option for agencies to electronically transmit

payment details to the Reserve Bank of Australia (the Reserve Bank) by means

of a software package called ReserveLink7. On receipt of the electronic

transmission, the Reserve Bank makes either an EFT payment for a cost of

about $0.05 or arranges a cheque payment through Australia Post’s EDI Post

for a cost of $0.80.

The introduction of the ReserveLink facility has provided a number of benefits

to agencies including:

� reduced operating costs – processing cheques is costly;

� shorter transaction times – effectively payments, from time of release,

are made overnight. This compares favourably with cheques that require

cheque processing, postal delivery and bank clearance time; and

� potential for improved cash management – EFT provides certainty in

the timing of cash flows. With cheque payments, the timing of cash

flows is usually unknown and can take from days to months.

Suppliers also receive benefits from EFT payment, such as earlier access to

funds and a saving in staff overhead costs associated with the daily receipt

and banking of cheques. Nevertheless, some suppliers have been reluctant

to accept EFT payments because they:

� do not always know when an EFT payment has been credited to their

account and which invoices have been paid; and

� may be reluctant for security or privacy reasons to disclose their bank

account details that are required to make EFT payments.

These concerns may reflect, in part, supplier attitudes that will change as

electronic commerce becomes more widely accepted. However they also

reflect ReserveLink’s implementation primarily as a replacement to an existing

7 Appendix II contains a summary of controls that agencies should put in place to ensure integrityover ReserveLink payments.

Auditor General WA


32


cheque production facility. The future development of EFT within the Western

Australian public sector therefore lies in its better integration within the

purchasing cycle, as the final phase in redesigned purchasing and payment

processes.

Electronic data interchange

EDI enables the direct computer to computer electronic transfer of business

documents between trading partners with different computer systems.

Benefits include a saving in costs and improvement in customer service

resulting from:

� not having to process paper and the associated handling, filing, printing

and mailing activities and costs; and

� the reduction in errors from not having to re-key data and thereby avoiding

most of the time consuming follow-up activities and costs.

EDI has a structured and well-defined approach. Trading partners agree on

predefined transactions that are exchanged in accordance with international

standards and formats. Historically the cost of establishing and operating

EDI has limited its use to large organisations (and their trading partners)

that process a sufficiently large number of standard transactions, such as

purchase orders.

It is common for EDI trading partners to exchange documents through a

third party service provider, known as a value added network (VAN). The

VAN provides a variety of network management and document translation tasks.

The Electricity Corporation (Western Power) has developed direct EDI

connections with 11 of its major suppliers through a VAN. This facility

allows Western Power to both send orders via EDI and receive invoices back

from the supplier via EDI. More than 30 per cent of purchase orders go out

via EDI and about eight per cent of invoices come in that way. Both figures

are by volume with the level of penetration governed by the ability of suppliers

to participate. Western Power has recently introduced EFT payments and

suppliers have taken up this payment option quite rapidly. EFT comprised

about 45 per cent, by volume, of all goods and services payments at the end

of August 1998.

The Gateway (page 35)

1. Little impact on purchaseplanning

2. Electronic orders are received

by suppliers via a number ofmedia

3. No use of invoice receival or

EFT functionality

4. Systems captures orders only

12

34

33



In order to provide an electronic purchasing system for broader public sector

use, the then Department of State Services established SupplyNet in 1989.

SupplyNet was replaced in 1994 by an EDI facility known as the Electronic

Trading Gateway (ETG) – called the Electronic Commerce Gateway (the

Gateway) from October 1997.

After its implementation in July 1994, the ETG was used by over 25 agencies

to process purchase orders electronically to over 450 suppliers. However,

this level of usage was largely dependent upon transactions being generated

via an across government common user purchasing system (CUPS). When

the removal of CUPS was announced, as part of public sector management

devolution, agencies had to accept the greater business responsibility of

using their own newly implemented FMIS8 if they wished to continue trading

via the ETG.

This was a challenge for most existing agency users of the ETG that were

also having to devote resources to:

� the adoption of accrual accounting with associated management and

system implications;

� the implementation of new FMIS, for some agencies a first time

experience; and

� identifying and addressing Year 2000 computer system risks.

In 1997, the Ministry of Justice was the pilot agency to send electronic

purchase orders to the Gateway from its FMIS. During 1998, the Education

Department of Western Australia9 and Health Supply Services10 also started

using the Gateway for purchasing. Other agencies are now joining or are

poised to join. In addition, the Gateway is also used by some agencies to

electronically exchange non-purchasing operational data within a secure and

controlled environment.

8 At September 1998, two agencies were still using CUPS to send electronic orders through theGateway, until such time as they can make other arrangements.

9 The Education Department had to temporarily suspend its use of the Gateway pendingimplementation of a compatible FMIS EDI module.

10 Health Supply Services is a specialist unit that undertakes contracting and tendering serviceswithin the health portfolio, under the direction of the Government Health Supply Council.

Auditor General WA


34


The Gateway has the facility to convert electronic purchase orders to an

appropriate form that can be accepted by any supplier, be it EDI, fax or post.

The Gateway also enables agencies to connect with EDI enabled suppliers,

irrespective of which VAN the supplier uses. As well as facilitating supplier

access, this provision for open access was a strategic choice by Government

in 1994, which successfully sought to avoid VAN vendor lock-in.

CAMS advises that the current Gateway also has the capability of providing

additional secure electronic purchasing functions for agencies such as:

� receiving supplier invoices;

� receiving credit card provider transaction statements; and

� making EFT payments to the Reserve Bank.

However, agencies are not currently using these services although CAMS

believes that many will be ready to do so over the next six to 12 months.

CAMS is available to assist agencies undertake the required business process

redesign and has formed a client agency reference group to guide the further

development of the Gateway. The present agency utilisation of the Gateway,

excluding the transfer of non-purchasing operational data, is shown in Figure 5.

35



Figure 5: Sending purchase orders through the Electronic Commerce Gateway (August

1998)

The Gateway converts the agency purchase orders, transmitted from differing FMIS, into the

appropriate form that a supplier can accept – be it EDI (various VANS), fax or post. CAMS

advises that the Gateway has the capacity to support further electronic purchasing functions,

such as invoicing and EFT.

Note. The Gateway is also used by some agencies to exchange non-purchasing operational

data within a secure and controlled environment (not illustrated)

Source: OAG, SSC and CAMS

The decision to remove CUPS was part of a broader change in business

strategy within the public sector that could not have been reasonably foreseen

when the ETG was implemented. Whilst undoubtedly a setback to the ETG’s

development at the time, it also proved the spur to develop direct connections

from agency FMIS to the current Gateway. This should be of longer-term

benefit if it leads to the capture of more comprehensive purchasing data,

and improved procurement management, within agencies and across

government.

Australia

Post

Fax Server

VAN (2)

VAN (3)

VAN (1)

Supplier

Supplier

Supplier

Supplier

Supplier

Fax

EDI

FaxConfirmation

Letter

EDI

EDI EDI

EDI

ElectronicCommerce

Gateway

u

u

u

u

ut

u

Agency

Outpost

Agency (A)FMIS (1)

Agency (B)FMIS (2)

Agency (C)CUPS

u

u

u

u

p

Auditor General WA


36


SSC considers that weaknesses in the ETG’s 1994 implementation program

provide valuable lessons for future electronic commerce implementations.

These include the need to:

� focus on the importance of redesigning purchasing processes and defining

business rules;

� have a strong client focus, particularly with regard to quickly resolving

customer concerns and problems;

� avoid a disproportionate focus on the technology;

� maintain momentum as windows of opportunity can quickly arise and

pass away if not seized; and

� provide the level of resources and business skills, including strategic

marketing skills, needed to effectively implement the above.

SSC also notes that implementing EDI has presented a major challenge to

most Australian and overseas governments. Part of this challenge is that

governments typically purchase from thousands of suppliers whereas EDI is

particularly suited to large organisations that make a large number of

purchases from a small number of major suppliers11.

Although the history of the public sector’s experience with EDI has been one

of limited success, CAMS has actively sought to avoid the mistakes of the

past in its recent management and development of the Gateway. CAMS is

currently upgrading the Gateway in order to:

� ensure it is Year 2000 compliant;

� reduce the expensive running costs associated with outdated 1994

hardware and software; and

� enable it to connect to Internet based technology.

When this upgrade is completed, the Gateway should have the capability of

providing a range of needed electronic purchasing and data transfer services

within government.

11 This is because of the need for any two EDI trading partners to agree on predefined transactions,standards and formats.

37



Case study – Eliminating paper from the purchasing cycle

The examination sought to find an illustrative example of an Australian

company that had utilised electronic commerce to significantly eliminate

paper, and the need for data re-keying, within its purchasing cycle. With the

aid of a consultant, the Western Australian company Atkins Carlyle Group

(Atkins) was identified as such an organisation, as the following case study

illustrates.

Atkins and its many divisions have been using EDI for many years. Although

the benefits being obtained were real, Atkins found the task of expanding

the utilisation of EDI, for example by including electronic invoices and other

documents, to be daunting because of the technical difficulties and level of

skilled staff resources required.

Furthermore the benefits were not being achieved widely across the company’s

business. Less than one per cent of its supplier and customer base were EDI

enabled. Even then, some of these EDI trading partners had to manually re-

key the electronic order into their own systems – limiting EDI functionality

to that of a somewhat expensive fax for these customers.

In late 1997, Atkins sought a cheaper and more flexible alternative to its

existing EDI system that would bring benefits to its trading partners at all

levels. Atkins chose an Internet based EDI solution, outsourced to a service

provider. This new solution allowed Atkins to develop specific applications

with key customers that had not been possible under its previous EDI system.

The following specific customer application illustrates the gains that modern

Internet based EDI applications can now bring to both purchasers and suppliers.

Atkins Case Study

1. Purchase planning covered bycontract


3. Invoices eliminated

4. Data captured in FMIS

12

34

Auditor General WA


38


One large customer has imported Atkins’ price catalogue into its own

FMIS, using a proprietary purchasing system developed by another

Western Australian company. The customer’s on site users in the remote

north-west of Western Australia can electronically order items from

this catalogue at a known price from within their own FMIS.

When the order is received by the service provider, an electronic

acknowledgment confirming receipt is sent to the originator. This

acknowledgment also contains key order content and identification,

designed to establish that the data received was the same as the data

sent and that both parties to the transaction were authorised users.

The order is then sent electronically from the service provider to Atkins

in the format required by Atkins’ mainframe computer. On receipt, this

order is processed by the mainframe and, if any exception conditions

are encountered (for example insufficient stock, special or quantity break

pricing) the order is automatically presented to the appropriate order

clerk for review. If no exceptions are encountered, the order is

immediately printed in the warehouse (as a packing slip) for picking,

packing and dispatch.

When the packing slip is printed, an advance shipping notice is generated

and sent electronically to the service provider. This is translated and

sent to the customer’s FMIS.

When the goods are received on site, the order originator checks the

content and acknowledges receipt in the FMIS. Payment is generated on

a monthly basis from orders that have been flagged as received.

The only piece of paper involved in the entire transaction is the packing

slip that addresses and accompanies the goods to site. No invoice is

produced or required. In addition to savings in transaction costs, further

savings have resulted from eliminating keying errors and reducing the

number of phone calls and faxes.

39



The Electronic Marketplace

Although the Western Australian public sector faces some similar challenges

to both VDNRE and Atkins, it operates in a different environment. This may

require different electronic purchasing models and solutions, designed to

meet the needs of the Western Australian public sector and the role it plays

in the Western Australian economy. In addition, the Western Australian public

sector has to achieve its Government’s wider online service objectives.

CAMS is developing the Electronic Marketplace in order to meet future agency

electronic purchasing needs and facilitate an efficient whole of government

approach to procurement. The Electronic Marketplace will be an Internet

based electronic commerce system, likely to incorporate the upgraded

Gateway, which aims to provide the following functions and services:

� Online supplier catalogues for contract and non-contract items;

� Electronic purchase orders – supported by fax and post;

� Electronic invoicing;

� EFT, cheque and credit card payments; and

� Supply chain management and reporting.

Learning from past experience with EDI, the CAMS Electronic Marketplace

development strategy recognises the need for a focus on change management,

strategic procurement, business process redesign and active stakeholder (both

agencies and suppliers) involvement.

CAMS is planning a phased implementation, using a pilot site to test the

concept, develop the business rules and identify any policy requirements/

constraints. CAMS also intends to use the pilot to develop specifications

with which to go to tender to select a whole of government solution. Public

sector rollout for the Electronic Marketplace is dependent upon the results

of the pilot study, resource availability and level of ongoing agency

commitment.

It is too early to know whether the Electronic Marketplace will proceed in

its present conceptual form and what contractual arrangements will underpin

its development. CAMS envisage that the Electronic Marketplace may develop

as a non-mandatory common-use-contract, with CAMS being the contract

The Marketplace – currently underdevelopment

1. Proposed online catalogues

2. Proposed simplified ordering

3. Proposed simplified payments

4. Proposed electronic datacapture

12

34

Auditor General WA


40


manager and contract principal. Depending on the outsourcing model

developed, participating agencies may either contract directly with the

selected service provider(s) or with CAMS through a service level agreement.

Competition for the provision of electronic commerce services is intensifying.

Many organisations offer an array of secure electronic commerce services at

increasingly competitive prices. Agencies will therefore have access to a

wider range of providers and options than was previously available.

Increasingly, agencies are likely to compare the services offered by CAMS to

those offered by other providers, and choose accordingly.

In developing whole of government electronic commerce solutions, such as

the Electronic Marketplace, CAMS is in a position to use economies of scale

to bundle services together at lower cost. The Electronic Marketplace could

also facilitate a consistent approach across government to the implementation

of electronic purchasing standards and protocols developed by OIC.

However, as an intermediary contract manager, CAMS will also find it a

challenge to meet diverse and changing agency requirements as well as

keeping agencies informed about contractor performance and industry

developments.

CAMS is actively consulting with agencies in developing its plans for the

Electronic Marketplace. An inter-agency steering committee, comprising

appropriate mid-level managers, has been formed to guide the pilot

implementation.

The Electronic Marketplace, if it proceeds, will be a key strategic procurement

initiative within government that will have both policy and operational

implications for agencies and suppliers. Past experience suggests that its

future success will depend upon:

� a shared vision and joint ownership between policy making bodies, CAMS

and participating agencies;

� a clear understanding of respective roles, responsibilities and

commitments;

� robust inter-agency service level agreements that include details of

deliverables, funding arrangements and methods for dispute resolution; and

� ongoing liaison and consultation with industry.

41



The successful implementation of the Electronic Marketplace would be

assisted by further high level strategic oversight, and support, from across

government. This oversight would likely include:

� periodic assessment of the viability and appropriateness of the developing

Electronic Marketplace concept;

� an ongoing monitoring of progress against key milestones, with initiation

of corrective action if required; and

� endorsing the proposed contract and service level agreement framework

between CAMS, participating agencies and the chosen outsourced service

provider(s).

OIC, with assistance from the CEOs Online Services Consultative Group,

would appear to be the appropriate body to provide this strategic oversight.

ICPAC would also likely have an interest in the strategic direction of the

Electronic Marketplace and related online infrastructure and support service

developments.

Recommendations


� look for opportunities to better utilise simple electronic purchasing

tools, such as the corporate credit card; and

� consider a range of options and suppliers when implementing more

advanced electronic purchasing applications.



sector by arranging high level strategic oversight, and support, within

government for relevant Department of Contract and Management

Services (CAMS) projects and contracts.

�� CAMS should support OIC online strategies and agency electronic

purchasing implementation by:

� facilitating, in consultation with the Treasury Department (the

Treasury), OIC and agencies, more effective utilisation of the corporate

credit card;

Auditor General WA


42


� working with the Treasury, OIC and agencies to identify opportunities

for Smartcard common-use-contracts; and

� continuing to work with OIC and agencies to determine where it

can best add value in arranging for the provision of needed

infrastructure and support services and where it can best leave

agencies to make their own arrangements.

43


Electronic purchasing – the wayforward

� Leadership and coordination will be required for effective implementation

of the Government’s online service strategies.

� The implementation of electronic commerce is part of a longer-term

strategic change process and needs to be managed accordingly. It should

be business driven rather than technology driven.

� The ability and willingness of the public sector’s suppliers, particularly

small business, to participate in electronic purchasing is fundamental

to its success.

� Agency electronic purchasing implementation should be soundly based

around a business case. As with any computer system implementation,

data integrity and system control implications need to be addressed.

Leadership and coordination

All agencies have a responsibility to deliver the Government’s commitment

to online services, of which electronic purchasing is an important part.

However successful implementation will require leadership, coordination

and commitment within government and across the public sector. The

Western Australian Government has given the primary lead role to OIC. In

addition to driving the online services strategy, and providing strategic and

policy oversight of relevant CAMS projects and contracts, OIC will need to:

� identify and facilitate online service implementations that have significant

across government costs, savings and/or other benefits and are hard to

justify or work through within a single agency; and

� identify and resolve policy and practice issues that arise. This could

include disputes between agencies regarding respective roles,

responsibilities and mandate.

More complex or contentious issues may need to be put to Government,

after canvassing views from bodies such as ICPAC and the CEOs Online

Services Consultative Group, for resolution and direction.

Auditor General WA


44


Business Process Redesign

Traditionally, large public and private organisations have had separate

purchasing and accounts payable functions. This was based on complex

individual transaction controls, including the need to segregate duties.

For electronic purchasing implementation, the whole supply chain, including

inventory management, should be considered as one continuous process.

Redesigning this process should be undertaken within a framework of

strategic procurement and business planning.

As the public sector delivers more of its services through contracts with the

private sector, and increasingly manages its finances on an accrual basis, the

need for employees with highly developed procurement and financial

management skills becomes more critical. Agencies therefore need to

distinguish these high value-added activities from low value-added

transaction processing activities, when implementing business process

redesign of the purchasing cycle.

Managing change

It takes time to change organisational culture and the mind-set that supports it.

OIC recognises that a key part of its coordination role is to facilitate a long

term change management process. Even relatively simple forms of electronic

purchasing, such as the corporate credit card, require a significant change in

management thinking for effective utilisation. The challenges that lie ahead

with the implementation of more complex forms of electronic purchasing,

and online services, are much greater.

Notwithstanding the technical complexities of electronic purchasing, it is

likely that the associated people issues will be the hardest to manage. For

example staff, including senior managers, who are reluctant to be part of a

work flow process that involves significant interaction with a computer,

may passively or actively resist electronic commerce implementations. Other

staff – for example, those working in centralised purchasing, accounting

and stores areas – may feel threatened as a result of work process redesign

that results in their full or partial redeployment to more productive tasks.

45



Agencies will need to recognise and manage these fears as part of their

move to online services. Other staffing issues to be considered include the

need for awareness raising, skills training, and a customer focused approach

to continuous service improvement.

The ability of small business suppliers to participate

When implementing electronic purchasing, agencies need to manage change

externally with trading partners as well as internally with staff.

Most small to medium enterprises (SMEs) do not perceive electronic

commerce to be high priority issue, although interest in electronic commerce

is high12. For small business, any electronic commerce implementation must

be low cost, easy to use and directly aligned to core business functions. This

would be difficult to achieve if the older style of EDI remained the only form

of electronic trading. However, cheaper alternatives that build on the

foundations of EDI are now available, or are becoming available. Commercial

competitiveness is likely to encourage more rapid adoption of these newer

forms of electronic commerce.

SBDC periodically survey Western Australian small business regarding a range

of issues, including computer and Internet usage. SBDC’s November 1997

survey found that an estimated 70 per cent of Western Australian small

businesses use a computer, and that nearly a third of those that use a computer

also use the Internet. This Internet usage is mainly for e-mail and accessing

information, although the number of small businesses that receive electronic

orders through the Internet is growing.

On the basis of this survey, about 20 per cent of Western Australian small

businesses already have the technical means to conduct electronic purchasing

and payment. A further 50 per cent could acquire these means, if they have

an available telephone line and purchased a modem, appropriate software,

and Internet access through an Internet service provider (ISP). The remaining

30 per cent mostly have a fax, which allows them to at least receive electronic

orders.

12 One of the more extensive studies undertaken was the Small Business Index, a survey ofAustralian SMEs listed in the Telstra Yellow Pages, published by Telstra in April 1998.

Auditor General WA


46


Developing a business case

Many of the Australian organisations that were canvassed during this

examination had implemented EDI up to ten years ago. The decision to

implement EDI then was driven by a number of factors, common ones being:

� the belief that large savings were achievable without appreciating the

need to be innovative in redesigning common business processes;

� pressure from large trading partners;

� a desire to be up-to-date with the latest technology; and

� a belief by suppliers that, if they became EDI capable, the orders would

follow.

With the changes in technology and the increased use of the Internet, some

of these organisations are now in the process of reviewing their existing

implementations. Many organisations indicated that, in future, the

introduction of any new forms of electronic purchasing would be business

driven rather than technology driven and would need to be supported by a

business case with a cost justification.

OIC supports the principle that an agency’s electronic commerce

implementation should be soundly based on a comprehensive business case

and is developing guidelines to assist agencies. Some factors to be considered

in developing an electronic commerce business case are shown in Appendix III.

Broader legal issues

At September 1998, OIC was advancing a tender for a study to clearly identify

barriers and solutions to legal, audit, security and management issues

associated with the implementation of online services. For some of these

issues, especially the more complex legal ones, any Western Australian

solutions will need to take account of national and international

developments.

The law has not been able to keep up with the rapid changes in technology.

This is likely to continue to be the case, notwithstanding efforts to now

address some key areas. Therefore agencies should consider gaps in the law

carefully as part of wider business risk assessment. As an example, the

47



possible inadmissibility, as legal evidence of contract, of a faxed purchase

order would usually be considered an acceptable risk for a routine low value

purchase. Legal certainty of contract becomes more important as value,

complexity and risk increases.

Regulatory constraints

Public sector rules and regulations have not kept pace with technological

change. This frequently creates problems for agencies seeking to redesign

their supply processes and implement electronic commerce.

Within the Western Australian public sector, the Treasurer’s Instructions

(issued under the FAAA) probably represent the main regulatory constraint

to agencies seeking to implement electronic purchasing. Problem areas relate

to the role of incurring and certifying officers and the requirement for written

signatures. As part of a wider review of the FAAA, the Treasury and OIC

plan to work with agencies, in consultation with the Auditor General, to

determine which current regulatory requirements are:

� irrelevant to the Information Age and must be removed or amended;

� critical and must be retained or reinforced; or

� deficient or missing and in need of further development.

Telecommunications infrastructure

The development of telecommunications infrastructure, particularly to rural

and remote areas, will become increasingly important in the Information

Age. Modern telecommunications have the potential to remove the

disadvantage that distance has traditionally placed on accessing information

services.

Some agencies consider that a lack of suitable telecommunications carrying

capacity is, along with current regulatory constraints, the main barrier to

implementing online services to their devolved regional centres. The need

for greater telecommunications carrying capacity, or bandwidth, increases

as the data carried moves from voice to text to multi-media.

Auditor General WA


48


These agencies also expressed interest in subscribing to a joint public sector

wide solution because of the prohibitively high costs of seeking to go alone.

OIC and CAMS are currently evaluating the infrastructure requirements, and

associated funding implications, to address this issue and are likely to go to

public tender early next year.

The availability of sufficient Internet bandwidth within the Perth metropolitan

area is also becoming an issue for some agencies. Whereas current Internet

bandwidth may be adequate for publishing documents and conducting

research, it may not be adequate for electronic commerce. CAMS currently

manage an ISP contract on behalf of about 30 agencies – other agencies

make their own arrangements.

Internet electronic commerce information security

The availability of simpler, more flexible and cheaper technologies, together

with ready access to the Internet, is rapidly changing the economics of doing

business. “Any transaction that is done from a distance, be it by telephone,

fax, or mail, can be done cheaper, faster and easier on the Internet”.13

A number of Western Australian public sector agencies are implementing,

or can be expected to soon start implementing, Internet based electronic

commerce applications. As with any computer system implementation, or

significant change to business practice, agencies need to consider the data

integrity and system control implications of Internet electronic commerce.

These considerations are integral to:

� ensuring data accuracy and validity of transactions;

� conducting risk assessments and developing a business case;

� establishing contracts and trading agreements with external parties;

and

� ensuring security and confidence in the systems deployed.

13 Remarks of Secretary Daley Before the European Ministerial Conference on Global InformationNetworks ‘Creating a Favorable Environment for Electronic Commerce’ (U.S. Department ofCommerce and Trade) Tuesday, July 8, 1997 p. 1.

49



The essential pre-requisite is an organisational commitment to information

security that is reinforced from senior management down. Without this

commitment, security and control may not be taken seriously. With this

commitment, policies and procedures can be developed and implemented,

and employee-training needs assessed.

Internet based electronic commerce security practice and control can be

considered to operate at three levels as shown in Figure 6. A more detailed

description of these three levels of control is provided in Appendix II.

Figure 6: Data integrity and system security

Electronic commerce security practice and control can be considered to operate at three

levels as shown above. An essential pre-requisite is an organisational commitment to

information security that is reinforced from senior management down.

Note: The firewall configuration shown is illustrative only.

Source: OAG

Local Area Network Internet

Firewall

Level 2Build a shield

Web Server

Level 3

Protect data transmission

Level 1Tighten basic

network security

p

q

p

q

Auditor General WA


50


Agency next steps

The way forward for individual agencies will vary and depend upon:

� the agency’s business needs and planned strategic direction;

� their current stage and skill level in electronic commerce implementation;

and

� the size and nature of their purchasing function.

For many Western Australian public sector agencies, particularly if their

exposure to electronic purchasing to date is limited, a phased approach that

provides some immediate and easily obtainable gains may be a preferred

option.

Many small to medium sized public sector agencies, that do not process

high volumes of purchasing transactions, may prefer to focus upon non-

purchasing electronic commerce initiatives. For example, an agency that

purchases few goods and services, but has a major role in the provision of

information to the public, may find it more productive to focus its resources

on improving and redesigning these customer services.

Alternatively, small to medium agencies implementing broader electronic

commerce and service delivery initiatives may also be attracted to electronic

purchasing. This is because many of the technical and work process redesign

issues are common and it may be more effective to tackle them concurrently.

Some agencies have an immediate priority to address critical Year 2000

compliance problems and/or any outstanding FMIS and accrual accounting

implementation issues. They may decide to address these issues first or

address them concurrently with online services.

Whatever path agencies take, advances in technology are making it more

feasible for them to implement electronic purchasing. Although CEOs have

choice regarding the type, timing and rate of change, a refusal to embrace

online services is not an option. It is a requirement of Government and it is

the direction in which the rest of the developed world is heading.

51



Recommendations


� recognise that electronic purchasing is part of a significant long

term change process and manage accordingly;

� base initiatives on a comprehensive business case;

� carefully consider gaps in the law regarding the legal status of

electronic transactions as part of broader business risk; and

� address fundamental information security issues, especially when

utilising public networks (such as the Internet) that potentially open

up their private computer systems to the world.

�� The Office of Information and Communications should lead and facilitate

the implementation of electronic purchasing within the public sector

by:

� identifying and facilitating initiatives with significant across

government costs, savings and/or other benefits that are difficult

for individual agencies to address; and

� identifying and resolving policy and practice issues that arise,

referring more complex or contentious issues to Government.

Auditor General WA


52

Appendix I – Purchasing in theyear 2002

Where will Western Australian public sector agencies be in four years time?

Scenario A

In the year 2002, Chris, from the Department of Progress, connects the

personal palm-top computer via a video link to the Internet super store

to obtain a list of pre-qualified suppliers to government. Chris then

chooses the appropriate laser disk needed from the interactive 3D

catalogue and has the in-built intelligent software agent:

�� find the cheapest priced supplier with the item in stock;

�� undertake a due diligence test on the company selling it;

�� confirm that the product is not listed on the faulty goods file; and

�� identify the most cost effective delivery option.

Chris then clicks on the order button and swipes the personally allocated

Smartcard on the reader attached to the palm-top. Embedded software:

�� checks that Chris’s personal authorisation limit (both for the price

and type of goods or services purchased) has not been exceeded;

�� verifies that the budget has sufficient funds and updates the

departmental FMIS with the order and reservation for funds; and

�� confirms supplier acceptance of the order.

The laser disk is delivered by courier the next day. On receipt, Chris

reads the bar code directly into the departmental FMIS via the palm-top

computer. Once the FMIS verifies that the item was on order and has

not been paid for, it approves the EFT for due date payment to the

supplier.

53


Appendix I – Purchasing in the year 2002

Scenario B

In the year 2002, Kim, from the Ministry of No Change:

�� thumbs through an out-of-date catalogue looking for a thing called a

laser disk needed for an upcoming presentation;

�� makes numerous phone calls to find a supplier who sells the product;

and

�� fills out a requisition form by hand which is then passed by internal

mail to the purchasing section.

The requisition arrives the next day but the section is busy and it takes

a further two days to complete required checks and key into the purchase

order system. The order is then printed off, sent for approval and mailed

to the supplier two days later. Fortunately, the purchase order arrived at

the correct address but, unfortunately, the supplier is now out of stock.

After several weeks, the item is finally shipped to the Ministry. Even

later, an invoice is posted out – twice by mistake. The accounts section

has difficulty matching the invoices to their purchase orders and delivery

dockets. Accounts ask purchasing for copies of the requisitions but this

does not help either. By mistake both invoices are paid, accounts payable

updated and the cheques printed off to be mailed out.

By the time Kim received the laser disk, the presentation had already

been held but it was too complicated to try and return the good – all

that paperwork.

Auditor General WA


54

Appendix II – Summary of keyelectronic commerce controls

Corporate credit card

Purchases made with the corporate credit card should comply with SSC and

agency supply policies. Because the checks and balances have to be built

into the system, the utilisation of credit cards and other forms of electronic

purchasing help reinforce the importance of clearly establishing, and regularly

updating, an agency’s business purchasing rules.

The key management controls that need to be in place when using credit

cards are:

� policies – Agencies need to develop clear policies that inform cardholders

individually and collectively of how credit cards are to be used, supported

by training as required;

� point of issue – Making staff aware that they will be held accountable

for the proper use of their credit card in accordance with policy and

requiring an acceptance of this accountability as a condition of issue.

Management, by placing trust in their staff, accepts the risk that staff

can make improper purchases – but lets them know that they will suffer

a penalty if they abuse that trust;

� credit limits – The credit card has important front end controls, that

the LPO does not, by being able to set dollar limits on individual credit

cards for both single and total purchases (for example, no more than

$500 per individual purchase and no more than $5 000 total purchases

per month). The credit card can be more readily cancelled than LPOs if

lost, stolen or misused;

� approval for payment – At this point the cardholder confirms the purchase

was made for official purposes. Another individual, usually the

cardholder’s supervisor, approves the purchase. Both the cardholder and

the approving officer are accountable for their decisions. This is a key

control that must be diligently applied; and

55


Appendix II – Summary of key electronic commerce controls

� monitoring – This is best done electronically, especially for large volumes

of purchases, by requesting invoice transaction data from the credit

card provider in electronic format. This electronic data can also be used

to develop agency and individual purchasing profiles. Electronic

monitoring can be undertaken at three levels, which are:

�� regular monitoring using pre-set parameters to identify and report

exceptions and compare supplier performance;

�� periodic randomly conducted sample audits to ensure system controls

are working as intended; and

�� occasional more comprehensive value for money reviews or special

investigations if misuse is suspected.

ReserveLink EFT

There are a number of controls that agencies should put in place to ensure

integrity over ReserveLink EFT payments. These include ensuring that:

� an authorisation structure exists that gives confidence that payments

are approved by an appropriate officer and that not all payment functions

are concentrated in one system or officer (segregation of duties);

� supplier bank account details are kept secure and private, and ensuring

that updates and modifications are appropriately authorised, unalterably

recorded, and monitored;

� secure control is maintained over any intermediate file handling processes

between an agency’s FMIS and its ReserveLink connection; and

� regular monitoring of rejected, returned and completed payments are

undertaken to identify any errors and reduce the risk of fraud.

Auditor General WA


56


Internet electronic commerce

Although these guidelines focus upon electronic purchasing applications,

they are also of relevance to wider Internet usage14. For example, agencies

need to set policies and inform staff regarding what is appropriate and

inappropriate usage of the Internet. Tools are available to monitor this usage

and staff should be advised that this monitoring might be undertaken.

The three main levels of control illustrated in Figure 6 (see ‘electronic

purchasing – the way forward’) include:

Level 1 basic in-house information security practices

Agencies need to tighten their basic information system security controls,

in advance of implementing electronic commerce, to avoid being at risk

from, or a risk to, external parties. Most of these basic controls have been

necessary since computers were first used in business and government. They

are therefore generally well understood but have not always been so well

practiced.

It is now more critical than ever that these basic controls are diligently

applied. For example, in the past if a departing employee retained the

knowledge and/or authority to access the agency’s computer system, they

may still have needed to physically enter the agency’s office building to

access those systems. Today, the power of the Internet means that they may

be able to enter the agency’s computer system from anywhere in the world.

The basic control measures that, as a minimum, agencies should ensure are

documented and applied include:

� effective password controls, including mandatory periodic change of

passwords;15

14 For further information about managing public sector Internet usage refer to:

�� Best Practice Guidelines – The Internet (Western Australian Information Policy Council,October 1997); and

�� The Internet and Public Sector Agencies (Special Report No. 3, Office of the Auditor General– June 1996)

15 Although it is probable that, due to technological advances, security measures more effectivethan passwords will be developed, passwords remain the main current method of user identificationand authentication.

57



� periodic review of users to reconfirm appropriateness of access and

removal of access when staff leave the agency;

� monitoring of any changes to critical data, whether from internal or

external sources, and whether deliberate or accidental;

� effective control over, and recording of, system changes;

� management commitment to ensuring that ‘business rules’ remain

current. For example, it is essential that the file of system users who

may approve payments online is up-to-date; and

� maintaining physical security16 by, for example, ensuring high-risk areas

are locked at all times, and other areas after hours.

Level 2 protecting the information system – building a shield

Once an agency directly connects all or part of its network to the Internet, it

potentially opens its information systems to the world. If agencies simply

connect to the Internet via a stand-alone personal computer, with no network

link, then the risk to their network is low. However, this risk increases as

the agency seeks to use the access, flexibility and relatively low cost of the

Internet to conduct electronic commerce.

The control measures described at Level 1, although critical, will not alone

protect a database from accidental or deliberate damage from an external

source. Additional control measures that need to be considered include:

� an extension of Level 1 access requirements to incorporate external

parties – the agency’s ‘internal’ control system now extends beyond

organisational boundaries;

� development of agency policies and procedures regarding Internet usage

and staff awareness raising/training regarding these policies;

� the ability to maintain continuity of service in the event of system or

contractor failure. If the need to maintain continuity of service is critical,

16 A previous performance examination found that the need to protect confidential informationwas not considered by many public sector agencies when conducting physical access securityrisk assessments. See Guarding the Gate (Report No. 5, Office of the Auditor General – September1996).

Auditor General WA


58


agencies may consider securing a normally unused alternative connection

that is available for use in an emergency, such as ‘denial of service’17

attacks; and

� protection against breaches – the use of a firewall(s), linked to other

security measures, to limit system exposure.

A firewall is a collection of hardware and software devices that restrict data

flow between computer networks according to a set of security standards. A

firewall can also log and monitor all accesses to and from the Internet, as

well as run anti-virus and data content scanning software.

The term firewall covers a range of hardware/software configurations of

varying functionality, complexity and cost. The level of protection an agency

requires will depend upon potential exposures and will need to balance

acceptable risk against cost. In determining which firewall configuration is

most suited to their needs, agencies should also consider:

� the need to develop a firewall security policy that defines what data the

organisation wants to let in and out. A policy that denies any service

unless expressly permitted provides more security than a policy that

permits any service unless expressly denied;

� whether to operate the firewall in-house or outsource it. Outsourcing is

becoming more common in order to take advantage of the expertise that

specialist providers can offer;

� whether outsourced or provided in-house, agencies will need to specify

their firewall requirements in terms of their business needs and rules,

confirm and test that the firewall protection is working as intended and

monitor security and policy breaches, taking action as required. A firewall

requires frequent review to reconfirm that it remains effective; and

� the need to maintain system flexibility and avoid vendor lock-in. For

example, the ease of upgrading or maintaining firewall hardware and

software in line with changing business needs and developments in

technology.

17 ‘Denial of service’ attacks are attempts to shut down a Web site server by inundating it withmessages. They are relatively difficult to protect against.

59



Level 3 transmission protection

When transmitting data over a public network such as the Internet, it is

essential to ensure that the data is protected and kept private and that the

data received is the same as data sent. This requires a well-developed and

clearly understood relationship with external parties. The foundation of such

a relationship is usually a trading partner agreement, or contract, that:

� defines the electronic relationship;

� agrees joint controls and procedures; and

� defines the method of resolution of errors or exceptions.

SSC is currently incorporating electronic trading agreement clauses into the

general terms and conditions for trading with the Western Australian

Government. Large individual suppliers, or those using specific electronic

commerce applications, may require a specifically tailored trading partner

agreement.

Further to a trading agreement or contract, the key elements that need to be

in place to ensure the secure and accurate transmission of private information

over public networks include:

� authentication – A process by which a user seeking access to the network

is identified and confirmed;

� integrity checking – A process of ensuring that no modifications have

been made to data before, during and after its transmission;

� encryption – A process for scrambling information in such a way that it

only be read by those with authorised access; and

� non-repudiation – A means of being confident that you and your trading

partners accept the sending and receiving of electronic transactions as

being contractually binding.

Auditor General WA


60

Appendix III – Developing anelectronic commerce business case

Some of the issues to be considered when developing an electronic commerce

business case, depending upon the scale of the implementation, include:

� a statement of the current issues/opportunities/limitations and what

the project is aiming to achieve;

� consideration of how the proposed electronic commerce initiative aligns

with the agency’s future strategies for improving customer service

through online services;

� an assessment of agency benefits and costs;

� an attempt to assess the broader impact of its proposed electronic

commerce initiative upon the wider public sector and the Western

Australian business community. This may highlight the need for a

marketing plan;

� a listing and evaluation of options with rationale for the preferred choice;

� a willingness to adopt the paradigm shift and business process re-design

involved in the adoption of electronic commerce;

� an assessment of the organisations control environment to ensure that

effective electronic controls are in place and that redundant manual

controls have not been needlessly transferred into the electronic

environment;

� assessment of the need to comply with relevant OIC electronic commerce

principles, standards and protocols;

� supporting operational and financial data to serve as a baseline against

which to measure future progress;

� identification of constraints and risks together with corresponding

strategies and controls;

� an implementation plan showing resources required, timeframes,

allocation of responsibilities etc.

� an evaluation plan for assessing planned and unplanned impacts;

� a change strategy for managing staffing issues including probable

redeployment and training; and

� a communications plan to keep staff, customers and stakeholders

informed and encourage feedback.

61


Appendix IV – Glossary of termsand acronyms

APCC Australian Procurement and Construction Council – support

body to APCMC.

APCMC Australian Procurement and Construction Ministerial

Council. A national body of government ministers formed

to facilitate a nationally consistent approach to public sector

procurement, contracting and electronic commerce.

APEC Asia Pacific Economic Co-operation.

ASCII American Standard Code for Information Interchange, being

the predominant character set encoding of present-day

computers.

ATM Automatic teller machines.

Authentication controls Controls used to identify and confirm user’s identification

for transaction and access purposes.

Bandwidth The amount of data that can be sent through a given

communication circuit per second.

Browser A program which allows a person to read hypertext. The

browser gives some means of viewing the contents of nodes

(or ‘pages’) and of navigating from one node to another.

Bulletin board Originally designed/evolved as public messages medium

where an electronic message database logged messages. This

approach has been enhanced in a commercial sense to provide

access to files and other services of interest to the bulletin

board’s system operator and clients.

CAMS Department of Contract and Management Services.

Certification Authority (CA) An organisation that verifies the identity of users and

provides copies of public keys so others can apply encryption.

CUPS Common user purchasing system – a soon to be discontinued

government wide purchasing system, maintained and

operated by Bureau of Services (now part of CAMS).

Digital signatures Allows for documents to be signed in a way that is unique to

the individual and the document. Recipients can then verify

the identity of the sender and confirm that the message has

not been altered.

EDI Electronic data interchange. The electronic transfer of

structured data by an agreed message standard between

computer systems.

Auditor General WA


62

Appendix IV – Glossary of terms and acronyms

EFT Electronic funds transfer. As for EDI but pertaining to

payment instructions.

EFTPOS Electronic funds transfer at point of sale.

Electronic commerce Defined broadly as any commercial activity conducted

electronically.

E-mail Messages that are sent to another person using a computer

network.

Encryption Scrambling information in such a way that only those with

an encryption key can view it. Used to securely transfer

information and files.

Electronic Marketplace A developing CAMS sponored whole of government online

procurement solution.

Electronic service delivery The delivery of easy to access and use online government

services to the community.

ETG Electronic trading gateway.

FAAA Financial Administration and Audit Act (1985).

FMIS Financial management information system – usually a

computerised accounting system.

Gateway Electronic Commerce Gateway – a government EDI facility

managed by CAMS.

HTML Hypertext markup language. The formatting tool used to

produce documents displayed on the WWW.

Hypertext Generally, text that contains ‘links’ to other documents.

ICPAC The Information and Communications Policy Advisory

Council.

Internet A network connecting many millions of computers around

the world. It is more a set of protocols rather than an entity.

No person or organisation is responsible for or controls the

Internet.

ISP Internet service provider – an organisation that provides

access services to the Internet.

LPO Local purchase order.

Multimedia Combining multiple data types such as text, graphics,

scanned images, audio and video.

Non-repudiation Not being able to refuse to acknowledge the sending or

receiving of a transaction.

OAG Office of the Auditor General.

63


Appendix IV – Glossary of terms and acronyms

OECD Organisation of Economic Co-operation and Development.

OIC Office of Information and Communications – located within

the Department of Commerce and Trade.

PACCER Procurement and Contracting Centre for Education and

Research.

ReserveLink Facility available to provide dial-up connection to the Reserve

Bank to provide EFT services.

SBDC Small Business Development Corporation.

Search Engine A remotely accessible program that does key word searches

for information on the Internet. There are several types of

search engine; the search may cover titles of documents,

headers, or the full text.

Smartcards Any card (like a credit card) with an embedded integrated

circuit capable of storing value and recording transactions.

SME Small to medium sized enterprises. By default, enterprises

with less than 200 people.

SSC State Supply Commission.

SupplyNet State Government’s early online purchasing tool.

TIs Treasurer’s Instructions (issued under the authority of the

FAAA).

Trading Partner An organisation with which a company establishes a trading

relationship.

VAN Value added network. A service provided by a third party

which, in the case of EDI, provides network and store and

forward/retrieval (i.e. mailbox) services.

VDNRE Victorian Department of Natural Resources and Environment

Web Page A WWW file. Web pages are ASCII files coded with HTML

tags that tell the browser how to display it. Web pages can

include hyperlinks to other web sites.

Web Site Any computer on the Internet running a World Wide Web

server process.

Work process redesign Re-designing processes and procedures in an organisation,

generally so that they are more closely aligned with the

mission and vision. Such redesign is also needed to take

advantage of new computer systems and new technology.

WWW World Wide Web. A system that enables information to be

presented using formatting, graphics, and containing links

to other information.

Auditor General WA


64

Performance Examination Reports

1996

Improving Road Safety May 1, 1996

The Internet and Public Sector Agencies June 19, 1996

Under Wraps! – Performance Indicators of Western Australian Hospitals August 28, 1996

Guarding the Gate – Physical Access Security Management within the

Western Australian Public Sector September 24, 1996

For the Public Record – Managing the Public Sector’s Records October 16, 1996

Learning the Lessons – Financial Management in Government Schools October 30, 1996

Order in the Court – Management of the Magistrates’ Court November 12, 1996

1997

On Display – Public Exhibitions at: The Perth Zoo, The WA Museum and

The Art Gallery of WA April 9, 1997

Bus Reform – Competition Reform of Transperth Bus Services June 25, 1997

Get Better Soon – The Management of Sickness Absence in the WA Public Sector August 27, 1997

Waiting for Justice – Bail and Prisoners in Remand October 15, 1997

Public Sector Performance Report 1997 November 13, 1997

Private Care for Public Patients – The Joondalup Health Campus November 25, 1997

1998

Selecting the Right Gear – The Funding Facility for the Western Australian

Government’s Light Vehicle Fleet May 20, 1998

Weighing up the Marketplace – The Ministry of Fair Trading June 17, 1998

Listen and Learn – Using customer surveys to report

performance in the Western Australian public sector June 24, 1998

Do Numbers Count? – Educational Financial Impacts of School Enrolment August 19, 1998

Public Sector Boards – Boards governing statutory authorities in Western Australia November 18, 1998

On request these reports may be made available in an alternate format for those with visual impairment.

SEND ME NO PAPER! - Office of the Auditor General · 2013. 6. 3. · SEND ME NO PAPER! 4 Executive...

Documents

Transcript of SEND ME NO PAPER! - Office of the Auditor General · 2013. 6. 3. · SEND ME NO PAPER! 4 Executive...