This case study is about a severely failed systems implementation by the US Coast Guard. For this post, you will need to use the reading to identify specific controls about SDLC that will prevent their issues in the future. Generic references to SLDC controls, but not specific activities will not be considered. The information you need is in the case itself, although you might find more controls in the book, as well.

The Coast Guard and the Failed Systems Implementation Case Study Overview The purpose of this case study is to help students understand and evaluate the system development internal control issues that have impacted the United States Coast Guard (Const Guard). The organization attempted to upgrade an antiquated system with a robust electric records (EHR) system which included billing, scheduling, and reporting lab results. Unfortunately, after five years and $60 million, the entire project was terminated. The case study leverages findings identified in the congressional report (GAO-18-59) called "Coast Guard Health Records - Timely Acquisition of New System Is Critical to Overcoming Challenges with Paper Process." After reading the case study, the student will act in the role of a consultant to analyze the situation and identify system development related internal controls and processes that would address the organization's issues for future implementations System Development Controls Information The Systems Development Life Cycle (SDLC) methodology provides a standard process and guiding principles to implement a new system or significantly modified existing systems I The methodology includes various phases in which key deliverables and documents are reviewed and approved before moving into the project's next phase. The phases in the methodology typically include systems planning, analysis, design, implementation, and maintenance Leadership and project management play a vital role in any systems implementation Typically, an Information Technology (IT) governance board or IT steering committee is responsible for significant changes to an organization's IT environment Members of this group should include key stakeholders of the business, including the Chief Information Officer and department heads. The committee should monitor the progress of IT projects and evaluate the impact each project has on the area of responsibility Approval for each phase of a project The Coast Guard and the Failed Systems Implementation helps ensure that the system meets the organization's needs and functions correctly. The committee should evaluate the team's progress to ensure the project meets the user needs while remaining on time and budget Project management also plays a critical role in ensuring the system meets the organization's needs, budget, and time frame. Project team member roles and activities need to be defined and scheduled Management should regularly update and communicate changes to the project plan to prevent issues. Within the first two phases, systems planning and analysis, the project team gathers data, identifies, and evaluates options. The project team must understand the user community's needs and find options that address those needs when narrowing down the alternatives. The standard choices include purchasing a new system, potentially developing a new system, or significantly alternating an existing system. A feasibility study will be performed on the selected system sohations with the most promise. The feasibility study will evaluate the system options based on various criteria including technical, economic, legal, operational, and scheduling feasibility. This helps ensure the system will meet the user needs, meet legal requirements, and meet the organization's timeline. If more IT infrastructure is required for technological feasibility, the additional costs will be included while evaluating the project's economic feasibility. Using this data, the IT govemance board will evaluate the options and select the system that should be adopted based on its functionality and feasibility The next phases involve system design and development. During system design, the project team works through the details to meet the user specifications and technical requirements This proces includes activities such as identifying system settings, hardware, software and interfaces. During the development phase, the system will either be built or customized based on the approved design Critical testing occurs dung this phase Effective testing requires test The Coast Guard and the Failed Systems Implementation plans, involves various users, and encompasses all system functionality, such as user access and interfaces. Types of testing will include developer testing, user acceptance testing, and integration testing If testing does not have a successful outcome, the issue should be remediated and retested until rectified Developer testing ensures the code works as the developer intended User acceptance testing focuses on making sure the program meets the user's needs, and the data is correct. Integration testing ensures that the new system interfaces and communicates with the organization's other systems effectively. During this phase, the project team must ensure the system works as intended, and if it does not, the team must remedy the situation to deliver a fully functioning system. The coding will start in the developer environment for coding and move to the quality assurance environment for user acceptance testing. Segregated environments are in place to ensure the code approved by the users is not changed purposely or inadvertently. Once this phase obtains the proper approvals, the approved system will be migrated to the production environment The integration phase is also called go-live. This phase starts once the system is ready to use, and all the testing is complete. The final checks and balances are completed, and final approvals are obtained. The system will be implemented in the production environment for the A users to utilize. The project team will document out the steps that need to occur to integrate the new system with a timeline and back-up procedures if something goes wrong. Typically, go- lives occur over the weekend or over a holiday to minimize disruption to the user community Regardless of how well a project plan is executed, unforeseen issues will arise. Dunng the integration phase, the project team and the user community work together to identify issues and correct them quickly for the new system to work effectively. At the end of the project the team will document and evaluate lessons learned to apply to future projects The Coast Guard and the Failed Systems Implementation After integration, the final phase of system maintenance will occur. The IT support will move from the project team to the organization's IT department to maintain the system. During this phase, the IT department will be responsible for fixing system errors, ensuring system performance, and executing system enhancements to meet the user community's changing needs. This case study will focus on the United States Coast Guard's (Coast Guard) system development control issues as identified the report GAO-18-59. "Coast Guard Health Records - Timely Acquisition of New System Is Critical to Overcoming Challenges with Paper Process" Based on your understanding of the systems development process, the Coast Guard would like you to evaluate their situation. The organization would like you to identify the problems with their systems implementation and provide them with examples of systems development controls and processes that could help them prevent or detect system development issues in the future. Coast Guard System Implementation The United States Coast Guard serves by protecting U.S. ports and waterways through security, safety, and stewardship. The organization is one of America's five military forces and falls under the Department of Homeland Security jurisdiction. The Coast Guard's responsibilities are multi-faceted. The organization serves as maritime law enforcement and regulatory agency. In disaster situations, the Coast Guard is a first responder and provides humanitarian aid, as needed. For the Coast Guard to fulfill these roles, the organization must ensure its members are healthy and ready to serve whenever situations arise. As a result, the Coast Guard is responsible for its members health care, including those on active duty and in the Teserves As part of this responsibility, the Coast Guard beavily relied on its Electronic Health Records (EHR) system. An electronie health record is a digitized version of patients medical The Coast Guard and the Failed Systems Implementation charts. The EHR inchades vital patient information, including medical diagnosis, allergies, and treatment plans. The Coast Guards felt their existing system was antiquated. The system did not include functionality like scheduling and billing. In 2010, the Coast Guard announced plans to upgrade its outdated EHR system. The Coast Guard selected an off-the-shelf EHR product to replace their previous EHR system. The contract to implement this system was $14 million, and it was estimated to take five years. The new IT system was supposed to help the establishment improve their ability to provide healthcare services. Some of these improvements included online health records, scheduling billing, and easy navigation for users. The new system would allow for enhanced tracking of patient lab work, radiology scans, and prescriptions. Unfortunately, the systems development project did not go as planned Throughout the development process, the Coast Guard realized that other systems needed to interface with EHR needed updating. As a result, the project scope had grown significantly and ultimately morphed into an Integrated Health Information System (IHS). This new system was much more complex and involved over 25 different vendors. The budget for the new system increased by $42 million The Coast Guard's troubles did not end there. In 2015, about five years later, the Coast I Guard decided to scrap the implementation entirely. Almost $60 million had already been spent, and the additional computer software and equipment purchased could not be repurposed Coast Guard identified a plethora of issues that resulted in the termination of the project According to the GAO report, a host of issues indicated that project management was ineffective. Although the Coast Guard had a documented system development methodology, the guidance was not followed consistently. The Coast Guard's charters indicated the need for various levels of leadership and project oversight levels through different governance boards However, some of these overnight boards were inactive. In addition, key stakeholders, such as The Coast Guard and the Failed Systems Implementation he Chief Information Officer (CIO), were not included on some of these boards. As a result, the project, budget, and timeline expanded During the early phases of the project, the project team did not clearly understand the system requirements. That was the catalysis for the initial scope creep. The off-the-shelf system originally purchased could not interface with the existing systems without significant updates. The Coast Guard did not adequately identify the technical and user requirements needed for the off-the-shelf EHR system before purchasing it. As a result, the scope and the cost of the project was expanded. The project team was also unable to keep with the implementation schedule. In August 2015, the Director was informed that there were significant delays, and the system was not ready for implementation. Many of the interfaces and workflows were incomplete or did not work effectively. Estimates regarding the pending work in this area would delay the system implementation at least one year. Also, the user authentication and user provisioning processes were incomplete. Existing users did not have access to do their jobs, and new users had not been added to the system. Patients did not have access to schedule their appointment or view lab I results. Furthermore, significant turnover in key personnel impacted the project timeline. These changes resulted in delays and confusion. For example, some vendors did not know who was in charge or their pomt of contact. System testing was an extremely challenging area for the organization and compounded the delays. Some of the testing initially planned was not completed or not completed properly. Towards the end of the project both system security and interface testing were deemed inadequate, and the project was unable to move forward. After being plagued with setbacks, the project was terminated After the project was hated the Coan Graard did not document and evaluate lessons learned from the project to The Coast Guard and the Failed Systems Implementation prevent future project issues. As a result of the failed implementation, the Coast Guard hard to use manual processes to manage health records. Analysis / Discussion Based on the information provided, identify the Coast Guard's system development issues and provide recommendations regarding their systems development internal controls. DRAFT The Coast Guard and the Failed Systems Implementation Case Study Overview The purpose of this case study is to help students understand and evaluate the system development internal control issues that have impacted the United States Coast Guard (Const Guard). The organization attempted to upgrade an antiquated system with a robust electric records (EHR) system which included billing, scheduling, and reporting lab results. Unfortunately, after five years and $60 million, the entire project was terminated. The case study leverages findings identified in the congressional report (GAO-18-59) called "Coast Guard Health Records - Timely Acquisition of New System Is Critical to Overcoming Challenges with Paper Process." After reading the case study, the student will act in the role of a consultant to analyze the situation and identify system development related internal controls and processes that would address the organization's issues for future implementations System Development Controls Information The Systems Development Life Cycle (SDLC) methodology provides a standard process and guiding principles to implement a new system or significantly modified existing systems I The methodology includes various phases in which key deliverables and documents are reviewed and approved before moving into the project's next phase. The phases in the methodology typically include systems planning, analysis, design, implementation, and maintenance Leadership and project management play a vital role in any systems implementation Typically, an Information Technology (IT) governance board or IT steering committee is responsible for significant changes to an organization's IT environment Members of this group should include key stakeholders of the business, including the Chief Information Officer and department heads. The committee should monitor the progress of IT projects and evaluate the impact each project has on the area of responsibility Approval for each phase of a project The Coast Guard and the Failed Systems Implementation helps ensure that the system meets the organization's needs and functions correctly. The committee should evaluate the team's progress to ensure the project meets the user needs while remaining on time and budget Project management also plays a critical role in ensuring the system meets the organization's needs, budget, and time frame. Project team member roles and activities need to be defined and scheduled Management should regularly update and communicate changes to the project plan to prevent issues. Within the first two phases, systems planning and analysis, the project team gathers data, identifies, and evaluates options. The project team must understand the user community's needs and find options that address those needs when narrowing down the alternatives. The standard choices include purchasing a new system, potentially developing a new system, or significantly alternating an existing system. A feasibility study will be performed on the selected system sohations with the most promise. The feasibility study will evaluate the system options based on various criteria including technical, economic, legal, operational, and scheduling feasibility. This helps ensure the system will meet the user needs, meet legal requirements, and meet the organization's timeline. If more IT infrastructure is required for technological feasibility, the additional costs will be included while evaluating the project's economic feasibility. Using this data, the IT govemance board will evaluate the options and select the system that should be adopted based on its functionality and feasibility The next phases involve system design and development. During system design, the project team works through the details to meet the user specifications and technical requirements This proces includes activities such as identifying system settings, hardware, software and interfaces. During the development phase, the system will either be built or customized based on the approved design Critical testing occurs dung this phase Effective testing requires test The Coast Guard and the Failed Systems Implementation plans, involves various users, and encompasses all system functionality, such as user access and interfaces. Types of testing will include developer testing, user acceptance testing, and integration testing If testing does not have a successful outcome, the issue should be remediated and retested until rectified Developer testing ensures the code works as the developer intended User acceptance testing focuses on making sure the program meets the user's needs, and the data is correct. Integration testing ensures that the new system interfaces and communicates with the organization's other systems effectively. During this phase, the project team must ensure the system works as intended, and if it does not, the team must remedy the situation to deliver a fully functioning system. The coding will start in the developer environment for coding and move to the quality assurance environment for user acceptance testing. Segregated environments are in place to ensure the code approved by the users is not changed purposely or inadvertently. Once this phase obtains the proper approvals, the approved system will be migrated to the production environment The integration phase is also called go-live. This phase starts once the system is ready to use, and all the testing is complete. The final checks and balances are completed, and final approvals are obtained. The system will be implemented in the production environment for the A users to utilize. The project team will document out the steps that need to occur to integrate the new system with a timeline and back-up procedures if something goes wrong. Typically, go- lives occur over the weekend or over a holiday to minimize disruption to the user community Regardless of how well a project plan is executed, unforeseen issues will arise. Dunng the integration phase, the project team and the user community work together to identify issues and correct them quickly for the new system to work effectively. At the end of the project the team will document and evaluate lessons learned to apply to future projects The Coast Guard and the Failed Systems Implementation After integration, the final phase of system maintenance will occur. The IT support will move from the project team to the organization's IT department to maintain the system. During this phase, the IT department will be responsible for fixing system errors, ensuring system performance, and executing system enhancements to meet the user community's changing needs. This case study will focus on the United States Coast Guard's (Coast Guard) system development control issues as identified the report GAO-18-59. "Coast Guard Health Records - Timely Acquisition of New System Is Critical to Overcoming Challenges with Paper Process" Based on your understanding of the systems development process, the Coast Guard would like you to evaluate their situation. The organization would like you to identify the problems with their systems implementation and provide them with examples of systems development controls and processes that could help them prevent or detect system development issues in the future. Coast Guard System Implementation The United States Coast Guard serves by protecting U.S. ports and waterways through security, safety, and stewardship. The organization is one of America's five military forces and falls under the Department of Homeland Security jurisdiction. The Coast Guard's responsibilities are multi-faceted. The organization serves as maritime law enforcement and regulatory agency. In disaster situations, the Coast Guard is a first responder and provides humanitarian aid, as needed. For the Coast Guard to fulfill these roles, the organization must ensure its members are healthy and ready to serve whenever situations arise. As a result, the Coast Guard is responsible for its members health care, including those on active duty and in the Teserves As part of this responsibility, the Coast Guard beavily relied on its Electronic Health Records (EHR) system. An electronie health record is a digitized version of patients medical The Coast Guard and the Failed Systems Implementation charts. The EHR inchades vital patient information, including medical diagnosis, allergies, and treatment plans. The Coast Guards felt their existing system was antiquated. The system did not include functionality like scheduling and billing. In 2010, the Coast Guard announced plans to upgrade its outdated EHR system. The Coast Guard selected an off-the-shelf EHR product to replace their previous EHR system. The contract to implement this system was $14 million, and it was estimated to take five years. The new IT system was supposed to help the establishment improve their ability to provide healthcare services. Some of these improvements included online health records, scheduling billing, and easy navigation for users. The new system would allow for enhanced tracking of patient lab work, radiology scans, and prescriptions. Unfortunately, the systems development project did not go as planned Throughout the development process, the Coast Guard realized that other systems needed to interface with EHR needed updating. As a result, the project scope had grown significantly and ultimately morphed into an Integrated Health Information System (IHS). This new system was much more complex and involved over 25 different vendors. The budget for the new system increased by $42 million The Coast Guard's troubles did not end there. In 2015, about five years later, the Coast I Guard decided to scrap the implementation entirely. Almost $60 million had already been spent, and the additional computer software and equipment purchased could not be repurposed Coast Guard identified a plethora of issues that resulted in the termination of the project According to the GAO report, a host of issues indicated that project management was ineffective. Although the Coast Guard had a documented system development methodology, the guidance was not followed consistently. The Coast Guard's charters indicated the need for various levels of leadership and project oversight levels through different governance boards However, some of these overnight boards were inactive. In addition, key stakeholders, such as The Coast Guard and the Failed Systems Implementation he Chief Information Officer (CIO), were not included on some of these boards. As a result, the project, budget, and timeline expanded During the early phases of the project, the project team did not clearly understand the system requirements. That was the catalysis for the initial scope creep. The off-the-shelf system originally purchased could not interface with the existing systems without significant updates. The Coast Guard did not adequately identify the technical and user requirements needed for the off-the-shelf EHR system before purchasing it. As a result, the scope and the cost of the project was expanded. The project team was also unable to keep with the implementation schedule. In August 2015, the Director was informed that there were significant delays, and the system was not ready for implementation. Many of the interfaces and workflows were incomplete or did not work effectively. Estimates regarding the pending work in this area would delay the system implementation at least one year. Also, the user authentication and user provisioning processes were incomplete. Existing users did not have access to do their jobs, and new users had not been added to the system. Patients did not have access to schedule their appointment or view lab I results. Furthermore, significant turnover in key personnel impacted the project timeline. These changes resulted in delays and confusion. For example, some vendors did not know who was in charge or their pomt of contact. System testing was an extremely challenging area for the organization and compounded the delays. Some of the testing initially planned was not completed or not completed properly. Towards the end of the project both system security and interface testing were deemed inadequate, and the project was unable to move forward. After being plagued with setbacks, the project was terminated After the project was hated the Coan Graard did not document and evaluate lessons learned from the project to The Coast Guard and the Failed Systems Implementation prevent future project issues. As a result of the failed implementation, the Coast Guard hard to use manual processes to manage health records. Analysis / Discussion Based on the information provided, identify the Coast Guard's system development issues and provide recommendations regarding their systems development internal controls. DRAFT