Item - 2024.AU7.2

The Auditor General recommends that:  

1. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor to:

a. Evaluate whether the cost of unused software licences identified in this report can be reduced or deferred to future periods to align with changes in the deployment dates for projects that are still in progress.

b. Identify other technology projects that are delayed and evaluate whether the cost of the unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates.

2. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether future software subscription contracts can include provisions to allow the City to defer the licence purchases or adjust the contracted volume of software subscriptions, in situations where:

a. Projects are delayed, or

b. Requirement for software subscription volume changes.

3. City Council request the Chief Technology Officer and the Chief Information Security Officer, in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether:

a. Financial compensation can be obtained for non-compliance with expected product features required under the contract.

b. The cost of unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates.

4. City Council request the Chief Technology Officer to improve on the project planning and coordination for the remaining phases of implementing the Public Digital Access Solution.

5. City Council request the City Manager in coordination with the Chief Technology Officer to develop a reporting mechanism and criteria for reporting on City-wide technology projects (or projects that span across multiple divisions) to the General Government Committee of City Council by the appropriate City officials, on project implementation delays and related accumulated financial impact or costs from the delays, including unused software licences, with reports to include as a minimum:

a. Accumulated financial impact of project delays, including forgone benefits

b. Cost of unused software licences, and solutions

c. Plans in place to mitigate the impact of delays, and

d. How the expected benefits will be measured once the project or contract is fully completed.

6. City Council request the Chief Technology Officer evaluate the current email back-up procedure to:

a. Finalize the related procedure and guidelines to ensure M365 licences assigned to employees who leave the City are terminated in a timely manner; and

b. Terminate or re-assign, as needed, active M365 licences of former staff identified in this report.

7. City Council request the Chief People Officer and Chief Financial Officer and the Chief Technology Officer to develop an automated process for employee offboarding, including to:

a. Integrate and update the employment separation checklist with the current Information Technology Service Management process to identify and disable unused accounts of employees who leave the City, in a timely manner.

b. Conduct periodic automated comparisons of active licences with inactive or dormant accounts and ensure unused licences or licences assigned to former employees or employees on long-term leave are disabled or re-assigned in a timely manner, and

c. Unassigned or unused licences identified in this report are re-assigned or terminated as needed.

8. City Council request the Chief Technology Officer to:

a. Establish criteria to identify and select software titles that should be managed through the Information Technology Asset Management System

b. Develop a data strategy and migration plan for managing the City’s software licences and subscriptions

c. Develop a plan to decommission the existing system, and

d. Evaluate whether the existing data import process from the financial system is required for the new system and fix the data accuracy and reconciliation issues if the data are to be used.

9. City Council request the Chief Technology Officer to develop and implement a governance framework to improve ownership and accountability of the Information Technology asset management process. This should include:

a. Updating policies, guidelines, and procedures on Information Technology asset management, ensuring appropriate reporting and staff roles are established to facilitate ongoing monitoring of Information Technology assets through the new system.

b. Developing reports, to monitor the accuracy and completeness of data updated in the new Information Technology Asset Management system.

10. City Council request the City Manager to coordinate the work of the City’s agencies and corporations with the City’s Chief Procurement Officer and Chief Technology Officer to explore joint purchasing on key software programs to achieve volume discounts and savings for the City as a whole.

The Auditor General’s 2024 Work Plan included an audit on how the City acquires and manages its applications, corporate-wide software licences, and cloud subscriptions.

In 2023, the City spent $44 million on software acquisitions and $34 million on software maintenance. Over the last five years from 2019 to 2023, the City’s total expenditures for software acquisition, maintenance and support were approximately $235 million. The City currently uses over 7,500 software titles; over 1,200 titles are paid software. As the City continues to automate its processes and systems, the investment in technology systems and applications will continue to grow.

This audit focused on assessing whether tracking of software licences, cloud subscriptions, and maintenance is accurate, and that unused software is identified and addressed in a timely manner. The audit scope included seven selected software applications.

We estimated that the cost associated with unused licences for the assessed software applications was almost $11 million. This cost is related to unused or underutilized software licences and subscriptions for various periods of time, primarily from 2020 to 2024. A summary of the cost of unused licences by software application is provided in Table 1.

Table 1: Summary of the Cost of Unused Licences

Our report identifies the following four key areas for attention:

- Improvements are required for licence acquisition, management, and utilization. In particular, improved project planning and stakeholder coordination to ensure timely deployment of licences when making bulk purchases.

- Former employees’ licences are not terminated or not re-assigned in a timely manner. The off-boarding process needs streamlining and automation to reduce the risk of licences remaining assigned to users who leave the City or are on long-term leave.

- Governance over Information Technology asset management needs to be strengthened and a clear data strategy and plan is needed to manage the City’s software assets.

- The City, by virtue of its size, has an opportunity to achieve greater economies of scale through more effective bulk purchasing of software, if agencies and corporations are included in the procurement.

From the samples we reviewed and analyzed, this report estimates a potential cost of almost $11 million relating to unassigned or unused licences. We have made ten recommendations in this report. By addressing these recommendations, the City will be able to maximize the value of its investments in software licences and improve governance, management, and processes related to software acquisition and utilization.