Unit4 handed police ERP deal after 'significant deficiency' found in Oracle Fusion system
(2021/05/18)
- Reference: 1621332192
- News link: https://www.theregister.co.uk/2021/05/18/unit4_3m_police_erp/
- Source link:
Cheshire Police has awarded mid-scale ERP vendor Unit4 a £3m two-year contract to replace [1]a troubled Oracle implementation , which only went live on the latest Fusion software in 2019.
A [2]simple procurement notice shows the Police and Crime Commissioner for Cheshire issued a call-off contract via the Crown Commercial Services G-Cloud 12 Framework Agreement to award the vendor - which runs cloud-based applications on Azure - a deal including finance, purchase-to-pay, HR, and payroll services.
The brevity of the statement belies the circuitous route by which the police authority arrived at the decision.
[3]
[4]
[5]
The commissioner's [6]Audit Advisory Committee report [PDF] of a 27 May 2020 meeting said the Oracle Fusion system, which went live in 2019 in the Oracle-based Multi-Force Shared Service (MFSS) group system, included "segregation of duties conflicts in Oracle Fusion between IT security and finance duties."
'Risk that internal access to information assets and administrative functionality may not be restricted based on legitimate business need'
Flagged as a "significant deficiency" by auditors at Grant Thornton, the problem meant 18 MFSS or Capgemini system administrator's accounts – service accounts that have the IT security manager role assigned to them – also had privileged access to the finance system. "This breaches good practice to split these abilities," the committee report said, and could allow account control by the vendor to "change system configurations," meaning "there is a risk that system-enforced internal control mechanisms are bypassed through inappropriate use of administrative functionality."
"Further, where IT staff are given access to finance roles and privileges there is a risk that internal access to information assets and administrative functionality may not be restricted based on legitimate business need," the report added.
Meanwhile, IT general controls were also weak, including a "lack of periodic Oracle third party service assurance report review," the auditors found.
A tender for a new system in October last year signalled the police authority's decision to part ways with the MFSS group system, set up in April 2012 between Northamptonshire Police and Cheshire Constabulary. Nottinghamshire Police joined in April 2015 and Civil Nuclear Constabulary in April 2016, with Capgemini as the services partner.
[7]
The tender followed a [8]prior information notice launched in April last year .
Unit4 may be disappointed by the contract price – a piddling £3m compared with a potential £190m on the table.
The initial price is just for two years, which, unless the authority decides to jump to a third system in five years, is likely to be extended.
[9]
The contract notice put the value of the job at anything between £19m and £190m due to the maximum term being 20 years and other organisations taking part in the framework, the council explained last year. Its current contractual agreements for the Oracle system run out in late 2022.
Oracle has so far declined to comment. ®
Get our [10]Tech Resources
[1] https://www.theregister.com/2020/10/14/cheshire_police_tender_erp_system/
[2] https://www.contractsfinder.service.gov.uk/Notice/af196c30-7903-47a9-ac3a-84c64bca6556
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.cheshire-pcc.gov.uk/SysSiteAssets/media/downloads/what-i-do/making-key-decisions/audit-advisory-committee/committee-documents/19-20/29-may-report.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2020/04/30/cheshire_police_ted_notice/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
A [2]simple procurement notice shows the Police and Crime Commissioner for Cheshire issued a call-off contract via the Crown Commercial Services G-Cloud 12 Framework Agreement to award the vendor - which runs cloud-based applications on Azure - a deal including finance, purchase-to-pay, HR, and payroll services.
The brevity of the statement belies the circuitous route by which the police authority arrived at the decision.
[3]
[4]
[5]
The commissioner's [6]Audit Advisory Committee report [PDF] of a 27 May 2020 meeting said the Oracle Fusion system, which went live in 2019 in the Oracle-based Multi-Force Shared Service (MFSS) group system, included "segregation of duties conflicts in Oracle Fusion between IT security and finance duties."
'Risk that internal access to information assets and administrative functionality may not be restricted based on legitimate business need'
Flagged as a "significant deficiency" by auditors at Grant Thornton, the problem meant 18 MFSS or Capgemini system administrator's accounts – service accounts that have the IT security manager role assigned to them – also had privileged access to the finance system. "This breaches good practice to split these abilities," the committee report said, and could allow account control by the vendor to "change system configurations," meaning "there is a risk that system-enforced internal control mechanisms are bypassed through inappropriate use of administrative functionality."
"Further, where IT staff are given access to finance roles and privileges there is a risk that internal access to information assets and administrative functionality may not be restricted based on legitimate business need," the report added.
Meanwhile, IT general controls were also weak, including a "lack of periodic Oracle third party service assurance report review," the auditors found.
A tender for a new system in October last year signalled the police authority's decision to part ways with the MFSS group system, set up in April 2012 between Northamptonshire Police and Cheshire Constabulary. Nottinghamshire Police joined in April 2015 and Civil Nuclear Constabulary in April 2016, with Capgemini as the services partner.
[7]
The tender followed a [8]prior information notice launched in April last year .
Unit4 may be disappointed by the contract price – a piddling £3m compared with a potential £190m on the table.
The initial price is just for two years, which, unless the authority decides to jump to a third system in five years, is likely to be extended.
[9]
The contract notice put the value of the job at anything between £19m and £190m due to the maximum term being 20 years and other organisations taking part in the framework, the council explained last year. Its current contractual agreements for the Oracle system run out in late 2022.
Oracle has so far declined to comment. ®
Get our [10]Tech Resources
[1] https://www.theregister.com/2020/10/14/cheshire_police_tender_erp_system/
[2] https://www.contractsfinder.service.gov.uk/Notice/af196c30-7903-47a9-ac3a-84c64bca6556
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.cheshire-pcc.gov.uk/SysSiteAssets/media/downloads/what-i-do/making-key-decisions/audit-advisory-committee/committee-documents/19-20/29-may-report.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2020/04/30/cheshire_police_ted_notice/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKPknEaFsC-BZIfg1ddwgQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: Unit 4?
Anonymous Coward
Wow, that's an obscure reference! I only got it because I used to be in a band with the singer's son - the guitarist used to pull his leg about it.
Yet another pork barrel
chubby_moth
Another Tory donor who is to be made happy I guess. The previous one has been paid by now. Anyone here involved in the roll out of the new UK customs system? How's that going these days?
Payment method?
Version 1.0
Discovering "a troubled Oracle implementation" like this usually results in someone being paid in bitcoin.
system or config?
Anonymous Coward
"18 MFSS or Capgemini system administrator's accounts – service accounts that have the IT security manager role assigned to them – also had privileged access to the finance system"
Maybe missing something here but this sounds like a configuration issue rather than software issues.
Unit 4?
Where is the + 2 or are the 'Plod' stuck in 'concrete and clay'?
I'll get me coat.