Without naming names I am going to describe a "situation" that I have been aware of as a BA, and the management decisions that were made in spite of any analysis (quick guess, oh brilliant reader - were they good decisions?).  My purpose is twofold:

1. I hope that the "situations", though not outed publicly, will recognize "themselves", and decide to take action.
2. I hope that BAs who read this column will weigh in on the ETHICS of being a BA in such situations - is there a threshold where "outing" a situation is ethically required?

Situation: 

A certain government agency (un-named) needed a system to collect money from certain parties, to be disbursed to other parties.  The money is real and the rules and laws involving accounting and auditing clearly apply.  The agency already had an accounting based system that performed the functionality, but had no bookkeepers or accountants to run it. The personnel assigned to run it complained constantly, and  the executive in charge decided to replace the system, instead of training the personnel in accounting.

The agency avoided being forced to apply accounting rules and laws by publicly declaring (to the overseeing government agencies) that the system to be built was not a financial system.

When the project began, (I was not involved directly), I was approached by the project manager and asked what I thought of the requirements approach.  I shared the thought that avoiding the overhead of scrutiny was a cost saving strategy in a government project, and the system still needed to perform accounting. Money was being collected and disbursed, and accounting is the name of the correct solution (at least, it has been since the Italians invented it in the fourteenth century).

I was basically kicked out of his office, and had no other involvement in this project, except once, when I was asked to a review meeting, and asked if the "reversal" of a reversal transaction, where multiple parties had already been paid, was actually "reversible" - had anyone tried to do this on paper?  I was told that this was all covered in the requirements (this was not true), so I dropped the questions.

When the project was completed, it did not do accounting, as planned, and the users hated it even more than the old system.  It was found that to issue checks, in many cases a DBA had to "poke" data directly into the system and print a check from that data.

Two Questions

1. What, if anything, is a BA who is aware of such a situation required to do?
2. What are the implications and consequences of "poking checks" and printing them in a money system?

NEXT MONTH - another situation - send yours, if you know of one!

Don't forget to leave your comments below

Marcos Ferrer, CBAP has over 20 years experience in the practice of business analysis and the application of Information Technology for process improvement. Following graduation in 1983 from the University of Chicago, Mr. Ferrer joined IBM in Chicago, where he worked on requirements and systems implementations in diverse industries. His recent projects include working requirements for the Veteran's Administration, introducing BA practices at the Washington Suburban Sanitary Commission, and creating bowling industry models for NRG Bowl LLC. In November 2006, Marcos Ferrer is one of the first  CBAPs certified by the IIBA. He has served as an elected member of the DC-Metro chapter of the IIBA, most recently as President, and assisted in the writing of the BOK 2.0 test.

Comments (9)

Subscribe to this comment's feed

...
written by Ebony Blackwell, October 20, 2009

were was the stated objectives for the project - I would expect that these should have clearly stated what was the goals to be achieved. And governance? If there was issues over the principles of the project, why could this not have been escolated to the governance forum, which would normally include some form of audit and risk monitoring.
No BA should find themselves in a position where they are being asked to take on work of dubious legality. Would like to know how a governement project could by pass all normal governence standards.

• 
• +0
• 
• 

...
written by Craig, October 21, 2009

That's an interesting scenario Marcos. It appears to be an issue of competence more than anything.

Who is your question diected to? Analysts hypothetically working on the project or bystanders?

If youar on the team you probably ahve formal escalation channels; the project manager, your line manager, stakehodlers, sponsors and steering committee members.

You also need to realise that you personally may not be seeing the whole picture.

As for poking data... If that is the UI, that's the UI, but again, there are better ways to work.

• 
• +0
• 
• 

...
written by Scott Gardner, October 21, 2009

As an employee of the State (or as a contractor) you probably signed something that indicated you would follow State policies and also accepted an obligation to report violations of policies. The lying about the financial nature of the system and "poking" checks are undoubtedly policy violations, if not illegal. The BA must document his concerns and present them to his management and certainly not participate in the activities.

Depending on the whistleblower laws in the State, the BA may feel protected and let State authorities know about the situation.

• 
• +0
• 
• 

...
written by Greg Busby, October 21, 2009

Any group, public or private, will have internal and/or external auditors to whom they must prove that their money-handling (fiduciary) policies pass muster. In almost every case, allowing a DBA to "poke data" into a system that results in a financial transaction is, to say the least, frowned upon. What is to stop them from poking money into their own account? If this is public money (and it is, in your scenario), I'd think you have a responsibility or at least standing to mention it to the auditing agency.

• 
• +0
• 
• 

...
written by Marcos Ferrer, October 21, 2009

I want to thank everyone who has left a comment, and will address some of the questions here:

1. Stated Goals - interestingly enough, the government official stated that the goal was to handle these checks WITHOUT building a financial system. All normal escalations available to me as a contractor were exhausted once I held a discussion with the project manager.

2. Dubious legality - I avoided participating, that seemed my only choice - it just looked like a bad project, one that would fail. Only later did the "illegality" become manifest, as the non-working system was forced to work anyway.

3. Bypassing governance standards - the government executive directing the action was exactly responsible for implementing governance standards, but did not do so.

4. Who is question directed to: Interesting question - In this case I was a bystander, yet the question applies double if I am a participant.

5. The "bigger picture" in this case is the fact that the executives in the agency did not have the money or resources to meet the high standards for buidling a financial system, so they ducked it - in effect, they could not afford to replace the existing system, but tried to do so anyway.

6. Whistleblower protection is directed at government employees, I think, not contractors.

7. Poking as UI - I must disagree with the first comment, that if poking is the UI, it just is - the second comment is more to the point - poking data into financial systems is by its nature a corruption of the process.

8. It is tempting to report the problem to the appropriate auditing body, but since I am not close to the situation, it is difficult for me to offer information that meets the standard of evidence.

9 - NEW QUESTION - is there a way to suggest that an auditor examine something, without making unprovable claims?

Thanks for all the comments!

• 
• +0
• 
• 

...
written by Scott Watts, October 23, 2009

This is an ethical dilemma for sure.

First, whenever we are presented with information that **may** have moral or legal implications for ourselves or others, regardless of our level of involvement, we have a responsibility to do the right thing. If we don't, we are guilty as well.

Second, the information shared with the "BA" in this scenario definitely involves moral and legal implications...for all parties involved. Does the subject in this scenario ever wish to give the testimony, "Yes, though I did not participate directly, I was aware and did nothing." Most will find such a reply unacceptable.

Third, we can't assume the motives of the Project Manager, though that is our natural tendency. The best thing to do would be to let the PM know that moral/legal issues exist and it must be rectified. If that approach is not possible or the PM is not willing or capable of responding appropriately, then other options for bringing light to the situation must be sought.

Without knowing more, all I can say is that you can't sit on this information. Even if all you do is hand over your knowledge to investigative reporting, you have done your part to serve your fellow citizens. It is prudent to give those directly involved the opportunity to do the right thing first, but not acceptable to ignore the issue.

• 
• +0
• 
• 

...
written by Scott Watts, October 23, 2009

I forgot to address this question:

"9 - NEW QUESTION - is there a way to suggest that an auditor examine something, without making unprovable claims?"

I would assume there is an oversight committee somewhere for this local or national agency.

• 
• +0
• 
• 

...
written by Craig, October 28, 2009

Surely an auditor would prefer you to lodge your concerns rather than sit on them until you have sufficient evidence.

• 
• +0
• 
• 

...
written by Julie Biddle, November 05, 2009

your final suggestion - to send situations if you know of one. Hope your system hasn't crashed under that deluge...

• 
• +0
• 
•