The AMF’s difficulties in controlling its IT projects are highlighted by a report from the Court of Auditors. The authors explain that to cope with its new missions and the progressive obsolescence of its tools, the markets authority has multiplied projects since 2015, without necessarily controlling the delays and associated costs.
Unfortunately, these have “often been launched without in-depth examination of their content, without analysis of the conditions of operational implementation, and without taking into account the internal capacity to carry them out.” The initiative for these different projects was launched to a strategic information systems governance committee (CSG SI) in 2016, which in 2017 noted “a significant number of projects launched and a low capacity to the AMF to carry them out internally taking into account the resources available.
But this awareness was not enough to avoid the problem, a failure that the Court of Auditors attributes to several factors: the restriction of the missions of the CSG IS, responsible only for monitoring projects carried out by the DSI and not major projects strategies carried out by the business departments, monitoring limited to the cost of external service providers, and finally the fact that “the attention of the CSG IS focused on the launch of new projects more than on their operational execution and the technical difficulties encountered.” In other words, the CSG IS was not able to fully play its steering role initially assigned to it, a governance concern finally identified by a 2022 audit and corrected during the year 2023.
Rosa, emblematic project
The Court of Auditors illustrates these various abuses by retracing the difficulties encountered by the ROSA project, the name given to a new IT tool intended to follow on from BIO2, a tool for collecting data relating to financial players and products. Initiated in 2015, the project originally aimed for a full deployment and shutdown of BIO2 in the first half of 2021. “The total cost of the project over the period 2016-2028 was €42.1 million, which included the “all investment and operating costs of the two applications for the entire period” adds the Court of Auditors.
But the project experienced several setbacks, linked in particular to the difficulties of establishing specifications as well as to requests linked to specific functionalities. The authors of the report also highlight the limited involvement of the IT department in this project, mainly entrusted to a project director placed within the business department.
These difficulties caused delays and additional costs: the total amount of the allocated budget “increased to €52.1 million in December 2022 then to €53 million in mid-2023” underline the authors of the report.
Delays and additional costs
The complete delivery of the tool has therefore suffered delays, the first modules expected for 2020 are thus postponed to 2021, then new postponements lead the production of the application to finally be postponed to October 2023. These successive delays are the fact of a choice assumed by the project management, which chose to set itself the “objective of controlling the annual budget even if it means letting the schedule drift”. But this strategy logically had an impact on the total cost: “Control of the annual budget resulted in a very significant overrun in the cumulative cost of the program” estimate the authors of the report.
And seven years after the launch of the project, it is not yet completely finished and deployed. The Court of Auditors thus recalls that only two of the main modules of the application are currently actually deployed, and that a third is currently in the testing phase before a launch planned for “early 2024”.
Consequence of these delays: the BIO2 application remains in place, and the authors of the report emphasize that “the obsolescence of BIO2 is increasing, its maintenance being carried out at a minimum. This application now presents critical security vulnerabilities.”