47. In inviting the attention of the Data Processing Manager to my observations I suggested that the present procedures for vetting potential computer systems should be strengthened. The Data Processing Manager has informed me that the costing presented to the Computer Committee was logically wrong and he will work with the uty Financial Secretary to ensure that future cost-benefit analyses provide a sound basis for assessing the cost justration aspects of computer projects, and will add appropriate guidelines to the project manager's handbook to facilitate the proper compilation of cost-benefit analyses.
48.
Disaster recovery planning for Government computer installations. In their Seventh Report issued in December 1984 the Public Accounts Committee expressed their concern over the lack of a systematic approach to adequate disaster recovery planning for the Government's computer installations. The Committee were particularly concerned at the lack of effective action, despite acceptance in 1979 by the Government of a recommendation by the consultant appointed to review the operation of the Government Data Processing Agency, on the need for disaster recovery planning. The Committee went on to recommend that with the increasing use of computers by the Government an overall Government policy on disaster recovery planning should be established without delay.
the 49. In reporting progress to the Public Accounts Committee at a hearing of the Committee in December 1985, Secretary for Administrative Services and Information said that a disaster recovery plan would be submitted to the Computer Committee for consideration at a meeting to be held later that month. The plan consisted of two parts. The first part covered the recovery of software and data, and the second part covered the necessary back-up hardware facilities to be installed offsite. These would enable the immediate resumption of computer services in the event of a disaster. The Secretary stated that a 100% recovery of software and data was possible. Provision of 100% back-up of hardware facilities would cost $300 million over five years. This was considered over-ambitious and unnecessary and instead it was proposed to cover 75% of the critical areas which would be adequate for the Government's needs, at a cost of $70 million. The proposal was to provide standby facilities in the form of two offsite mainframe computers covering the two major suppliers to the Government. The facilities would be used for non-essential and non-urgent computing work whilst on standby.
50. In their Eighth Report issued in January 1986 the Public Accounts Committee noted that progress had been slow but they were pleased that a plan was about to be put forward to the Computer Committee, then to the Chief Secretary's Committee and finally to the Finance Committee of the Legislative Council seeking the necessary approvals. The Public Accounts Committee wished to be informed whether the proposals were accepted, and if so, of the progress in implementing the plan.
51. The Computer Committee endorsed the proposed disaster recovery plan in December 1985 and directed that a paper be submitted to the Chief Secretary's Committee for policy clearance. The Secretary for Administrative Services and Information forwarded a draft paper to the Deputy Financial Secretary in July 1986 for his comments with particular reference to the financial implications of the plan. The Deputy Financial Secretary noted that the cost of the plan was governed by the capacities of the back-up systems required which in turn depended entirely on the number of systems classified as critical, but considered that the criteria used in determining what was critical were inadequate for the decision-making process. The Secretary for Administrative Services and Information has arranged for the issue to be referred back to the Computer Committee in October 1986.
52. The Public Accounts Committee also recommended in their Eighth Report that in addition to disaster recovery plans, further consideration should be given to preventive measures, including fire prevention arrangements at computer sites, which might minimize the chances of a disaster. The Data Processing Manager has established a methodology and drawn up a programme for conducting security reviews on all major Government computer installations over the period from June 1986 to December 1987.
53. Personal Emoluments. Review of departmental procedures for the calculation and recording of leave eligibility. In concluding their deliberations on the subject of overstatement of leave earnings in certain departments in their Eighth Report issued in January 1986, the Public Accounts Committee expressed their concern at the lack of appreciation so far revealed by certain controlling officers of the financial implications arising from incorrect leave records and overstatement of leave earnings. The Committee noted that the Secretary for the Civil Service:
—had issued an aide-mémoire to all controlling officers drawing their attention to the proper method of calculation
of leave earnings and to the need to carry out random checks within departments;
-intended to issue new forms for leave applications and for recording leave earnings;
-was considering whether leave records should be computerized; and
-was carrying out a continuing programme of periodic quality control checks in departments to ensure that procedures for recording and calculating leave earnings, and the handling of leave applications and approvals were in order.
The Committee also noted that there were wide varieties of leave schemes and leave earning rates within the civil service, both of which contributed to the difficulties of calculating and recording leave eligibility, and that the Standing Commission on Civil Service Salaries and Conditions of Service was considering proposals to rationalize and simplify leave schemes. The Committee wished to be informed of:
14