Audit of Digital Program Phase 1 – Digital Workspace Implementation

Executive Summary

The CNSC is currently in the late stages of rolling out a suite of Microsoft tools across the organization, the most impactful aspect of which has been the setup and adoption of SharePoint as the operational platform for Information Management. SharePoint will replace the existing electronic document system (e-Access) and enhance the organization’s information and data management capabilities. The engagement has been divided into three phases, with this first phase focused on auditing the project management implementation and the change management supporting the organization’s SharePoint and its accompanying tools.

Why this is important

Effective delivery of CNSC’s Digital Strategy is important to ensure that technology investments directly support the organization’s goals, and that the IT systems and processes needed to carry out the CNSC’s mandate are in place. This phase of the Digital Program is key to ensuring successful completion of the project.

Key findings

The CNSC has made considerable progress in advancing the first horizon of its digital modernization strategy, including the rollout of SharePoint across the organization. The majority of CNSC staff are currently using SharePoint effectively for their Information Management, and in a recent survey conducted by Information Management Technology Directorate (IMTD), nearly three-quarters of respondents (74%) reported a positive experience with M365 in their work. In summer 2025, an Operations Digital Governance was established to execute change management activities, and although ongoing delays are possible, it is expected that the entire CNSC will be transitioned to SharePoint by summer 2026.

Although the CNSC made significant strides in 2025 to address barriers to adoption, overall, the Digital Workspaces Project experienced delays, cost overruns, and issues with implementation. Key contributing factors for the delays included insufficient resource estimation, assigning a senior management champion, delays by operational groups in formalizing operational change-management plans, lack of operational representation in decision making and oversight, gaps in business requirements gathering, unclear scope, and insufficient training. Lower residual risks remain in ensuring robust project and change management practices are in place for the remaining activities to fully transition staff to using SharePoint.

To distinguish short-term recommendations and lessons learned that should be considered for future projects, these have been included separately in the report. Audit recommendations focus on ensuring that both Operations and IMTD develop clear plans for completing the remaining work for the organization to adopt SharePoint, and that progress is reported to management until completion. Lessons learned focus on ensuring that appropriate governance, cost estimation, planning, and reporting practices are in place for future IT initiatives.

Background

Since 2021, the Information Management and Technology Directorate (IMTD) has been working to modernize the CNSC’s IT systems and processes under a broadly defined Digital Strategy consisting of three time horizons. Delivery of the Digital Strategy is led by the DG of IMTD and overseen by the Digital Steering Committee, a sub-committee of the CNSC Management Committee.

In 2021, IMTD launched the Release 10 project (also referred to as the Digital Workspaces project) with the mandate to deploy a suite of Microsoft 365 (M365) tools across the organization, the most significant of which is SharePoint. The project was led by IMTD, which sought approvals and oversight through IMTD “Digital Governance”, comprised of IMTD staff and management who make technology, information, data and IMTD resourcing decisions. The project was originally anticipated to be completed by end of 2023.

Between 2022 and 2025, M365 and SharePoint were successfully deployed to most non-operational groups across the CNSC. IMTD created a Digital Program Dashboard to provide insights on the adoption rate of SharePoint, site creations, and staff engagement to inform management. In 2024, when planning to roll out SharePoint to the Technical Support Branch (TSB) and Regulatory Operations Branch (ROB) — branches with significantly higher workloads and operational requirements—IMTD engaged the operational groups Change for Enablement (C4E) working committee members to facilitate change management and onboarding. The IM practices have varied across the operational groups, and the project provided the opportunity to improve standardization, adding complexity to both onboarding and change management.

IMTD began deploying SharePoint sites for the ROB and TSB groups in January 2025, and this work continues at the time of this report. Although many SharePoint sites have been deployed, operational groups noted a number of issues in adapting their business process to use SharePoint, such as versioning, approvals, and locking of documents. Beginning in summer 2025, operational groups established Operations Digital Governance (ODG), appointed operational change leadership, and formed a dedicated project team tasked with guiding operational work and change management to migrate operational groups to use SharePoint. In alignment with IMTD, Operations are working toward having all groups deployed and using SharePoint for their IM and business processes by summer 2026.

Authority

This audit is part of the CNSC’s approved Risk-Based Audit and Evaluation Plan for 2023-24 to 2024-25.

Objective, scope and approach

The objective of this audit is to examine the adequacy and effectiveness of the management control framework in place to support the development and implementation of the Digital Program including governance, project management, and change management. In addition, this audit provides insightsintosuccesses and failures in the first horizon to support the operational branches (ROB and TSB) as they transition to SharePoint.

This engagement has been divided into multiple phases. The first phase, covered in this audit report, examines the implementation and change management for the Digital Workspace initiative, with a focus on the roll out to the operational branches where increased complexity and delays in adoption were identified. This audit phase reviewed activities in these domains from April 2021 to December 2025. The audit lines of inquiry and criteria are set out in detail in Appendix A.

The audit methodology included the following activities:

Documentation review: Analysis of relevantstrategies, plans,policies, procedures,project management and system development artefacts,and reports.

Interviews: Discussions withIMTD and operational management,users of the relevant IT systems, and IMTD staff involved in the design and delivery of the Digital Strategyand Program

Statement of Conformance

This engagement conforms with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing.

Findings and Observations

Budgeting and Ressources

Budgeting and resource estimation refers to the project management practice of establishing financial and human resource allocation expectations for the project and managing the project against those baselines.

Why it matters

Reliable cost and HR estimation is a cornerstone of an effective project control framework and enables management to prioritize investments relative to their expected benefit.

Key Findings

The engagement found that IMTD did not define a project cost estimate or budget for the Digital Workspaces project. No overall financial estimate was developed, and project financials were not regularly tracked and reported throughout the project. The human resources required to deliver the project and change management function were not comprehensively identified and underestimated.

Operational groups only developed estimates of operational resources needed in November 2025 and were in the process of allocating the resources at the time of the audit.

Projet Budgeting

The project team developed a Release Charter as the key project management artefact to outline the project’s scope, budget, and objectives. No financial estimate of the human resources cost required was developed for Horizon 1, as funding for the project was covered though IMTD and branches’ existing operating budgets. Throughout the project’s duration, there has been no reporting of costs incurred specifically for the Digital Workspaces Project.

When IMTD launched the Release 10 (Digital Workspaces) project in 2021 to roll out SharePoint and M365 tools across the organization, the project team sought approvals to proceed through IMTD’s Digital Governance. The project team developed a Release Charter as the key project management artefact to outline the project’s scope, budget and objectives. No overall financial estimate of the human resources cost was developed for Horizon 1, as funding for the project was covered though IMTD and branches’ existing operating budgets. Throughout the project’s duration there has not been any reporting of costs incurred specifically for the Digital Workspaces Project.

Lessons Learned

1. IMTD should develop clear estimates of the financial and human resources required for IMTD projects with business impacts for the organization and establish a defined project baseline. When resources outside IMTD are required to support project delivery, IMTD should assist in the estimation of these costs, and track them formally as part of the project cost. IMTD should use the CNSC Project Management Framework developed in 2025 to guide this process.

In December 2025, IMTD was preparing to closeout the Release 10 project and transition all remaining IMTD work to support the organization’s deployment and adoption of SharePoint programmatically through IMTD regular business. This approach is acceptable; however, there are notable critical IMTD activities remaining to support the SharePoint rollout that have not yet been formally scoped or budgeted. These include SharePoint site creation, training delivery, and change management support.

Recommendation 1 :

IMTD should develop baselines for cost, resources, schedule, and scope for the organization using the Project Management Framework (introduced in 2025) for major upcoming initiatives in the Digital Program.

Management Action Plan :

Management agrees. IMTD will update digital program framework documentation to formalize the use of CNSC’s Project Management Framework (2025). IMTD will also develop criteria to identify major initiatives that will leverage the framework for management.

Targeted Completing Date : May 2026

Human Resource Estimation and Allocation

Throughout the organization’s adoption of SharePoint, IMTD maintained a project team, and operational groups assigned representatives to committees and participated in working sessions with IMTD to design and deploy the new tools. However, for much of the project, Operations did not develop a formal plan, budget, or estimate of the resources required to guide and execute business process changes across the organization. As a result, the level of change management effort was significantly underestimated.

In November 2025, Operations established the Operations Digital Transformation – Change Management Project, led by an operations team with support from staff from the Transformation Management Office (TMO). The TMO mandate is to provide integrated project management and change management services to support the organization's transformational and horizontal initiatives. Estimates of the operational staff required have been developed; however, these staff have not yet been fully committed and assigned.

Digital Governance and Reporting

Digital governance refers to the oversight mechanisms to review, approve and monitor project and change management activities across the organization.

Why it matters

Effective digital governance is a key practice to ensure that accountabilities, roles and responsibilities are clearly defined and understood, and that management has visibility to guide the successful delivery of digital initiatives and implement corrective actions when required.

Key Findings

The audit found that there was a lack of operational business ownership and representation in the Digital Workspace governance, project approvals, and decision making throughout much of the project. In addition, a lack of clear reporting against baselines impeded oversight across the organization.

Governance and Business Ownership

The IMTD Digital Workspaces project, which supported the migration of the organization to SharePoint, was an IMTD-led project as part of the CNSC Digital Strategy and IMTD Digital Program. The project applied IMTD’s Digital Program Governance Framework, through which technology, sequencing and IMTD resourcing decisions and approvals were provided by IMTD Digital Governance. At the outset, there was no defined operational or business sponsor or champion for the initiative. In spring 2025, Operations appointed an Operational Digital Champion, and operational groups established an Operational Digital Governance structure throughout 2025, facilitating a more integrated and coordinated approach within Operations and then with IMTD.

Lessons Learned

2. For IT projects with a business impact, governance should include both business and IMTD representatives.
3. For IMTD projects with a business impact, dedicated business owners from the relevant areas of the organization should be appointed at the outset of key initiatives.

Oversight, Decision making, and Reporting

Throughout the project, IMTD periodically provided status updates to the Digital Steering Committee (DSC), which includes representatives from across the organization, including operational groups. These updates took place on average a few times per year, and materials presented frequently included aspects across the digital program. These updates were primarily provided for information, as decision making for the project rested with IMTD Digital Governance. These updates also did not include clearly defined project baselines of scope, schedule, cost, and risks for which the project status was reported against. As a result, project oversight by operational groups and senior management was very limited throughout the project. In summer 2025, Operations established a counterpart governance, and IMTD and Operations have since begun meeting regularly to report on the progress of work in support of SharePoint adoption.

Lessons Learned

4. For IMTD projects with business impact, IMTD should develop a clear dashboard that tracks progress against established baselines and report it to a governance committee with decision-makers that includes operational management.

Change Management

Change management refers to the structured practice of preparing, supporting, and guiding people and processes so that a new IT system is adopted successfully and used effectively.

Why it’s important

Change management is a foundational practice to ensure that new IT systems are successfully adopted by users and used efficiently with minimal disruption.

Key Findings

The audit found that, for much of the Digital Workspaces initiative, there was ambiguity between Operations and IMTD regarding the roles and responsibilities for change management. Lack of formal business-requirements gathering and ineffective training contributed to implementation issues and ongoing delays.

Change Management Responsabilities

In designing the Digital Workspaces project to deploy SharePoint, IMTD established a change management team and incorporated various change management activities into its project plan. These activities primarily focused on setting up the necessary SharePoint sites and configurations for each team, and providing training on the use of the tools. However, the scope of IMTD work did not include activities or support for business process mapping or change management for operational business processes — both of which critical activities necessary for the organization to functionally use the new system. Although IMTD informed operational teams on this division of scope and need for operational change management, the extent of planning and work needed was not fully understood and underestimated by operational teams. IMTD Digital Workspaces project management documentation did not define the roles or responsibilities of operational staff, and the expectations of operational staff participating in the C4E group were not fully understood. As a result, for much of the project there was ambiguity on accountability and the division of responsibilities for operational change management. This persisted until Operations established its own governance and project in summer 2025 and engaged staff throughout the fall.

Lessons Learned

5. For IMTD projects with business impact, IMTD should establish clear project charters that identify representatives from operational groups in defined roles with defined accountabilities.

Business Analysis

Beginning in 2022, IMTD conducted multiple design and requirements-gathering consultations with business groups across the organization. These focused on the configuration and site specification required for each group and were generally successful for all non-operational groups. However, this process did not include a business requirements gathering exercise for operational requirements. As a result, in 2024-2025 as operational groups began to be onboarded to SharePoint, a number of critical issues were identified impeding operational use of the new system. Actions to address these issues are currently underway, either through business process change, workarounds, or technical changes. Resolution of these issues is being led by Operations and may require support or system modifications by IMTD. It will be essential for IMTD and operational staff to work collaboratively in resolving these issues and arrive at a joint consensus of their resolution prior to the full migration from e-Access to SharePoint.

Lessons Learned

6. For IMTD projects with business impact, Operations should commit internal expertise with technological and business analysis expertise to facilitate the development and advocacy of operational business requirements in digital initiatives early in the project cycle.

Recommendation 2:

Key technological decisions related to SharePoint adoption with an operational impact, such as finalization of configurations or readiness to transition, should be brought for decision to a governance committee/group that includes management from operational groups.

Management Action Plan:

Management agrees. IMTD will seek endorsement from the Digital Steering Committee representatives to finalize a decision on eAccess read-only date

Targeted Completion Date: June 2026

Training

To help staff in learning and onboarding to SharePoint, IMTD developed a learning site with training videos and information resources. The Digital Workspaces project team developed an original training plan and explored the option of contracting external vendors to deliver training. However, limitations in the configuration and CNSC information available to these external training providers was an insurmountable obstacle, and this approach was discontinued. Some operational groups that received training noted that the self-paced and virtual training was insufficient to equip them with all the training they needed for their work. IMTD and operations have identified the need to deliver more comprehensive training in 2026, and IMTD has begun outreach to facilitate this training across the organization. This training is planned to be delivered by the IMTD IM program team; however, the associated plans and resources have not yet been finalized.

Recommendation 3:

IMTD, in collaboration with Operations, should develop a plan for training to support staff in the adoption of SharePoint.

Management Action Plan:

Management agrees.

IMTD will add Information Management with SharePoint instructor-led training for groups to complement existing self-paced training.

Targeted Completion Date: March 2026

Overall Conclusion

The CNSC has made considerable progress in advancing the first horizon of its digital modernization strategy. Work remains over the coming months to develop clear and measurable plans that define the remaining work to be done for SharePoint adoption and to report progress to governance until completion.

Lessons learned from this report, along with those from IMTD’s on going self assessments from the Digital Workspaces project, can be applied to future initiatives in the domains of digital governance, resource estimation, change management, and business ownership and participation.

Appendixes

Appendix A : Audit Criteria – Phase 1 – Digital Workspace Implementation and Change Management

Line of Enquiry 1: The scope, schedule, cost,objectives, and outcomes of the Digital Workspace Project have been clearly defined, documented, and approved by management.

1. Project baselines (scope, schedule, budget) and project outcomes are documented in project artefacts or an equivalent, such as a Business Caseor Project Plan.
2. Project baselines have been presented and approved to management at theappropriate level, either through committees or approval of project artefacts. Records of approval are documentedand includestakeholders from outside IMTD.

Line of Enquiry 2: Roles and responsibilities for the Digital WorkspaceProject have been clearly defined and documented and are understood by all stakeholders.

1. Governance (specifically, roles and responsibilities for the project and its delivery) have been documented in project artefacts or an equivalent, such as a Project Charter.
2. Project roles and responsibilities have been defined at a sufficient level to include all stakeholders, such as in a RACI matrix or equivalent document.
3. Roles and responsibilitieshave beenvalidatedbybusinessstakeholders(e.g. management of operational groups)and communicatedtooperationalstaff involved in the project

Line of Enquiry 3: There is a defined plan for change management and business process change, with adequateresources and support.

1. IMTD has a documented change management plan for the Digital Workspace Projectemploying a recognized change managementmethodology.
2. Organizational committees or governance bodies are in place to manage and approve changes.
3. Change management roleshave been defined and assigned todivisions andindividuals.
4. Business stakeholder needs(focus on ROB and TSB)have beenidentified, collected, assessed, and integrated into the change management plan.
5. Estimates of effort and resources involved have been developed and integrated into the projectplan or change management plan.
6. Business stakeholders(focus on ROB and TSB)are communicated regularly onchangesstemming from the project.

Line of Enquiry 4: Project risk management and reporting practices are in place and functioning effectivelyfor the Digital Workspace Project.

1. There is a documented risk management plan that is followed throughout the duration of the project.
2. Risks and issues are reported to oversight bodies, and responses are documented.
3. Project status is formally tracked against baselines and reported to the relevant oversight bodies.
4. Changes to project baselines are formally approved and documented.

Appendix B : Management Action Plans

Recommendations	OPI	Management Action Plan	Completion Date
1. IMTD should develop baselines of cost, resources, schedule, and scope for the organization using the project management framework, introduced in 2025, for major upcoming initiatives in the Digital Program.	IMTD	IMTD will update digital program framework documentation to formalize usage of CNSC’s Project Management Framework (2025). IMTD will develop criteria to identify major initiatives that will leverage the framework for management.	May 2026
2. Key decisions related to SharePoint adoption with an operational impact, such as date to transition to e-Access read-only mode, should be brought for decision to a governance committee/group that includes management representation for all branches.	IMTD	IMTD will provide communications, awareness sessions and outreach to prepare the organization for final onboarding to SharePoint and retirement of e-Access. IMTD will leverage existing channels such as email, TechTalk Engage posts, TechTalk learning sessions, and Manager’s Forum presentations. IMTD will seek endorsement from the Digital Steering Committee representatives to finalize a decision on e-Access read-only date.	June 2026
3. IMTD, in collaboration with Operations, should develop a plan for training to support staff in the adoption of SharePoint.	IMTD	IMTD will add Information Management with SharePoint instructor-led training for groups to complement existing self-paced training.	March 2026