With the ever-increasing technological advancement, IT environments have continued to increase in complexity and inter operate ability with ever greater reliance on the information produced by IT systems and processes. The General Control Review will assess the controls around the IT infrastructure and process deployed in the local government environment. Based on our understanding of your environment and risks that are likely, we will cover the following IT general controls focus areas:

• IT and network security
• User account management (covering main authentication systems and applications)
• Physical security and environmental controls
• Change management
• Backup
• Disaster recovery plan and backup processes
• IT operations (capacity management and job scheduling)
• Incidents and service desk

IT governance refers to the structures, oversight and management processes in place which ensures the delivery of the expected benefit of IT investments in a controlled way to help enhance the long-term sustainable success of an organisation. IT governance is a subset of an organization’s corporate governance. As the utilization of IT grows in an organization, it presents risks which must be mitigated. IT governance focuses specifically on information technology investments and assets, their performance and risk management. The primary goals of IT governance are to ensure that the investments in IT generate business value, and to mitigate the risks that are associated with IT.

Our IT governance approach is underpinned on national and international standards as well as compliance to regulatory and statutory bodies as noted below:

• Public Service Corporate of Information Communication Technology Policy Framework
• ISO/IEC 38500
• ISAE 3000 Guidelines
• King III
• IT Governance Institute
• COBIT 5
• ITIL

“ Proactive data monitoring was associated with 52% lower losses and frauds detected in half the time.” (Association of Certified Fraud Examiners, 2018 Report to the nations on occupational fraud and abuse)

With the right data analysis technology, you can:

• Automatically search 100% of your transactions for indicators of fraud.
• Easily merge, normalize, and compare data from different systems and sources.
• Quickly identify fraud before it becomes material (or front-page news).
• Strategically realign resources to focus detection efforts on suspicious transactions.
• More accurately calculate the impacts of fraud.
• Significantly reduce sampling errors and improve internal controls.
• Save time by automating repetitive tests. 

We can assist your organisation to detect irregularities that would otherwise be undetected using the conventional sampling methods an techniques. We can utilize a variety of analytical tools such as:

• Trend analysis & time series analysis- Analysis of trends across years, or across departments, divisions, etc. can be very useful in detecting fraud
• Ratio analysis
• Duplicate transactions- Duplicates testing is one of the more common fraud tests because it can indicate fraud as well as inefficiency and inaccuracies in transactions.

The use of ACL (Audit Command Language) enables us to get a full view of all business transactions rather than the traditional sampling which had the inherent shortcomings of sampling error;

We can conduct automated Audit Command Language (ACL) testing to analyse a wide range of transactions such as:

• Order-to-Cash Analytics
• Payroll Analytics
• Purchase-to-Pay Analytics
• Tax Compliance
• Travel & Entertainment
• Budget Management
• Credit Card Management
• General Accounting
• General Ledger
• Asset Management

Risk based audits are the cornerstone of modern internal auditing. The higher the risk to the organisation the greater the impact to the achievement of goals and objectives. Risk is also viewed in the form of risk and opportunity. 

We will use our methodology which is aligned to the International Professional Practices Framework (IPPF) of the Institute of Internal auditors (IIA).

Each assignment should at least consist of the following: 

• Pre-audit survey,
• Audit planning memorandum,
• Minutes of entrance meeting,
• Risk assessment document,
• Control Adequacy assessment document,
• System descriptions,
• Audit programmes,
• Record of work performed,
• Audit of work performed,
• Audit finding and recommendations,
• Sampling methodology,
• Mechanisms for follow up on matters previously reported and feedback to the Audit
• and Risk Committee,
• Mechanism to ensure that working papers are reviewed at the appropriate level,
• Reporting (draft internal audit report and final internal audit report); and
• Follow up of previous audit findings.

We comply with the quality control standards as laid down by the Institute of Internal Auditors, and we also have a process of internal quality review within our company. 

Our internal audit service is subject to constant internal quality assurance and peer reviews. We regularly conduct extensive quality reviews within our firm. In addition, at project/process level, each individual process/project will be subject to a review by a manager and director. Their responsibility will be to ensure that the project/process audit meets the IIA standards and that: 

The terms and conditions of the contract are adhered to;

• Individual projects are appropriately staffed at director/manager level;
• Staff was appropriately supervised and working papers properly reviewed;
• The project scope is appropriately set and communicated with management;
• The reporting deadlines and standards are consistently met.
• Our staff was assessed at the end of each project. 

It must be noted that our methodology has built in steps and templates that ensure the adherence to IIA standards.

Determining whether risk management processes are effective is a judgment resulting from the internal auditor’s assessment that: 

• Organizational objectives support and align with the organization’s mission
• Significant risks are identified and assessed
• Appropriate risk responses are selected that align risks with the organization’s risk appetite 
• Relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities. 

It is important that an organization obtains assurance on its risk management process. This assurance must accommodate the possibility that the internal auditor might not be functionally independent of the risk management function. In this case, assurance may be sought from an external party. 

Our approach to giving assurance on the effectiveness of risk management at the organisation is based on the IPPF Practice Guide –Assessing the adequacy of Risk Management using ISO 31000. The assurance approach (Process Elements, Key Principles, or Maturity Model) to be used will be discussed with organisation’s internal Audit based on the level of appliance of risk managementat the organisation and agreed before commencement. 

Based on our knowledge, general areas of concern include establishing whether: 

• The risk management process has been applied appropriately and all elements of the process are suitable and sufficient.
• The risk management process is in keeping with the strategic needs and intent of the organization.
• All significant risks have been identified and are being treated.
• Controls are being correctly designed in keeping with the objectives of the risk management process.
• Critical controls are adequate and effective. 

The expanded scope of the review of the adequacy and the effectiveness of Risk Management process will look into the following areas: 

• Whether organisation operates within the terms of a risk management policy and Strategy approved by the Accounting Authority.
• Whether NRR’s risk management philosophy has been communicated in the context of how risk management is expected to support the achievement of objectives.
• The roles and responsibilities of the key players has been clearly articulated and delegated in a manner that ensures effective co-ordination and synergy of risk management activities.
• The implementation of organisation’s risk management policy is guided by a strategy approved by the Accounting Authority.
• Internal processes have been established to sensitize all employees of the relevance of risk management to the achievement of their performance goals.
• Training and support should be provided to everyone involved in risk management activities to equip them to optimally execute their responsibilities for risk management.
• Organisation has adopted a rigorous and ongoing process of risk identification that also includes mechanisms to identify new and emerging risks timeously.
• Formal channels of communication and co-operation exist within the Institution to facilitate synergy between the Risk Management Unit and Risk Management Committee, and internal formations concerned with risk mitigation. There is proper delegation of responsibilities relating to risk management to Management and internal formations such as the Risk Management Committee, Fraud Prevention Committee, Finance Committee, Information and Communication Technology Committee.
• Whether management is held accountable for designing, implementing, monitoring and integrating risk management into their day-to-day activities.
• Organisation’s risk appetite and risk tolerance has been set and thus approved.
• Personal attention has been devoted to overseeing management of the significant risks.

• Financial Statement
• Computer forensic
• Electronic Discovery
• Bankruptcies, insolvencies, and reorganizations
• Workplace fraud investigations
• Calculation of economic losses
• Business valuations
• Professional negligence 

Forensic investigations are therefore critical in establishing the facts of the matter, the legislation/regulations not followed, and the culpability of officials. The results of the forensic investigation also enable the organisation to institute consequence management and also act as a deterrent of such behaviour.

• We make use of a variety of forensic audit procedures depending on the nature of the investigation such as:

  a) Data Analysis
  b) Analytical Procedures
  c) Inspection
  d) Observation
  e) External Confirmation
  f) Recalculation
  g) Re-Performance
  h) Inquiry
  i) Interviews

In recent times, corporate governance in South Africa has been dominated by the King reports on corporate governance. The latest report, King IV provides a comprehensive guide on the standards for governance and its application. The corporate governance framework will also take into consideration other governance prescripts such as OECD in benchmarking best practice for this section.

Ethical leadership is one of the latest buzz words to come out of King IV; “Good corporate governance is essentially about effective ethical leadership. While leadership starts with each individual director, it finds its expression through the Board as a collective, setting the appropriate example and tone which is referred to as ethical governance. King IV explains the governance of ethics as the role of the Board in ensuring that the ethical culture within the organisation is aligned to the tone set by the Board through the implementation of appropriate policies and practices.” (King IV Report)

The code of ethics therefore plays an integral part in the setting of the organisation’s ethical culture and providing a means to measure effectiveness.

• Business Continuity Management ensures that the organisation can meet its objectives – whatever the cause or impact of disruption may be;
• Protects your ability to supply key products and services;
• No longer the recovery of IT systems only – (Disaster Recovery);
• BCM focuses on identifying choices available to protect delivery of products and services following a disruption to operations; and
• The long-term goal of the BCM programme is to improve organizational resilience

• • Absorb – Capability to bounce back from disruptive and damaging incident(s); failover capability;
  • Respond – To have a tested plan in place to ensure recovery;
  • Recover – To have an alternative site where operations can be recovered if the organisation has lost office space or IT infrastructure.

  (Ensuring minimal disruption to the organisation’s most urgent activities supporting the supply of services).