PRESENTATION TO PARLIAMENTARY PORTFOLIO COMMITTEE A-G AUDIT FINDINGS

PRESENTATION TO PARLIAMENTARY PORTFOLIO COMMITTEE

A-G AUDIT FINDINGS

Joseph A Mutungama

Chief Audit Executive

National Home Builders Registration CouncilEmail: [email protected]

Bryanston, South Africa

22 February 2013

1

mailto:[email protected]

2

BACKGROUND• NHBRC received a qualified audit opinion in the financial year

ended March 2012.

• In addition to the qualified audit opinion, numerous matters of emphasis were raised by the Auditor General.

• In response Internal Audit facilitated a workshop with NHBRC Management to review the report, perform root cause analysis and develop an Action Plans to address identified control weaknesses as raised by the Auditor General.

• Progress in implementing the action plan is reported on to the NHBRC Exco monthly and to both the NHBRC Audit and Risk Committee and Council quarterly.

3

BACKGROUND… (CONTINUED)As per the A-G report the areas below had the most material control deficiencies reported on:

BUSINESS AREA REMARKS

SUPPLY CHAIN • Irregular Expenditure exceeded R200m• General non compliance with PFMA and SCM

policy.

IT • The current legacy systems cannot support or enable the NHBRC in a consistent manner

• Issues of system and data security, availability and integrity.

PERFORMANCE INFO • Problems in identifying SMART KPIs.

FINANCE • GL and Payroll Reconciliations issues and controls over the EFT system.

4

NHBRC REMEDIATION STRATEGYThe Action Plan to address the A-G reported issues adopted the following implementation timeframes:

CATEGORY TIME TO ADRESS THE FINDING

Immediate Immediately

Short Term Within 30 DAYS

Medium Term Within 3 MONTHS

Long Term Within 6 MONTHS

5

PROGRESS TO DATE• Progress To Date is as Follows:

CATEGORYTOTAL RESOLVED PARTIALLY

RESOVEDUNRESOLVED DISAGREED

IMMEDIATE 38 36 0 2 0

SHORT TERM 13 3 9 1 0

MEDIUM TERM 3 2 0 0 1

LONG TERM 9 1 2 6 0

TOTAL 63 42 11 9 1

PARTIALLY RESOLVED

UNRESOLVED DISAGREED

7 - BUSINESS MANAGEMENT SOLUTIONS (IT)

2 - SUPPLY CHAIN 1 - SUPPLY CHAIN

2 – HUMAN CAPITAL 1 – HUMAN CAPITAL1 - FINANCE 4 - FINANCE1 - PERFORMANCE INFORMATION 2 - BUSINESS MANAGEMENT

SOLUTIONS (IT)0

11 9 1

6 6

GRAPH-PROGRESS TO DATE

7 7

A-G ACTION PLANNO FINDING TIMEFRAME PROGRESS

STATUSCOMMENT

1. Irregular Expenditure. Goods or services with a transaction value of more than R 500 000 were not procured by means of a competitive bidding process.

Immediate Unresolved NHBRC faces an irregular expenditure amount of over R100m as at end of third quarter mainly due to Forensic Consultation fees and Rectification contractors. This expenditure emanates from contracts entered into in the previous financial year.

2. The accounting authority did not take effective steps to prevent irregular expenditure. In terms of section 51(1) (b) (ii) of the PFMA the accounting authority must take effective and appropriate steps to prevent irregular expenditure. The irregular expense declared in the financial statements decreased from R400 255 in 2010/2011 to R202 223 991 in 2011/2012, furthermore additional irregular expenditure was identified through the audit process.Management circumvented the compliance requirements by awarding contracts/quotations without following applicable laws and regulations pertaining to supply chain management.

Immediate Unresolved As above

3. Evaluation of tender for points and functionality not performed. The root cause for this non-compliance was that buyers were buying from historically disadvantaged suppliers on the approved supplier database, but they did not understand that they had to print out the document to prove that they considered those elements.The non-compliance with the applicable laws, rules, regulations and practices resulted in irregular expenditure.

Immediate Resolved A new matrix system has been implemented and approved by Management. The preferred service provider is selected due to highest score points. The matrix system includes name of the service provider, tender price, points for price, BEE scoring and ranking.

8 8

A-G ACTION PLAN…CONTINUEDNO FINDING TIMEFRAME PROGRESS

STATUSCOMMENT

4. Tax Clearance certificate not obtained. National Treasury Practice Note 8 of 2007/08 and Treasury Regulation 16A9 require the winning supplier to submit an original Tax Clearance Certificate from SARS certifying the tax affairs of that person to be in order or that suitable arrangements have been made with SARS. The following supplier did not submit a tax clearance certificate: Supplier Name: Surestream Property Investments Pty Ltd Supplier No. 2944 The owner of the building leased by NHBRC changed and the new owner did not submit a tax clearance certificate.This resulted in irregular expenditure of R3 641 147 and due to the fact that management did not identify and disclose this as irregular expenditure in the financial statements submitted for auditing purposes on 31 May 2012 this will contribute to the modification in the audit report on the completeness of irregular expenditure.

Immediate Resolved The supplier has submitted the tax clearance certificate.

9 9


STATUSCOMMENT

5. Internal Audit Function: Non Compliance with Treasury Regulations. In terms of Treasury Regulations 27.2.6 Internal Audit must be conducted in accordance with the standards set by the Institute of Internal Auditors. Through testing performed on the Internal Audit Function it was found that the Internal Audit Function did not adhere to all standards set by the Institute of Internal Auditors.In terms of Treasury Regulations 27.10(e) internal audit should evaluate the compliance with laws and regulations. Through testing performed on the Internal Audit Function it was found that the Internal Audit Function did not evaluate the compliance with laws and regulations.

Immediate Resolved Annual operational audit plan 2012/2013 which includes the evaluation of compliance weaknesses and regulations has been approved by Council and is being implemented.

6. Extensions to contracts exceeding 15% of the original value not approved by National Treasury. In terms of the NHBRC procurement policy the extensions of contracts exceeding 15% of the original contract value should be approved by the CEO.The extensions were approved by the CEO in terms of the NHBRC policy but were not approved by National Treasury in terms of Treasury Regulations.This was as a result of management circumventing the requirements of treasury regulations.The non-compliance resulted in irregular expenditure and a modification under the compliance section will be included in the audit report.

Immediate Resolved The finding has not occurred in the current financial year. Finance section has not received extensions to contract exceeding 15% of the original value in the current financial year.

10 10


STATUSCOMMENT

7. Invitations to bid not advertised as per Treasury Regulations. Per management the urgency of transactions resulted in minimum advertising time not being followed.The non-compliance resulted in irregular expenditure and as a result this will contribute to the modification in the audit report pertaining to the completeness of irregular expenditure.

Immediate Resolved The policy has been drafted to align with Treasury Regulations.New tenders published currently are Revision of Home Building Manual and Forensic Engineering Services.

8. Non-compliance with Treasury Regulations.The scope of the work was increased and more quotations were sourced for completing other renovation tasks.Additional work was then performed by Bougart Building Construction CC.In terms of Treasury Regulation 16A3.2 the supply chain management system must be fair, equitable, transparent, competitive and cost effective. In terms of instruction note 32 expansions / variation orders should not exceed the following limits without prior approval by the national/ provincial treasury: For construction contracts: - The lesser of R20 million or 20% of the original contract amount.For other goods/ services: - The lesser of 15% or R15 million of the original contract price.In terms of the NHBRC procurement policy the extensions of contracts exceeding 15% of the original contract value should be approved by the CEO.

Immediate Resolved The finding occurred is no longer applicable. The process occurred only once in the previous financial year.

11 11


STATUSCOMMENT

9. More than 20% of planned targets not achieved. During the audit of the performance information, it was noted that 24% (13 out of 54) of the targets set by the NHBRC as per annual performance plan were not achieved as at 31 March 2012.This matter will be included in the audit report in the section relating to predetermined objectives.

Short Term Partially Resolved

There are new targets to be attained by the organization for 2012/2013 financial year. The performance of sections is monitored by Strategy Section to ensure that targets are achieved as set out in the organizational Balanced Scorecards.

10. A list of all bank accounts not submitted to National Treasury. As per the Treasury Regulations section 31.2.1 the Accounting Authority should submit a list of all bank accounts to National Treasury annually by 31 May. We obtained correspondence between NHBRC and National Treasury where the Main bank account details were sent to treasury on 19 April 2012. However no record could be found that banking details were submitted during the 2011/2012 financial year.

Medium Term

Resolved A list of all bank accounts was sent through e-mail to National Treasury by the Personal Assistant to the Chief Financial Officer on 24 April 2012.

12 12


STATUSCOMMENT

11. Bank reconciliations not prepared on a weekly basis. It was noted that bank reconciliations are performed on a monthly basis instead of a weekly basis as required in terms of Treasury Regulations. Treasury Regulations 31.1.2 (j) states that sound cash management includes preparing bank reconciliations on at least a weekly basis. However management does on a daily bases clear receipts and payments even though there is no formal reconciliation prepared.Upon enquiry as to the reason for this management indicated that the Oracle system does not allow for management to evidence that reconciliations are done on at least a weekly basis.

Long Term Unresolved The Oracle platform is not configured to handle reconciliation and posting weekly; this can only be done monthly.The bank reconciliation is prepared on a monthly basis as transactions occur on a monthly basis.

12. Payment not made within 30 days of receipt of invoice.

It was noted during the inspection of a sample of payments made during the period, where certain payments were not made within 30 days of receipt of invoice. In terms of Treasury Regulation 8.2.3. "all payments due to creditors must be settled within 30 days from receipt of an invoice". This amounts to non-compliance with the Treasury Regulations


The delay in payment is due to business not receipting goods and services timeously, business has the obligation to check all invoices to ensure that all goods and services were delivered, in certain instances the receipting of these invoices is delayed, however once the invoice is receipted they are paid within two weeks of receipt

13 13


STATUSCOMMENT

13. Exception (Variance) Reports not reviewed by management. It was noted that for the months of September 2011, November 2011 and March 2012, the spike/variance reports that were prepared were inspected for material & unusual movements by the Payroll Specialist, however the reports were not reviewed by senior management.Furthermore the September 2011 ACB Report was not reviewed by management.

Immediate Resolved The current Human Capital Manager was appointed end of February 2012 and started reviewing the work in March 2012. HC Manager is reviewing the variance report on a monthly basis.

14. Reconciling items not cleared timely. It was noted that reconciling items/differences between the Payroll Oracle system and the general ledger were not cleared on a month to month basis.This finding was caused due to human resources constraints.

Immediate Resolved The reconciliations are cleared timely by the Financial Accountant.

15. Fringe benefits not subjected to PAYE. The PAYE deducted from employees may be understated due to the non-inclusion of a petrol card allowance received by 107 employees (specifically High Users) of R4400 that is used for both business and private purposes, as no travel log is maintained. Staff is required to be taxed on fringe benefits in term of schedule 7a of the Income Tax Act.This was caused by staff not fully understanding the implications of tax on fringe benefits.

Long Term Partially Resolved

Human Capital is in a process of sourcing a Tax Consultant to assist and advice on matters of tax. The Payroll Specialist has prepared the Terms of Reference document for submission with regard to sourcing a Tax Consultant.

Matter to be resolved by 31 March 2013

.

14 14


STATUSCOMMENT

16. Findings on Predetermined Objectives.

Inconsistencies in the reporting of amounts collected from debtors.

It was noted that there were inconsistencies with regard to the amounts reported in the quarterly reports for the indicator “R 72 million to be collected from the NHBRC debtors” This indicator was only reported in the first quarter. An amount of R 11 million was reported as collected in the first quarter and nothing was reported from the second quarter up to the fourth quarter. In the annual report an amount of R348.3 million was reported for this indicator.Management did not define the objectives clearly in the prior year, which resulted in inconsistent reporting.

Immediate Resolved The reporting of performance information and targets are clearly indicated in the performance report of 1 April 2012 to 30 June 2012. The reporting of amounts collected from debtors is included in the quarterly report. KPI’s have also changed in the first quarter of 01 April 2012 to 30 June 2012 and it is no longer a performance indicator.

17. Inconsistencies in the reporting of assurance structures implemented in the provincial departments of Human Settlements. It was noted that there were inconsistencies with regard to the quarterly reporting of the indicator “Quality assurance support structures strengthened in the Provincial Departments of Human Settlements”. This indicator was only reported in the fourth quarter. A total number of 2 support structures were reported as achieved in the fourth quarter and nothing was reported from the first quarter to the third quarter. Through inspection of the number of structures reported as implemented in the annual report, we noted that 9 support structures were reported.

Immediate Resolved Nine quality assessors have been appointed in all nine provinces.

15 15


STATUSCOMMENT

18. Management does not ensure the completeness of the indicators or targets reported in the annual report. It was noted that management does not have any controls to ensure that indicators/targets reported in the annual report are complete. Completeness of targets is important since it ensures that all the activities relating to a particular indicator/target has been reported. Note that management did report on all the indicators included in the strategic plan for the entity.Management did not define the objectives clearly in the prior year, which resulted in matter above.

Immediate Resolved The matter has been taken into consideration in the KPA’s and KPI’s 2012/2013.

19. Inconsistencies between the quarterly and annual reports for the indicator of “20% ofall houses under construction inspected to be audited” It was noted that that there were inconsistencies with regard to the quarterly reporting of this indicator“20 of all houses under construction inspected to be audited”. The following has been reported in thequarterly reports:Management did not define the objectives clearly in the prior year, which resulted in matter above.The final amount reported in annual report could be substantively audited. Thus this matter highlights the control weaknesses that exist during quarterly reviews of data that is reported.Through inspection of the annual report, we noted that management reported that a total of 20% of the houses that were inspected have been audited. This is not consistent with what has been reported in the quarterly performance reports.

Immediate Resolved The matter has been addressed in the 2012/2013 NHBRC balance scorecard. The copy of the balance scorecard is accessible on the intranet.

Objectives are clearly defined in the performance report 01 April 2012 to 31 March 2013.

16 16


STATUSCOMMENT

20. Inaccurate reporting of technical services revenue. It was noted that the amount reported in the quarterly reports does not agree to the amount disclosed in the management accounts. Through inspection of the fourth quarter performance report, we noted that management disclosed that they have collected nothing from technical services revenue, but through inspection of the management accounts, we noted that a total of R 22 642 545 had been collected from technical services, resulting in a difference of R 22 642 545 between the management accounts and quarterly performance reports. Note that the amount that is reported in the annual report agrees to the annual financial statements and the above issue relates to a control deficiency on reviewing of data reported on quarterly bases.

Immediate Resolved The matter is no longer a performance indicator in the current financial year.

17 17


STATUSCOMMENT

21. The register for the “Reduction in the number of days taken to produce a legally enforceable contract from 3 weeks to 7 working days” does not have the date the request was received and the date the request/contract was completed. The Contract register does not include dates on which the request for contract was received and the date on which drafting thereof was completed. Through inspection of the quarterly reports submitted to the National Department of Human Settlement, we noted that this target was indicated as achieved/met. It was not possible to assess if a legally enforceable contract was issued within 7 working days. Management did not define the objectives clearly in the prior year, which resulted in the matter above. Note that the misstatement of indicators that could not be tested is less than 20% and thus will not have an impact on the opinion on predetermined objectives.

Immediate Resolved The matter is no longer included in the 2012/2013 financial year.

22. Duplicate suppliers The NHBRC entered into business with suppliers duplicated on the supplier database.

Short Term Resolved IT section has programmed the Oracle system not to allow duplication of suppliers. The system does not permit the capturing of the same Co. registration number or Vat number. Test suppliers have been deactivated from Oracle system.

18 18


STATUSCOMMENT

23. The declaration of bidder’s past supply chain management practices (SDB8) form not completed for the winning supplier.

The National Treasury Practice Note 4 of 2006 and Treasury Regulation 16A9 require the winning supplier to complete and sign the bidder’s past SCM practices on the SBD 8 form. This information furnished by the builder should be used to ensure that when goods and services are procured or disposed of, all reasonable steps are taken to combat the abuse of the supply chain management system.

Immediate Resolved This was an isolated incident where the NHBRC had a dispute with the supplier which was subsequently settled.

24. Senior managers acted in positions for more than 6 months The CEO position was acted in for longer than 6 months by J Mahachi, due to pending investigations on S. Mashinini. Position was approved in minutes of meetings by the Council as well as on the approved acting allowance forms.

Long Term Partially Resolved

The new CEO has been appointed and will commence on 1 March 2013.

25. Senior management vacancy rate increased from prior year The senior management vacancy rate increased from 43% in the previous year to 60% in the current year. This was due to a decrease in total positions available from the prior year.

Long term Unresolved HCREMCO resolve to put a moratorium on the appointment of all senior officials until the appointment of the CEO is finalised.

19 19


STATUSCOMMENT

26. Payments made in excess of contract value. In terms of treasury regulations 8.2, the total payments made under the contract/ quotation should not exceed the original contract / quoted amount.

Medium Term

Disagreed Management still disagrees with the finding. NHBRC entered various contracts with ICM. Balance score cards, strategic planning and training of consultants’ facilitation were part of the SLA’s entered into with ICM. The R 1, 615.461 was allocated for different services with ICM in addendum to the agreement entered into with NHBRC. The total payment of R 1, 065. 607 that was paid to ICM, instead of paying the total value of R749 696 that was agreed upon, it was for another contract that was entered into with the organization for R 315, 911.

27. The certificate of independent bid determination (SBD 9) was not completed and signed by the winning supplier.

National Treasury Practice Note dated 21 July 2010 and Treasury Regulation 16A9 requires the winning supplier to complete and sign the certificate of independent bid determination on the SBD 9 form. This information furnished by the bidder should be used to ensure that when goods and services are being procured or disposed of, all reasonable steps are taken to combat the abuse of the supply chain management system.Management did not believe it to necessary to obtain certificate if they did go out on tender and contract was entered into before practice note came into effect.

Medium Term

Resolved Signing of the SBD9 form is implemented. Every supplier is required to complete and sign the SBD 9 form.

20 20


STATUSCOMMENT

28. Construction Projects not registered on the CIDB database.

In terms of the Construction Industry Development Board (CIDB) regulation 24, an invitation to tender or calls of expression (in the case of a two stage building process) should be advertised in the CIDB website.

Bogart Building and Construction CC was awarded a contract without the contract being registered on the CIDB database.

Immediate Resolved Management disagrees as this was a partitioning exercise.

This was a once off project.

21 21


STATUSCOMMENT

29. Employees’ declaration of interest not in line with NHBRC policy.

Immediate Resolved SCM practitioners have completed their declaration of interest forms.

30. No reference made to the list of restricted suppliers and tender defaulters when adding new suppliers to the supplier database. Through testing performed on additions to the supplier database it was noted that no reference is made to whether a prospective supplier are listed on the Restricted supplier database or List of tender defaulters as published by National Treasury. In terms of the Treasury Regulations Section 16A9.1(c) the evaluation criteria for prospective providers should include the disallowance of providers whose name appears on the National Treasury’s database as a person prohibited from doing business with the public sector and in terms of The Prevention and Combating of Corrupt Activities Act sec 29 the evaluation criteria should include the disallowance of providers whose name appears on the National Treasury’s register of tender defaulters.An additional audit procedure was performed to check on a sample bases that none of the suppliers were listed on the restricted supplier data base. This was an oversight by management.

Immediate Resolved Tender defaulters are checked by Supply Chain through a list of tender defaulters as published by National Treasury. This is attached to each supplier’s application form.

22 22


STATUSCOMMENT

31. Investment disclosure not in compliance with IFRS. Per the inspection of the Annual Financial Statements we noted that the IAS 39 Investments were not in compliance with IFRS 7 disclosure requirements.

Immediate Resolved The investments disclosures have been reassessed. The annual report 2012/2013 will be in compliance with the IFRS disclosure requirements.

32. No reconciliation of technical services revenue accounts to technical services expenses.This is necessary as the revenue recognized in the financial statements should be directly proportional to the expenses recognized in the financial statements.This reconciliation was performed after year end prior to 31 May submission of financial statements.Note that the necessary adjustments were processed to correct the revenue recognized compared expenses that was recognized in the general ledger. Thus no material misstatement exists. This was not performed as management did not consider it necessary at that point in time.

Short Term Resolved The control has been implemented as per management response. This control has been implemented to assist with management reporting. The NHBRC was behind with invoicing for the EC Department of Human Settlements, this has been resolved and the funds have been received.

23 23


STATUSCOMMENT

33. Trade Receivables outstanding for longer than 30 days Trade debtors relating to government Departments included in the age analysis that are outstanding for longer than 30 days. This is contrary to the PFMA regulations as these departmental debtors had to pay the NHBRC within 30 days.The accounting authority did not take effective steps to collect all money due to the NHBRC as required in terms of section 51 (1) (c) (ii) of the PFMA.

Long Term Unresolved Management is in process of clearing the long outstanding amounts. Resolution of finding targeted for 31 March 2013.

34. Unidentified and unapplied receipts not cleared. Our testing of unidentified and unapplied receipts revealed long outstanding amounts in unidentified and unapplied receipts. Receipts in the bank account are not identified and captured in a form and time frame to support financial reporting. This issue was also reported in the prior year. The unidentified receipts’ balance at year end was R 3 306 994 (R 5 815 003: 2011) and the unapplied receipts’ balance at year end was R 23 481 286 (R 41 386 698: 2011). Note: comfort has been obtained that all receipts entered in the system are allocated to accounts or allocated to unapplied or unidentified cash, Furthermore additional procedures were performed over the allocation of the amounts moving out of these accounts.

Long term Unresolved Finance in process of addressing unidentified and unallocated receipts.

24 24


STATUSCOMMENT

35. Unrecorded liabilities identified. The total amount for invoices that were tested and not accrued for were R 4,067,627.These items were selected through target testing a no extrapolation was done, but the sample was extended to include more items from the misstatement identified.Proper systems to identify all accruals that should be made at year-end are not in place.

Long term Resolved All liabilities are recorded in the period in which they are incurred. Accruals are raised at each month end to ensure that the NHBRC complies with IFRS.

36. Assets with a zero book value held on the fixed asset register.In terms of GRAP 17, paragraph 61, the residual value and the useful life of an asset shall be reviewed at least at each reporting date and, if expectations differ from previous estimates, the change(s) shall be accounted for as a change in an accounting estimate in accordance with the Standard of GRAP on Accounting Policies, Changes in Accounting Estimates and Errors.This resulted because a rigorous exercise to evaluate the residual value and useful life of all assets was not performed at year-end.The current value of fixed assets does not represent the economic benefit of the assets as they are still in use.

Long term Unresolved Busy Addressing the Financial policy and doing upgrades on the Oracle system. Upgrades may be completed by 31 March 2013.

25 25


STATUSCOMMENT

37. Unexplained difference on bank reconciliation. As per inspection of the bank reconciliations for December 2011 for the Main bank account of the entity (account number 62081366520), there was an unexplained difference between the balance as per bank statement, and the balance as per general ledger amounting to R27, 235.76 (December 2011).The finding was a result of taken balance errors from JD Edwards.

Immediate Resolved Bank reconciliations differences are attached with supporting documentation by the Financial Accountant.

38. Bank reconciliation not prepared on a timely basis. It was noted that the Trust bank account bank reconciliation as at 31 October was only prepared and reviewed on 8 December 2011.This was a result of management oversight.

Immediate Resolved Bank reconciliations are prepared by the Accounts Clerk and reviewed by the Financial Accountant on a monthly basis.

39. Ineffective preparation and review of petty cash reconciliations.It was noted during inspection of bank confirmations that the amount as per the bank confirmation for the petty cash accounts, does not agree to the amount as per the general ledger. Upon further investigation, it was noted that no petty cash reconciliation is prepared to reconcile the physical petty cash bank account, and the general ledger account.

Immediate Resolved The petty cash reconciliation is prepared by the Accounts Clerk and reviewed by the Financial Accountant on a monthly basis. A bank column was added to the petty cash reconciliation to agree to the amount as per bank statement to the petty cash control general ledger.

26 26


STATUSCOMMENT

40. Authorized signatories includes employees no longer employed by the NHBRC It was noted through inspection of the bank confirmations received that the signatories listed on the bank confirmation are no longer employed by the NHBRC.We inspected the change mandate form sent to the bank on the 11th of May 2012, and noted that change of signatories had been requested for the Main Account and Trust Account. However, no change of signatories had been requested for the Gauteng and Free State Petty Cash Accounts.Furthermore, the following signatories were identified in the prior year as signatories which were not valid and not belonging to current employees, but still appeared on the bank confirmation as authorized signatories: Management relied on the bank updating their request for signatory changes, with the exception of LD Less and S. Mashinini.

Immediate Resolved With reference to the bank, the signing arrangements have been updated with the bank for change of signatories in Free State and Gauteng. All documents for the Petty Cash Account and Council-Trust Account are signed by two signatories, the Acting CEO, Chief Financial Officer and a list of authorised signing officers. Petty Cash Account has been updated.

27 27


STATUSCOMMENT

41. Allowance for doubtful debts policy not in line with IFRS. In terms of IAS 39 paragraph 64 and entity should assess whether objective evidence of impairment exists individually for financial assets that are individually significant and for financial assets that are not individually significant. If an entity determines that no objective evidence of impairment exists for an individually assessed financial asset, whether significant or not, it includes the asset in a group of financial assets with similar credit risk characteristics and collectively assesses them for impairment.It was noted that management provided for all invoices older than 120 days at year end. This is not in line with the requirements of IAS 39 as debtors were not assessed for impairment on an individual basis. Furthermore there debtors’ policy does not make reference to what is required by the standard. Note that the provision has not been misstated as a result of the above.Management never considered the impact IAS 39, due to fact that they consider government of be one debtor with one risk profile.

Immediate Resolved Resolved: The Allowance for doubtful debt procedure has been updated to be in line with IFRS and the requirements of IAS 39.

28 28


STATUSCOMMENT

42. Reconciliations of accounts receivable control account to age analysis were neither prepared nor reviewed on time.

Immediate Resolved Reconciliations for accounts receivable account age analysis to General Ledger are prepared by Accounts Clerk and reviewed by the Financial Manager.

43. Bad debts written off, policy not followedWe noted that management did not follow the procedures as per the Financial Policy and Procedures document; Procedure 9.4.2. which states that the “Executive Director: Finance must recommend to the Chief Executive Officer overdue accounts that cannot be collected and recommend writing off...” Bad debts written off of R1, 101,783 were with regards to the dispute between the Mpumalanga Department of Human Settlements and the NHBRC over a quantum that had to be used for a project enrolment.These invoices where incorrectly raised. As per our inspection of the correspondence (email) between Thobeka Khubisa (DoHS: Mpumalanga) and Tamlyn Bouwer and Mabel Afrika (both NHBRC) on 24 November 2011. However, this particular write off did not follow the policy per the Financial Policy and Procedures.

Immediate Resolved This was a once off incident in the prior year, and this has not happened in the current financial year.

29 29


STATUSCOMMENT

44. No Fraud prevention plan in place that includes specific measures for preventing and detecting fraud in the procurement process. Through enquiry a Fraud Prevention Plan could not be found The plan would include specific measures for preventing and detecting fraud in the procurement process. This was as a result of oversight by management.

Immediate Resolved Fraud prevention plan has been approved on 18 July 2012 at Executive Committee meeting.

45. No gift register could be located where employees can declare a gift or award received. In terms of the “Gifts to NHBRC Employees Policy” all gifts should be declared and registered in the Gift Register which can be found at the Human Resources department. Through enquiry from employees in Human Resources the gift register could not be located.

Immediate Resolved Gift register template was circulated to all staff in December 2012.

30 30


STATUSCOMMENT

46. Names of successful bidders not published on NHBRC website or Tender Bulletin. In terms of Instruction Note 32 the details of the winning bidder, contract number and description, preference claimed and contract price should be published in the government tender bulletin or website of the auditee.The names of the successful bidders for the following awards were not published on the tender bulletin or the NHBRC website:

•Hydrotek - KZN Water Tanks•Motswako Office Solutions This matter arose due to the NHBRC’s website being under construction.

Immediate Resolved The new tenders published currently are: Revision of Home Building Manual and Forensic Engineering Services. The tenders were published on the government bulletin and Sunday Times newspaper; however they were not advertised on the NHBRC website. Tenders to be published on the NHBRC website by next tender advert.

47. Test suppliers included in the supplier listing. Test suppliers included in supplier’s listing. During our procurement testing of conflicts of interest, we noted a supplier by the name of "TEST" that was included in the listing.Controls should be established to mitigate the creation and maintenance of supplier details on the system. No test journal entries should be processed on a live system

Immediate Resolved Test suppliers are deactivated; therefore transactions cannot be conducted under their names.

31 31


STATUSCOMMENT

48. Rental expenses not appropriately classified It was noted in our testing of leases that the amount posted to the Rental of premises (4624) account included other expenses such as water and electricity, sewage, cleaning services, insurance, etc., which should be posted to separate accounts. Note that none of the disclosable line items in the financial statements have been misstated thus matter is considered to be administrative of nature.

Immediate Resolved Rental expenses are appropriately classified in consolidated management accounts such as water and electricity, sewage, cleaning services, insurance, etc.

49. Other non-cash items on the cash flow statement are not supported by any documents. It was noted that the “Other non-cash items” amounting to R 3,324,183 disclosed in the notes to the Cash Flow Statement do not have any supporting documents. This balance was included in the notes to the cash flow statement as a balancing figure.

Immediate Resolved The Annual report has been amended in “other non-cash items” in the Cash Flow Statement. Non cash items are no longer reflected in the notes to the Cash Flow Statement.

32 32


STATUSCOMMENT

50. Incorrect capitalization of additional costs associated with assets. It was noted that the cost of four air conditioners were incorrectly reflected in the fixed asset register due to the incorrect capitalization of costs to each asset. The total value of the invoice was agreed to the total value of the sum of all four air conditioners capitalised, however the costs to bring the asset into a condition ready for use to relative component were incorrectly split.Note that the overall value as per the fixed asset register is not misstated, only a misallocation per individual assets exist. This does not result in a material misstatement in the financial statements.

Immediate Resolved The finding will never occur in future. NHBRC is presently not charging VAT and not paying VAT. Capex and Opex expenses are acquired VAT inclusive. Total 163,483

51. Assets that are ready for use not depreciated. It was noted that the following assets are ready for use but are not depreciated on the system. However this is not material.

Immediate Resolved The assets have depreciated on Oracle financials system by the Accounts Administrator. The Oracle financial system indicates the useful life of the asset, original cost, accumulated depreciation, net book value, depreciation amount and remaining useful life of the asset.

Asset number Date purchased Amount ( R )

Total Depreciation (R)

17714-CBT205 FLEX

14-Jan-10 205,974 34,329

17715-CHT4106 STA

14-Jan-10 460,108 76,685

17793-YAW4206 MTS

25-Mar-10 314,815 52,469

33 33


STATUSCOMMENT

52. Non-compliance to EFT payment controls. There was non-compliance with controls designed by management to adequately mitigate key financial risks. As a result, the following were not implemented:At the time of the audit, the following EFT payment controls were not complied with:One payment batch had not been signed by the preparer;One payment document within a payment batch had not been signed by releaser 1, but wassigned by releaser two; andTen occurrences existed were supporting documentation had not been cancelled.The non-compliance to EFT payment controls could result in erroneous and unauthorized payments.

Immediate Resolved The payment batch is signed by the preparer and has signatory A and Signatory B being the Financial Accountant and Management Accountant before a payment is released.

53. Inadequate controls exist to manage the process regarding new user access to the EFT application. Management had not formally designed user access controls (policies, procedures, guidelines) to mitigate the risk of unauthorized access to the network and information systems. Informal controls were in place, but were inadequate. As a result, the following key financial risks were noted:It was noted at the time of the audit, that no formal process had been implemented to control the new user access requests to the EFT application.The informal new user access process to the EFT application could result in unauthorized user gaining access to the EFT application.

Immediate Resolved FNB new access requisition form has been designed for new user access requests to the EFT application.

34 34


STATUSCOMMENT

54. Inadequate controls exist relating to the periodic review of activity logs on the EFT Application. Management had not formally designed user access controls (policies, procedures, guidelines) to mitigate the risk of unauthorized access to the network and information systems. Informal controls were in place, but were inadequate. As a result, the following key financial risks were noted:It was noted that no formal periodic review of user activities on the EFT application is currently performed.

Long Term

Unresolved User Access policy and procedures are currently in draft.

35 35


STATUSCOMMENT

55. Inadequate controls exist relating to the password parameters on the EFT application.There was non-compliance with controls designed by management to adequately mitigate key financial risks. As a result, the following were not implemented:It was noted that no expiry is set for general users' accounts on the EFT application. The EFT application provides the functionality to enforce password expiration after 30 days, it was noted that this functionality is not enabled. Furthermore, it was noted that the log of unsuccessful login attempts is not periodically reviewed.No password expiration and no formal periodic review of unsuccessful login attempts on the EFT application may result in unauthorized users gaining access to the EFT application.

Short Term Resolved There was a request to FNB bank on availability and functionality of password expiration. Management site profile has been sent to the Financial Accountant that can be changed on site profile of a password expiry. After 30 days, password expires; the user will be reminded to change the password and FNB will lock the user out of the system for failure to change password.

56. Inadequate design and non-compliance regarding user access controls for the Linux operating system environment. IT management had inadequately designed user access controls (policies, procedures, guidelines) to mitigate the risk of authorized access to the network and information systems. Informal controls were in place, but were inadequate. There was also non-compliance with controls designed by IT management to adequately mitigate key user access risks.


A procedure manual has been developed to address this finding. The manual will be submitted to the policy task team in the beginning of 2013 for review.

36 36


STATUSCOMMENT

57. Inadequate design of user access controls defined for the Oracle database environment. IT management had inadequately designed user access controls (policies, procedures, guidelines) to mitigate the risk of unauthorised access to the network and information systems. Informal controls were in place, but were inadequate.If the controls for the user access control processes are inadequate, users might obtain access to system functions without proper approval, which might lead to employees having rights not related to their job descriptions.


A procedure manual has been developed to address this finding. The manual will be submitted to the policy task team in the beginning of 2013 for review..

58. Inadequate design and non-compliance regarding user access controls for the Oracle E-Business Suite application environment. IT management had inadequately designed user access controls (policies, procedures, guidelines) to mitigate the risk of unauthorised access to the network and information systems. Informal controls were in place, but were inadequate. There was also noncompliance with controls designed by IT management to adequately mitigate key user access risks. If the controls for the user access control processes are inadequate, users might obtain access to system functions without proper approval, which might lead to employees having rights not related to their job descriptions.


A procedure manual has been developed to address this finding. The manual will be submitted to the policy task team in the beginning of 2013 for review.

37 37


STATUSCOMMENT

59. Lack of design regarding user access creation and removal controls on the Oracle E-Business Suite and Siebel applications. IT management had not formally designed user access controls (policies, procedures, guidelines) to mitigate the risk of unauthorized access to the network and information systems. Informal controls were in place, but were inadequate. On the Siebel and Oracle E-Business Suite application it was noted that the user account management processes such as new-user registrations, terminations of access, regular reviewing of access rights and changes to user profiles were not formalized. There is an increased risk is of unauthorized users gaining access to the Oracle E-Business Suite and the Siebel applications without going through the formal new users’ approval process. Furthermore, there is an increased risk of unauthorized access to the environment as user IDs belonging to users who left the organization or department can be targeted for malicious use by users with a reduced risk of discovery.


The external users have been removed.User access forms are already in use.The long term solution will be to delete the user however the user is currently linked to a number of concurrents that would adversely affect functionality if the user were to be deleted.

38 38


STATUSCOMMENT

60. Inadequate IT security controls designed for the Linux operating system environment. IT management had not formally designed security management controls (policies, procedures, guidelines) to mitigate the risk of unauthorised access to the network and information systems. Informal controls were in place, but were inadequate. As a result the following key financial risks were not addressed:•The privilege account “root” usage has not been logged and therefore no auditing has been enabled.•No independent formal review of audit logs is being performed on a periodic basis. Data transfer is in clear text (unsecure protocol running is “FTP”). .


Root logs are now abled but have not been reviewed. Review frequencies and responsibilities still to be assigned.A procedure manual has been developed to address this finding. The manual is in draft and will be submitted to the Policy Task Team for review. FTP (File Transfer Protocol) has been disabled, only using SFTP (Secure File Transfer Protocol).

61. Inadequate IT security controls designed for the Oracle E-Business Suite application environment. IT management had inadequately designed security management controls (policies, procedures, guidelines) to mitigate the risk of unauthorised access to the network and information systems. Informal controls were in place, but were inadequate. Therefore, noIndependent formal review of audit logs, generated from the Oracle E-Business Suite application environment, is being performed on a periodic basis. Without adequate security controls, unauthorised access to the organisation’s network and possibly IT systems can be gained, which could result in data integrity being compromised.


Review frequencies and responsibilities still to be assigned.A procedure manual has been developed to address this finding.

39 39


STATUSCOMMENT

62. Inadequate IT security controls designed for the Oracle database environment. IT management had not formally designed security management controls (policies, procedures, guidelines) to mitigate the risk of unauthorised access to the network and information systems. Informal controls were in place, but were inadequate. As a result the following key financial risks were not addressed:•Encryption has not been configured.•Connection strings, which provide privileged access to the Oracle database without the need of a password, were active.•The current Oracle security patch loaded (Release 11.1.0.7.0) on the database server is outdated. Parameters (listener) have been inappropriately configured. An unprotected listener could lead to the shutdown of the listener, denial-of-service and the database being compromised.


Encryption has been investigated and management has decided that it is not required in our environment.Release 11.1.0.7.0 is still supported by Oracle and patches are loaded based on Oracle recommendations, therefore an upgrade is not necessary.A procedure manual has been developed to address this finding. The manual is in draft and will be submitted to the Policy Task Team for review.

40 40


STATUSCOMMENT

63. Non-compliance to change management controls designed. There was non-compliance with controls designed by IT management to adequately mitigate key financial risks. As a result, the following were not implemented:Six out of the 30 change management request forms selected for testing, could not be provided.No version control is used to control the migration of source code from development to production.There is an increased risk of unauthorised or erroneous changes being made to the Oracle E-Business Suite and Siebel application. Furthermore, these unauthorised changes may have a negative impact on the transaction processing environments.

Short Term Unresolved Procedure will be enforced.

41 41

Irregular ExpenditureWASTEFUL EXPENDITURECondoned by Council 2012 2013

Nature Amount DivisionResponsible

ManagerAction Taken

Completion Date

Effect on the Current financial year

Interest paid to suppliers 575 Finance N/A

IRREGULAR EXPENDITURECondoned By Council


ManagerAction Taken

Completion Date


Rebahale Consulting (Pty) Ltd 5 411 627 AuditChief Audit Executicve

Contract Terminated Arbitratration

A Provision for R 1.8 million raised as well as a contigent liability of R 20 million

Council appointed a task team to review the appointment of Rebahale Consulting (Pty) Ltd, and a quality assurance review was performed by the Institute of Internal Auditors on the work done by Rebahale Consulting (Pty) Limited. The reports from the Institute of Internal Auditors and the Task team were presented to Council and the Service Level Agreement with Rebahale was terminated. The appointment of Rebahale was considered irregular due to a conflict of interest during tender evaluation.

42 42

Irregular Expenditure

Condoned By Council 2012 2013

Nature Amount DivisionResponsinle

ManagerAction Taken

Completion Date


Non Subsidy Inspectorate appointments 47 732 066 CEO CEO

Council Resolution 31 May 2013

Expenditure will be reported in the current financial year(Dec R 24 million)

Hydrotek International 17 273 848 TechnicalExecutive Manager None taken 31 March 2013

Expenditure will be reported in the current financial year

(Dec R 3.4 million)The period for the advertising of this tender did not comply with the Treasury Regulations, which require a period of 21 days. Subsequent tenders have been advertised in line with the Treasury Regulations.

Inspectorate Tender was advertised for a period of one year, on award of the tender the contracts were extended to a period of three years. This was in contravention of the SCM policy.

43 43

Irregular Expenditure

Not Condoned by Council 2012 2013


ManagerAction Taken

Completion Date


Ms V Somiah 1 300 000 CEO CEO

Empoyment contract

terminated Complete None

Rectification and Forensics appointments 129 586 693 Technical CEO

CEO Dismissed 31 May 2012

Expenditure will be reported in the current financial year

(Dec R 112 million)

The appointment of Ms Somiah was irregular, the appointment was not within the Delegated Authority of the CEO.

The appointment of the Forensics companies contravened the procurement policy, the appointments were above the delegated Authority of the CEO.

44

THANK YOU

PRESENTATION TO PARLIAMENTARY PORTFOLIO COMMITTEE A-G AUDIT FINDINGS

Documents

Transcript of PRESENTATION TO PARLIAMENTARY PORTFOLIO COMMITTEE A-G AUDIT FINDINGS