increase the risk of user departments. IT unauthorised access. department also is no formal process responded to informal for registering new users, communication for user removing access for access requests for terminated users in the new users, this resulted system and for reviewing the in some users not activities of the system completing user starter administrator for the Payday forms. system. Inadequate user Payday has account management Manager: traditionally not been practices increases the risk of Payroll administered by the IT users with unauthorised Manager department. However access rights going full IT policies and undetected. This could result procedures need to be in unauthorised additions, followed in all systems modifications, and deletions deployed. of transactions and other data of significance to the entity. The Payday Furthermore, the system is a packaged following password controls system acquired from relating Payday system had the vendor, the not been defined in the challenge is that system: password security settings cannot be Minimum password changed as the system length; was bought off the Password complexity shelve as is (limitation on the system Number of incorrect functionality). attempts before a user is locked out and how this is reset; Without adequate controls on the application systems, there is a risk of unauthorised access to the Payday application systems, which may lead to unauthorised data manipulation. IT service continuity is the process The internal control IT management will ensure 10 The Senior 28/02/14 of managing the availability of deficiencies identified were that backup and recovery Manager: hardware, system software, categorised as (Financial procedure document is Information application software and data to and performance reviewed to ensure that Systems enable an organisation to management: Design and adequate back up recover/re-establish information implement formal controls processed are catered for, systems services in the of a over IT systems to ensure and outline a process of disaster. The process includes IT reliability of the systems and
increase the risk of unauthorised access. is no formal process for registering new users, removing access for terminated users in the system and for reviewing the activities of the system administrator for the Payday system. Inadequate user account management practices increases the risk of users with unauthorised access rights going undetected. This could result in unauthorised additions, modifications, and deletions of transactions and other data of significance to the entity. Furthermore, the following password controls relating Payday system had not been defined in the system: Minimum password length; Password complexity Number of incorrect attempts before a user is locked out and how this is reset; Without adequate controls on the application systems, there is a risk of unauthorised access to the Payday application systems, which may lead to unauthorised data manipulation. user departments. IT department also responded to informal communication for user access requests for new users, this resulted in some users not completing user starter forms. Payday has traditionally not been administered by the IT department. However full IT policies and procedures need to be followed in all systems deployed. The Payday system is a packaged system acquired from the vendor, the challenge is that password security settings cannot be changed as the system was bought off the shelve as is (limitation on the system functionality). Manager: Payroll Manager 10 IT service continuity is the process of managing the availability of hardware, system software, application software and data to enable an organisation to recover/re-establish information systems services in the of a disaster. The process includes IT The internal control deficiencies identified were categorised as (Financial and performance management: Design and implement formal controls over IT systems to ensure reliability of the systems and IT management will ensure that backup and recovery procedure document is reviewed to ensure that adequate back up processed are catered for, and outline a process of The Senior Manager: Information Systems 28/02/14
Mid-Year%20Report%202014-02-24.docx