Security management ensures that The internal control 8 The company will The Senior 31/03/14 security controls are implemented deficiencies identified were implement formalised Manager: to prevent unauthorised access to categorised as (Financial policy for documenting the Information the network and information and performance OS changes the purchase Systems systems that generate the management: Design and would be formally information used to prepare the implement formal controls documented and testing financial statements over IT systems to ensure evidence and approval be reliability of the systems and retained as part of the Key audit findings identified: the availability, accuracy and process. protection of information) Network patch management was deficiency and could be reviewed and the following ascribed to the following: weaknesses were noted: WSUS system Although patches were does not provide a performed, however WSUS, proper audit trail of does not clearly generate all patches reports, of patches pushed performed, due to through for the period under limitation on the review. system. Without formal testing and approval to validate that only approved patches are implemented is a risk that unauthorised patches or upgrades are applied to the entity’s infrastructure which can adversely impact the functioning and integrity of data User access control is the The internal control 9 Management will ensure The Senior 31/05/14 systematic process of managing deficiencies identified were that the implementation of Manager: the access of users to an categorised as (Financial the user starter forms for Information application. The process includes and performance SPS are adequately and Systems the creation, review, disabling and management: Design and effectively implemented as removal of user accounts. implement formal controls designed. over IT systems to ensure Key audit findings identified: reliability of the systems and the availability, accuracy and Evidence of user starter protection of information) forms could not be obtained deficiency and be for certain users that were ascribed to the following: selected for testing on the Selling Processing system Non-adherence (SPS). This could result to and implementation of unauthorised users being new user creation created on the system without control processes by formal process and this might system owners and
8 Security management ensures that security controls are implemented to prevent unauthorised access to the network and information systems that generate the information used to prepare the financial statements Key audit findings identified: Network patch management was reviewed and the following weaknesses were noted: Although patches were performed, however WSUS, does not clearly generate reports, of patches pushed through for the period under review. Without formal testing and approval to validate that only approved patches are implemented is a risk that unauthorised patches or upgrades are applied to the entity’s infrastructure which can adversely impact the functioning and integrity of data The internal control deficiencies identified were categorised as (Financial and performance management: Design and implement formal controls over IT systems to ensure reliability of the systems and the availability, accuracy and protection of information) deficiency and could be ascribed to the following: WSUS system does not provide a proper audit trail of all patches performed, due to limitation on the system. The company will implement formalised policy for documenting the OS changes the purchase would be formally documented and testing evidence and approval be retained as part of the process. The Senior Manager: Information Systems 31/03/14 9 User access control is the systematic process of managing the access of users to an application. The process includes the creation, review, disabling and removal of user accounts. Key audit findings identified: Evidence of user starter forms could not be obtained for certain users that were selected for testing on the Selling Processing system (SPS). This could result to unauthorised users being created on the system without formal process and this might The internal control deficiencies identified were categorised as (Financial and performance management: Design and implement formal controls over IT systems to ensure reliability of the systems and the availability, accuracy and protection of information) deficiency and be ascribed to the following: Non-adherence and implementation of new user creation control processes by system owners and Management will ensure that the implementation of the user starter forms for SPS are adequately and effectively implemented as designed. The Senior Manager: Information Systems 31/05/14
Mid-Year%20Report%202014-02-24.docx