Status as reported by ITU Comments received from Status on actions Comments received from Report Recommendation raised Management related to Swiss ITU Management related to by Management as evaluated Secretary-General at the time By Swiss Auditors Auditors’ report previous Italian of Auditors’ by Italian of the issuance of the Swiss Report Court of Audit report Inadequate management of The Enterprise Resource We were informed that the cost IS submitted a proposal to the Implemented IT of a software application for the task separation (SAP SRM) Planning Division has ICT Committee to fund the 2011 management of “governance, I recommend that ITU's already redefined, as a procurement of GRC software Rec. 4 risk and compliance” (GRC) business managers identify first step, the roles of and the implementation can go up to 500’000 CHF. We sensitive access rights and existing SAP users. It services. The fund request are also aware that strict and possible task-separation agrees with the External was not accepted. accurate procedures in the conflicts, so that the IS Auditor that an SAP A new SAP Access Access Authorization process teams can subsequently solution for the Authorizations process has implemented in April of 2012, identify particularly risky management of been put in place (since April manually operated (i.e. with access rights at the technical governance, risk and 2012) that should mitigate decisions double-checked on level and adjust the compliance (GRC) would access risks. paper) is intended to obtain corresponding SAP profiles. be useful for the good results in separation of This process is available for tasks. Our opinion is that this management of access review by the external recommendation, since the rights and for addressing auditors in to consider Management chose to work conflicts and risks this recommendation as around it for economic reasons, associated with the implemented. has not been completely separation of tasks. The IS implemented. In our view Department will be Management should consider submitting to the ICT again the use of a software if its Committee a proposal for cost will lower in the future. investment in GRC software and services. Follow- up of suggestions in our previous report
Report Recommendation raised By Swiss Auditors Comments received from Secretary-General at the time of the issuance of the Swiss report Status as reported by ITU Management related to Swiss Auditors’ report Comments received from ITU Management related to previous Italian of Auditors’ Report Status on actions by Management as evaluated by Italian Court of Audit IT 2011 Rec. 4 Inadequate management of task separation (SAP SRM) I recommend that ITU's business managers identify sensitive access rights and possible task-separation conflicts, so that the IS teams can subsequently identify particularly risky access rights at the technical level and adjust the corresponding SAP profiles. The Enterprise Resource Planning Division has already redefined, as a first step, the roles of existing SAP users. It agrees with the External Auditor that an SAP solution for the management of governance, risk and compliance (GRC) would be useful for the management of access rights and for addressing conflicts and risks associated with the separation of tasks. The IS Department will be submitting to the ICT Committee a proposal for investment in GRC software and services. We were informed that the cost of a software application for the management of “governance, risk and compliance” (GRC) can go up to 500’000 CHF. We are also aware that strict and accurate procedures in the Access Authorization process implemented in April of 2012, manually operated (i.e. with decisions double-checked on paper) is intended to obtain good results in separation of tasks. Our opinion is that this recommendation, since the Management chose to work around it for economic reasons, has not been completely implemented. In our view Management should consider again the use of a software if its cost will lower in the future. IS submitted a proposal to the ICT Committee to fund the procurement of GRC software and the implementation services. The fund request was not accepted. A new SAP Access Authorizations process has been put in place (since April 2012) that should mitigate access risks. This process is available for review by the external auditors in to consider this recommendation as implemented. Implemented Follow- up of suggestions in our previous report
S14-CL-C-0105!R1!MSW-E.docx