The IT Audit Finding That Keeps Appearing in South African Local Government and How to Prevent It

In the AGSA's 2022/23 local government audit outcomes, only 34 of South Africa's 257 municipalities received clean audit opinions. IT governance weaknesses, including inadequate IT general controls, poor access management and insufficient IT disaster recovery provisions, featured across the majority of qualified, adverse and disclaimed opinions.

The Auditor-General's annual local government audit outcomes are a document most South African municipal officials are very familiar with, and not happily. The findings that appear year after year are not new findings. They are the same findings, identified in the same municipalities and in new ones, repeated across financial years because the root causes are not structural enough to resolve without deliberate organisational change.

The IT findings are a specific subset of the overall audit findings, and they have a consistent character. They are not findings about technology failures. They are findings about governance: about the absence of controls, documentation and processes that the AGSA uses COBIT (Control Objectives for Information and Related Technology) to evaluate.

The category of finding that appears most consistently

The IT general controls (ITGCs) finding is the most common IT-related audit qualification in South African local government. ITGCs are the foundational controls over the IT environment that provide assurance that the financial data produced by IT systems is reliable.

The AGSA evaluates four categories of ITGCs: access management, programme change management, computer operations (including backup and recovery) and IT security.

The access management finding is the most common. It takes several specific forms: inappropriate access rights (users with system access that exceeds what their role requires, including in some cases former employees whose access was not revoked at termination); shared system credentials (multiple people using the same login, making it impossible to attribute actions in the system to specific individuals); and lack of privileged access review.

The programme change management finding involves changes made to financial systems without a formal change management process: no approval, no testing, no documentation of what was changed and why.

The backup and recovery finding involves either the absence of tested backup procedures or the absence of documentation that backups have been tested. A municipality that performs backups but cannot produce evidence that the backups have been restored successfully is in a worse position at audit time than a municipality with a tested and documented recovery process.

Why these findings persist

The findings persist because they require sustained governance discipline to resolve, and governance discipline is difficult to maintain in municipal environments characterised by staff turnover, capacity constraints and competing operational demands.

Access management requires a process: when a person's role changes or they leave the organisation, their system access must be reviewed and adjusted or revoked. In a municipality where the IT function is staffed by one or two people and is managing day-to-day operational demands simultaneously, the access review process may not happen until an audit flags it. Then it happens once, as a remediation measure, and the cycle repeats.

What sustainable resolution looks like

The difference between municipalities that resolve IT general control findings and those that do not is not usually a technology difference. It is a process formalisation difference.

Sustainable resolution of access management findings requires three things: a joiner/mover/leaver process that is integrated with HR and the IT function; a quarterly access review schedule that produces a documented record of what was reviewed, who approved it and what changes were made; and a system configuration that enforces the principle of least privilege.

Sustainable resolution of backup and recovery findings requires documented test procedures and a scheduled testing calendar, with results recorded, signed off by the IT manager and retained for audit purposes. The test needs to happen. The evidence that it happened needs to exist.

The B-BBEE credential in the municipal procurement context

For accounting officers and municipal managers selecting IT support providers: Sourceworx is a verified Level 1 B-BBEE contributor, the highest rating available under the B-BBEE codes. Under the Preferential Procurement Policy Framework Act, Level 1 suppliers deliver the maximum preference points available in any procurement scoring.

Speak to our public sector team about IT governance support for MFMA-compliant municipal environments.