3rd QUARTER RISK MANAGEMENT REPORT TO THE AUDIT

STRATEGIC RISKRISK CONSEQUENCE4. Inadequate ICTInfrastructure & Systems- Fruitless, Wasteful & irregularexpenditure-Adverse Audit opinion-Possible litigation-Poor service deliveryMITIGATION PLAN(S)/CONTROLSPROGRESS ONMITIGATION PLANS-Review & finalization of the costedICT strategy- ICT GovernanceFramework of theDepartment is underdevelopment stage (work inprogress).- Systems are tested on a - Continue system testingquarterly basis for service on a quarterly basiscontinuity-Monitor implementation of the ICTstrategy-Testing of systems for servicecontinuitystACTION PLAN5. Reputational Risks-poor public image-Lack of public confidence-Delays & reversal in women'ssocio economic empowermentand societal transformation-gender equality-Monitor implementation of thecommunication strategy-Quality assurance standards forpublications-Standard operating proceduresmanual- 1 phase of theCommunication Strategy,viz. the annualcommunication planimplemented- Communication Strategyis being implemented inphases6. Fraud, Corruption &Misconduct-Misappropriation and abuse ofassets/power- Adverse Audit opinion-Irregular ,fruitless and wastefulexpenditure-Reputation risk-Training and awareness onpolicies & procedures- Ethics training has beenconducted with all staff- To conduct fraud andethics managementawareness sessions on thefourth quarter.-Poor service delivery-HRD based on classification of the List of improvedrequired skillsqualifications was-Monitoring the implementation ofsubmitted to DPSA forthe recruitment, selection process7. Inadequate capacity(Human & Skill)- Fraud Prevention Policy15/16 and FraudPrevention Plan 15/16developed and approvedAwareness on key policieson SCM and Finance to beconducted in the fourthquarter.Page 14 of 51

STRATEGIC RISKRISK CONSEQUENCEMITIGATION PLAN(S)/CONTROLSPROGRESS ONMITIGATION PLANS- Monitoring the implementation ofthe PDP'sconcurrence in SeptemberACTION PLAN- Workplace skills plan wasdeveloped and submittedto PSETA in April2016.Quarterly reports aresubmitted to PSETA on aquarterly basis.Page 15 of 51

5. 3rd quarter Progress on Implementation of Risk MitigationPlans per Programme.Programme1 consists of 10 units/directorates which are: Strategic Planning and ReportingInternal Operations EfficiencyInternal AuditFinancial ManagementHuman Resources ManagementInformation Communication and TechnologyLegal ServicesAuxiliary Services, Security Services and Records Management.Programme 1 had 48 risk mitigation plans that were due for reporting in the thirdquarter. Out of the 48 mitigation plans 36 are fully implemented, which translates into75%, and 12 are partially implemented/still work in progress of which translates into25%.Commentary Note: Substantial progress has been made towards implementing all risk mitigationplans.Page 16 of 51

PROGRAMME 1: evedPartially AchievedNot AchievedPage 17 of 51

Below is the progress against each risk mitigation action for Programme 1:ROOT CAUSESUNITRISKStrategicPlanning andReportingStrategicobjective ofeachbusiness unitor programmemay not bealigned to thevision andmandate ofthedepartmentStrategicPlanning andReportingInadequateandmisalignedreporting ofperformanceCURRENT CONTROLS'-Programme may put'- Integrated strategic planning ofstrategic objectives that the departmentare convenient to them- Lack of understanding of - Consultation with Programmesthe department's mandate to make sure that there is an- Ignoring the broaderalignmentdepartmental strategicobjectives- Insufficient situational- Strategic documents areanalysis by Programme presented to managementstructures before approvalMITIGATIONPLAN(S)/CONTROLS- Conduct integratedplanningPROGRESS ONMITIGATIONPLANSIntegrated planningis a continuousprocess until thefinalisation of thestrategic planningThis is a processthat is integrated inthe whole strategicplanning- Monitor quarterlyreports for alignmentwith thedepartmentalstrategic objectives-Quarterly reportspresented at EXCOQuarterly reportsmonitored foralignment'- Lack of branch meetings - Standardised reporting template - To issue nonto discuss quarterly- Performance management policy compliance letters toperformance reportsDDG's and Heads ofUnit for non-CORRECTIVEACTIONContinue with theprocess until thefinalisation ofstrategic planningprocess.This is going to bea continuousprocessQuarterly reports at This is going to bepresented at EXCO done quarterlyBranches and Units This is going to besubmitted on time done when nonhowever , it wascompliance isreturned back tonoted.address somePage 18 of 51

UNITinformationsubmitted bybranchesInternalOperationsEfficiencyROOT CAUSESCURRENT CONTROLSincomplete quarterlyreports- Submission in a form ofmalicious compliance-Non-compliance of duedatesin place- Circular for operationalprocedure for reporting- Quality assurance and internalaudit report- Non- compliance report issuedfor programmes- Reports and evidence files aresigned off by DDGs and HeadsRISKInadequatemonitoringandcompliancewith MPAT-Non-compliance with theManagementPerformance AssessmentTool (MPAT)- Poor planning andmanagement of MPATProcessesLack of quality assuranceon evidence submitted byrelevant managers- Lack of on-goingmonitoring on theimprovement plan byrelevant managers- MPAT Key Performance Arrearscoordinators appointed- MPAT improvement plandeveloped and monitored on aquarterly basis-MPAT share folder created to fileevidence-MPAT checklist ESS ONMITIGATIONPLANScomments fromSMUCORRECTIVEACTION- Branches to submit Branches submitThis is going to beanalysis reportquarterly reportsa continuousand StrategicprocessManagementthroughout thedevelops anquartersanalysis report on aquarterly basis- MPAT reporting to MPAT status report This is going to bebe done on adeveloped anddone on aquarterly basissigned off by thequarterly basis.Director-GeneralMonthly MPATprogress meetingMPAT progressmeeting held on amonthly basisMonitoring of MPATevidence on theshare folderMPAT evidencefiled with DPME onthe 30 September2016There would be acontinuousmonitoring andverification of theevidence.Page 19 of 51

UNITRISKInternalOperationsEfficiencyInability toinstitutionaliseriskmanagementROOT CAUSESCURRENT CONTROLSMITIGATIONPLAN(S)/CONTROLS- Lack of risk governancestructures- Lack of riskunderstanding by brachesand business units- Risk management maynot be integrated intostrategic managementprocesses- Lack of monitoring forrisk mitigation action- Risk Mitigation CommitteeMembers appointed- Risk Management Framework inplace- Operational Risk workshopsconducted- Risk mitigation quarter progressreport developed- Quarterly reportson risk mitigationaction- Risk MitigationCommittee to meetevery quarterPROGRESS ONMITIGATIONPLANSFurther moreevidence wasloaded on theMPAT system on20 October 2016.This wasdelegations interms of the PublicServiceRegulations whichwere signed offafter 30 September20163rdquarter reportdeveloped andpresented to theAudit and RiskCommitteeCORRECTIVEACTIONThe fourth quarterreport is going tobe developed andpresented to theAudit and RiskCommitteescheduled to takeplace in April.Risk MitigationThe next meetingCommittee met on is going to takerdthe 3 of February place in March2017before the end ofthis financial year.Page 20 of 51

ROOT CAUSESUNITRISKInternal AuditFailure tocompleteInternal AuditplansInternal AuditLack ofindependenceand objectivityinperformanceof audit workCURRENT CONTROLSMITIGATIONPLAN(S)/CONTROLS- Insufficient human- Resourced planning of theThe Office of theresourcesinternal audit activitiesAccountant-General- Lack sufficient skills to - The Department entered intowill periodicallyperform audit workagreement with National Treasury second an official to- Ad hoc internal auditto provide internal audit support to provide internal auditassignment fromthe internal audit activity of thesupport to themanagement and theDepartmentDirectorate: InternalAudit and Risk Committee - Audit and Risk Committee toAuditassess the resource requirementsof the Directorate: internal auditand recommend appropriate staffcomposition to Management of theDepartment'- Audit scope limitation- Internal Audit Charter- Interference with audit - Internal Audit activity overseenworkby the Audit and Risk Committee- Inadequate internal audit - Dedicated internal audit budgetauthority- Internal Audit Plans are- Status of internal audit in endorsed by MANCO andthe Department'sapproved by the Audit and RiskPROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSNational Treasury Continue to workprovides Internalwith NationalAudit Support to the Treasury as andDepartment’swhen necessaryInternal Auditfunction as whennecessary.The Directorate:Internal Audit willestablishcollaboration withinternal auditfunctions of othergovernmentdepartments andentities to share andtransfers of skills.During the thirdThe Directoratethere was nowill havecollaborationscollaborations withformed between the IA functions ofDepartment’sother departmentsinternal auditas an when thefunction andneed arises.internal auditfunctions of othergovernmentdepartments andentities.Review InternalAudit CharterannuallyInternal AuditThis will continueCharter was tabled, as required.discussed andapproved by theARC in the ARCmeeting held on the27 October 2016.Page 21 of 51

ROOT Governancelegislations : Sec 38 Sec 39 –BudgetResponsibilities Sec 40 ReportingResponsibilitiesCURRENT CONTROLSMITIGATIONPLAN(S)/CONTROLSorganisational structure CommitteeQuarterly Reporting- Internal Audit plans that - Internal Audit dual reporting lines to the Audit and Riskare not informed by theto the Director-General and theCommitteerisk assessment results Audit and Risk Committee- Annual Departmental RiskReportPresentation ofInternal Audit Plansto MANCO and theAudit and RiskCommitteePROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSQuarterly Internal This is going toAudit Reports are continue aspresented atplanned.MANCO, EXCOand AuditCommitteeInternal Audit Plans This process iswere presented and going to continueaccepted byannually until theMANCO. Theyfinal approval.were alsopresented anddiscussed andsubsequentlyapproved by theAudit and RiskCommittee- Inadequate alignment of -SCM and financial delegations infinancial and SCM policies placeand procedures- Financial instructions issued to-Non-payment of suppliers officialswithin the prescribed 30 - Financial Policies are in placedays period- Awareness creation.-Circumvention of SCM - Strengthening of financialand financial policiescontrols- Unauthorised- Asset register in maintained onexpenditureexcel- Irregular expenditure- Enforcing controls on movement- Lack of understanding of assetsfrom officials in theEnforcing ofprocurementprocesses hasbeen done toeliminate irregularexpenditure.SCM policy havebeen drafted,approved andimplementedSCM circular hasbeen issued onAbuse of SCMprocessesConsequencemanagement-Strengthening ofawareness andenforcing SCMpolicies andprocedures- Implementation ofconsequenceContinuousmonitoring ofPage 22 of 51

ROOT CAUSESUNITHumanResourceManagementCURRENT nual and annual physicalverification of asset register-Budget committee in plan-Continuous monitoring of thebudget- Training people tomigrate to LOGIS- Budget committeeto meet monthly andgo through budgetexpenditureMonthly BudgetThe monthlyCommittee in place, meetings tochaired by thecontinue asAccounting Officer scheduled.-Leave management policy-Leave administrators-Leave plan circular-Warning letters for late-Develop HRstandard operatingprocedures for theadministration ofleave.Draft HRM inprocess ofdevelopment andconsultationRISKdepartment- Late submissions ofrequired reports- Lack of policies andguidelines- Inadequate internalcontrols- Inadequate practices inmanagement of assets- Incomplete assetregister- Movement of assets notproperly control anddocumentedMismanagem -Lack of monitoring ofent of leaveleave trends and patternsby supervisors-Lack of monitoring thepersonnel attendancePROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSimplemented ondeviations will takepayments outside placeof 30 daysSCM staff attended noneLogis training sinceNov 2015 in phasesFinalise businessprocesses.- Submission for reappointment ofLeaveAdministratorssubmitted to DG forapproval.- Submission sentto the DG forapproval.Page 23 of 51

ROOT CAUSESUNITRISKCURRENT CONTROLSMITIGATIONPLAN(S)/CONTROLSPROGRESS ONCORRECTIVEMITIGATIONACTIONPLANS- A communiquéapproved by theDG was circulatedto employees forsubmission ofannual leave plans.- Circulated to allstaff- A standardwarning letter wasdeveloped toaddress noncompliance.On-going as theneed arisesStandard letter fornon-compliancedeveloped, signedby DG/CD: CM andgiven to respectiveemployees/supervisor- Annual leave plancircular alreadycirculated to all staffPage 24 of 51

UNITHumanResourceManagementROOT CAUSESCURRENT CONTROLSregister by supervisors-Late and non-submissionof leave forms-Non-compilation ofannual leave plan and/oradherence to annualleave plan-Lack of leave verificationand reconciliation-Absenteeism, latecoming and early leavingby staff-Late capturing of leave-Lack of departmentalskills development plan-Employees' nonavailability or nonattendance of scheduledsubmission of leave forms-Manual Register andreconciliation of leave forms-Attendance registers-Attachment of the leave creditsavailableRISKLack e managementof bursary scheme-Dedicated training budget-Skills audit agement fornon-compliantemployeesPROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSStandard letter for On-going as thenon-complianceneed arisesdeveloped, signedby DG/CD: CM andgiven to respectiveemployees/supervisorQuarterly trainingreportQuarterly training On-going as thereport submitted to need arisesPSETA on 07October 2016-Nomination forms tohold employeesaccountable for nonattendance oftrainingNomination forms Nonecontain declarationby employees tocomply withrequirements,failure which theywill be held liablefor the paymentcoursesDraft HRMSOP for thebusiness processes management ofin process ofbursaries will bedevelopment and finalised during theconsultationfirst quarter of thenext financial yearDevelop SOPs forthe management ofbursariesPage 25 of 51

ROOT rformancemanagementof and selectionprocesses tofill fundedvacanciesICTLack of ICTsecurityCURRENT CONTROLS-Late/non-submission of '-PMDS policy and SMSperformance work plans Handbookand agreements-Circular on implementation of-Lack ofsystemunderstanding/commitme -Workshops provided onnt of PMDS policies and implementation of systemprocedures by managers, -Progress reported tosupervisors andEXCO/MANCOemployees-Moderating Committees-Performance agreementsand work plans notaligned to the AnnualPerformance Plan-Late/non-submission ofprescribed performanceassessments-Late/non-submission ofprescribed performancemoderations-Inadequate interventionsfor poor performance-Jobs not profiled and-Recruitment and Selection policyevaluated prior to-1 contract workeradvertisement of posts-1 employee temporarily from-Limited capacity toFacilitieshandle responses toapplications received-Limited capacity tomanage recruitment andselection volumes-Delayed securityscreening of qualifyingcandidates-Lack of policy on ICT-Anti-virus contract with thesecurity to guide theexternal service provider in nt fornon-compliantemployeesPROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSStandard letter for Nonenon-compliancedeveloped, signedby DG/CD: CM-Finalise jobdescriptions andevaluate all jobs88.0% of jobevaluated-MonitorimplementationProgress reportedin Q2 HR OversightReport-Approval of ICTsecurity policyMonthly meetingTo be presented toheld with Info Gaud the ICT SteeringFinalise jobdescriptions andevaluation processby the 31 March2017.Page 26 of 51

ROOT CAUSESUNITcontrolsICTCURRENT CONTROLSRISK'Disruption ofICT servicesimplementation of the-Reporting of the monitoring ofcontrolssecurity activities conducted-Lack of monitoring of the fortnightlyimplementation of the ICT -ICT policy draft implementedsecurity controls-ICT security infrastructure in- Exposure to logicalplaceattacks such as malwareand viruses-Breach of IT contractualcompliance with IT serviceproviders-Logical access rightstrespassing by users orunauthorized persons onactive directory--Exposure of sensitive orconfidential informationdue to medialoss/disclosure tounauthorized persons-Limited or inadequate ITinfrastructure and systemsto effectively support thecurrent and future needsof the department in anefficient, cost-effectiveand well controlledmanner-Disclosure ofdepartment's informationto unauthorized persons'-Loss of IT services due '-Monitoring tool in place toto Interrupted/ failure ofmonitor the serversutilities performance.-Disaster recovery plan in place-Exposure to business-Disaster recovery site has beenMITIGATIONPLAN(S)/CONTROLSFinalise theimplementation ofdisaster recoveryPROGRESS ONCORRECTIVEMITIGATIONACTIONPLANSand SITA regarding Committee that isactivities andscheduled for thethsecurity access4 Quartercontrols. Theirprovision of reportis used todetermine theaccountability offunctions renderedwith respect to theagreed SLA.Register tophysically accessthe Server Roomexist. For internalpeople BiometricAccess ControlSystem is used.Remote access isprovided only upona singed andapproved SLA withthe department. Anoption of bringingDashboardssystems which areto be used to pullremote access logshas been discussedwith ServiceProvidersEngagement with SourcingSITA are inassistance fromprogress to assist in SITAoperationalizing thePage 27 of 51

UNITROOT CAUSESCURRENT CONTROLSand operationalinterruptions emanatingfrom loss of ITservices(down time)-Absence of a functionalDisaster Recovery Sitemay cause inability torecover critical systemsand applications in theevent of a disaster-Lack of backup policyimplementation andtesting-Lack of up to dateworking equipmentbuilt-Backups are running every dayand are being monitored-IT personnel that are able toattend to issues-ICT contracts with SITA tosupport with disruptionRISKMITIGATIONPLAN(S)/CONTROLSPROGRESS ONMITIGATIONPLANSDR SiteCORRECTIVEACTIONConduct testing onbackupsTest has beenconducted and ithas beendetermined that thesystems are notbacking up data,and restoring alsoposing somechallenges.Continuous testingto take place untilall the challengesare resolved.Page 28 of 51

UNITRISKICTLack ofalignment ofICT activitiesto thestrategicobjectives ofthedepartmentROOT CAUSESCURRENT CONTROL

Facilitate risk identification and assessment sessions and assessment of risk Approved Risk Registers:Strattegic and Operational Risk assessment sessions were conducted with all business units to facilitate the identification during the fourth quarter of 2015/16. Strategic Risk Assessment was conducted in Dec/Jan 2016