2011-12

Root cause
• IT management considered the proactive review of logs as a labour-intensive exercise, given the high number of users to whom access had been granted
to the network and applications and the volume of logs generated by the system.
3.4.4.2. District and local municipalities
At most district and local municipalities IT security policies had not been adequately designed. Most municipalities did not have mechanisms in place for
reviewing security violations or failed logon attempts. Consequently, security breaches on the network or application systems might not be detected. Although
no instances of unauthorised access were identified at municipalities, appropriate IT controls should be implemented to prevent this risk from materialising in
future.
Root causes
• Municipalities that lacked IT resources relied on third-party service providers to maintain the IT security infrastructure and consequently did not have staff
with sufficient capacity or technical skills to review security logs.
• There were no processes in place for transferring IT knowledge and skills from third-party service providers to internal resources at municipalities.
• IT resources at some municipalities did not have sufficient knowledge regarding password security parameters and relied on prior-year audit findings to
provide guidance.
• IT resources at municipalities focused on day-to-day operations and considered the proactive reviewing of security reports to be a labour-intensive, lowpriority
task.
Good practices
No weaknesses were identified in the management of IT security at the Eden District, Knysna and Overstrand Municipalities. This could be attributed to the
leadership demonstrated by the IT manager, hands-on management and efficient use of available IT resources.
3.4.5 User access management
User access controls are measures designed by management to prevent and detect the risk of unauthorised access, creation or amendment of financial and
performance information stored in the application system. This responsibility normally resides within core and supporting business units. User access
management controls at the municipalities were evaluated in terms of their status in relation to the IT control life cycle, namely design, implementation and
operating effectiveness. Outcomes are shown below:
Figure 16: User access audit outcomes – municipalities
91