State IT Agency Briefing on Quarterly Performance to Parliamentary Portfolio Committee on Telecommunications and Postal Services 17 March 2014

Contents 2 1.Overview 2. Summary Performance 3. Financial Performance 4. Resolution of findings raised by the Auditor General 6. Questions 5. Conclusion

Overview 3 SITA has developed a transformation strategy to make the agency work Accountability and good governance are at the core of SITA’s operations The organisation continues to align its objectives with the priorities of the Department of Telecommunications and Postal Services (DTPS) as well as the National Development Plan agenda SITA’s continues to strive to improve the service delivered to customers so that the business grows and ultimately delivers value for government Transforming, updating, and modernising our procurement process is key SITA’s performance measures are crafted from the fundamental pillars of the SITA strategy namely: Customer centricity Improve core IT services with a strong focus on eGovernment and Security Improve organisational health E-GovernmentSecurity Core IT Services Procurement Organisation

Summary of Performance as at 31 December achieved 40 Partially achieved  32 not achieved  Numerous interventions and corrective actions have been identified and were implemented to ensure favourable performance in the current financial year. 4

Overall Organisational Performance (3 rd Quarter 2014/15) 5

Revised APP The strategic objectives are unchanged The measures have been reduced from 40 to 14 The organisation is now focused on impactful measures Implementation is happening during this last quarter of 2014/15 The fourth quarter report 2014/15 will be informed by these changes 6

Financial Performance 7

Resolution of findings raised by the Auditor General There were a total of 55 Audit Findings (Management Letter Points (MLPs)) reported in the 2013/2014 Auditors-General’s report. Upon receipt of the Auditor-General’s report in August 2014, the Audit, Risk and Compliance Committee Chairperson convened a workshop with all Executives to discuss the resolution of the MLPs. During the meeting, the root causes for the findings as well action plans and implementation dates were identified with the view of addressing and preventing a repeat of the findings. Monitoring and verification of the resolution of the MLPs is carried out by Internal Audit, which reports functionally to the Audit, Risk and Compliance Committee. The monitoring of the status of MLPs is automated and all Lines of Business have access to the system. 8

Resolution of findings raised by the Auditor General Lines of Business have identified process owners and MLP Liaison officers for each division to ensure that action plans identified are implemented. Progress on the status of implementation of the MLPs are reported monthly to EXCO and regularly to the Audit, Risk and Compliance Committee and Board (as a Standing Item on the agenda). The resolution of the Auditor-General MLPs form part SITA’s Corporate Balanced Scorecard for 2014/2015 (under the Governance and Administration Perspective). As at the end of February 2015, 45 findings have been resolved representing 82% of the 2013/2014 MLPs. The remaining 10 MLPs have implementation dates for March

Status of specific matters raised by the Auditor-General as reported to the Portfolio Committee on 17 October 2014 Business AreaAuditor-General FindingAction Plan Corporate Performance Predetermined Objectives: a) The annual performance report included information on performance against predetermined objectives that was not reliable (i.e. valid, accurate & complete). For the 2014/2015 financial year, the Corporate Performance, Monitoring and Evaluation division have put in place monitoring and verification measures, to ensure that all reported performance information is supported by valid, accurate and complete evidence. b) The entity submitted an annual performance report for audit that contained material misstatements. The Internal Audit division performs independent verification of the validity, accuracy and completeness of the reported information. Supply Chain Management a) Transactions above the value of R500K were procured without inviting competitive bids. SCM Managers and Adjudication Committee(s) monitor and reject transactions in violation of the relevant governance policy. b) Deviations approved by the accounting authority even though it was not impractical to invite competitive bids. (i)A contract tracking system with an expiry notification function and the contract management framework has been developed. SCM staff proactively alert Lines of Business of contracts expiring. (ii)The revised SCM Policy addresses the challenge where end users abuse the emergency procurement process. (iii)The Chief Procurement Officer enforces compliance by not approving cases that are related to poor planning. c) Persons in service of the entity with private business interest failed to disclose interest. (i)Executives have been engaged through the CEO to ensure declarations are submitted for all employees under their responsibility. (ii)Reconciliations between declarations received by Human Capital and Company Secretariat are currently being conducted. d) Contracts awarded to bidders who failed to submit declarations as to whether they were employed by the state and/or past supply chain management practices. Sole suppliers are now required to sign the applicable SBDs (declarations). 10

Status of specific matters raised by the Auditor-General as reported to the Portfolio Committee on 17 October 2014 Business AreaAuditor-General FindingAction Plan Supply Chain Management Irregular Expenditure: a) Procurement procedures not followed.(i)The revised SITA Procurement Policy was approved by the Board for implementation 1 April (ii)Addressed through the establishment of Contract Management and Compliance functions within SCM. A newly developed SITA Contract Management Framework has also been developed and approved to ensure appropriate and effective contract management processes, together with the strengthening of compliance process within the SCM environment. (iii)A contract tracking system with an expiry notification function and the contract management framework has been developed. SCM staff proactively alert Lines of Business of contracts expiring. Information Technology a) Lack of review of user access management procedures. (i)Short-Term: User Access Control policy reviewed. (ii)Governance Minder solution implemented. (iii)System Centre policy and procedure reviewed. (iv) Dormant user accounts policy and procedure reviewed. (v) End dated inactive support staff account. (vi) Long-Term: Outstanding items to be addressed as part of the ERP frame contract support being procured from Oracle: - Form personalisation. - DBA roles configuration. b) Lack of formal patch management processes. (i)Short-Term: Patch management changes are submitted to the Change Authority Board and approved according to "User Requirement Specification for The Change Management Approval chain for Internal IT - MS Patch Updates". (ii)Long-Term: Process initiated to formalise patch management process. Meeting completed with stakeholders. Draft process document to be finalised and work shopped with stakeholders. c) Lack of adequate IT and business continuity arrangements. (i)Infrastructure for Disaster Recovery (DR) 33site has been ordered. Installation planning in process. (ii)Long-Term: DR project initiated by Hosting. Pending infrastructure procurement. 11

Status of specific matters raised by the Auditor-General as reported to the Portfolio Committee on 17 October 2014 Business AreaAuditor-General FindingAction Plan Finance a) Significant underspend of CAPEX for the past 6 years despite aging infrastructure. The high rate of tender cancellations contributed to the underspending of CAPEX. A new revised Procurement Policy was approved to address these challenges. b) Debt not collected within reasonable period.(i)The Accounts Receivable and Debt Management Policy was revised to implement improvement, and has been approved. (ii)Standard Escalation Letters of outstanding debt are in the process of being sent to Accounting Officers. 12

13 Conclusion Retaining our customers and rebuilding trust amongst SITA’s customer base remains a key objective for the agency. SITA ‘s core services need improvement, the infrastructure needs refreshing to ensure that government’s data is securely stored. SITA is addressing procurement processes and segmenting procurement in a way that allows the agency to respond better, faster and with transparency. SITA’s aspiration is to be the lead ICT agency for government hence the focused drive on addressing cultural issues, accountability, motivation, control and coordination. Of the 1127 employees previously reported as displaced only 16 have not been placed and their matters will be resolved by end March A more focused and condensed balance scorecard ensures that SITA’s focus on improving performance is more achievable

Thank You