MFMA 2019-20

SECTION 3: STATE OF LOCAL GOVERNMENT AUDIT OUTCOMES 55 The main contributing factors leading to failed IT security controls were the following: • Long-standing shortage of IT security skills. • Ageing/legacy IT infrastructure and lack of adequate investment in cyberdefence mechanisms. • Lack of network monitoring controls to detect issues in time. Countrywide, 75 municipalities (with a total IT spend of R3 730 million), including the eight metros where R2 754 million was spent on IT, had more complex environments that were highly dependent on information systems to process financial transactions and support core business operations. We tested software licences at these 75 municipalities and found that the City of Johannesburg Metro paid R95 million and the City of Ekurhuleni Metro paid R3 million for licences. However, licences worth R75 million at Johannesburg and R3 million at Ekurhuleni, were not used. We selected six projects valued at R1 053 million for auditing at two municipalities and four metros, and identified the following concerns: IT EXPENDITURE Status of IT expenditure at 67 municipalities and 8 metros System developments External service providers State Information Technology Agency services Software licences Infrastructure R3 730 million 5% (R195 m) 28% (R1 057 m) 25% (R941 m) 39% (R1 436 m) 3% (R102 m) • R600 million was spent by the City of Johannesburg Metro on a SAP upgrade. The project scope and budget were not well managed, which led to this project absorbing more money than the value it created. • R1 906 million was spent by the City of Ekurhuleni Metro on a Solar upgrade. As a consequence of not having well-defined criteria for deliverables, the metro spent R1 906 million from an original budget of R842 million. Although a lot of money is spent on IT, the necessary controls surrounding IT investment and IT governance are not always implemented to ensure the effective and efficient functioning of IT systems in local government.