The role of the RAF Internal Audit department is to provide employees, management and the board with an objective assurance that the risk management, control and governance processes are adequate and operate effectively to ensure the achievement of the objectives and goals of the Fund.

Internal audit is required in terms of the Public Finance Management Act, 1999, and its Treasury Regulations, to report to the Audit Committee of the Board. In accordance with the Internal Audit Charter as well as IIA standards the department reports functionally to the Audit Committee and administratively to the Chief Executive Officer. This report is intended to communicate the following:

• The adequacy and effectiveness of the risk management processes and the internal controls designed to mitigate these risks and therefore enable the achievement of the objectives of the organization.
• Internal audit findings or observations, for the financial period 2002/2003, that are considered material and significant and require the attention or intervention of the Chief Executive Officer (CEO), the RAF’s Audit Committee and/or the Board,.
• The RAF’s compliance with the Public Finance Management Act, and the Treasury Regulations; as well as good governance processes.
• The functioning of the internal audit department, which includes the departmental activities during the period October 2002 to March 2003, progress on the implementation of the annual audit plans 2002/2003 .
• Matters relating to the staffing and general management of the department.

Internal audit should report to the Audit Committee on a quarterly basis. The Internal Audit report for the quarter periods ended June 2002 and September 2002, was only tabled at the Audit Committee meeting held during October 2002. This report therefore, relates to the third and fourth quarters in the 2002/2003 financial periods, while it also serves as the annual internal audit report to the Audit Committee.

The Audit Committee adopted the draft Terms of Reference as well as the Internal Audit Charter at the Audit Committee meeting held on 29 July 2002. The documents were submitted to the Board for ratification, at the full Board meeting, held during September 2002.

According to the minutes of the meeting of the Board, the Board has approved both the Audit Committee’s Terms of Reference, as well as the Internal Audit Charter.

Corporate Governance is one of the Strategic Objectives of the organization. Corporate Governance can be defined, in the context of the RAF environment, as an approach to governance of the Fund that seeks to ensure safeguarding of public monies entrusted to its administration, the alignment of the interests of its various stakeholders, viz., the road accident victims, claimants, RAF Board, RAF Management, RAF staff, government, service providers to RAF as well as to the accident victims.

The RAF Board exists in terms of the Road Accident Fund Act, 1996. The Board has, in addition to the Audit Committee, several other Sub-Committees, namely:

• the Medical Committee
• the Remuneration Committee
• the Transformation, Empowerment and Procurement Committee
• The Board EXCO (RAF Act provision)

It is strongly recommended that Terms of Reference for each of the Board Committees should be documented and formalized. The terms of reference should, at least, cover the following:

• The overall purpose of the Committee
• Membership / Composition of the Committee
• The frequency of meetings
• The delegated authority and powers of the Committee
• The roles, functions and activities of the Committee
• Reporting to the Board, (including the format and content)

The membership of the Audit Committee has, in compliance with both King II and the PFMA Treasury Regulations, been beefed-up with three members who have financial skills including two qualified Chartered Accountants (CA’s).

• The delegation of authority from the level of Executive Management to Operational Management and the lower levels of employment, per the Approval Framework, is not complete.
• The implementation of this policy is not completed, since none of the RAF’s officials have been required to acknowledge in writing the authority that has been delegated to them. In addition, the decision making levels as entrenched in the policy are not yet in effect.

The Minister of Finance has amended the Treasury Regulations issued in terms of the PFMA, as per Government Gazette No. 23463 dated 25 May 2002.

Internal Audit has used a questionnaire (originally prepared by SCOPA), and incorporating the changes to the Treasury Regulations, to assess the RAF’s progress in complying with the PFMA and the amended Treasury Regulations. The questionnaire is attached as Annexure B.

In addition, internal audit covers compliance with the PFMA in its various audit projects, and reports accordingly.

Risk Management workshops / training sessions will be held with the various departments of the organization upon the Board’s approval of the risk management policy and procedures.

It had been envisaged that these would take place in the last quarter of the current financial period 2002/2003. The Risk Management policy however, has not been approved.

The Audit Committee is required to review the effectiveness of the systems of internal controls as implemented by Management, and report thereon to the RAF Board. Internal controls provide reasonable, not absolute assurance, that risk areas are properly managed.

The Summary of audit findings that are considered to be significant ongoing concerns is attached as Annexure A. These are audit findings:

• either carried forward from previous reports to the Audit Committee and may not have been addressed to date,
• or they are summaries from audit reports issued during the financial period,
• or they may be observations by internal audit.

Ideally, these should also have been discussed with the Chief Executive Officer, before the meeting of the Audit Committee in order to ensure that findings reported upon have been brought to his attention. However, the CEO has not been available for an extended period of time.

An Executive Summary of these findings follows in 3.2 (a) below.

The significant weaknesses mentioned below, remain to be of audit concern. In some instances, as will be reflected in the detailed audit findings as per Annexure A, Management will have given comments as to how they intend addressing this issues. There are various instances where there is little or no evidence that agreed upon action plans have actually been implemented in full.

The RAF’s Corporate/Strategic Plan for the new financial year 2003/2004, either has not been reviewed and updated, or the updated plan has not been communicated to Management. As a result, departmental business plans and the 2003/2004 budget may not be aligned to the overall business plan. Lack of strategic plan and therefore direction for the organization, has exposed the Fund to the risk of continuing with operations which have little or no impact on the sustainability of the organization.

The CEO may not be able to focus on the direct responsibilities of his office as he occupies two other Executive positions as Claims Executive and Chief Financial Officer. This may result in inappropriate or incorrect decisions, and/or failure to design and implement adequate, effective and efficient systems of internal controls, due to time constraints.

There are instances where areas of responsibilities have not been properly defined and documented. Human and Financial Resources may not be utilized economically and efficiently due to overlap of functions or duplication of work.

There is inadequate segregation of duties between the Procurement function and ICT Management in that the two departments are headed by one official. The manager is able to initiate, authorize, and process ICT expenditure and also evaluate tenders. The Information Communications Technology Department is one of the departments that has high budgeted procurement expenditure compared to other support departments

Authority levels have not been delegated to levels below Executive Management. There is no transparent and efficient system in operation over the process to award mandates in the Claims environment. Senior Management in the Claims Departments have unlimited mandates to settle claims. There is no evidence of monitoring controls in place.

The Executive Forensics Committee appointed as Senior Manager Forensics, Mr D Beea, who is founding member of, and at that time of his appointment the CEO of one of the companies that forensics investigation have been outsourced to (Ikanyeng). Mr Beea was suspended during this financial period for alleged irregularities. He was found not guilty at a disciplinary hearing.

The implementation of a new Salaries’ application system was abandoned due to disputes between the software vendors and RAF’s technology partner African Legend Technologies, as well as poor systems development and implementation procedures. When the system was abandoned the RAF had incurred costs in excess in R1m. There is no evidence of any legal recourse taken to address this matter.

An employee of the RAF’s technology partner, African Legend Technologies, who had access to the claims system live environment manipulated the payment process and misappropriated RAF’s funds, amounting to R38 8000.00. This risk was realized due to inadequate systems of internal control over the claims payments process as well as inadequate application controls.

A post implementation review of the new Citrix Server, installed at all RAF’s regional offices and head office, revealed the following user problems:

• Citrix server overload resulting in slow system response times;
• Printer errors;
• Time out connections;
• Loss of documents and
• Repeated hanging/freezing sessions.

These problems have a direct negative impact on the ability on daily operations and therefore the Fund’s service delivery.

The RAF does not have a formal approved ICT Security Policy. In addition, logical access controls are generally poor since programmers have access to the live environment, the claims system allows multiple access by a single user, employees share passwords, "special branch" functions are not properly restricted and monitored.

The Fund does not have a documented and tested disaster recovery plan in place. In addition, there is no remote / off-site back-up storage facilities. The back-up servers currently reside in the ICT building, Odion Forum.

RAF’s recruitment procedures were not complied with in the appointment of some ICT personnel. There were no Job Descriptions for these positions, no evidence of interviews records, all employees appointed were from SITA (previous employer of Chief Information Officer).

A Manager (also from SITA – Human Resources) without ICT qualifications or experience was appointed to the position of ICT Security Manager and given comparatively higher remuneration package. The high premium does not appear to have been linked to any expertise that this official would be bringing to the Fund’s ICT environment. This Manager was subsequently suspended for alleged irregularities.

The RAF has continued to recognize fuel levies on a cash basis while there is no evidence that prior approval was obtained from Accounting Standards Board.

The financial statements 2002 "reinstatement of responsibility by board of directors" states that the financial statements are prepared according to GAAP (accrual accounting), but the accounting policy in the financial statements says that fuel levies are recognized upon receipt of levies from the oil companies.

The RAF has continued to disinvest its surplus funds, due to actual spending exceeding cash inflows. While an amount in excess of R500 million was disinvested during this financial 2002/2003 the Fund does not have an approved investment policy and procedure in place, as required in terms of the PFMA Treasury Regulations, paragraphs 31.3.1 and 31.3.2.

In addition, there is no evidence that exemption has not been received from National Treasury from investing the RAF’s surplus funds with the Corporation for Public Deposits.

An analysis of the 2002/2003 budget revealed that the systems in place and over the budgeting process are not adequate. Also, there were no monthly management accounts to assist management with monitoring actual expenditures against their departmental budgets.

There was lack of proper monitoring controls or systems over the procurement process and awarding of tenders. For example, no written agreement with Forensics Corporation’s to which the RAF had outsourced Forensic Investigations -NCIB and Ikanyeng.

There is no written delegation of authority to employees that are responsible for the procurement process in the Administration and ICT departments. In addition, the internal control systems appear inadequate to ensure that all major capital projects are properly evaluated.

There is no evidence that the RAF’s contract with the Central Endergy Fund regarding the fuel levy income assessment and collections has been reviewed in the 9.5 years since it became effective. The RAF has not raised interest accrued on late fuel levy payments by the oil corporations. In addition, audit certificates are not regular.

Detailed policies and procedures relating to purchases are not documented and authorized. Processes are not standardized with various practices existing and different documentation being used to support different expenditure items.

No formal documentary evidence of pre-authorization of expenditure items of significant amounts, for example in excess of R100 000. The certificate of signing authorities is incomplete and thus may be invalid.

There are instances noted where an employee worked more than 40 hours per month but the indemnity form was not completed, as required in terms of RAF policy. In addition, the organization may be exposed to an increased risk of inappropriately unauthorized overtime activity, due to poor verification procedures in place.

The overtime expenditure could not be traced to the RAF’s budget. However, a total amount of R7, 773,469.35 was incurred during the 2001/2002 financial year.

There is lack of adequate documentation evidencing authorization/approval of recruitment of contract as well as permanent employees. There are instances where interview records to support certain appointments made during the year under review could not be made available for audit purposes.

There is no evidence that a proper cost vs. Benefit Analysis was conducted, before the agreement with consultants, Creative Health Risk Management Systems (CHRIMS) was formalized at R20.52 million. The ‘medical cost savings’ claimed by CHRIMS were in fact, adjustments of costs claimed to BHF rates. Since the claimants would still have recourse to claim the full cost of the treatment they would have incurred, there is arguably no real financial benefit accruing to the Fund. While the contract with CHRIMS has since been terminated at the insistence of the Medical Committee of the Board, there is now a legal dispute.

It is not clear, subject to a legal opinion whether the arrangement / scheme entered into with AFCT is a valid agreement in terms of either the RAF Act, 1996, or the Public Finance Management Act, 1999. In terms of the arrangement, the RAF would fast-track the processing of suppliers’ claims lodged by AFCT on behalf of service providers (mainly private hospitals). In addition to the claims being processed and paid by the fast tracking unit in the claims department, the Finance Department would pay lump sums / bridging finance / interim payments to AFCT to administer these claims.

The total amount of lump sums /bridging finance/interim payments made during the five month period April 2002 to August 2002 was R56 million while approximately R9 million was refunded to the RAF. RAF’s net exposure is therefore approximately R47 million.

While the budget for Claims Life Cycle Pilot Project (YASEBETSA) is R32m, Project Management controls have not been adequate. There is no evidence that

• the project charter was approved,
• this life cycle process had been agreed to by Management,
• there is "buy-in" and support by the Claims Department,
• there is communication or continuous feedback on the progress of the project between all the Regional Managers.

In addition, the system of budget controls and management may not be effective. The project has been ICT driven, with the minimal input from the business or user departments. The medical assessment of claims as one of the functions or phases in the claims process has been excluded in the pilot process.

The system in operation over the re-opening of finalized and claims appear to be inadequate. There are no measures put in place to ensure that the requests to retrieve finalized claims files from archives are authorized. Finalized files are re-opened without reasons being provided and/or management having approved such reasons.

Failure to build in measures/controls in places within the current claims systems to ensure that the re-opening of a finalized claim file is at least restricted to the respective Manager in whose section/department the finalized claim file was processed/handled.

In instances where the claim files cannot be found, either these are lost or simply misplaced, a copy or duplicate of the original claim file is created-termed "dummy file". However, the procedures and guidelines over the creation of dummy files is not standardized within and between the claims regional offices. For example, the authority to create a dummy file rests with a senior claim handler or at some branches only a claims manager can authorize the creation of dummy files. There is no evidence to indicate that once a dummy file has been created, these are properly monitored. As a result, fraudulent or fictitious payments may not be detected timeously.

Weaknesses have been identified in the claims computer system, the claims handling process, as well as in the payment process:

• Inadequate segregation of duties
• Inadequate monitoring controls or quality control procedures currently in place during the claims handling process
• Inadequate capacity in the claims departments
• Inability to authenticate claims documentation
• Lack of application controls

There are inadequate monitoring controls over the movement of files between departments and within departments. In addition, the security over claim files is inadequate in that they can be found lying all over in the claims department. Claims handlers use individual file tracking registers and this does not allow for continuity.

The current claims system application does not take into account basic controls, which should have been programmed into the system. For example, there is no facility to detect incorrect ID numbers that are incorrectly captured either due to human error or intentionally, and therefore, the system is unable to detect/duplicate claims. Also, there is no capacity to detect prescribed claims at time of registration, nor are there automated controls to monitor that become prescribed before they are settled.

The claim system is underutilized by the claims department mainly due to lack of adequate training with respect to capabilities of the system. There are various modules in the system that are either not used or are not use consistently.

The offer system implemented during 2001/2002 was not properly planned and designed to meet the needs of the business:

• System development life cycle methodology not used
• No user requirements were received by the development team
• No formal project management was followed during the development of offer system
• No training was offered to users regarding version 2 of the offer system
• The system is not yet signed off by the users
• No formal change management was followed during system maintenance
• Errors have been identified on the offer system
• The system was rolled out to all the branches despite the problems and errors that had been identified during the pilot run at the Pretoria Branch.
• Claims Officials can bypass the offer system

It appears that planning for the establishment of the East London Branch did not address certain critical areas:

• A large number of claims were relocated to this branch prematurely, before the infrastructural requirements had been addressed properly.
• The manager initially appointed to head this branch was not given the mandate to settle claims. Alternatively, this mandate was not communicated to them
• There were various computer related problems, which included inavailability of printers, users not given access rights, and therefore delays with training.
• No archiving unit in place.

The following weaknesses have been identified in the mediation and arbitration project which was designed as an alternative dispute resolution mechanism in the settlement of claims:

• Inconsistent compliance with RAF Arbitration rules.
• Officers increased without the justification thereof being documented.
• The current payment module of the claims system is totally not capable to handle payments to the Arbitration Forum. No other accounting systems has been put in place.

Policies and procedures provide guidelines and are training tools for the employees in their day- to day activities. However, there are key policies and procedures that have not been formalized

In the attached annexure, there are material / significant audit findings where the RAF is exposed to the risk of or has incurred financial loss which, in terms of the PFMA, could constitute fruitless expenditure:

A proper feasibility study and cost benefit analysis was not conducted before the decision to implement the new financial/accounting system – AXS One. The cost of the new system is approximately R16 million while an upgrade of the then existing system (ACCPAC) to perform the same functions was quoted at R 800 000,00.

In addition, failure to properly manage the "YaSebetsa Project" – i.e. the Claims Life Cycle, could result in additional fruitless expenditure with the budgeted capital outlay estimated at R 32 million. There is the increased risk of:

• summons issued against the Fund and therefore financial loss in the form of increased costs of litigation, i.e. in instances where the processing and settlement of claims may be delayed.
• processing of claims merely speeded-up to avoid summons at the expense of ensuring quality assessments. As at January 2003, a backlog of about 5000 claims had accumulated in this project, further increasing the risk of additional expenditure on the project.

At the previous meeting of the Audit Committee in November 2002, the members of the Committee resolved that this issue should remain in the agenda until such time that it had been resolved.

The report was finally discussed and management comments obtained. A summary version of this report has been included in the detailed audit findings, as Audit Finding #

The Board and Management have initiated several strategies aimed at addressing the major risk areas, and reducing RAF’s susceptibility to fraud and corruption. The following are some of the initiatives to date:

It is important to note that while these initiatives have been highlighted as improvements, there may be significant audit findings relating hereto that have also detailed in this report, Annexure A.

The internal audit department uses a risk based audit approach, and currently uses a combination of the various audit methodologies. As such, the annual audit plans were based on continuous risk assessments.

The department is comprised of three divisions, each headed by a Manager reporting to the Head of the Department / Internal Audit Manager:

• Computer Audit
• Compliance Audit
• Financial and Operational Audits

The annual audit coverage for the period 2003/2004 has been prepared on a three-year rolling plan, as required in terms of the PFMA regulations paragraph 27.2.7 (a).

The planning of the audit activities and the scope of the audits, required a review of the RAF’s Corporate / Strategic Plan as well as the Business Plans of all the departments for the new financial period. However, the overall RAF strategic plan has not been updated nor have the various departmental business plans been updated with the planned activities for the new financial period.

A departmental Business Plan for the current financial period (2002/2003) was prepared as part of an organization-wide exercise that was initiated by the CEO. Internal Audit has subsequently prepared its departmental business plan for the new financial period 2003/2004.

An analysis of available capacity in the department, at the beginning of the current financial period, had revealed an unfavourable capacity variance, i.e. that required hours exceeded the available man hours and therefore the department was under resourced.

Internal Audit Management had scheduled projects from the annual audit plans, for the first six months as well as the six months to end of the current financial period. Staff resources were assigned to each audit project.

It should be highlighted that some of the projects originally scheduled for this financial period, have either not be conducted, or these were started but not completed. There are various factors that can be attributed to this problem, and these include:

• Inadequate capacity per the organizational structure (i.e. vacancies), not compensated for with overtime
• Moratorium on recruitment including replacement of existing positions.
• Approximately 85% of staff employed in the department were recruited during the current financial period and as a result there has been a learning curve, which impacted on the speed of completing audit projects.
• Also, two of the Managers in the department (Computer Audit and Financial Audit) are recently recruited.
• The Manager Computer Audit, was seconded to the ICT department for a period of six (6) months after the suspension of the Chief Information Officer.
• Some of the employees recruited during the financial period resigned citing various reasons ranging from demotivation, career moves, RAF’s public image.

In line with the approved Internal Audit Charter, the department performed both consulting and assurance activities during the period. The activities of each of the three internal audit divisions are summarized in the attached annexure:

The department has performed the following consulting activities during the period October 2002 to December 2002

1. Workshops on the policy and standardized procedures that should be in place to allocate mandates in the claims departments.
2. Facilitating the Implementation of the Risk Management function / process in the organization, which includes:

• Researching and drafting the RAF’s Organisation-Wide Risk Management Policy, which includes formulating a risk management framework.
• Evaluating, selecting and acquiring risk management software
• Workshops and training on the risk management process

1. Research and documentation of Delegations of Authority Policy and Approval Framework
2. Evaluating Policies and procedures:

• ICT Security Policies
• Recourse and Recoveries policy (not completed)

1. Providing various advisory services in the ICT department.
2. Advisory services during the establishment of the RAF’s Management Procurement Committee, and its terms of reference
3. Attending meetings of the Claims Life Cycle Steering Committee, advising on both IT controls and internal controls.
4. Evaluating the Undertakings Structure (not completed)

The following Performance Management Contracts have not been finalized:

• Head of Internal Audit Department
• Middle Management: Internal Audit

While the RAF’s Going Concern assertion remains a major concern to the government and the Management of the Fund, management should be seen to be making every effort in addressing the actuarial deficit, and ensuring the proper management of its finances.

The implementation of action plans, internal audit recommendations or management’s alternative action plans, should assist in addressing the identified weak areas thereby ensuring effective management of the operations of the organisation.

We would like to thank members of management for their co-operation during the execution of our duties.