WEAKNESS IDENTIFIED

IMPLICATION

RECOMMENDATIONS

ACTION PLAN(S)

The existing departmental and organisation’s overall business plans should be reviewed and updated for the new financial period ending March 2004, as required i.t.o. paragraph 30.1.3 of the PFMA Treasury Regulations.

The RAF’s strategic plan should be formally adopted and communicated to the organisation.

The plan should be constantly reviewed for its relevance, and updated accordingly where there are major shifts in the RAF’s goals.

Heads of Departments

Executive Management

CEO

PREVIOUS AUDIT COMMITTEE REPORT

1. The CEO currently occupies three executive offices which are all demanding in nature.

• The one key position of Claims Executive has remained vacant for an extended period (about two years). As a result, the CEO has been acting as Claims Executive.
• In addition, to acting as Claims Executive, the CEO has now also assumed some of the responsibilities of the Chief Financial Officer, since the suspension of the Finance Executive, Mr Duncan Anderson.

2. The position of Medical Executive was also vacant for an extended period, exceeding two years.

Inefficient, ineffective and uneconomical utilization of the Fund’s resources:

• The CEO may not be able to dedicate sufficient time to address claims related issues and serious problems that arise from time to time. This in turn may result in poor service delivery, as well as increased costs of delivery.
• Inadequate attention and therefore lack of focus on direct responsibilities.
• Inappropriate decisions may be taken.
• Difficulties in implementing good systems of internal controls in the various environment, including the core business of the RAF.

Lack of separation of duties.

The CEO and the Board should consider either temporary or fixed term contract appointments, for the position of Claims Executive. The person appointed should have the appropriate skills, knowledge and qualifications for the positions.

While this position remains vacant, it is recommended that:

• for decisions pertaining to the claims environment, the team of Regional Managers should be consulted and engaged in the deliberations before such decisions are made.

The position of Claims Executive remains vacant, and the CEO is acting in this positon.

ORGANISATIONAL STRUCTURE (CONT’D)

PREVIOUS AUDIT COMMITTEE REPORT

1. HUMAN RESOURCE TRAINING

Difficulties may be experienced in co-ordinating training for employees, for example:

• The technical (claims handling) training of newly recruited employees may not be accompanied or supported with training on the RAF’s computer systems. Alternatively, this training may not be in synergy to ensure that employees are properly trained.
• Unauthorised and unnecessary expenditure on training may be incurred due to inability to monitor expenditure of the training budget.

It is recommended that Executive Management should consider the option of centralizing the training function to the HR department to ensure proper management and implementation of employees’ development and empowerment strategies.

Line Management or Head of Departments should be given the authority to utilize their training budgets subject to the availability of the financial resources. However, this expenditure should be monitored by the HR Training Department to ensure that it is:

• Authorized (i.e. the training is in line with the functions of the department);
• Expensed fairly and equitably;
• And within authorized limits.

September2002

The training function has now been centralized and presently resides with the Manager: Human Development

PREVIOUS AUDIT COMMITTEE REPORT

The general areas of responsibilities for some departments have not been properly defined and documented.

There may be inadequate segregation of duties at Executive Management, as well as other management levels.

Uncertainties resulting from undefined roles could result in:

• Inefficient and uneconomical use of resources due to overlap of functions and therefore possible duplication of work.
• an inability to enforce and ensure accountability and responsibility at all levels.
• And therefore, low morale of staff and possible conflict between departments.

Executive Management should review and document the general areas of responsibilities for all departments, which must also be informed by the RAF’s strategic objectives and its strategies to achieve these objectives.

The assignment of responsibilities to the various departments should ensure segregation of duties and functions. Care should be taken to minimise areas of overlap or to ensure synergies in the functioning of such departments.

Management should consider the introduction of service level agreements which will regulate and provide guidelines with regard to service capabilities / delivery of the respective departments within the Fund.

Executive Management

Chief Executive Officer

YASEBETSA PROJECT REVIEW, REF. IOP/03/2003

• Lack of independence and objectivity in the procurement process
• Poor control environment and procedures; and therefore non-compliance with the PFMA and Treasury Regulations

Therefore, Executive Management should ensure the implementation of sound control procedures, by separating the functions of CIO / Pilot Project Co-sponsorship and Procurement Management.

Executive Management should respond

Responsible Person(s):

CEO

PREVIOUS AUDIT COMMITTEE REPORT

1. The policy and framework on the "Delegation of Authority" has not been finalised. The authority levels in the Approval Framework that sets out in detail the powers and duties delegated to the various Sub-Committees of the Board, the office of the CEO and Executive Management have not been cascaded to the lower levels.
2. The authority mandates/powers of the Regional Managers and the Undertakings Managers are unlimited.

 

3. The system of granting mandates to the claims staff cannot be relied upon as it appears to be subjective and undefendable. The Claims Managers and the Senior Claims Handlers are allowed to use their own discretion.

The Fund could suffer financial loss as it would be responsible and bound by the actions of its employees and be unable to take any disciplinary actions against them should employees, either intentionally or unintentionally, exceed their authority in:

• Settling claims for compensation
• Negotiating or acquiring goods and/or services on behalf of the Fund.
• Or be involved in any irregularities.

Abuse of authority in the allocation of mandates. Favouritism and inconsistency in allocation mandates.

The draft Policy on Delegations of Authority, previously adopted by the Board should be finalized.

Cognisance should be taken of the provisions of the Public Finance Management Act, 1999, and the Road Accident Fund Act, 1996.

The delegation of mandates to claims officials should be included in the organization-wide delegation of authority/ approval framework.

The Audit Committee has reviewed and adopted the draft policy as well as the Approval Framework subject to ratification by the Board.

Chief Executive Officer

Finance Executive

PREVIOUS AUDIT COMMITTEE REPORT

• CEO – Ikanyeng

• Cape Town Ex-Regional Manager

A claim that was repudiated by claims handler, senior and manager was subsequently re-opened by the then Regional Manager. There is no supporting evidence for the reversal of the initial repudiation.

An investigation into this claim revealed that there was a conflit of interest in that the Regional Manager had worked as an associate in the claimant attorney’s office. In addition the claimant alleged that they were paid only R250 000,00 and an additional R200 000 invested while the RAF had settled the claim at R1,2 million.

Non-compliance with the principles of corporate governance.

Collusion between RAF officials and third parties (including claimants, service providers) may result in financial losses to the Fund.

The referrals of investigations to the forensic companies should be closely monitored.

Written agreements between the RAF and its forensic investigators should be formalized, and be submitted to the Board or Audit Committee for ratification.

A Register detailing RAF officials’ interests should be maintained. A code of Conduct / Ethics governing the general conduct of employees, inclusive of the measures to manage conflict of interest situations should be formalized.

Management should consider referring the Cape Town matter to a law enforcement agency for further investigations.

According to the Finance Executive, Mr Anderson, the CIO – Mr Sello Mokale had introduced and motivated for the appointment of Mr Beea to the Executive Forensics Committee.

Mr H. Kgomongwe, CEO

Executive Forensics Committee

The Senior Manager Forensics was suspended in May 2002.

1. INFORMATION & COMMUNICATION TECHNOLOGY (ICT) - NEW SALARIES APPLICATION

IT AUDIT REPORT: REF.

During the current financial period, the RAF embarked on a project to develop and implement a new HR – Salaries application (EMSOFT) that would be able to interface with the new Finance and a new claims system.

Disputes between the software vendor (supplier) and the RAF’s technology partner (African Legend Technologies – ALT) regarding the manner in which the deal was structured, resulted in the abandoning of the new EMSOFT system. The direct costs/ expenditure on the project amounted to R 1, 041 200.

The system was implemented without following systems development and implementation procedures properly.

• For example, there was no parallel run conducted before the system went "live" to ensure that the system would meet the desired objectives and outcomes.
• The user specifications were not properly defined which had an adverse impact on the programming of the new payroll system.

In addition, the licence fees for the Unique system previously used by the Fund (and which the Fund subsequently reversed to) were not discontinued although the RAF had gone live with the new system.

Inefficient utilization of the Fund’s financial resources, resulting in possible fruitless expenditure of R 1 m.

Incorrect salaries paid out resulting in employees becoming dissatisfied and disgruntled.

Adoption and implementation of a methodology for the systems development life cycle, which will be in accordance best practice.

Invitations for the design and development of new systems should only be conducted once management have fully conceptualized and agreed on management strategic objectives and the expected functioning and therefore use of the system.

In instances where a strategic partner has sub-contracted with a third party, the RAF should ensure that the formal agreement enables recourse against non-performance to ensure that the Fund is not exposed to financial losses.

Acting CIO

HR Executive

CEO

Presentations for a new system have been invited, although the user specifications have not been re-visited, and formally documented.

1. ICT / FINANCIAL MANAGEMENT - CLAIMS PAYMENTS ANALYSIS

IT AUDIT REPORT

An employee of the RAF's technology partner African Legend Technologies, who had access to the claims system live environment manipulated the payment process and misappropriated RAF's Funds, amounting to R38 800,00. This risk was realised due to inadequate systems of internal control over the claims payments process as well as inadequate application controls:

Development personnel (programmers and system administrators) have access to the production / live environment including full rights to sensitive applications.

Risk of financial loss to the Fund, due to unauthorized changes, manipulation or override of automated procedures. Fraud and theft may be perpetrated.

Application Development Personnel should not be granted access to the live environment. In the case of system maintenance, change control procedures should be adhered to.

A task team will be set up to address all the issues and problems raised in the audit report.

Acting CIO

Target Date:

PREVIOUS AUDIT COMMITTEE REPORT

A post implementation review of the new Citrix server, revealed the following user problems:

• Citrix server overload resulting in slow

system response times;

• Printer errors;
• Time out connections;
• Loss of documents, and
• Repeated hanging/freezing sessions.

Inavailability of computer systems impacts negatively on the speed of service delivery.

An independent evaluation of the current Citrix environment by a Citrix expert is strongly recommended.

Technical evaluation planned

Keitihetse Teisho

August 2002

Technical Evaluation report issued to ICT management. A process of corrective action as per recommendations of the evaluation report was started.

1. ICT MANAGEMENT - IT SECURITY

PREVIOUS AUDIT COMMITTEE REPORT

There is no formal and approved ICT Security Policy in place. In addition, logical Access Controls are generally poor in that

• Programmers have been allowed access to the live environment
• The claims system allows multiple access by the same user
• Some employees are sharing passwords
• Special Branch functions are not properly restricted and monitored.
• Database Administrator maintains no formal documentation in respect of request for user access to database.

Unrestricted access to the live environment by programmers allows manipulation of information or live data, and therefore increases the risk of irregular and unauthorized transactions.

An overall IT Security Policy should be drafted, reviewed for adequacy and effectiveness, and approved by the CEO.

Programmers’ access to the live environment should be restricted.

The allocation of Special Branch Functions should also be restricted to authorized personnel.

The Data Owners / Management should formalize user profiles with the assistance of the ICT department and access be granted in accordance therewith.

ICT is in the process of drafting an IT Security Policies and procedures. These policies will be benchmarked against best practices (BS7799 and COBIT) before the approval thereof.

Acting CIO

December 2002

According to the Security Manager, he will also be responsible for ICT security.

1. ICT MANAGEMENT - DISASTER RECOVERY PLANNING

PREVIOUS AUDIT COMMITTEE REPORT: REF.

The Fund does not have a documented and tested disaster recovery plan in place.

In addition, there is no remote / off-site back-up storage facilities. The back-up servers currently reside in the ICT building, Odion Forum.

The organization is exposed to the risk of inavailability of systems due to inability to recover with minimum delays from incidents of disaster, e.g. system crashes, fire.

The ICT Department, in particular the ICT Security and the Data Base Management functions, should document a Disaster Recovery Plan (DRP). The DRP should be tested for efficiency and effectiveness, and approved accordingly.

Immediate arrangements should be made for an off-site back-up storage facility.

(i) The Disaster Recovery Plan is currently under development.

(ii) The current ICT Risk Assessment Project, with KPMG, includes the investigation and identification of an offsite back-up facility.

Acting CIO

(i) September 2002

(ii) November 2002

KPMG Risk Assessment project is not completed. KPMG has submitted an interim report.

PREVIOUS AUDIT COMMITTEE REPORT

1. There is evidence that the RAF’s recruitment policies and procedures were not complied with in the appointment of several staff members in the ICT department.

• There are no job descriptions for the new positions created in ICT.
• Some of the staff employed were head hunted but there is no evidence that there were any interviews conducted.
• All these appointments, (period September to December 2001) are ex-employees of SITA where the CIO had been employed immediately prior to his appointment by the RAF
• A Manager employed in the department, Mr D. Mokgwetsi, does not have the appropriate qualifications and experience for the position of Manager ICT Security and Risk Manager. While this Manager is not qualified for the position he occupies he is paid a salary in excess of Senior Management’s whose salaries have been frozen since 2000.

Management Abuse of authority:

• Staff may be appointed to positions for which they are not properly qualified or they are not skilled to perform.
• There is also the risk of nepotism which also results in the appointment of unqualified staff.

Negative effect on productivity and service delivery.

Management should ensure that the principles of transparency and responsibility are consistently adhered to. The recruitment process should be, and be seen to be fair and equitable on any objective test. This will require consistent compliance with laid down policies and procedures.

The Human Resources Department should obtain signed job descriptions of all the newly created positions in the ICT department. External consultants who specialise in IT recruitment should grade these job descriptions.

A review of all appointments in the ICT department should be considered, and appropriate action taken where employees do not meet the minimum requirements of the job.

We are currently reviewing the structure of the ICT department. The aim of the review is to determine the resource requirements (skills). Our next goal will be to ensure that we recruit suitable skills for the positions. This process, we agree, will be conducted through the service of an IT recruitment consultant who will advise us regarding the respective job profiles and grades.

The CIO Mr Mokale, and ICT Security Manager Mr Mokgwetsi remain on suspension.

1. MAINTAINING ACCOUNTING RECORDS – INCOME RECOGNITION

Non-compliance with Generally Accepted Accounting Practice (GAAP) and the PFMA

The RAF’s Finance Department should either adopt accrual accounting or seek the appropriate authority to recognize its fuel levies on a cash basis.

Manager Finance

Chief Financial Officer

Chief Executive Officer

PREVIOUS AUDIT COMMITTEE REPORT

The monthly fuel levy income that the Fund receives from the oil companies via the Central Energy Fund appears to be insufficient. The RAF may be overspending in that cash outflows have been exceeding the cash inflows.

As a result, the Fund has been disinvesting its reserves with the result that the reserves may be depleted while there is no evidence of a back-up plan to mitigate this risk.

In addition,

• there is no approved Investments Policy in place, as required in terms of the PFMA Treasury Regulations, paragraphs 31.3.1 and 31.3.2.
• There is no evidence that exemption has been received from the National Treasury from investing the RAF’s surplus funds with the Corporation for Public Deposits.

Inavailability of funds may result in the RAF’s inability to meet its day to day financial obligations.

The increase in the deficit will render the Fund’s Going Concern assumption inappropriate.

Executive Management should ensure strict financial control, by ensuring that only budgeted expenditures are incurred and this expenditure is monitored. High expenditure that was not budgeted for should be authorized by the CEO, and communicated to the Board .

Mechanisms to closely monitor the Fund’s Asset Managers, and therefore the performance of the RAF’s investments should be put in place.

High value procurement contracts, at a level to be determined by the Board’s Procurement committee, should be subject to ratification by the Board.

Chief Executive Officer

Finance Executive

The amount of funds that have been disinvested to date is about R 500 m, while there is no formal policy and procedures.

1. FINANCIAL MANAGEMENT – BUDGETING

PREVIOUS AUDIT COMMITTEE REPORT

1. An analysis of the budget for the financial period 2002/2003 had revealed the following:

• Management had budgeted for a negative cash flow position in that for the financial periods 2003/2004 and 2004/2005 a deficit of about R 1 billion per year was budgeted for.
• Investment income of R100 000 had been provided for the periods 2003, 2004 and 2005, while the Fund had budgeted to disinvest all its reserves to meet the year’s expenditure.

2. While over a three year term, i.e. 2003 to 2005, the total cost for special projects alone is estimated at about R 550 million:

• There is neither evidence that proper cost benefit analyses and feasibility studies have been conducted for the various special projects; nor :
• Nor is there evidence that a critical path analysis was conducted, and that all the projects have actually been ranked according to their priority

Lack of prudence in the preparation of the annual budgets.

Failure to ensure the effective and economical utilization of the RAF’s available financial resources, will move the RAF financial position from an actuarial deficit to an actual deficit.

.

The Finance Executive should revise the budget figures for the period under review. Each head of department and/or Executive Manager should be required to provide detailed justification for their budget items, rated according to their priority. Ratings can be the minimum requirements to carry out the duties and functions of the department; the standard requirements; and the maximum requirements to operate at full and maximum capacity.

Proper cost vs benefit, and impact analyses should be conducted; and these should be submitted to the Finance Department-Executive and Manager: Budgets and Policies for a comprehensive budget.

CEO

Finance Executive

PREVIOUS AUDIT COMMITTEE REPORT

Failure to formalize effective procurement policy guidelines may result in:

• Ineffective and uneconomical utilization of financial resources
• Procurement of goods and/or services that are substandard or of inferior quality
• Inflated costs, fees
• Use of disreputable suppliers
• Increased level of internal fraudulent activities.
• The risk of ‘backhands’ and collusion
• Non-compliance with the Public Finance Management Act, s 51 (1) (a) (iii) and the Treasury Regulations.

Appointment of a Procurement Manager.

The draft procurement policy should be reviewed, approved and implemented as a matter of urgency.

A permanent procurement committee should be formed, members of which should be rotated regularly.

Special powers should be delegated to the procurement committee in terms of a delegation of powers policy.

A Procurement Committee of the Board should be involved in the decision making in cases of major capital expenditure. Terms of Reference for this Committee should be formulated.

A Procurement Manager was appointed with effect from 1^st October 2002.

A Procurement Committee at management level has been established.

The draft Procurement policy has been presented to the RAF Board.

Chief Executive Officer

Finance Executive

Procurement procedures are currently under development.

FIN & OP AUDIT REPORT: REF. IAFOP 02/2003

• Procurement Policy or Guidelines

To date the Fund has not adopted and implemented the draft procurement policy.

Procurement process, as per the system description at ICT, was not adhered to.

• With no approved and implemented procurement policy, the board is at risk of being held accountable for any procurement related irregularities (PFMA; 49.1).

• Unauthorised purchases / acquisitions of goods and services. Possible increase in fraudulent activities that may not be detected timeously or alternatively, incidents of fraud and / or corruption may not be detected.

On behalf of Administration – We will comply once the policy is available. We await Executives’ mandates after which we will implement. B. Furniss, Admin Manager

FIN & OP AUDIT REPORT: REF. IAFOP 03/2003

• CONTRACT AGREEMENT

The fund has an agreement with Central Energy Fund regarding the fuel levy income assessment and collection.

It was noted that RAF does not regularly receive audited documents as per agreement.

Possible wasteful expenditure as RAF pays for this service from CEF.

We further recommend that the clause of submission of audited statements by CEF be upheld as it is imperative that fuel levy as stated is verifiable.

Will follow up with CEF and Department of Mineral Energy to get a new agreement in place and to force them to comply with relevant clause in the contract agreement.

17. EXPENDITURE MANAGEMENT / CAPITAL PROJECTS

FIN & OP AUDIT REPORT: REF. IAFSP 02/2003

Detailed policies and procedures relating to purchases are not documented and authorised. Various practises exist and different documentation is used to support different expenditure items.

An expense of R 250 204.42 on Security Equipment was incurred and paid on 21 December 2001. This amount was however incorrectly allocated to a maintenance account.

Fixed Assets may be understated. The result is incorrect and unreliable financial reporting.

Each expense should be carefully considered before account allocations are made.

Mr J Rabie: "This is a disputable point. The decision on the capitalization of the particular asset or not was that of the Fixed Assets department that is reporting to the Admin. Manager.

FIN & OP AUDIT REPORT: REF. IAFOP 05/2003

It is RAF policy that, where an employee works more than 40 hours per month an indemnity form must be completed.

It was noted that the organisation may be exposed to an increased risk of inappropriately authorized overtime activity. The salaries department does not keep a list of signature specimen to verify managers signatures for authorization on overtime application forms. Instances of processed unauthorised overtime were noted.

Unauthorised expenditure

Management should ensure that overtime budget forms the basis of all authorisation for such activity. Appropriate analysis should be performed which will inform adequate overtime expenditure budget

Since the establishment of the budget office all activities are budget for and detail budget is prepared

17. RECRUITMENT – PERMANENT & CONTRACT EMPLOYEES

FIN & OP AUDIT REPORT: REF. IAFOP 07 & 08 / 2003

Lack of adequate documentation evidencing authorisation/approval of recruitment.

Also, refer finding # 12.

Disputes arising due to lack of common understanding regarding the terms and conditions of employment; and lack of documented evidence to support appointments should an investigation into those appointments be incited.

The HR dept should follow-up with the responsible officials and obtain the interview records for all new appointments/transfers/promotions before their approval.

PREVIOUS AUDIT COMMITTEE REPORT

Consultants (CHRIMS) were appointed to assist the RAF with the implementation of health management systems. This contract became effective in December 2001.

There is no evidence that a proper cost vs. benefit analysis was conducted. The ‘medical cost savings’ per CHRIMS are in fact, cost adjustments. There is no real financial benefit accruing to the Fund as these adjustments are not necessarily realizable.

The original operational mode of the CHRIMS PROJECT has now been changed, as they were not adding value according to the Finance Executive.

Therefore, it appears that:

• the fees incurred and paid to April 2002 (R855 000,00 per month X 4)
• as well as the overhead costs ( IT system; HR costs; other administrative costs) incurred

may be ‘fruitless expenditure’. PFMA section 51.

Inefficient and uneconomical utilization of the RAF’s financial resources due to uncertainty that the Fund will derive economic benefits.

In terms of the PFMA this may constitute fruitless expenditure amounting to a minimum of R3, 42 million as at April 2002, (R 7, 695 million: September 2002).

The CHRIMS contract, the deliverables, expected outcomes, the management thereof and the costs of these services should be revisited. A proper cost vs. benefit analyses should be conducted and the results hereof should be submitted to the Board’s Medical Committee for their review and appropriate action plan.

Wasteful and fruitless expenditure should be reported as prescribed in the PFMA.

As at April 2003, the Medical department under the direction of the Medical Executive appointed wef January 2003, has embarked on a project to document policies and procedures. Internal Audit has also been requested to review the organizational structure and functions of the Medical Department

17. FAST-TRACKING OF CLAIMS PROJECT (ALEXANDAR FORBES COMPENSATION TECHNOLOGIES

COMPLIANCE AUDIT REPORT: REF. NO. IACSP 07/2003

It is not clear, subject to a legal opinion, whether the arrangement/scheme entered into with AFCT is a valid agreement in terms of either the RAF Act, 1996, or the Public Finance Management Act, 1999. In terms of the arrangement, the RAF would fast-track the processing of suppliers’ claims lodged by AFCT on behalf of service providers (mainly private hospitals). In addition to the claims being processed and paid by the fast tracking unit in the claims department, the finance department would pay lump sums/bridging finance / interim payments to AFCT to administer these claims.

While the intention of this arrangement was the avoidance of summons against the RAF and therefore management of litigation costs, the RAF ‘s Finance department originated and made lump sum payments/ bridging finance / interim payments to AFCT, totaling R56 m in addition to payments made by the claims department responsible for the fast –tracking of the said suppliers’ claims.

• Arrangement and subsequent payments could be in contravention of the laws governing the administration of the RAF.
• Potential Financial loss to the organization, due to irrecoverability of lump sums paid out as well as due to double compensation being paid out .
• Double compensation, which due to lack of reconciliations of claims paid by the two parties, will not be detected.
• Possible litigation by other claimants / establishments acting on behalf of the claimants, resulting in financial loss to the organization and poor image of the Fund.

1. The agreement/arrangement be referred to the Executive: Corporate Legal Services for a legal opinion/advice with regard to compliance with relevant legislation / sections currently in place.

This opinion should influence/form the basis for Executive Management’s appropriate action plan

2. Executive Management should revisit and review this arrangement to ensure that it is in the best interest of the Fund,

the principles of fairness are consistently applied, and the associated risks are mitigated (e.g. attorney firms requesting similar treatment or arrangement)

3. While the delegation of authority policy framework remains a draft, care should be taken to ensure sound and effective financial management.
4. Executive Management should formulate a policy that will provide the appropriate guidelines regarding business relationships with suppliers, including disreputable suppliers, suppliers without good standing with the authorities, etc
5. Oral agreements should be reduced to writing and signed by all parties soon after conclusion. Entering into contract should be in accordance with the Fund’s approval framework.

FAST-TRACKING OF CLAIMS (AFCT) - CONTINUED

Internal Audit not yet consulted with the legal expert, Prof. Gutto, appointed to analyse the scheme.

COMPLIANCE AUDIT REPORT: REF. IOP/03/2003

• There is no evidence that Executive Management has formally approved the YA-SEBETSA project charter. As a result, there is no clarity in the delegation of authority and responsibilities of the co-sponsors.
• There is a lack of project management continuity in that the Pilot Project has been co-sponsored by the Claims (JHB Regional Manager) and ICT (CIO), since its inception in April 2002.
• There is a lack of evidence that there is "buy-in" and support by the claims departments, nor is there evidence of communication between the Johannesburg Regional Manager and the other Regional Managers on the progress of project YA-SEBETSA.
• No effective system of budget control and management. For example, there have been instances where expenditure has been incurred on the pilot project’s budget without the knowledge of the Programme Manager.

Also refer finding # 4..

The Steering Committee should consider assigning the responsibility of project accounting to a single individual; and the status of the budget should form part of the Agenda at the monthly Steering Committee meetings.

A project plan and charter has been submitted to EXCO for approval.

Acting Claims Executive /CEO

17. NEW CLAIMS LIFE CYCLE PROCESS

COMPLIANCE AUDIT REPORT: REF IOP/03/2003

• There is no EXCO representation for the business (Claims Environment) on the Pilot Project Steering Committee;
• On each occasion the new Acting CIO has automatically assumed Chairmanship of the Project Steering Committee regardless of his/her limited knowledge about the Pilot Project;
• Almost all presentations to Executive Management on the progress of the project are done by ICT Management; and
• The project budget is kept and managed by ICT department.

As at January 2003, the pilot project had resulted in a backlog of +/- 5000 claims thereby increasing the risk of summons against the Fund and therefore an increase in litigation and costs of delivery.

Executive Management should ensure that this project is owned, driven and managed by the business with the full co-operation, assistance and support from ICT.

Lesedi recommendations were never furnished to Johannesburg management.

COMPLIANCE AUDIT REPORT: REF. IA COP 07/2003

• There are no measures put in place to ensure that the requests to retrieve finalised claim files from archives are authorised.
• Finalised files are re-opened without reasons being provided and/or Management having approved such reasons

In some instance we noted that certain Personal Assistants to the Claims Managers are able to re-open finalized files on behalf of their Managers. However, the audit trail would reflect as if it was the Claims Manager concerned who re-opened the particular claim file because he/she had in fact furnished the PA with his/her username and password.

Problems and/or trends may not be identified and resolved timeously. In addition, fraudulent and/or fictitious payments could be effected, exposing the Fund to financial loss.

Monitoring controls/measures should be incorporated in the policies and procedures / guidelines to be compiled.

Agreed with Findings.

Regional Managers (5)

Acting Claims executive

17. CLAIMS HANDLING – "DUMMY" CLAIM FILES

COMPLIANCE AUDIT REPORT: REF. IACOP 10/2003

• Lack of formal and standard policies and procedures may result in difficulties in ensuring accountability and responsibility.
• Staff perceptions that Management condones their actions
• Fraudulent/fictitious payments may not be detected timeously resulting in financial loss to the Fund.
• Accuracy and integrity of information contained in more than one version of a claim file may be compromised.
• Other departments, mainly legal costs, have to place reliance on information provided by external parties (e.g. claimant attorneys)

Monitoring controls / measures to ensure compliance with the laid down guidelines should be incorporated in the policy and procedure document.

Acting Claims Executive

17. FRAUDULENT CLAIMS / PAYMENTS

PREVIOUS AUDIT COMMITTEE REPORT

Weaknesses have been identified in the claims computer system; the claims handling process, as well as in the payments process:

• Inadequate segregation of duties
• Inadequate monitoring controls, little or no quality control procedures currently in place during the claims handling process. Approximately 64% (+/- R 1, 2 billion) of capital compensation is paid at claims handler.
• Inadequate capacity in the claims departments
• Inability to authenticate claims documentation
• Lack of application controls.

In addition, there has been reluctance by the employees to report irregularities by fellow colleagues for fear of victimisation.

High exposure to fraudulent activities.

Payments on fraudulent claims have resulted in substantial cash outflows and therefore financial losses to the Fund.

The high incidents of fraud create negative perceptions about the Fund; its management and staff

The Fund should devise more preventative measures or controls to mitigate the risks of fraudulent payments.

Incompatible functions should be identified and segregated.

Executive Management should seriously consider the possibilities of increasing the staff complement in the claims handling departments.

All the Regional Offices should be equipped with the following, in order to assist with the earlier detection of fraudulent claims:

• On-line links with the Department of Transport now installed.
• Links with the Home Affairs Data Base should be arranged.

A project to streamline the claims process is running at the Johannesburg branch.

A finalisation department has been introduced to conduct quality checks.

A new offer system has been implemented in the Regional Offices.

An increase in the staff complement will be included in the 2002/2003 budget.

Links with NATIS and Home Affairs population register are being arranged.

CEO

Executive Management

Refer Audit Findings # 24 &25

PREVIOUS AUDIT COMMITTEE REPORT

There are inadequate monitoring controls over the movement of files between departments and within departments. In addition, the security over claim files is inadequate in that they can be found lying all over in the claims departments.

Claims handlers use individual manual file tracking registers and this does not allow for continuity.

The RAF has a ‘file tracking system’ which has not been in use due to its alleged inefficieny and ineffectiveness.

Refer Audit Finding on « Dummy Claim Files » above.

This exposes the Fund to the risk of files being deliberately destroyed or lost inorder to conceal fraud or irregularities.

The Fund could subsequently suffer huge financial losses as well as lose critical information.

Management should look at all possible safety measures including:

• acquiring lockable steel filing cabinets,
• each dept/section having or being allocated a central point for the safekeeping of all important documents including claim files, etc.
• A central file movement register, located either with the Senior Claims Handler or Claims Manager, while the feasibility study for an electronic system is being conducted.

A policy and procedures should be formulated to control and monitor the movement of files outside the RAF premises.

Management should consider incorporating a file tracking system into the new claims system that is currently under development.

One feature in the system that is to be developed is the imaging / scanning of claims documentation and other correspondence. Therefore, claims will be processed using the imaged documents. All original documentation will be held in storage.

Manager Security has been appointed and will be responsible for overall security including document security.

30. THE CLAIMS COMPUTER SYSTEM

PREVIOUS AUDIT COMMITTEE REPORT

The current claims system application does not take into account basic controls which should have been programmed into the system. For example

• No facility to detect incorrect ID numbers that are incorrectly captured either due to human error or intentionally; and therefore, the system is unable to detect duplicate claims.
• No capacity to detect prescribed claims at time of registration, nor are there automated controls to monitor that become prescribed before they are settled.
• No facility to differentiate between defended and undefended matters, and therefore the controls to monitor the associated mandates are inadequate.
• Inadequate controls to detect duplicate payments
• Some data fields to capture information necessary to process a claim properly, are not compulsory.
• The system does not restrict ‘multiple log-ins’ by a single user.

Irregular and/or fraudulent transactions can not be detected timeously.

Inadequate audit trails, and therefore, inability to follow-up fictitious data that is captured into the system. This could result in failure to provide substantive evidence for criminal / civil cases.

Unreliable information from the database is used to prepare the Fund’s statistical information on which high reliance is placed for decision making.

Failure by the claims system to detect duplicate false claims has resulted in financial losses to the Fund.

Falsified offers and discharge forms can not be detected resulting in financial loss to the Fund.

The claims handling process and therefore the claims system should be revisited so as to identify problem areas at each step of the claims handling process from the time that the claim is lodged and registered to the stage where the claim file is archived.

The following issues were already addressed during the design phase of the new claims life cycle.

• File tracking
• Verification procedures to detect incorrect ID’s, and other related issues as per report item XIII – The Claims Computer system.

Claims Executive (Acting)

Chief Information Officer

30. UTILISATION OF THE CLAIMS SYSTEM

PREVIOUS AUDIT COMMITTEE REPORT

The claims system is underutilised by the claims department mainly due to a lack of adequate training with respect to the capabilities of the system.

There are various modules in the claims system that are either not used or are not used consistently.

Information which may be considered vital for decision making purposes may not be available from the system. This was evidenced by the inability of the Fund to furnish the RAF Commission with information that the commission has requested.

The incapability of the claims managers to use the system as a management tool results in their failure to detect fraudulent claims or payments timeously, if ever.

MIS software should be made available to Claims Management, and they should be trained on the use thereof.

The ICT department should adopt and introduce a Systems Development methodology that will ensure the involvement of the Claims Management and other end-users in the redesign and development of the new claims system.

This will assist in ensuring that basic and necessary controls are built into they system.

Claims Management

Chief Information Officer

A new claims system is currently under development. The design hereof is based on the new claims life cycle that is being piloted at the Johannesburg branch.

PREVIOUS AUDIT COMMITTEE REPORT

The offer system was not properly planned and designed to meet the needs of the business:

• System development life cycle methodology not used
• No user requirements were received by the development team
• No formal project management was followed during the development of the offer system
• No training was offered to users regarding version 2 of the offer system
• The system is not yet signed off by the users.
• No formal change management was followed during system maintenance
• Errors have been identified on the offer system
• The system was rolled out to all the branches despite the problems and errors that had been identified during the pilot run at the Pretoria branch.
• Claims officials can bypass the offer system.

The system appears to be failing to drive processes.

The weaknesess and errors in the system can result in the manipulation thereof, and therefore inability to detect irregular activities timeously.

Delays in processing claims as a result of system inavailability.

Management should institute a corrective action where user departments (i.e. business

process owners) and Application Services should work together to get the systems working properly.

• User departments should hold sessions with Application Services to discuss practical problems and errors encountered.
• Application Service should investigate the problems, explore scenarios then

• Access control should be scrutinised and users be given access and rights only to

We acknowledge failure to adhere to the system development life cycle methodology. However, the task team, which was made up of users and development staff, has completed an investigation. Specific changes and enhancement to the system are already in progress.

The following policies are being drafted, and we will be presenting the initial draft during the beginning of September 2002.

● Disaster Recovery plan

● IT Security Policy

(Acting) Chief Information Officer

Claims Management

The documentation of the policies has not been finalized.

One of the Strategic objectives of the Fund is to be accessible and visible to the public by providing extra delivery channels. Executive Management therefore opened a new branch in the Eastern Cape Province as the Fund was not represented in this region.

However, planning for the establishment of the East London branch did not address certain critical areas:

• A large number of claims was relocated to this branch prematurely, before the infrastructural requirements had been addressed, properly.
• The Manager initially appointed to head this branch was not given a mandate to settle claims. Alternatively, this mandate was not communicated to him.
• Limited number of staff with mandates to settle claims.
• There were various computer related problems, which included inavailability of printers, users not given access rights, and therefore delays with training.
• No archiving unit in place

Delays in processing of claims, will result in a backlog, and therefore expose the Fund to the risk of increased summons and legal costs.

Inefficient and ineffective utilization of human resources.

Project Plans should be developed and communicated to all the role-players, whenever major operations or activities are undertaken. Critical paths should be identified and a project manager be appointed and assigned to co-ordinate these activities.

It is recommended that the issue of mandates in the branch be attended to as a matter of urgency.

Mr Donald Diale an experienced Claims Manager has been appointed to head the Branch.

The Branch Manager is addressing the issue of the archives function.

30. ARBITRATION PROJECT

PREVIOUS AUDIT COMMITTEE REPORT

The following weaknesses in the Arbitration Project have been identified:

• Inconsistent compliance with the RAF Arbitration rules
• Offers increased without the justification thereof being documented.
• The current payment module of the claims system is totally not capable to handle payments to the Arbitration Forum. No other accounting systems has been put in place.
• There is inadequate communication between the RAF’s Legal Costs Department, responsible for authorizing payments to the Forum and the Arbitration section, which is responsible for effecting payments.

The objective of settling claims without unwarranted delays is being achieved. However, the cost of settling the claims may far exceed the associated benefit.

The increase in settlement amounts without any apparent justification thereof may have adverse financial implications for the Fund.

Incorrect Arbitration fees may be paid out. It is difficult to monitor the fees that are recoverable from the Arbitration Forum.

Inability to determine amounts due and payable to, as well as refundable by, the Arbitration Forum, may result in overpayments and therefore financial loss to the Fund.

Management should ensure that the weaknesses identified during the pilot project are either eliminated, resolved or appropriate measures are in place for the management thereof; before the mediation and arbitration project is rolled out.

The purpose, policies and procedures of the Arbitration Unit should be documented and communicated. There should be proper documentation of the workflow between the responsible departments, claims, arbitration, legal costs.

A computer system should be designed to support the mediation and arbitration process.

The responsibility to oversee the roll-out of the mediation and arbitration section has been assigned to the Senior Litigation Manager, and the Executive Corporate Legal Services.

Responsible Person

Executive Corporate Legal Services

The Mediation and Arbitration function has not been rolled out to all the branches. This function remains in the Cape Town Regional Office where it was originally piloted.

PREVIOUS AUDIT COMMITTEE REPORT

Policies and procedures provide guidelines and are training tools for the employees in their day to day activities.

However, there are key policies and procedures that have not been formalized.

Employees are either ignorant of the procedures that should be followed, or they may deliberately ignore to follow the correct procedures.

As a result of the lack of documented policies and procedures, the Fund has not been able in some instances to hold employees accountable for their ignorance, gross negligence or non-conformance.

The documentation of the policies and procedures should be considered as high priority and Senior and Executive Management should drive this process.

The list of recommended policies and procedures that was compiled by internal audit should be updated and used as a checklist of all outstanding policies.

The Manager Budgets and Policies has been assigned the responsibility over policies and procedures of the Fund.

A code of Conduct was adopted at an Executive and Senior Management meeting – July 2002.

Finance Executive

Manager Budgets and Policies