Report of the Auditor-General for the year ended 31 March 2006

AUDITOR - GENERAL

REPORT OF THE AUDITOR-GENERAL TO PARLIAMENT ON THE FINANCIAL STATEMENTS OF THE COMPANIES AND INTELLECTUAL PROPERTY REGISTRATION OFFICE FOR THE YEAR ENDED 31 MARCH 2006

1. AUDIT ASSIGNMENT

The financial statements as set out on pages 73 to 97, for the year ended 31 March 2006, have been audited in terms of section 188 of the Constitution of the Republic of South Africa, 1996, read with sections 4 and 20 of the Public Audit Ad, 2004 (Ad No. 25 of 2004). These financial statements are the responsibility of the accounting officer. My responsibility is to express an opinion on these financial statements, based on the audit.

2. SCOPE

The audit was conducted in accordance with the International Standards on Auditing read with General Notice 544 of 2006, issued in Government Gazette no. 28723 of 10 April 2006 and General Notice 808 of 2006, issued in Government Gazette no. 28954 of 23 June 2006. Those standards require that I plan and perform the audit to obtain reasonable 'assurance that the financial statements are free' of material misstatement.

An audit includes:

· examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements

· assessing the accounting principles used and significant estimates made by management

· evaluating the overall financial statement presentation.

I believe that the aud1t provides a reasonable basis for my opinion.

3. QUALIFICATION

3.1 Internal control environment

My audit revealed a generally weak internal control environment which could mainly be attributed to the level of vacancies, rate of staff turnover and various acting positions at senior management level and within the finance department. The entity does not have an approved staff establishment.     

The following are the more significant observations which are also fundamental compliance requirements in terms of sections 38 and 40 of the Public Finance Management Ad, 1999 (Ad No.1 of 1999) (PFMA):

• Policies and procedures are either non existent, not strictly followed and enforced, or have not been updated in the recent past to take into account the changes within the operations of the entity; and

• Budgets, strategic and business plans not being approved timeously by the accounting officer and lack of proper financial and performance management systems

The qualification paragraphs below are the direct results of inadequate policies or policies not being strictly enforced. '

3.2 Inventory and asset management

Weaknesses in inventory and asset management continue to exist at the Companies and Intellectual Property Registration Office (CIPRO). Consequently, obsolete stock and absence of physical assets recorded in the asset register are not timeously identified and addressed by management.

3.3 Trade and other receivables

Included in trade and other receivables (note 6 to the financial statements) is an amount of R576 704 which may not be recoverable as this amount relates to recoveries of telephone expenses from staff members of CIPRO on a ratio determined by management.

3.4 Recording of revenue

CIPRO has adopted the declining balance basis for customers to transact with CIPRO. This means that customers must deposit money in advance into CIPRO's bank account and as the customer transacts and transactions are billed against the customer, the billings are netted off against the amount on hand in the particular customer's account. System weaknesses were identified particularly for intellectual property transactions, where transactions were either not billed to the customer, or billed after some time. Instances were also identified where the customer did not deposit funds in advance but could still transact with CIPRO. No debtor was raised for these transactions. I could therefore not satisfy myself that revenue recognised in the financial statements of CIPRO is complete and accurate.

Furthermore, as a consequence of the weaknesses identified in the billing system I could also not obtain adequate audit assurance that the income received in advance of R20 752 545 as disclosed in note 11 to financial statements, actually exists and is correctly valued.

3.5 Procurement deviations

Further deviations from CIPRO's procurement procedural manual and policy document were identified during the financial year under review, similar to those reported in paragraph 4.2.1 of my previous audit report. Instances identified during this reporting period included, amongst others:

• Inadequate supporting documentation and procurement policies not adhered to as CIPRO was obliged to pay for expenditure where the required delegations were bypassed and were not involved in the procurement process or tender procedures were not followed.

• Possible fruitless expenditure for information technology services paid to a service provider, as my audit revealed that none of the milestones agreed with the" service provider were met and payments still continue to be made for services rendered. Payments totalling R1.5 million were selected as part of my sample tested during the period under review. Furthermore, an amount of R1.1 million was approved by management during the period under review, but not paid out prior to year end, to be paid over to an equipment leasing company in order to terminate the contract. The payment was payable as contractually agreed between the parties at inception of the lease. Hence payments were made subsequent to year end for services not received. The accounting officer was not consulted in this decision.

• Irregular and fruitless and wasteful expenditure incurred as a result of non compliance with procurement procedures has not been disclosed in the financial statements and neither has action been taken as required in terms of section 55(2)(b) of the PFMA.

3.6 Trade and other payables

Whilst management have passed journal entries to effect adjustments of R1,249,380 identified during the execution of my audit procedures, a full exercise was not undertaken by management to identify all possible adjustments in order to ensure that all expenditure is recorded in the correct period and the accruals raised at year end are complete and correctly valued.

4. DISCLAIMER OF AUDIT OPINION

Because of the significance of the matters discussed in paragraphs 3.1 to 3.6, I am unable to express an opinion on the financial statements.

5. EMPHASIS OF MATTER

Without further qualifying the audit opinion, attention is drawn to the following matters:

5.1 Internal audit and audit committee

The entity did not have a fully functional audit committee and internal audit function for a significant part of the financial year under review. This situation also arose mainly due to instability at senior management level and vacancies within the internal audit department. Consequently, the requirements of Treasury Regulations 3.1 and 3.2, which have been issued in terms of the PFMA were not fully complied with.

5.2 Non compliance with Treasury Regulation

A year end function for CIPRO staff was held during November 2005 and letters were sent out to business houses requesting sponsorship for the function. The approval of the accounting officer was not obtained and no disclosure is provided on the details of the sponsorships received in the notes to the financial statements, both of which are contrary to the requirements of Treasury Regulation 21.

5.3 Submission of financial statements

According to section 40(1) (c) of the PFMA, the accounting officer for a trading entity must submit financial statements within two months after the end of the financial year to me for auditing. Although the entity submitted financial statements on 31 May 2006 for auditing, adjustments were made to the financial statements submitted on the due date and the final approved set was received on 03 August 2006.

5.4 Investigation into procurement at CIPRO

A report on an investigation into possible procurement irregularities identified at CIPRO during the 2004/05 financial year was finalised in July 2006.

The investigation focused on the procurement process of goods and services and the main findings are as follows:

• In general CIPRO did not comply with the internal procurement procedural manual and policy and other procurement prescripts such as the State Tender Board Regulations, 1998, the -State Information Technology Agency Act, 1998 (Act No. 88 of 1998) and the PFMA.

• The supply chain management system was not implemented. Furthermore, a departmental tender committee was not established

• CIPRO did not comply with various sections of the Preferential Procurement Regulations, 2001 as no preferential point system was implemented and Historically Disadvantaged Individuals and Black Economic Empowerment status was not taken into account in evaluating tenders and awarding contracts.

• Members of the previous Advisory Board of CIPRO had interests-in businesses with which CIPRO contracted for services and no declarations of interest documents were signed.

• CIPRO did not obtain approval from the relevant legislature as required by Treasury Regulation 21 .1.1 for a sponsorship amounting to R233 746. This amount is unrelated to the issue reported in paragraph 5.2 above.

5.5 Follow-up information systems audit of the general controls at CIPRO

A follow-up information systems (IS) audit of the general controls at CIPRO was completed in March 2006 and the findings were reported to the accounting officer. The accounting officer's comments, dated July 2006, referred to various corrective measures to be taken to address the weaknesses identified. The effectiveness of these measures will be evaluated during the next audit.

The follow-up audit indicated that little progress had been made in addressing the weaknesses identified during the previous audit, which was completed in July 2004. The most significant weaknesses identified were the following

• A disaster recovery plan had not been formally approved and established. Consequently, CIPRO might not be able to recover normal business operations, should a disaster occur.

• Although user account management procedures had been formally established, they were not adhered to and the procedures did not address certain critical aspects.

• A change control committee had not been established to prioritise and approve program change requests, the approved change control procedures were not adhered to and programmers still had access to the production environment.

• Physical access and environmental controls were inadequate as the security of CIPRO servers stationed in the server room at the department of trade and industry (the dti) could not be ensured due to the fact that anyone authorised to enter the server room could access these servers. Furthermore, developers and network administrators all sat in an open area which did not offer any physical security.

• Backup procedures, as well as the testing and restoration procedures, were still inadequate. Backup reports were hardly ever reviewed by management and a service level agreement (SLA) had not been established for the off-site storage of backup tapes.

• Various logical security setting weaknesses were identified on the UNIX server at CIPRO. Inappropriate settings might increase the risk of unauthorised access to systems.

• The activities and performance of consultants were not monitored and controlled by means of policies 'and procedures. Formal contracts or SLAs were also not in place between CIPRO and certain suppliers.

The duties of critical information technology functions were not adequately segregated.
6. APPRECIATION


The assistance rendered by the staff of CIPRO during the audit is sincerely appreciated.

F Joubert for Auditor-General:

07 August 2006