Docstoc

FOLLOW UP REPORT

Document Sample
FOLLOW UP REPORT Powered By Docstoc
					Report on the accounts of Vote 15 — South African Revenue Service

FOLLOW- UP R E POR T
OF THE

AUDITOR-GENERAL
ON THE

IMPACT OF THE YEAR 2000 ON COMPUTER SYSTEMS IN NATIONAL DEPARTMENTS AND PROVINCIAL ADMINISTRATIONS

PUBLISHED BY AUTHORITY

RP 179/1998 ................... ISBN ........................................
Obtainable from the Government Printer, Bosman Street. Private Bag X85, Pretoria 0001. Tel: (012) 323 9731 x 260

i

Report on the accounts of Vote 15 — South African Revenue Service

Cover design by Big Door Layout and Repro by Business Design & Repro Centre, Pretoria Printed and bound by Business Print Centre, Pretoria

ii

Report on the accounts of Vote 15 — South African Revenue Service

TABLE OF CONTENTS

1. 2. 3. 4. 5.

Context and purpose of the Follow-up Report Audit approach Key findings Conclusion Appreciation

3 4 6 11 12

iii

Report on the accounts of Vote 15 — South African Revenue Service

iv

Report on the accounts of Vote 15 — South African Revenue Service

FOLLOW-UP REPORT of the AUDITOR-GENERAL on the IMPACT OF THE YEAR 2000 ON COMPUTER SYSTEMS IN NATIONAL DEPARTMENTS AND PROVINCIAL ADMINISTRATIONS

1.
1.1

CONTEXT AND PURPOSE OF THE FOLLOW-UP REPORT
While considering evidence with regard to the Special Report of the AuditorGeneral on the Findings Arising from Computer Audits of Transversal Computer Systems [RP 112/1997], and the Special Report of the AuditorGeneral Arising from a Follow-up Computer Audit Concerning Important Aspects of Information Technology in National Departments [RP 129/1997], the Standing Committee on Public Accounts (SCOPA) also considered evidence with regard to Year 2000 compliance. In its Fifth and Tenth Reports dated 17 November 1997 and 3 June 1998, respectively, SCOPA recommended, amongst others, the following: The Departments of Finance and of State Expenditure (DSE) must ensure that:
s

1.1.1

the cost of computer system adjustments in respect of Year 2000 compliance is determined before the 1998-99 budget is finalised; and provincial and local government administrations, as well as parastatal institutions, are fully apprised of the implications of non-compliance with Year 2000 requirements, and appropriate provision is made in the upcoming budget cycle for the anticipated adjustments.

s

1.1.2

The DSE must ensure that adequate financial provision is made by national departments and provincial administrations for achieving Year 2000 compliance. The DSE, the Department of Public Service and Administration (DPSA) and the Department of Constitutional Development must, as a matter of urgency, make national departments and provincial administrations aware of their responsibilities in terms of Year 2000 compliance and ensure that contingency plans are in place where Year 2000 compliance cannot be achieved.

1.1.3

1

Report on the accounts of Vote 15 — South African Revenue Service

1.1.4

The progress in respect of the Year 2000 problem should be assessed by this Office and reported on regularly to SCOPA. Furthermore, a Special Report on the Impact of the Year 2000 on Computer Systems in National Departments and Provincial Administrations [RP 75/1998] (Special Report), was also tabled in Parliament on 22 April 1998 to inform it of the impact of the Year 2000 problem, the reasons therefore and what the national departments and provincial administrations were doing to ensure the continuation of effective business processes in the Year 2000. The purpose of this Follow-up Report (Report) is to inform Parliament of the progress that has been made by national departments and provincial administrations in dealing with the Year 2000 problem. For the purpose of this Report, national departments include the organisational components mentioned in Schedule 2 of the Public Service Act, Act No. 103 of 1994. It is hoped that this Report will assist in ensuring that effective steps are taken in cases where the Year 2000 problem has not yet been adequately addressed.

1.2

1.3

1.4

2

Report on the accounts of Vote 15 — South African Revenue Service

2.
2.1

AUDIT APPROACH
BACKGROUND 2.1.1 Audits of computer systems take place in a computerised information system environment where, in the first instance, it is the responsibility of the accounting officers concerned to institute and maintain adequate accounting and control systems. A national Year 2000 Decision Support Centre (Y2K Centre) was constituted as a Section 21 Company on 31 January 1998 to act as governmentís mechanism to inform the general South African public, the private sector, state-owned enterprises, financial institutions, et cetera, of the impact on and potential disruption of services as a result of the Year 2000 problem. The functions of the Y2K Centre are:
s

2.1.2

being responsible for monitoring the status of Year 2000 compliance for the whole of South Africa; coordinating the various initiatives in both the public and private sectors to find solutions, and developing contingency plans to deal with the Year 2000 problem; and liaising with international organisations to ensure that South Africa can draw on global best practices and international expertise to manage the Year 2000 problem.

s

s

2.1.3

In fulfilling its responsibilities, the Y2K Centre aims to:
s

raise awareness of the Year 2000 problem in all sectors of the economy; prevent duplication of effort and lower the cost of conversion by making international best practices, methodologies, et cetera, available to all; monitor the state of readiness of the country as a whole; and model national dependencies and provide proactive alerts to government and industr y.

s

s

s

2.1.4

The function of collecting information and monitoring previously undertaken by the DPSA, was taken over by the Y2K Centre in June 1998.

3

Report on the accounts of Vote 15 — South African Revenue Service

2.2

MODUS OPERANDI

Apart from information obtained during various computer audits, the sample-based comments of the accounting officers of the DSE and the Departments of Defence, Labour and Health, which operate critical systems, were requested on the Year 2000 issue. The Y2K Centre, which monitors the Year 2000 issue, also submitted a progress report that reflected the Year 2000 status of national departments and provincial administrations as at November 1998. The key findings in paragraph 3 below, were derived from an evaluation of the information provided by the aforementioned institutions.

4

Report on the accounts of Vote 15 — South African Revenue Service

3.
3.1

KEY FINDINGS
CO-ORDINATION AND MONITORING Inadequate responses to questionnaire: The Y2K Centre, after taking over the responsibility of obtaining information in respect of the Year 2000 project from the DPSA, issued a revised questionnaire (Y2K Centre questionnaire) for the first time during September 1998, for return on a monthly basis. The Y2K Centre questionnaire was issued to 38 national departments and nine provincial administrations. Responses to the Y2K Centre questionnaire were generally not satisfactory. The following national departments and provincial administrations did not respond and their progress as at November 1998 was therefore not known:
s s s s s s s s

Department of Trade and Industry Independent Complaints Directorate Free State Provincial Administration Gauteng Provincial Administration KwaZulu-Natal Provincial Administration Mpumalanga Provincial Administration Northern Cape Provincial Administration Western Cape Provincial Administration

3.2

FEEDBACK Inaccurate feedback: With reference to paragraph 4(3)(e), page 7, of the Special Report, the Department of Labour and the Office of the Executive Deputy President indicated that their systems were Year 2000 compliant as at September 1997.However, in response to the Y2K Centre questionnaire, the Department of Labour indicated that the assessment phase was in progress as at November 1998, while the Office of the Executive Deputy President indicated that new systems had to be purchased to address the Year 2000 problem. Furthermore, the Free State Provincial Administration (FSPA) during April 1998 indicated to the DPSA that its systems were Year 2000 compliant. However, comments received from nine of the 11 departments of the FSPA proved the response to the DPSA to be incorrect, as it was clear that four of these departments did not have an approved documented plan to address the Year 2000 problem. Furthermore, available evidence indicated that on 21 August 1998, five of these departments had not tested all the hardware and applications for Year 2000 compliance.

5

Report on the accounts of Vote 15 — South African Revenue Service

3.3

PROGRESS Progress generally inadequate:

3.3.1

In the Y2K Centre questionnaire, national departments and provincial administrations were requested to indicate the progress in respect of mission critical systems. The mission critical system was defined in the Y2K Centre questionnaire as a system that will totally disrupt the supply of services to the community or stakeholders, or a system that could cause business to collapse if it malfunctions. However, the information supplied in the Y2K Centre questionnaire, did not include the status of embedded systems. On 10 April 1997 the Office of the State Tender Board approved a panel of tenderers who may assist participating national departments and provincial administrations to become Year 2000 compliant (Contract RTG 9962 SA). The contract recommended the following completion dates for the specific phases of the Year 2000 project:
Description Assessment Analysis and planning Problem resolution Integration and testing Recommended completion date End of February 1998 June 1998 December 1998 Commencing January 1999

3.3.2

Phase Phase I Phase II Phase III Phase IV

From the responses to the Y2K Centre questionnaire, 112 mission critical systems were identified at national departments and provincial administrations as at November†1998. If the responses are benchmarked against the abovementioned phases and completion dates, 17 mission critical systems were in the assessment phase, notwithstanding a recommended completion date of February 1998 and three in the analysis and planning phase, notwithstanding a recommended completion date of June 1998. Furthermore, 27 systems were in the problem resolution phase, 27 in the integration and testing phase and 22 were Year 2000 compliant. The Year 2000 status of the remaining 16 mission critical systems was indicated as either not yet started, unknown, or such that new systems had to be purchased. 3.3.3 Six of the national departments and provincial administrations indicated that a risk existed that their systems would not be Year 2000 compliant by December 1999, indicating the lack of a clear plan to address the Year 2000 problem. The six national departments and provincial administrations as well as the reasons for not being Year 2000 compliant by December 1999, are set out in the following table:

6

Report on the accounts of Vote 15 — South African Revenue Service

National department / provincial administration Department of Health Department of Justice Department of Labour Department of Transport Department of Defence Northern Province Provincial Administration

Reason for not being Year 2000 compliant by December 1999 Not enough time to take all the required steps Time constraints, inadequate budget and lack of resources Time constraints and sufficient funds not yet allocated Lack of manpower Time constraints and sufficient funds not yet allocated Embedded systems in hospital equipment might not be replaced in time

3.4

TENDER TO ADDRESS THE YEAR 2000 PROBLEM Tender to address the Year 2000 problem not generally used: Contract RTG 9962 SA, which provides for a panel of 17 companies with skills to assist participating national departments and provincial administrations to become Year 2000 compliant, was not generally used. Responses to the Y2K Centre questionnaire indicated that as at November 1998, only 14 of the national departments and provincial administrations were using RTG 9962 SA. A number of national departments and provincial administrations were, however, attending to the Year 2000 problem as part of existing maintenance contracts.

3.5

EMBEDDED SYSTEMS Progress generally inadequate: As mentioned in paragraph 3.3.1 above, the Y2K Centre questionnaire did not include embedded systems. Letters were sent to selected departments by this Office, requesting an indication of the progress in respect of embedded systems. The following progress in this regard was furnished by accounting officers. Health services systems: With regard to health services systems, high reliance is placed on systems for many of the services that patients require, including admissions, patient records, laboratory tests, et cetera. Many of the more sophisticated laboratory, X-ray and life-support systems contain embedded computer chips, and failure of these systems could have serious consequences for patients. Failure of non-medical equipment could also seriously affect patients, for example, failure of air-conditioning equipment could cause operating theatres to close. Some systems depend on the correct operation of several other systems. There is thus the possibility of simultaneous multiple failures. A letter in this regard was issued to the accounting officer of the Department of Health on 3 June 1998. In the
7

3.5.1

3.5.2

Report on the accounts of Vote 15 — South African Revenue Service

comments, the accounting officer indicated that from discussions held at a workshop of the National Health Information System for South Africa Committee on 8 and 9 October 1998, it appears that, with the exception of the Gauteng, Free State and possibly Western Cape and Northern Province Provincial Administrations which were attending to all aspects of the Year 2000 problem, the other provincial administrations were focusing mainly on the traditional Information Technology related implications and not on the embedded computer chips in medical equipment. The accounting officer further indicated that more information in this regard had been requested from each provincial administration with a due date of 3 November 1998, whereafter a plan would be drawn up to ensure that every provincial administration addressed the problem with regard to medical equipment.

3.5.3

Weapons systems: The Department of Defence (DOD) indicated on 24 August 1998 the following regarding embedded weapons systems at the various Arms of Services: (a) At the South African Army, the impact on embedded weapons systems was still being assessed. (b) At the South African Air Force, 58 embedded weapons systems had been identified. However, basic information on 13 of these systems was still to be collated and the initial assessment of the other 45 embedded weapons systems needed to be further confirmed. (c) At the South African Navy, embedded weapons systems were still in the process of identification.

According to the DOD, the completion date for the Year 2000 compliance of the embedded weapons systems was 30 November 1999.

8

Report on the accounts of Vote 15 — South African Revenue Service

3.6

TRANSVERSAL SYSTEMS Reasonable progress made with transversal systems:

3.6.1

The DSE indicated on 23 October 1998 that the progress in respect of the transversal application systems was as follows:
Current phase Conversion and testing Testing Conversion and testing Anticipated date of certification 3/03/1999 31/01/1999 31/12/1998 Revised anticipated date of certification 31/03/1999 31/03/1999 31/12/1998

Transversal system Personnel and Salary System (PERSAL) Basic Accounting System (BAS) Financial Management System (FMS)

3.6.2

The Provisioning Administration System (PAS) mentioned in paragraph 4(4)(a), page 7, of the Special Report is no longer supported by the DSE. The Year 2000 compliance of the PAS is therefore the responsibility of the departments still using it. However, according to the information supplied to the Y2K Centre, none of the departments still using the PAS has identified it as a mission critical system. The anticipated Year 2000 certification date of the new Logistical Information System (LOGIS) that replaced the PAS, was indicated as 31†March 1999.

3.7

COST Accurate cost estimates generally not available:

3.7.1

SCOPA, after having considered the possible disastrous effects of the Year 2000, expressed its concern about the possible disruptive implications of non-compliance with the Year 2000 for the public sector. Its concern was further aggravated by the fact that the 1998/99 budget was the last opportunity for the Government to make financial provision for the costs to adjust computer systems. With reference to Resolution No. 4 of the Fifth Report of Standing Committee on Public Accounts, dated 17 November 1997, mentioned in paragraph 1 above, the Department of Finance and the DSE were requested on 26 June 1998 to inform this Office on the steps taken to comply with the above-mentioned Resolution and to also give an indication of the total amount made available to all national departments and provincial administrations in the 1998/99 budget for Year 2000 compliance. In his response, the Director-General of the DSE indicated that most national departments and provincial administrations had not completed

9

Report on the accounts of Vote 15 — South African Revenue Service

an impact analysis and that a reliable estimate of costs was consequently not available. With regard to the 18 national departments and provincial administrations that responded, amounts of R159 762 650 and R427 397 257 had been budgeted for the 1997/98 and 1998/99 financial years, respectively. Furthermore, the DSE indicated that reminders had been sent to the other national departments and provincial administrations that had not yet replied. In response to the actions taken by the Department of Finance, the Director-General indicated on 5 August 1998 that the Y2K Centre, of which the Department of Finance is a board member, had been asked to ensure Year 2000 compliance in all government and quasi-government departments. 3.7.2 In response to the Y2K questionnaire, 14 of the national departments did not submit information on the amounts budgeted for the Year 2000 problem. The total amount budgeted as indicated by the other 24 national departments amounted to R717 597 555 of which R224 028 112 had been allocated as at November 1998. In response to the Y2K Centre questionnaire, five of the nine provincial administrations did not submit information on amounts budgeted in respect of the Year 2000 problem. The other four provincial administrations indicated that an amount of R68 780 000 had been budgeted in this regard, of which only R23 745 000 had been allocated as at November 1998.

3.7.3

10

Report on the accounts of Vote 15 — South African Revenue Service

4.

CONCLUSION
The Year 2000 issue has had much publicity and accounting officers of national departments and provincial administrations should therefore be aware of their responsibility and the consequences of non-compliance in this regard. Indications are that monitoring is ineffective since feedback is inaccurate. Progress in general is inadequate since a large percentage of national departments and provincial administrations have not yet completed the assessment phase. Overall, there is a risk that the departments which have not completed the assessment and the analysis and planning phases, will not be able to be Year 2000 compliant in time. These include critical systems such as health services systems with embedded computer chips. Since a number of national departments and provincial administrations have not completed the assessment phase, concern also exists as to the accuracy of the amounts budgeted for the Year 2000 problem.

5.

APPRECIATION

The assistance rendered by the different role players during the completion of this Report is sincerely appreciated. (BM13A/3/6)

H. E. KLUEVER, Auditor-General

Pretoria,.......................

11


				
DOCUMENT INFO
Shared By:
Tags: FOLLOW, REPORT
Stats:
views:116
posted:12/19/2009
language:English
pages:15
Description: FOLLOW UP REPORT