1. Experiences and common shortfalls on GRAP 17 audits
Shelmadene Petzer
Auditor-General of South Africa

2. Introduction Drivers of internal control Asset management systems
Asset registers
Reconciliation between the General Ledger and the asset register
Ownership of assets
Identification of infrastructure
Assessment of useful lives, residual values and impairment
Use of consultants and valuation experts
Directive 4 transitional provisions
General comments

3. Drivers of internal control
Leadership
Provide effective leadership based on a culture of honesty, ethical business practices and good governance, protecting and enhancing the best interests of the entity
Exercise oversight responsibility regarding financial and performance reporting and compliance and related internal controls
Implement effective HR management to ensure that adequate and sufficiently skilled resources are in place and that performance is monitored
Establish and communicate policies and procedures to enable and support understanding and execution of internal control objectives, processes, and responsibilities
Develop and monitor the implementation of action plans to address internal control deficiencies
Establish an IT governance framework that supports and enables the business, delivers value and improves performance

4. Drivers of internal control (continued)
Financial and performance management
Implement proper record keeping in a timely manner to ensure that complete, relevant and accurate information is accessible and available to support financial and performance reporting
Implement controls over daily and monthly processing and reconciling of transactions
Prepare regular, accurate and complete financial and performance reports that are supported and evidenced by reliable information
Review and monitor compliance with applicable laws and regulations
Design and implement formal controls over IT systems to ensure the reliability of the systems and the availability, accuracy and protection of information

5. Drivers of internal control (continued)
Governance
Implement appropriate risk management activities to ensure that regular risk assessments, including consideration of IT risks and fraud prevention, are conducted and that a risk strategy to address the risks is developed and monitored
Ensure that there is an adequately resourced and functioning internal audit unit that identifies internal control deficiencies and recommends corrective action effectively.
Ensure that the audit committee promotes accountability and service delivery through evaluating and monitoring responses to risks and providing oversight over the effectiveness of the internal control environment including financial and performance reporting and compliance with laws and regulations

6. Asset management systems
Challenges
Costly to acquire asset management software that support GRAP compliant information
 Under-utilisation of functionalities of the asset management system
 Asset management system not integrated with the financial system
 Lack of skills and/or capacity to operate and maintain the asset management system
Suggestions
A single asset management system to be implemented by all municipalities
 Asset management systems to be run by suitably qualified and experienced consultants
Monetary support to enable municipalities to obtain suitable asset management software
Improved training and support by National and Provincial
Treasuries

7. Asset registers Challenges Asset registers are not:
mathematically accurate
complete
updated and maintained
Information in the asset registers does not facilitate GRAP compliance
Asset information in the asset register is not descriptive, making identification of and locating the assets difficult
Asset registers are not available for audit on a timely basis
Auditing of a GRAP compliant asset register for the first time is time consuming and requires the involvement of senior auditors and/or experts; the audit time between Aug and Nov is insufficient to do this

8. Asset registers (continued)
Suggestions
Regular (monthly / quarterly) asset counts and monitoring
Continuous (at least monthly) update and maintenance of asset registers
Proper identification (bar-coding) of assets
Implementation of safeguarding controls

9. Reconciliation between the General Ledger and the asset register
Challenges
Information in the asset registers does not reconcile to the General Ledger
Unidentified / unexplained reconciling items
Separate asset management and financial systems – no integration
Suggestions
Implementation of a real time integrated system – costly
Monthly reconciliation of the General Ledger and the asset register and asset management system (as opposed to at the end of the year when required by auditors)
Proper monthly reviews by senior officials of reconciliations

10. Ownership of assets Challenges Tribal land: ownership of land
buildings constructed thereon by municipalities
Uncertainty about ownership of:
land in rural areas or where land has not yet been sub-divided
community buildings constructed on municipal land
buildings such as schools and clinics that are incorrectly recognised in the financial statements of a municipality instead of the DPW or Department of Basic Education
Title deeds:
none available
in the name of former regional councils
in the old names of the municipalities prior to name changes
in the name of previous municipalities prior to amalgamation or changes in demarcation
An independent audit committee fulfils a vital role in corporate governance. The audit committee is vital to, among other things, ensure the integrity of integrated reporting and internal financial controls and identify and manage financial risks.
The audit committee should be an integral component of the risk management process
The responsibility for a company’s risk management function, specifically implementing risk management processes, is that of management.
The board should assign oversight of the company’s risk management function to an appropriate board committee (for example a risk committee or the audit committee).
The audit committee should satisfy itself that the following areas have been appropriately addressed by itself, failing specific assignment by the board:
- financial reporting risks;
- internal financial controls;
- fraud risk as it relates to financial reporting; and
- IT risks as it relates to financial reporting.

11. Ownership of assets (continued)
Challenges (continued)
Valuation roll:
impact of ownership issues on the completeness of the valuation roll (and consequently on revenue generation)
reconciliation of information in the asset register with the valuation roll
Uncertainty about ownership of assets due to many changes in powers and functions; sometimes annually and/or with retrospective effect, with insufficient consideration of the practical implementation issues
Clarity is needed where functions are shared between:
local and district municipalities (e.g. water services)
municipalities and departments (e.g. clinics)
No guidance or support is available to assist with these matters
The board should be responsible for the governance of risk
The board should exercise leadership to prevent risk management from becoming a series of activities that are detached from the realities of the company’s business.
The board should be able to demonstrate that it has dealt with the governance of risk comprehensively. This should include the development and implementation of a policy and plan for a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, as well as the related internal control, compliance and governance processes within the company.
The board should be able to disclose how it has satisfied itself that risk assessments, responses and interventions are effective.
The board’s responsibility for risk governance should manifest into a documented risk management policy and plan. Management should develop both the risk management policy and the plan for approval by the board.
The board should continually monitor significant risk taken by management, and should satisfy itself that management decisions balance performance with the defined tolerance limits. The board should ensure that it understands the implications of risks taken by management in pursuit of returns, as well as the potential impact of risk-taking on stakeholders.

12. Ownership of assets (continued)
Suggestions
NT and COGTA should provide detailed guidance per municipality on shared powers and functions and who should account for the related assets
Assistance and guidance from the Department of Rural Development and Land Reform, DPW and NT in order to resolve ownership issues

13. Identification of infrastructure
Challenges
Individual infrastructure assets are not identified, but indicated in the asset register as one line “infrastructure assets”, consequently the auditors cannot verify the existence and completeness thereof
Identification of infrastructure assets is a timely and costly process
Municipalities do not have the capacity and expertise to perform the identification of infrastructure assets and need consultants, engineers and other specialists to do so
Consultants in many cases do not understanding the full extent of GRAP 17 requirements and either do an incomplete job or it takes very long
Changes are made and adjusting journals prepared by the consultants, without the municipality understanding (owning) the detail behind these journals
Supporting documentation and working papers for the asset verification are not properly maintained or not provided by the consultants and are therefore not available to the auditors
Management should identify and consider different ways that the company can respond to the risks identified during the risk assessment process. These responses opted for should be noted in the risk register. The options for responses should include:
avoiding the risk by not starting the activity that creates exposure to the risk;
treating, reducing or mitigating the risk, through improvements to the control environment such as the development of contingencies and business continuity plans. Risk treatment may include methods, procedures, applications, managements systems and the use of appropriate resources that reduce the probability or possible severity of the risk;
transferring the risk exposure, usually to a third party better able to manage the risk, for example, through insurance or outsourcing;
tolerating or accepting the risk, where the level of exposure is as low as reasonably practicable or where there are exceptional circumstances;
exploiting the risk, where the risk exposure represents a potential missed or poorly- realised opportunity;
terminating the activity that gives rise to the intolerable risk; and
integrating some or all of the risk responses outlined above.

14. Identification of infrastructure (continued)
Suggestions
Better cooperation between technical and finance departments to ensure all assets are identified
Municipal officials must be closely involved with the work performed by consultants
Early involvement of the audit team at the start of the process
NT to provide a list of approved engineering consultants and other specialists and prescribe what information such consultants must make available for audit purposes
Knowledge sharing and assistance by metros and others who have succeeded

15. Assessment of useful lives, residual values and impairment
Challenges
It is impractical to assess useful lives, residual values and indicators of impairment at each reporting date:
large number of assets
infrastructure assets, e.g. underground pipes
costly
Fully depreciated assets still in use
Challenges with the distinction between cash-generating and non-cash-generating assets for impairment purposes
Difficult to audit municipalities’ assessments of useful lives, residual values and indicators and estimation of impairment; may require the use of an expert by the auditors
Suggestions
NT to provide guidance on simplified methods for assessing useful lives, residual values and indicators and estimation of impairment
that still comply with GRAPs

16. Use of consultants and valuation experts
Challenges
Extensive use is made of consultants/ experts
Affordability:
contracting of consultants/ experts is expensive and not value for money
municipalities sometimes have to settle for consultants/ experts
which they can afford rather than those that are suitably qualified
and experienced to perform the required work
Poor quality of work; consultants/ experts are contracted to resolve problems, yet the problem still remains after the consultants/ experts
have completed their work
There is a lack of control over the work performed by consultants/ experts
Consultants’/ experts’ supporting documentation and working papers
are not made available to the municipalities and auditors
No skills transfer takes place; making municipalities permanently dependent on consultants/ experts

17. Use of consultants and valuation experts (continued)
Challenges (continued)
Difficult and time consuming to audit the methods, assumptions,
data, etc. used by consultants/ experts
Contracts with consultants do not protect the interests of the municipality (no penalties or come backs)
Suggestions
NT to provide a list of approved consultants/ experts
NT to continually assess the experience and skills of such consultants/ experts
NT to prescribe tariffs that consultants/ experts doing work in the public sector may charge
NT to prescribe what information and supporting documentation consultants/ experts must make available to the municipalities and auditors
Standard contracts to be made available to protect the interests of municipalities

18. Directive 4 transitional provisions
Challenges
All assets were recognised at R0, as the transitional provisions allowed assets to be recognised at provisional amounts
No asset management implementation plans to ensure municipalities will achieve the GRAP 17 requirements at end of the transitional provision period
No disclosure in the financial statements regarding the use of the transitional provisions and the progress towards full GRAP compliance
Assets acquired after the effective date of GRAP not recognised in the asset register or recognised at R0
Confusion regarding what constitutes “recognition” and what forms part of “measurement”
Municipalities have not started with the measurement of assets, but are leaving this to year-3 of the transitional provision period
Changes resulting from full compliance with GRAP to be accounted for retrospectively (cost and effort vs. benefit)

19. Directive 4 transitional provisions (continued)
Suggestions
Municipalities to prepare and submit detailed asset management implementation plans to NT
Provincial Treasuries to monitor implementation on a monthly basis, supported with quarterly monitoring by National Treasury

20. General comments
Inconsistencies in interpretation between different municipalities
Confusion about the status of and manner in which the ASB FAQs should be applied
ASB FAQs not taken into consideration by municipalities as they are not considered to have any status
Centralise certain systems and functions at districts or municipalities in locations where skills are readily available
Non-accounting for assets impacts the ability to effectively maintain assets, which in turn impacts on:
useful lives, residual values and impairment
losses (water, electricity, etc.)
service delivery

21. General comments (continued)
In conclusion
How good is the understanding of the standards by the average non technical accountant?
Section 89(1)(b) of the PFMA
The Accounting Standards Board must prepare and publish directives and guidelines concerning the Standards of GRAP
Section 89(2)(a) & (b) of the PFMA
In setting standards the Board must take into account all relevant factors, including:
best accounting practices, both locally and internationally
the capacity of the relevant institutions to comply with the standards

22. Reputation promise/mission
The Auditor-General of South Africa has a constitutional mandate and, as the Supreme Audit Institution (SAI) of South Africa, it exists to strengthen our country’s democracy by enabling oversight, accountability and governance in the public sector through auditing, thereby building public confidence.