“Q.1 Relates to Agenda Item 6 Paper B. Action Plan following AIS Audit Report – final report issued 31 October 2013 – 3.5a (Application availability cannot be assured.) RAG status Amber.
The recommendation (B9) by the AIS System Owner “require(s) the implementation of an SLA…..” Why will Southwest One not agree to an SLA as recommended? Why can an agreement with Northgate not be reached?
Answer 1 SWO will not agree to an SLA as it states because they cannot guarantee its delivery unless they have an agreement with Northgate. We will endeavour to get an answer to the second part of this either at the Committee or shortly after from SWO.
Q.2 Relates to Paper C SAP IT Controls Report
Please can details be provided as to why the Grant Thornton report discussed at the last Audit Committee
Was redacted aproximately a month after it was discussed in the public domain?
Answer 2 The report posted before the last Audit Committee was posted in error. It contained some IDs and passwords that should not have been included in the published report. It was therefore redacted for security reasons. The main themes and concerns raised by the report remain unchanged and as you know the Audit Committee discussed these in full. The report came through to the senior managers of SCC quite late and the wrong version was posted by mistake. The chair of the Audit Committee was notified of the change as soon as it was discovered.
Q.3 Relates to Paper E Risk Management update.
a) Appendix A E4 Risk Reference ORG0025 “We do not have mechanisms in place for measuring cumulative impact of decisions” is RAG status Red and 14% implemented. What steps and measures are being taken to identify the impact on sections of society?
b) When is it anticipated that the “% implemented” will increase significantly from the present 14%
c) Are resources available to minimise any adverse impacts identified?
d) Part 3.5 (E2) shows that R1, R2 and R3 continuing at RAG status Red. When is it anticipated that the Red status will change? What systems, processes, monitoring, education and training are being deployed to reduce the risks in this area?
Answer 3 a,b and c)
More resource has been secured to support the corporate impact assessment process. We were deficient in measuring the sustainability impact theme and have rectified that position. Work is continuing to increase the percentage completion at a rate of knots to meet the MTFP timetable. The reason this percentage was so low was down to timing. Work could not be completed until options had been finalised and they were only finalised last week. We are now confident that we will meet the target and reduce this risk considerably. There always remains an element of risk as some assessment of impact can be subjective but professional theme leads should help managers to ensure that the impact of all sections of society is considered.
All managers have been advised of their responsibility to review risks and it is anticipated that any outstanding training issues will be addressed by the end of January. At the last Cabinet meeting when these PIs were reviewed, it was reported that R1, R2 and R3 would move from red to at least amber by the final quarter of the financial year.