b) Audit Committee – composition and appointments

1. The audit committee does consist of at least three members as prescribed by the King
IV (principle 8, point 46) (1½)
2. All members of the audit committee must be independent non-executive directors
(principle 8, point 56). Only one member (Gibbs) is an independent non-executive
director. (1½)
3. The audit committee is chaired by the chairperson of the board. This is not in compliance
with the King IV Report, where it is recommended that the chairperson of the audit
committee should not be the chairperson of the board. (principle 7, point 36) (1½)
Due to the CEO in the scenario being the chairperson of the board, the student should
be awarded 1.5 marks should he/she mention that the CEO should not be the chairperson
of the audit committee (1 ½)
4. The audit committee should be chaired by an independent, non-executive director
(principle 8, point 57). Virat Amla is not an independent non-executive director. (1½)
(Max 4½ marks for this section)

c) Audit committee – meetings

1. The audit committee met only once for the year. It does not comply with the King IV
Report (principle 3.1, point 7) where it states the audit committee should meet at least
twice a year. (1½)
2. The audit committee did not meet with the auditors (both internal and external) at all,
as required by the King IV Report (principle 8 point 58 ) (1½)
3. The audit committee should meet with the internal and external auditors at least once a
year without management being present (principle 8 point 58). As two of the audit
committee members are part of management, they do not comply with this
recommendation. (1½)
(Max 3 marks for this section)

d) General remarks
1. They do not comply with King IV Report recommendations as the audit committee’s
responsibilities are not confined to only nominating the external auditors for
appointment. (principle 8 point 59) (1½) Note: Give 1.5 marks when the student mentions
other duties.
2. The Board did not appoint a nomination, remuneration, risk or social & ethics
committees as required by the King IV Report. (1½)

(Max 3 marks for this section)

(1 marks for presenting answer under the correct headings)

Max of 18 marks for section from 24 available marks + 1 presentation marks

1.2 Six capitals of the integrated report 3 Marks

Reference: King IV (2016:47-48), Adams, Diale & Richard (2019: 4/13)

1. Financial (½)

14
 AUE2602/201/1/2021

2. Manufactured (½)

3. Intellectual (½)

4. Human(½)

5. Natural (½)

6. Social and Relationship (½)

Max of 3 marks for section from 3 available marks

1.3 Controls relating to the implementation of a disaster recovery plan 6 Marks

Reference: Adams, Diale & Richard (2019: 8/22)

1. There should be a written disaster recovery plan (1½)

2. The disaster recovery plan should be widely available to ensure there is no frantic search
should a disaster occur. (1½)
3. More than one plan should be available in physical and electronic version. (1½)
4. The disaster recovery plan should address priorities i.e. where backup data etc. may be
obtained. (1½)
5. The disaster recovery plan should be tested (ideally annually) to ensure that the plan
works as intended. (1½)
6. The disaster recovery plan should detail alternative processing arrangements, e.g.
using a bureau. (1½)
7. The disaster recovery plan should be communicated to all employees (1½);
8. And during the testing of the plan the roles and responsibilities should be evaluated.
(1½)
Max of 6 marks for section from 10½ available marks

1.4 Controls over passwords 12 Marks

Reference: Adams, Diale & Richard (2019: 8/17)

No Describe the weakness Explain why it is a weakness

1 Only one password is Users can therefore reuse old passwords much sooner
remembered by the system

2 Maximum password age is This results in passwords which can easily be memorised
set to 6 months (1) OR or guessed (1)
Password is not frequently
changes (1)
OR

15
 Password is only changes
twice a year (1)

3 Minimum password length is This results in weak passwords which can easily be
set to four characters (1) hacked or guessed (1)

4 Password complexity is Users therefore do not need to ensure that passwords

disabled (1) consist of a mix of letters, numbers, upper/lower case and
symbols. This results in weak passwords which can
easily be hacked or guessed (1)

5 Store password using Passwords can be readable when the file containing the
encryption is disabled (1) passwords is opened. Passwords should be changed
regularly and users should be forced by the system, to
change their password (1)

6 Users to change password at This means that users are allowed to continue using the
first logon is disabled (1) default password, which can normally be guessed easily,
and the IT person that generated the password, knows
the password. (1)

7 Characters are shown when This allows other people the opportunity to see what your
password are typed (1) password is while you are typing it (1)

(1 for each valid identification and 1mark for each description of weakness to the max. of
12 marks)
(Available in total 14 marks)
(1 marks for presenting in table)

1.5 Weaknesses in wage system, biometric data 9 Marks

1.5.1 Weaknesses in the wage system
Reference: Adams, Diale & Richard (2019: 13/9-13/13)

• There is no reliable timekeeping mechanism/clocking system, making it virtually impossible

to prevent invalid hours being “clocked”. OR The clock is broken/batteries not working,
therefore it can lead to an error in the hours recorded (1½)
• Workers record their own times of arrival and departure and could thus create fictitious hours.
(1½)
• As the entry and exit take place through a generally used gate and are unsupervised, workers
can again create fictitious hours. (1½)
• Workers could tick off the names of fellow workers who are not actually at work. (1½)
• Workers could sign in but not actually go to work and return to sign out. (1½)
• “Clocking” documentation controls are poor as there is no documentation (clock card or
similar) which records the time of exit and entry of each employee independently and in
permanent form. (1½)
• The clipboard bearing the daily time sheets is left unattended in the gate hut and could be
lost, or tampered with, for example hours could be altered. (1½)

Max of 6 marks for section from 12 available marks

1.5.2 Biometric data
16