SCM‑NUMSICT Governance & System Assurance Standards

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

AAbbreviations & Acronyms

Abbreviations are expanded upon first use in each section and consolidated here for ease of reference.

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

1Project Charter & Project Plan

Purpose. Defines the system purpose, scope, objectives, stakeholders, responsibilities and implementation approach per KZN ICT Governance Standard §4 (Document 1).

1.1 Executive Summary

The Supply Chain Management (SCM) Nurse Uniform Management System (NUMS) project was initiated to address the critical need for a unified, transparent and auditable platform for nurse uniform management across the KwaZulu‑Natal (KZN) Department of Health (DoH). The system replaces fragmented manual processes with an integrated, secure, web‑based solution serving over 32,000 nurses across 11 health districts.

The project was formally established on 26 May 2026 with a budget comprising Mr TG Sikosana's remuneration (maximum overtime allowed for the project duration) and to be completed on the 15th October 2026, delivering all planned objectives within scope and budget.

Project registration

Project Name	SCM‑NUMS (Supply Chain Management – Nurse Uniform Management System)
Project ID	KZN-ICT-2026-01
Department	KwaZulu‑Natal Department of Health
Division	Supply Chain Management & ICT Division
Sponsor	Head of Department: KZN Health
Project Manager	Mr Themba Sikosana (Project Manager · Technical Lead)
Start / End	26 May 2026 → 15 October 2026
Budget	Mr TG Sikosana remuneration — max overtime for project duration
Status	Implementation Ongoing

1.2 Project Purpose

SCM‑NUMS was established to develop and implement a unified, transparent and auditable platform for nurse registration, uniform ordering, supervisor approval, distribution tracking, financial reporting and compliance monitoring. The system replaces manual paper‑based processes with a secure, web‑based solution providing end‑to‑end visibility and control.

Challenges Addressed by SCM‑NUMS

1.3 Project Scope

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

2Business Requirements Specification (BRS/BRD)

Purpose. Documents the business requirements and expected system functionality per the KZN ICT Governance Standard §4 (Document 2).

2.1 Business Problem Statement

The current manual paper‑based uniform ordering process within the KZN Department of Health is inefficient, error‑prone and lacks transparency. Nurses experience significant delays receiving uniforms, supervisors struggle to track and manage orders, and management lacks visibility into ordering patterns and expenditure.

Business problems and impact

Problem	Business Impact
Time Delays	Order processing takes 30+ days from request to delivery
Email‑Based Requests	Difficult to track, prioritise or audit
Data Errors	Incorrect sizes, quantities, nurse details
Lost Records	Paper forms frequently lost or misplaced
No Audit Trail	Cannot track who ordered or approved
Inconsistent Practices	Each facility has different procedures
Financial Leakage	Budget overspending due to lack of visibility

2.2 Business Objectives

2.3 Key Business Requirements

2.4 Stakeholder Groups

2.5 Business Process Changes

2.6 Success Criteria

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

3User & System Requirements (URS / FRS / NFR)

Purpose. Documents user requirements and defines the functional and non‑functional requirements per the KZN ICT Governance Standard §4 (Document 3).

3.1 User Requirements

3.2 Functional Requirements

3.3 Non‑Functional Requirements

3.4 Non‑Functional Requirements Detail

3.5 Password Complexity Policy (Aligned with check_name.php)

SCM‑NUMS enforces a single password policy on both client (check_name.php live checklist) and server (bcrypt comparison at login). The following rules apply to every nurse account at registration.

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

4Functional & Non‑Functional Requirements (Detail)

Purpose. Detailed breakdown of Functional and Non‑Functional Requirements per the KZN ICT Governance Standard §4 (Document 4).

4.11 Non‑Functional Requirements — Detailed Specifications

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

5System Architecture & Technical Design

Purpose. Documents system architecture, components, infrastructure, integrations and technical design per the KZN ICT Governance Standard §4 (Document 5).

5.1 Architecture Overview

SCM‑NUMS is built on a four‑layer architecture designed for security, scalability, performance and maintainability.

5.2 Technology Stack Justification

• Operating System (SITA VM): Windows 10 Enterprise (22H2). Enterprise‑grade hosting, security and compliance.
• PHP 8.2: Performance, security, rapid development. Supports password_hash() with bcrypt.
• MariaDB: ACID‑compliant relational database with strong performance and security.
• Apache 2.4: Industry‑standard web server with robust security features.
• HTTPS: All data in transit encrypted using SSL/TLS certificates.

5.3 Key Database Tables

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

6User Roles & Access Matrix

Purpose. Defines user roles, permissions and functions accessible to each role per the KZN ICT Governance Standard §4 (Document 6).

6.1 Position Hierarchy

6.2 Supervision Rules

6.3 Access Matrix

6.4 Data Access Scopes

6.5 Role Descriptions

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

7Risk Register

Purpose. Identifies system, operational, security and implementation risks and mitigation actions per the KZN ICT Governance Standard §4 (Document 7).

7.1 Risk Assessment Methodology

7.2 Risk Mitigation Details

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

8Information Security & Privacy Assessment

Purpose. Identifies security and privacy risks and controls implemented, including applicable POPIA requirements per the KZN ICT Governance Standard §4 (Document 8).

8.1 Security Controls

8.2 POPIA Compliance Assessment

The SCM‑NUMS system has been assessed against the 8 conditions for lawful processing of personal information as defined in POPIA:

8.3 Security Architecture — Four Layers

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

9Data Management & Retention Requirements

Purpose. Defines data ownership, classification, access, retention, archiving and disposal per the KZN ICT Governance Standard §4 (Document 9).

9.1 Data Classification

9.8 Data Security Measures

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

10Requirements Traceability Matrix (RTM)

Purpose. Provides traceability between requirements, system functionality, testing and UAT approval per the KZN ICT Governance Standard §4 (Document 10).

10.1 Traceability Matrix

10.2 Detailed Traceability

10.3 Test Coverage Analysis

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

11Test Strategy, Plan, Scripts & Results

Purpose. Provides the framework for comprehensive testing per the KZN ICT Governance Standard §4 (Document 11).

11.1 Test Phases & Schedule

11.4 Test Scripts

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

12UAT Plan & Sign‑Off

Purpose. Confirms that business users will test and accept the system functionality before go‑live per the KZN ICT Governance Standard §4 (Document 12).

12.4 UAT Feedback Template

12.5 UAT Sign‑Off

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

13Change Management Records

Purpose. Provides evidence that system changes were requested, assessed, approved, tested and implemented in a controlled manner per the KZN ICT Governance Standard §4 (Document 13).

13.1 Change Records

13.2 Change Request Forms (Completed)

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

14Backup, Recovery & Disaster Recovery Plan

Purpose. Defines how system and data recovery will be managed in the event of system failure or disaster, including the exact scripts and schedules executed per the KZN ICT Governance Standard §4 (Document 14).

14.3 Recovery Objectives

14.4 Script 1 — Local Full Backup

Full MySQL dump of nurses_db, zipped and named with a date‑time stamp. Runs daily at 17:00. Retention keeps the last 30 daily backups. The script writes the database dump to a temporary .sql file, compresses it with 7‑Zip into E:\Backup\scm-nums_YYYY-MM-DD_HHMMSS.zip, deletes the raw SQL, writes a success line to _backup.log, and prunes any backups older than the last 30.

@echo off
REM ============================================================
REM SCM-NUMS Local Full Backup
REM Runs daily at 17:00 via Task Scheduler
REM Output: E:\Backup\scm-nums_YYYY-MM-DD_HHMMSS.zip
REM ============================================================

setlocal enabledelayedexpansion

REM --- Configuration ---
set DB_NAME=nurses_db
set DB_USER=root
set DB_PASS=
set MYSQL_BIN="C:\xampp\mysql\bin\mysqldump.exe"
set BACKUP_DIR=E:\Backup
set ZIP_BIN="C:\Program Files\7-Zip\7z.exe"

REM --- Build timestamp ---
for /f "tokens=1-4 delims=/ " %%a in ("%date%") do set D=%%d-%%c-%%b
for /f "tokens=1-2 delims=:. " %%a in ("%time%") do set T=%%a%%b
set T=%T: =0%
set STAMP=%D%_%T%
set SQL_FILE=%BACKUP_DIR%\scm-nums_%STAMP%.sql
set ZIP_FILE=%BACKUP_DIR%\scm-nums_%STAMP%.zip

REM --- Ensure backup dir exists ---
if not exist "%BACKUP_DIR%" mkdir "%BACKUP_DIR%"

REM --- Dump database ---
%MYSQL_BIN% -u %DB_USER% %DB_NAME% > "%SQL_FILE%"
if errorlevel 1 (
  echo [ERROR] mysqldump failed at %date% %time% >> "%BACKUP_DIR%\_errors.log"
  exit /b 1
)

REM --- Zip the dump ---
%ZIP_BIN% a -tzip "%ZIP_FILE%" "%SQL_FILE%" > nul
if errorlevel 1 (
  echo [ERROR] zip failed at %date% %time% >> "%BACKUP_DIR%\_errors.log"
  exit /b 1
)

REM --- Remove raw SQL after successful zip ---
del "%SQL_FILE%"

REM --- Log success ---
echo [OK] %date% %time% backup created: %ZIP_FILE% >> "%BACKUP_DIR%\_backup.log"

REM --- Retention: keep only last 30 daily backups ---
for /f "skip=30 delims=" %%F in ('dir /b /o-d "%BACKUP_DIR%\scm-nums_*.zip"') do (
  del "%BACKUP_DIR%\%%F"
)

endlocal

14.5 Script 2 — Hourly Incremental Backup

Runs at the top of every hour after the 17:00 full backup. Uses MySQL binary log to capture only the deltas since the last backup. Each incremental backup is named inc_YYYY-MM-DD_HHMMSS.zip and stored in E:\Backup\incremental.

@echo off
REM SCM-NUMS Hourly Incremental Backup — uses MySQL binary log
setlocal enabledelayedexpansion
set DB_NAME=nurses_db
set DB_USER=root
set MYSQL_BIN="C:\xampp\mysql\bin\mysqladmin.exe"
set BINLOG_DIR=C:\xampp\mysql\data
set BACKUP_DIR=E:\Backup\incremental
set ZIP_BIN="C:\Program Files\7-Zip\7z.exe"

for /f "tokens=1-4 delims=/ " %%a in ("%date%") do set D=%%d-%%c-%%b
for /f "tokens=1-2 delims=:. " %%a in ("%time%") do set T=%%a%%b
set T=%T: =0%
set STAMP=%D%_%T%

if not exist "%BACKUP_DIR%" mkdir "%BACKUP_DIR%"
%MYSQL_BIN% -u %DB_USER% flush-logs
for /f "delims=" %%F in ('dir /b /o-d "%BINLOG_DIR%\mysql-bin.*" 2^>nul') do (set BINLOG=%%F & goto :copied)
:copied
copy "%BINLOG_DIR%\%BINLOG%" "%BACKUP_DIR%\%BINLOG%_%STAMP%" > nul
%ZIP_BIN% a -tzip "%BACKUP_DIR%\inc_%STAMP%.zip" "%BACKUP_DIR%\%BINLOG%_%STAMP%" > nul
del "%BACKUP_DIR%\%BINLOG%_%STAMP%"
echo [OK] %date% %time% incremental backup: inc_%STAMP%.zip >> "%BACKUP_DIR%\_backup.log"
endlocal

14.6 Script 3 — Remote Off‑site Copy

Runs at 17:30 daily. Copies the latest full backup AND the latest incremental to the pharmacoportal VM over SMB (\\pharmacyportal\e$\backup). The script maps the share, finds the newest local full backup, ensures the destination directory exists, performs the copy, logs success or failure, and then unmaps the share.

@echo off
REM SCM-NUMS Remote Backup to PharmacyPortal VM
setlocal enabledelayedexpansion
set SRC=E:\Backup
set DST=\\pharmacyportal\e$\backup
set NET_USE=net use \\pharmacyportal\e$ /user:administrator PASSWORD_HERE
%NET_USE% > nul 2>&1

for /f "delims=" %%F in ('dir /b /o-d "%SRC%\scm-nums_*.zip" 2^>nul') do (set LATEST=%%F & goto :found)
:found
if "%LATEST%"=="" (echo [ERROR] no local backup found >> "%SRC%\_errors.log" & exit /b 1)
if not exist "%DST%" mkdir "%DST%"
copy "%SRC%\%LATEST%" "%DST%\%LATEST%" > nul
echo [OK] %date% %time% remote copy: %LATEST% -^> %DST% >> "%SRC%\_backup.log"
net use \\pharmacyportal\e$ /delete > nul 2>&1
endlocal

14.7 Task Scheduler Registration

The three scripts are registered under a single Windows scheduled task called SCM-NUMS Backup Suite. The task contains three triggers (17:00 daily for full backup, hourly repetition starting 18:00 for incremental, and 17:30 daily for the remote copy) and three actions that invoke the batch files in sequence.

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-05-26T08:00:00</Date>
    <Author>KZN-DOH\ThembaSikosana</Author>
    <Description>SCM-NUMS Backup Suite</Description>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2026-05-26T17:00:00</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>
    </CalendarTrigger>
    <CalendarTrigger>
      <StartBoundary>2026-05-26T18:00:00</StartBoundary>
      <Enabled>true</Enabled>
      <Repetition>
        <Interval>PT1H</Interval>
        <Duration>PT23H</Duration>
      </Repetition>
      <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>
    </CalendarTrigger>
    <CalendarTrigger>
      <StartBoundary>2026-05-26T17:30:00</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>SYSTEM</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <StartWhenAvailable>true</StartWhenAvailable>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
  </Settings>
  <Actions Context="Author">
    <Exec><Command>E:\Scripts\backup_full.bat</Command></Exec>
    <Exec><Command>E:\Scripts\backup_incremental.bat</Command></Exec>
    <Exec><Command>E:\Scripts\backup_remote.bat</Command></Exec>
  </Actions>
</Task>

14.7.1 How to Register the Task

1. Save the XML to E:\Scripts\SCM-NUMS-Backup.xml.
2. Open an elevated Command Prompt on the SCM‑NUMS VM.
3. Run: schtasks /Create /TN "SCM-NUMS Backup Suite" /XML "E:\Scripts\SCM-NUMS-Backup.xml"
4. Verify: schtasks /Query /TN "SCM-NUMS Backup Suite" /V /FO LIST
5. Test manually: schtasks /Run /TN "SCM-NUMS Backup Suite"
6. Confirm a ZIP was produced in E:\Backup.

14.8 Disaster Recovery Runbook

14.9 DR Team Roles

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

15Incident Management Procedure & Register

Purpose. Defines how system issues and security incidents are reported, managed, escalated and resolved per the KZN ICT Governance Standard §4 (Document 15).

15.7 Incident Communication

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

16System User Manual & Standard Operating Procedures

Purpose. Provides comprehensive, step‑by‑step, illustrated guidance to all users of the SCM‑NUMS system per the KZN ICT Governance Standard §4 (Document 16).

16.1 Document Control

User manual document control

Title	SCM‑NUMS System User Manual
Version	1
Issue Date	September 2026
PM · Technical Lead	Mr Themba Sikosana
Classification	Internal · Confidential
Review Cycle	Quarterly, or upon material change
Audience	All SCM‑NUMS users

16.2 User Roles at a Glance

User roles overview

Role	Primary Functions
Nurse	Register, log in, place requisitions, edit pending, view own history
Supervisor	Activate nurses, approve/reject, re‑open approved requisitions
Stores Officer	Manage stores inventory, issue uniforms, view stores reports
Head Office	Configure system, manage users, view province reports, manage admins
Auditor	Read‑only access, view audit logs, generate compliance reports

16.3 How to Register as a Nurse

Prerequisites: Active Persal number in HR database; valid surname as recorded in Persal.

1. Open your browser and navigate to the SCM‑NUMS login page (URL provided by ICT Division).
2. On the home page, click the Register button.
3. Enter your Persal number (e.g. 12345678).
4. Enter your surname exactly as it appears in Persal (case‑sensitive).
5. Click Verify. The system checks your details against the HR database.
6. If details match, a profile completion form appears. If not, contact your supervisor.
7. Complete: Email, Telephone, Gender, Position, Department, Password, Security Question.
8. Password rules: Minimum 6 characters with at least one uppercase letter (A–Z), one lowercase letter (a–z), one number (0–9), and one special character (e.g. !@#$%^&*).
9. Click Submit Registration.
10. Your account is created with PENDING status.
11. Contact your immediate supervisor to activate your account.

16.4 How to Log In

1. Navigate to the SCM‑NUMS login page.
2. Enter your Persal Number and Password.
3. Click Sign In. You will be redirected to your role‑specific dashboard.

16.5 How to Place a Uniform Requisition

Prerequisites: Active account; active order cycle; not yet ordered this cycle.

1. Log in as described in Procedure 16.4.
2. From your dashboard, click Order Uniforms.
3. The catalogue loads; items are filtered by your gender.
4. For each item: click Add to Requisition, select Size, enter Quantity (≤ maximum shown), click Add.
5. Review your requisition summary on the right panel.
6. Click Submit Requisition. Status = PENDING; supervisor notified.

16.6 Supervisor — Activate a Nurse Account

1. Log in. Your dashboard shows Pending Activations.
2. Click View All Pending Activations.
3. Review the list (nurse name, Persal, facility, department, date).
4. Click Review on a nurse you wish to activate.
5. Verify the nurse's details against your records.
6. Click Activate Account (or Reject with a reason).
7. The nurse receives an automatic notification.

16.7 Supervisor — Approve or Reject a Requisition

1. From your dashboard, click Pending Requisitions.
2. Requisitions are filtered to your scope (department or facility).
3. Click Review on a requisition.
4. Review items, sizes, quantities and total amount.
5. Click Approve Requisition or Reject Requisition (with mandatory reason).
6. The nurse is notified automatically.

16.8 Supervisor — Re‑open an Approved Requisition

1. Navigate to Requisition History.
2. Filter by Status = Approved.
3. Locate requisition and click Re‑open.
4. Provide a reason for re‑opening (mandatory). Confirm.
5. Status reverts to Pending; returns to your approval queue.

16.9 Admin — Manage the Catalogue

1. Navigate to Catalogue Management from the admin menu.
2. View uniform items including prices (admin‑only).
3. Add: click Add New Item, complete form, click Save.
4. Edit: click Edit, update fields, click Save.
5. Deactivate: click Deactivate (removed from nurse catalogue).
6. All changes logged automatically in the audit trail.

16.10 Stores Officer — Manage Inventory & Issue Uniforms

1. Navigate to Stores Management.
2. View inventory levels, low‑stock alerts, pending requisitions.
3. Update stock: click Adjust, enter new quantity, click Save.
4. Issue uniforms: select approved requisition, click Issue, confirm.
5. Generate stores reports via the Stores Reports tab.

16.11 Standard Operating Procedure — Full Process Flow

1. Nurse registers with Persal + surname.
2. Nurse completes profile, selects Position ID, and creates a password meeting the complexity policy.
3. Account status = PENDING ACTIVATION.
4. Supervisor (Position ID 6+) activates account.
5. Account ACTIVE.
6. Nurse places order (active cycle required).
7. Order PENDING APPROVAL.
8. Supervisor (Position ID 6+) reviews the order.
9. Decision: Approved or Rejected.
10. If rejected: nurse edits and resubmits.
11. If approved: delivery recorded.
12. Audit trail closes the cycle.

16.12 SOP — Establishment Control Process

16.13 SOP Sign‑Off

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

17Training Records

Purpose. Provides evidence that relevant users were trained before using the system per the KZN ICT Governance Standard §4 (Document 17).

17.6 Ongoing Training Plan

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

18Go‑Live Readiness Assessment & Approval

Purpose. Confirms that business, ICT, security, testing and operational requirements have been addressed before production deployment per the KZN ICT Governance Standard §4 (Document 18).

18.1 Go‑Live Readiness Checklist

18.2 Go‑Live Deployment Plan (Draft)

18.5 Go‑Live Sign‑Off

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

19Post‑Implementation Review

Purpose. Assesses whether the system achieved its objectives and identifies outstanding issues, risks and improvements per the KZN ICT Governance Standard §4 (Document 19).

19.5 Recommendations

19.6 Conclusion (Preliminary)

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

20Audit Evidence Summary

Purpose. Confirms that all required audit evidence is compiled and available for review by Internal Audit and external assurance providers, in line with the KZN Department of Health ICT Governance and System Assurance Standards.

KwaZulu‑Natal Department of Health

ICT Governance & System Assurance

Document: KZN/ICT/SCM-NUMS/2026/001

Version: 1 · 23 September 2026

System: SCM‑NUMS

✓Document Approval & Sign‑Off

The undersigned confirm that this SCM‑NUMS Governance & System Assurance document has been reviewed and approved in accordance with the KZN Department of Health ICT Governance & System Assurance Standards.