3.3  Status of Prior Year Matters   Documentation of IT Security Policies and Procedures 3.2 The auditors noted that the Commission overspent on the activities of the Botswana Netball Association, and in the process  created a receivable of P837 496 which was purported to be  recoverable from the parent Ministry. The auditors further noted  that efforts to recover the amount had proved futile and the  whole amount had been provided for a possible impairment.  While it may have been practical to cover the expenses of the  Botswana Netball Association and recover the amount at a later  date, the auditors observed that the Commission did not seek a  written commitment as evidence in case of disputes.  of the gate takings. However, in some instances control sheets  were not submitted to the Commission by the teams involved or  the agencies hired for the collections, making it difficult to  validate the income the Commission was entitled to. In response, management noted the auditors’ finding and stated  that it is being addressed. Further it was stated by management  that the Commission had agreed with Botswana Premier League  on a once off payment for the use of Commission’s stadia. Both  parties determine the annual charge of stadia based on historical costs with a compound interest formula that would be  applied annually. The charge would then be paid bi-annually at  the beginning of the Premier League season and at the beginning of the second half of the season. In response management noted the finding and stated that  Commission was continuing to engage the parent Ministry on the  over-expenditure by the Botswana Netball Association at the  Netball World Youth Cup. They further stated that the Commission was given an expenditure limit by the Ministry which  was adhered to, but the Association spent outside Commission’s  authority.  The auditors noted that 6 of the 13 matters reported in the prior  year were still unresolved and the process to resolve them was  stated as ongoing. These were: As reported in the previous year, there were no written formal  security policies and procedures that had been established  and communicated for the Commission’s IT environment. 145 