. The Service Level Agreements entered into by the municipality with BCX, True North West Technologies and Vesta Technical Services were inadequate in that there were no clauses which held the service providers accountable for unsatisfactory services rendered; . Weak password controls; . Lack of audit trail; . Lack of periodic reviews of access to the municipality information system; . Database security related policies are not in place; . Lack of approved network security policies; . Lack of an approved User account management policy; . No formally designed security controls in place; . An Information Security Officer has not been appointed; . No formally designed user access controls; . Inadequate change management controls; . Non-compliance with controls designed by IT management to adequately mitigate key financial risks; . Service level agreements inadequately managed; . Inadequate Service Level agreements were in place.