Sunrise Insurance (Ghana) Ltd: one administrator, thirty-one unapproved changes

The central weakness is that one person can initiate, approve, execute and conceal a change. Everything else is a symptom.

1. No segregation of duties (critical). The IT Manager holds administrator rights, writes production reports, changes business rules and approves his own spending. There is no combination of transactions he cannot make and no second pair of eyes at any point. This is a fraud exposure as much as an error exposure: a premium rate can be altered and the change removed from the log.
2. No change control or audit trail (critical, already realised). Thirty-one undocumented changes, no approval, no rollback. The March incident is the predictable output, and the inability to establish which rating table was live between 4 and 11 March means the insurer may be unable to demonstrate the premium charged on affected policies was correct - a financial reporting and conduct problem, not just an IT problem.
3. No test environment (high). Production is the test bed. Every change carries outage and corruption risk, and the 900 mispriced notices are direct evidence.
4. Unmanaged business-rule ownership (high). Rating tables are business policy, not IT configuration, yet no underwriter approved the change. The business has no idea what the system is doing.
5. Key-person concentration (high). A single point of failure for every system; absence or departure stops the business.
6. Governance gap (high). No IT steering committee, no IT strategy, no board reporting beyond an audit finding, and purchase authority that sits with the person who benefits from it.
7. Informal approval culture (moderate). Verbal approval from the Finance Director is not approval because it leaves no evidence and cannot be reviewed.

Quantify the realised loss. 140 underpriced renewals, each potentially a year-long mispricing, plus the cost of correcting 900 notices and the supervisory and reputational exposure.

Proportionality test: the process must be lighter than the risk it prevents. A four-stage gate would be ignored here; a one-page form with real teeth will be followed.

1. One request form, one log. Every change, including emergency fixes, is entered on a single form covering: what changes, why, which system, who tested it, what happens if it fails, and how to reverse it. A shared register records date raised, approver, implementation date and outcome. The log is the control that February's failure showed is missing.

2. Risk tiering.

• Standard (low risk, repeatable, e.g. adding a user report): pre-approved by the Finance Director under a standing list, logged after the event.
• Normal (any change to business rules, interfaces, server configuration): one named approver who is not the person making the change, a test on a copy of production, a rollback plan and a scheduled window.
• Emergency (system down): implement, then retrospective approval within two working days with the reason recorded. Emergency status must be reviewed monthly, or everything becomes an emergency.

3. Separate the business rule from the technical change. Any change to a rating table, commission rate or premium calculation must be requested and signed by the owning business head - underwriting, not IT. That single rule would have prevented the March incident.

4. A test environment. A cloned virtual machine and a copy of the database refreshed monthly is affordable at this scale and removes the main excuse.

5. Rollback discipline. Take a backup and record the current version identifier before every normal change. The March failure was less the wrong rate than the inability to say what had been live.

6. Review. The Finance Director reviews the change log monthly; the audit committee sees it quarterly with emergency-change counts and any changes made without approval.

He is half right: full segregation is impossible; adequate compensating control is not. The answer is not to demand a second IT department, but to remove the specific combinations of access that create the fraud and error risk, and to make the remainder visible.

Immediate, no-cost changes. Remove his authority to approve his own purchases - that is not an IT control issue at all and can be transferred to the Finance Director today. Split his accounts: a day-to-day account without administrative rights, and a separate administrator account used only for administration, so that privileged activity is distinguishable in the logs. A sealed break-glass administrator credential held by the Finance Director, with use logged and reviewed, gives a second person visibility over the highest-risk action. Monthly independent review of the change log and privileged-account activity by the Finance Director, signed and retained, is the compensating control that replaces unachievable segregation.

Low-cost structural changes. Move business-rule approval explicitly to underwriting management. Hire a second IT person or an apprentice, even at junior level, because two people can be separated in a way that one cannot - the cost is trivial against the March incident. Alternatively, outsource server administration to a managed service provider so that infrastructure access sits outside the company, leaving internal IT to application support, with the provider's activity independently reviewed.

Governance overlay. Form a small IT steering group (Finance Director, operations head, IT Manager) meeting monthly, and give the audit committee standing oversight of privileged access and changes. Consider using the external auditor or an IT consultant for an annual independent review of administrator activity.

The point to make to the board. The argument that formal control is impossible with one person is an argument for a second person, not for no control. The March incident has already been paid for; the question is whether it is paid for once or repeatedly.