NORWAY: Cooperation with African SAIs - The IT Audit Champions Program
OAG Norway has had a cooperation with the African Organisation of English-speaking Supreme Audit Institutions (AFROSAI-E) for many years. In 2016, the cooperation was expanded to include IT audit. AFROSAI-E had observed significant differences in the area of IT audit between the SAIs in the region. Many SAIs had not yet started conducting IT audits, and only a few had established dedicated IT audit units. The challenges faced by these SAIs included inadequate number of IT auditors and ability to build capabilities to audit critical public information systems.
To fill this gap, OAGN and AFROSAI-E launched the IT Audit Champions Programme - a 4-module training programme for prospective IT auditors. Each module consist of a week of hands-on training including presentations and discussion from participants who have carried out an audit of topics from previous modules.
The programme covers topics like application- and general IT controls, databases (both MS SQL and Oracle), Active Directory, and networks and firewalls. In the first round of the programme (2017 - 2019), 24 auditors from eleven different SAIs signed up to become IT Audit Champions. Hence, agreeing to conduct at least two pilot audits on each of the topics covered, and to train their colleagues in their own SAIs. OAGN has provided audit programs, scripts for extracting data from databases and firewalls, and images to run on virtual machines for practise.
Modules in the IT Audit Champions Programme
The evaluation of the first round of the programme showed good results and that the participating SAIs were very satisfied. Many SAIs have now implemented IT audit units and carried out their first IT audits based on the training. The programme has also created a community of IT auditors where experiences are shared and support is provided. In addition, when the second round of the programme started last year, some of the first round participants joined as facilitators - to teach a new generation of IT Audit Champions.
By senior advisor Hanne Nordrehaug and special advisor Børre Lagesen