ITWG Newsletter 1/2023
Message of the Chair
Dear Colleagues,
It is my pleasure to present the sixth newsletter by EUROSAI IT working group. Summer has arrived and hopefully everybody is heading to well-deserved vacation. But before that – I hope you have the chance to enjoy interesting articles our colleagues have prepared.
Featured in this issue, we consider protection of classified information and I am glad our German and Bulgarian experts have showed their willingness to share their findings and describe their systems, although it is a sensitive field and one must carefully consider the information to disclose.
It is our core goal to ensure governments are working efficiently and build trust for citizens. We have a wide mandate to perform our duties but realizing this mandate, we also have to build trust with our auditees. Information extracted to our premises should be kept as carefully as it is held by the responsible stakeholders themselves. Also, it is important to conservatively consider the necessity of information and only process material relevant for the audit scope. In my own institution, I have confronted a situation where, even with thorough design and system of measures to protect information, stakeholders are opposing the information processing only because they cannot understand the link between the extracted information and audit need. Once again we must practice what we preach – set an example as protectors of sensitive information and making sensible decisions when using it.
Also, I am glad to see so many other authors in this newsletter - be assured, the auditors' community appreciates your articles.
Enjoy the read and upcoming summer holiday!
Feature story from Bulgaria: Protection of classified information in the Bulgarian National Audit Office
The implementation of the activities related to creating, processing of and preserving classified information and the terms and conditions for granting access to it are regulated under the Protection of Classified Information Act (PCIA), the Rules on Implementation of the Protection of Classified Information Act (RIPCIA) and the Mandatory instructions issued by the State Commission on Information Security (SCIS).
Read more
Feature story from Germany: Protection of Classified Information
The Bundesrechnungshof, Germany’s supreme audit institution, provides advice, on the basis of its audit experience, to Parliament and the Federal Government about public expenditures and revenues at federal level. The Bundesrechnungshof also examines the extent to which federal institutions meet the requirements for protecting the data they process. Ultimately, the Bundesrechnungshof itself must also comply with these requirements when it comes to the collection of sensitive data.
Read more
GERMANY: Data analysis and artificial intelligence systems in the federal administration
The German SAI conducted a cross-sectional audit on the use of data analytics (DA) and artificial intelligence (AI) in the German federal administration. The German federal government intends to increasingly apply DA and AI techniques in the federal administration. It expects the federal administration to take a pioneering role. To this end, it adopted its national AI strategy in 2018. In 2021, the federal government reaffirmed its ambitions by also adopting a national data strategy.
KOSOVO: Highlights of IT audit from SAI Kosovo
The National Audit Office of Republic of Kosovo* has conducted the IT audit for the Civil Status Information System in the Civil Registry Agency. The Civil Registry Agency (CRA) as an agency within the Ministry of Internal Affairs, is the main source of personal data of Kosovo citizens, which are registered and kept in the civil status registry, attesting birth, family status, death, their relationships and any changes that occur. Civil status data is administered through the information system, which has been developed on the .NET and SQL platform and interacts with other information systems in the public and private sectors for the exchange of data in electronic form, providing updated and timely information.
KOSOVO: Kosovo National Audit Office put into operation its own Audit Management System - SITA
In 2020, the Kosovo* National Audit Office has put into operation the Audit Management System. This is the third audit season that we have been using SITA for all audit types that KNAO carries out.
LITHUANIA: The National Audit Office of Lithuania promotes the opening of data in Lithuania
Open data is data that anyone can access, use and share. Governments, businesses and individuals can use open data to bring about social, economic and environmental benefits. Not to spend time and effort to create their own data sets, but to use what has been created by others.
MALTA: IT audit of the online component of the 2021 Malta Census of Population and Housing
In December 2022, the Malta National Audit Office (NAO) published the report of its Information Technology (IT) audit of the online component of the 2021 Malta Census of Population and Housing. The 2021 Malta Census was the first census that could be completed through an online form. The audit assignment sought to analyse the planning and implementation phases of the Census, including the collection of data, data integrity and security, the technological challenges, and the costs of this project.
THE NETHERLANDS: Audit of Digital Identity (eIDAS) Tools in the Netherlands
The Netherlands Court of Audit recently audited the most important and widely used digital identity tools available in the Netherlands: DigiD, the public authentication tool for citizens, and eHerkenning, the private authentication tool for businesses. We concluded that they currently function satisfactorily. We have concerns, however, about the future of digital authentication.
ROMANIA: Development of the Digitization Strategy for the Romanian Court of Accounts - identification of competencies in order to facilitate the implementation of the Digitization Strategy
The Romanian Court of Accounts has the ambition to continue to provide audit evidence in a clear and usable format for Romanian citizens and their elected representatives by increasing the degree of use of digital solutions in the operations of the Court of Accounts in order to provide timely and accurate information without using ambiguous specific terminologies.
IDI LOTA Pioneers: Preparing auditors for the Digital Age
In November 2022, IDI has launched three new initiatives. One of these initiatives was Leveraging on Technological Advancement (LOTA) Pioneers. This initiative aims to transform nominated auditors into change agents who will bring technology to their SAI’s audit world by scanning their internal and external audit environments, strategizing for leveraging on technology in audits, and auditing the use of technology by governments.
Four modules of the training course IT Audit for non-IT Auditors have been launched
In the frame of Research and Training Hub project, EUROSAI IT Working Group is developing a training course IT Audit for non-IT Auditors.
Summary from the ITWG e-Seminar Identify Yourself: the Devious Road to eID
E-Seminar Identify Yourself: the Devious Road to eID was held on April 19 2023 and was accessible to all members of the International Organisation of Supreme Audit Institutions (INTOSAI). Over 200 participants from 56 different countries took part in the e-seminar.
New member in the EUROSAI IT Working Group
We are pleased to announce that starting from March 2023, the EUROSAI IT Working Group has a new member from Iceland – The Icelandic National Audit Office.
