ITWG Newsletter 1/2025
Message of the Chair
Dear colleagues,
SAIs mission is to promote accountability, transparency, and the responsible use of public resources. While SAIs core work focuses on auditing the digital and operational performance of others, it is important to ensure SAIs own IT foundations are strong, secure, and strategically aligned. Without credible, modern systems of our own, stakeholders cannot be expected to trust SAIs with their data — or to follow SAIs recommendations on digital governance. "Practice what you preach“ – this is something that is necessary when allocating resources for our IT operations.
This edition of the EUROSAI IT Working Group newsletter explores “The Most Imminent Challenges of SAI IT Operations.” These include managing complex digital environments, meeting evolving demands from auditors, protecting against ever-changing cybersecurity threats, and implementing advanced technologies like data analytics and AI. In this context, the efficiency, agility, and strategic clarity of internal IT operations are more critical than ever.
We are particularly honored to feature an article from SAI Germany (Bundesrechnungshof), which presents its approach to project portfolio management—a forward-looking model designed to align IT initiatives with strategic priorities. The Bundesrechnungshof’s IT department focuses on achieving a smooth, efficient project flow by concentrating only on the deliverables that are truly necessary at any given time. At the same time, they prioritize projects that offer the greatest strategic value in a given period. This approach exemplifies how thoughtful governance and prioritization can help SAIs manage limited resources while maximizing institutional impact.
The guest contributions in this issue provide complementary insights into how SAIs are advancing their digital capabilities. The State Audit Office of the Kingdom of Thailand describes its Advanced Data Analytics Capacity-Building Project, which offers a practical roadmap for mid-sized developing SAIs aiming to embed data-informed practices into their audit functions. Meanwhile, the Comptroller and Auditor General of India introduces OIOS, a web-enabled, end-to-end IT platform that supports the entire audit lifecycle and enables real-time monitoring. In parallel, SAI India is investing in the infrastructure and processes required to harness AI and machine learning in auditing—demonstrating long-term strategic vision.
These articles collectively illustrate that effective IT operations are not a side function—they are core to our ability to audit well, act credibly, and lead by example. Whether we are building digital platforms, managing complex project portfolios, or enabling the next generation of AI-powered auditing, the strength of our internal systems directly affects the quality of our external work.
That is why I want to encourage closer cooperation between European SAIs’ CIOs and IT leaders under the umbrella of the EUROSAI IT Working Group. By deepening these professional connections, we can accelerate shared learning, identify common challenges, and build joint solutions that strengthen all of us.
Let us recognize and support the people behind the systems—our internal IT professionals—who keep our institutions secure, agile, and prepared for the future.
Feature story from Germany: Project Portfolio Management and Complexity Reduction
Many IT departments primarily organize changes in the form of projects — and for good reason. In theory, projects allow these changes to be created in a targeted, measurable manner and within a defined timeframe.
Read more
BELGIUM: Big data analysis of the perception of the social security contribution on company cars
In Belgium, employers who provide company cars to their employees pay lower social security contributions on this benefit than they would on regular wages. Specifically, they pay a flat-rate contribution based on the vehicle’s CO₂ emissions—referred to as the CO₂ contribution. The Belgian National Social Security Office (NSSO) is responsible for collecting these contributions. It receives information on contribution amounts and vehicle license plates through the quarterly social security declaration (DMFA). Legislation also grants the NSSO access to other data sources, notably from the Federal Public Service (FPS) Mobility, which records technical vehicle data such as CO₂ emission levels, to verify the declared contributions.
FRANCE: IT security in healthcare establishments: a recent reinforcement that needs to be continued, in the face of increasing cyberattacks
The healthcare sector is facing a steady increase in cyberthreats, which are likely to significantly disrupt operations and the quality of care provided. Accompanied by the Digital Audit Department, the French Cour des Comptes analyzed the vulnerability factors of healthcare establishments' information systems, and put forward recommendations for improving IT security management. The audit team conducted interviews with over twenty healthcare establishments and analyzed the results of a nationwide survey.
THE NETHERLANDS: Annual audit of algorithms: Potential for effectiveness clear, but key privacy risks not mitigated
Our audit results show that the use of algorithms can improve the effectiveness of governmental organisations and help citizens in need, but common risks are not mitigated adequately. Risks to the privacy of citizens were not controlled effectively, for instance by the Dutch Tax Administration. Two algorithms were found not compliant to the General Data Protection Regulation (GDPR).
SLOVENIA: Lessons from SPIRIT Slovenia’s Control Data Acquisition System
In its latest IT audit, the Court of Audit of the Republic of Slovenia assessed the technical setup and organization of ex-post controls under the Act Governing Aid to Businesses to Mitigate the Impact of the Energy Crisis (ZPGOPEK). The findings offer not only valuable lessons, but also a few wry smiles for IT auditors working in public sector oversight.
18th Meeting of ITWG in Prague and online on 23-24 September 2025
Registrations have started for the 18th Meeting of the EUROSAI IT Working Group scheduled for 23-24 September 2025 in Prague and online, organised by SAI Estonia and SAI Czechia.
Enroll in the ITWG e-course "Introduction to Public Sector IT Audit"
As part of the Research and Training Hub project, the EUROSAI IT Working Group has developed an online training course titled "Introduction to Public Sector IT Audit." This course is designed for anyone interested in gaining foundational knowledge on how to address IT aspects within audit work. Its primary aim is to enhance the quality and effectiveness of modern audits, which increasingly involve IT components. Both non-IT auditors and beginner-level IT auditors will benefit from the course's accessible introduction to IT auditing concepts.
e-Seminar on auditing the critical information infrastructure was held on 24 April
On 24 April 2025, e-Seminar “Mission Critical – Auditing the Critical Information Infrastructure” took place and was accessible to all members of the International Organisation of Supreme Audit Institutions (INTOSAI). More than 200 participants from 46 different countries took part in the e-Seminar.
Overview of WGISTA 5th Annual Meeting
The meeting of the INTOSAI Working Group on the Impact of Science and Technology on Auditing (WGISTA), held in Washington D.C. USA, on May 6- 7, 2025, marked a significant step forward towards equipping Supreme Audit Institutions (SAIs) for addressing the evolving technological landscape.
INDIA: Latest IT Developments and IT projects
The Comptroller and Auditor General (CAG) of India is undergoing a significant digital transformation to enhance its auditing capabilities and adapt to the evolving technological landscape.
THAILAND: Enhancing Audit Capabilities through Advanced Data Analytics Training: A Case from a Mid-Sized Developing SAI
In the context of increasing complexity in public financial oversight and the rise of data-driven governance, the State Audit Office of the Kingdom of Thailand (SAO) initiated the "Advanced Data Analytics Capacity-Building Project" under its Strategic Plan (2019-2022). The project aimed to develop advanced data analysis competencies among auditors and supporting staff, enabling them to perform their tasks more effectively and timely, especially in the era of big data.
