ITWG Newsletter 2/2023
Message of the Chair
Dear Colleagues,
We are continuing our tradition to publish newsletters twice per year and it is always encouraging to see members who are willing to share their practices this way.
EUROSAI region is already known for its capacity in IT auditing, but there is always room for development and as the chair of ITWG, I see much room for improvement in exchanging information and making this group an expert hub. This newsletter, together with our other activities, should enable people responsible for IT auditing to know about recent developments in other SAI-s as well as give opportunity to gain new ideas and motivation to innovate. It is vital to keep on learning in the field of IT – when you resort to resting on your laurels, you soon realize you are missing important developments. Rapidly evolving technology is gradually turning our knowledge outdated.
The feature topic of this newsletter is about understanding and reacting to technological advancement. I really like how our Dutch colleagues point out the need to understand and map the lifecycle of their auditees’ information systems – which in turn is a prerequisite to reconstruct or retire the legacy system. Otherwise, major services can be affected, and adequate security cannot be assured. An audit institution pointing at this issue in 2014 has resulted in major developments and we cannot speculate – but probably avoiding interruption in services and government tax collection. The audits by our members sometimes reveal completely obsolete solutions being used for vital services – as our French colleagues have described in their article. These examples clearly showcase the need for a better planning and risk-analysis performed by the stakeholders.
Ability to propose alternative to legacy systems does not always mean an auditor can envision better approach – this is the task of the business process owner. Still, there is a need to understand where portfolio management is not working as needed. And this is not only the task of an IT auditor – as information is processed in IT systems in every domain nowadays, the first risk indication should come from any auditor regardless of their domain. Therefore, I urge everyone looking at the training course „IT Audit for non-IT Auditors “.
But this year will be legacy soon, as well! I wish you cheerful holidays and I hope next year will be even better than this was.
Feature story from the Netherlands: IT lifecycle management is not a one-off job but a continuous and cyclical process that affects the entire organisation
The Netherlands Court of Audit (NCA) has been auditing digitalisation and the use of IT by the Dutch government since 1991. The government, like society in general, has become highly digitised in recent decades. Virtually all government processes and activities are now (supported) digitally. Properly functioning information systems are essential to implement government policy, introduce new laws and deliver reliable services to citizens and businesses. Managed and systematic maintenance of the IT landscape, also known as IT lifecycle management, plays a very important role. Important not only to avoid running unsupported IT and to upgrade it on a timely basis but also to respond to technological advances such as artificial intelligence (AI), quantum computing and the cloud.
Read more
ECA: The European Court of Auditors applies generative Artificial Intelligence to audit
In the recent months, the European Court of Auditors (ECA) has started building a strategy around Artificial Intelligence (AI) and its applications to audit. The AI practitioners at the ECA have integrated advanced AI techniques for document clustering and topic modeling into an audit process for the first time. This innovative approach helped auditors in managing and extracting insights from unstructured textual data. By grouping documents based on similarities and uncovering latent topics, this AI pipeline streamlined information retrieval. Overall, applying such techniques contributed to enhanced and more efficient analysis throughout the audit.
ESTONIA: Security of server rooms and office premises
The National Audit Office of Estonia recently audited security of server rooms and office premises. It was concluded that necessary security measures are generally implemented in the server rooms and technical rooms necessary for the operation of server rooms in ten audited state institutions and one audited legal entity in public law. Primary security measures are implemented in the office premises of IT centres to ensure physical security, and the risk of unauthorised access to the premises has been mitigated to an acceptable level.
FRANCE: Digital audit of the French State Retirement Service (SRE)
The French Cour des Comptes has conducted a digital audit of the French State Retirement Service (SRE). Created in 2010, this service is responsible for managing the retirement and disability pensions of civil and military civil servants, representing more than 58 billion euros in pensions paid each year to nearly 2.5 million pensioners.
LITHUANIA: The Innovation Lab encourages to try new approaches
The Innovation Lab “LabAI” has opened its doors at the National Audit Office of Lithuania. This is a space where, using applications installed on the computers, every employee of the institution can try out the latest technologies that:
💡 speed up audit conduct,
💡 improve the presentation of audit results,
💡 automate resource-intensive processes.
MALTA: IT audit – Malta Food Agency
The National Audit Office (Malta) has recently conducted a comprehensive Information Technology (IT) audit at the Malta Food Agency (MFA). Established in 2021 under the Ministry for Agriculture, Fisheries, and Animal Rights, the MFA was entrusted with the task of regulating food produce from farming and fishing while overseeing the Pitkalija[1] and the Pixkerija[2] markets. Essentially, this audit focused on the overall IT setup of the Agency, with a particular emphasis on the Pitkalija Market Management System (PMMS), which is the core IT system used at the Pitkalija market.
Summary of ITWG 16th meeting
The meeting took place 10-11 October in a hybrid format in Warsaw, Poland. On 10 October, a seminar “Digital Sovereignty in a Cloudy Environment” took place and was accessible to all members of the International Organisation of Supreme Audit Institutions (INTOSAI). Close to 120 participants from almost 50 countries were participating, among them approximately 50 in-person attendees in Warsaw, Poland.
Six modules of the training course IT Audit for non-IT Auditors have been opened for learning
In the frame of Research and Training Hub project, EUROSAI IT Working Group is developing a training course IT Audit for non-IT Auditors.
New member in the EUROSAI IT Working Group
We are pleased to announce that starting from November 2023, the EUROSAI IT Working Group has a new member from Italy – the Italian Court of Audit,
We are warmly welcoming our new colleagues in the working group that has already 44 members in total.
Changes in team of ITWG Secretariat
From January 2024, Ms Krislin Kivi leaves our team for her next successful endevaours and Ms Kaire Kesküla, Head of International Relations of the National Audit Office of Estonia rejoins our team. Welcome back!
