Information Technology Audit: Planning Authority

The Auditor General, Mr. Charles Deguara, today presented to the Speaker of the House of Representatives, Hon Anglu Farrugia, the National Audit Office (NAO) report entitled “IT Audit: Planning Authority”. The report analysed the overall IT setup of the Planning Authority (PA) focusing mainly on the core IT systems, which were selected for the purpose of this IT audit, and a review of a selected aspect of the Authority’s document management.

This report included the following key findings and recommendations, amongst others:

a. The PA did not have an official ICT strategy and therefore the NAO recommended that the PA drafts a formal ICT strategic plan for the coming years.

b. Though the PA did not have an ICT Business Continuity Plan (BCP)and Disaster Recovery Plan (DRP) in place, the NAO was informed that the PA obtained funds from an EU funded project for consultancy on drafting a BCP and DRP, which would also include a risk assessment exercise. The NAO opined that once this study is concluded both the BCP and DRP are drawn up without further delay.

c. During the execution of this IT audit, the NAO was pleased to note that the reviewed core software applications (used for the processing of building permits) had a sound audit trail functionality and the related source code was stored securely with the required version control.

d. The NAO opined that the PA was not making best use of social media platforms available to publicise further PA press notices published on the Government Gazette. The NAO recommended that the PA conducts a review of the communication channels used for the publication of such notices.

e. Documentation related to reviewed sampled cases of procurement of services through a tender process, was adequate. Conversely, document retention, deviated from generally accepted practices in sampled cases of direct orders issued for the procurement of services. In this regard, one case related to a specific direct order where key documentation was not made available, the NAO could not conclusively determine whether the documentation was unavailable because it was either misplaced or not compiled. In two other sampled cases of direct orders, contracts were not made available to the NAO. Although one would expect that the PA would maintain the full documentation, the NAO sought to retrieve such documentation through other Government entities but to no avail. This implies that the documentation may not have been drawn up at the outset.