Information Technology Audit:Malta Industrial Parks Ltd

The Auditor General, Mr. Charles Deguara, today presented to the Speaker of the House of
Representatives, Hon Anglu Farrugia, the National Audit Office (NAO) Report entitled
“Information Technology Audit: Malta Industrial Parks Ltd”. The scope of this Information
Technology (IT) audit was to analyse the overall IT setup of the Malta Industrial Parks Ltd.
(MIP) focusing mainly on the core IT systems.

This Report included the following key findings and recommendations, amongst others:

ICT Strategy – The NAO recommended that MIP drafts an ICT strategy as the entity relied
on 6 monthly IT plans documenting all the work being undertaken to address the ICT
needs of the organisation. In line with the above, the NAO also recommended that senior
management ensures that IT hardware needs are pre-empted with careful planning which
would cater for the time taken to complete procurement processes, thus eliminating the
need to resort to direct orders as happened in a few instances.

Software applications – The NAO noted that in 2012 the MIP procured an Integrated
Property Management Solution which was customised for MIP’s needs and included GIS
capabilities which were not being used by MIP. Furthermore, the MIP purchased a number
of “off-the-shelf” software packages. The NAO recommended that the MIP formulates a
3-year plan of all its ICT software and infrastructure needs to adopt a less fragmented
approach and increase integration between systems.

Backups – The NAO was informed that a restore of the backup files was conducted in
March 2020; however, the Office was not given any documentation that determined if
this task was a complete restore of MIP data or a test restore of particular backup files.
The NAO suggested that the MIP ensures the integrity of data by conducting periodic
restores which are signed off by the users, to certify that these restores were successful.

IT Business Continuity Plan – During the course of this audit, the NAO observed that the
MIP did not have a formalised IT business continuity plan (BCP); however, towards the
end of the audit, the MIP provided NAO with a related document, drafted by their third
party ICT services contractor.