LOTA – Leveraging on Technological Advancement

In response to this rapidly changing environment and technology development, IDI has developed a LOTA Scan Tool to help SAIs in making better use of technology in fulfilling their audit mandates, by planning technology-specific audits, developing technology skills and introducing new technologies into the SAI audit practice.

The LOTA Scan aims to provide SAIs with a tool to analyse their internal and external environment in the use technology in audits and use of technology by governments. The LOTA Scan part related to external environment assessment helps to identify areas where technology audits are required and outlining technology-related audit projects to be included in LOTA Strategy. At the same time, external environment assessment helps to identify the technological needs of SAI for using technology in audits. In turn, the internal environment assessment helps to assess the current state at the SAI and how well SAI responds to the technological needs arising from the external environment.

The LOTA Scan Tool consists of

1. LOTA Scan Guide. The LOTA Scan Guide provides basic guidance on running the LOTA Scan project at a SAI. This includes guidance on prerequisites for conducting a LOTA Scan and the LOTA Scan workflow including key phases and analysis.
2. LOTA Scan Canvas. The LOTA Scan Canvas provides a template for conducting and high-level reporting on the LOTA scan.
3. LOTA Scan Question Bank. The LOTA Scan Question Bank lists detailed questions to be considered during the analysis.

For more information on these items along with download links may be found below. 

The audit of information technology systems, controls, and processes, also referred to as an IT audit, has become one of the central themes of audits being conducted by Supreme Audit Institutions (SAIs) across the world. This is a natural response to the critical reliance on IT systems to support government and public sector organisations. The IT systems being used should protect the organisation’s data and assets as well as support mission, financial, and other specific goals.

While the increasing use of IT has led to improved business efficiency and more effective service delivery, it has also brought with it risks and vulnerabilities associated with, for example, the digitalisation of services and the increased connectivity to other internal and external systems and networks. The role of IT audit in providing assurance that appropriate processes are in place to manage the relevant IT risks and vulnerabilities is essential if the SAI is to report meaningfully on the efficiency and effectiveness of government and public sector operations.

In 2014, the International Organization of Supreme Audit Institutions (INTOSAI) Working Group on IT Audit (WGITA) and the INTOSAI Development Initiative (IDI) jointly worked to produce the first Handbook on IT Audit with the goal to provide SAI auditors with standards and universally-recognised good practices on IT audit. This 2022 version of the handbook provides an update to the explanations of the major areas that IT auditors may be required to look into while conducting IT audits.

The WGITA/IDI handbook follows the general auditing principles as laid down under the International Standards for Supreme Audit Institutions (ISSAI). The handbook also draws from the internationally recognised IT frameworks, including ISACA’s COBIT framework, International Standards Organisation (ISO) standards, and IT guides and manuals of some of the SAIs, in an attempt to provide the users with essential information and key questions needed for the effective planning and performance of IT audits.

The project to update this handbook was led by the chair of WGITA, namely SAI India, SAI of the United States of America, and the IDI. WGITA and the IDI wish to thank the individual members of the team who worked relentlessly in developing this guidance. IT auditors from the SAIs of Australia, Brazil, Fiji, India, Kuwait, Philippines, Tanzania, and the United States of America have contributed valuably by providing IT audit report examples. Many thanks also go to the SAIs that provided their valuable feedback and comments on the handbook.

IDI and WGITA will conduct a light touch review of this handbook on a biennial basis. If there are substantial changes to be made, IDI-WGITA may decide to work on a revised version of the handbook. Such decisions will be taken on the basis of the biennial review.