IT Developments – Towards Audit of MIS
1 Dr Talat Imtiaz
In today’s world of economic awareness and with governments everywhere
experiencing fiscal stress, the success of National Budgets depend to a great extent on
the efficiency of the Accounting and Auditing functions. Public sector Audit and
Accounting practices in Pakistan are currently undergoing major reform aimed at
increasing transparency, streamlining accountability and improving overall financial
management in line with international standards and practices. These changes are in
response to, and complement, broader socio-economic reforms underway in Pakistan,
such as the drive for greater accountability of public funds and the needed for increased
involvement of communities in the allocation and use of spending. The enhancement of
local governments and the devolution of political power from provincial to local
governments mean that accountants and auditors will work in a new administrative
environment, in which there are greater demands for accountability by the public.
Improvements in information technology have also provided the incentive to adopt more
cost-effective tools for managing government accounts and providing information to
government decision makers, essential for effective and efficient financial
management .A diagnostic study in early 1990s revealed basic weaknesses in the
existing Public Financial system that needed to be addressed for ensuring good
governance through improved public accountability. The Government of Pakistan (GOP)
with the assistance of the International Development Association (IDA) launched the
Project for improvement of financial Reporting and auditing (PIFRA) in 1996.
1.1 Some Developments at the SAI Pakistan
The Government of Pakistan has introduced some key legislative changes, including
separation of the accounting and audit functions, decentralization and devolution of
financial management and accountability to local governments via various newly formed
agencies. The project (PIFRA) was to work in tandem with these reforms. In order to
make the transition from the old system to the new and improved one, major changes
were required to be made. A phased plan was adopted for this transition as not only new
models for audit and accounts functions were required but also developments in human
resource and infrastructure were to be put in place for a modernized and improved
Accounting and Auditing setup to emerge on completion of the project.
1 The author working as Director (R&D) at Audit &Accounts Training Institute, Lahore.
As a result a New Accounting Model (NAM) in line with international standards,
has replaced the century old codes that were in use since the country gained its independence in 1947. The accounting model previously in use within the federal and provincial accounting entities were cash based for transaction recording and for most of the reporting purposes. The balances were not produced through a double entry accounting system and as such lacked reliability. The modified model adopts a modified cash basis of accounting, which is in line with generally accepted accounting principles. It will record the cash transactions and will also take into account the commitments, acquisitions of fixed assets, and incurrence of liabilities during an accounting period.
Secondly a revised five element Chart of Accounts (COA) was developed to
replace the old two element classification code. This measure would bring about transparency in the fiscal information as well as making the system IMF/GFS compliant to finally cater for a full accrual basis of accounting from an initial installing of a modified cash basis of accounting model.
These changes affect the financial management of all the four provinces of the country therefore the new paradigm was approved by the President of Pakistan under an Integrated Financial Management System. For an efficient recording of transactions as well for an effective audit a functional design to implement NAM in an IT
Environment was required. Over a thousand technology requirements were identified
and finally a comprehensive design covering modules on Payments ,Tax/Capital Receipts, Loans/Grants, projects, Fixed Assets, Inter-Equity Transactions, Budgets, Cash flow, Payroll, GP Fund, Commitments, Staff Expenses, Petty Cash , Pension, feeding into the General Ledger was built. The IT network/connectivity was to be initiated between the root accounting unit i.e. the District Accounts Offices (DAO)/ Treasury Offices (TO) spread all over Pakistan, and respectively attached to each of the four Provincial Accountant Generals and the Controller General Accounts (CGA) and the Finance Department/Ministry of Finance. Within the Province Local Area Networking (LAN) is employed and is presently being switched to the wireless system, the provinces are connected to the center via Wide Area Networking (WAN). Thus the new SAP based accounting and budgeting system set up under PIFRA I is operating on a Province based centralized architecture with central servers located at Federal Capital Islamabad and each of the Provincial capitals. District Account Offices connect to these offices to these servers through remote telecom links. In addition, servers are also located at the Federal Ministry of Finance and each of the Provincial Finance departments. This comprises the Financial Accounting and Budgeting System (FABS).
The out put of the CGA and the DAGP presently comes in the form of the Appropriation accounts and the finance accounts, and the respective audit reports, besides these the finance managers in GOP require analytical reports such as forecasts of the costs servicing and repaying outstanding debt, pension liabilities projected out to the future; etc. These reports require gathering information from different sources, and hence take a long time to produce. With the implementation of PIFRA FABS systems transaction data pertaining to expenditures and receipts will be readily available and could be used for MIS reporting and decision making purposes. The new system would in fact form the key transaction processing layer of the GOP MIS information pyramid.
As these changes will also implement interfaces with the other GOP systems such
as the National and Central banks and the Central Board of Revenue which are intimately involved in the processing of government payments and receipts. Thus the IT base will allow individual payments and receipts to be recorded in the National Bank/State Bank of Pakistan systems. The new IT base also envisages enhancement to accommodate the multi year budgeting process under a Medium Term Budgetary Framework (MTBF) Program, of the GOP. Thus the GOP finance managers will have access to a variety of information. The Federal and NWFP budgets for FY 2004-05 have now been
successfully prepared according to the new CoA using SAP systems.
After the separation of the audit and accounts functions the next step was to improve the Audit Systems and procedures. An Audit Manual and a number of specialized audit guides which introduce Computer Assisted Audit Techniques (CAATS) and new audit standards has been compiled and now being tested. Development of software for Computerized Auditing will ultimately result in the acquisition of two types of computer software: Software for analyzing and auditing accounting data, or Computer Assisted Audit Technique and management information software for planning and monitoring the status of audits (AIMS). The DAGP has acquired ACL as its CAAT software, and is in process of acquiring an AMIS package. Presently training in CAATS for all levels of auditors is underway.
Thus the other important features of a Management Information system, such as the Management Reporting system, Decision Support System and Office Systems have to shape up in accordance with the major network of the Transaction Processing System (FABS), once it is fully in place.
2. Current Status of Computerization in the SAI Pakistan
The Organization of Auditor-General has begun its journey towards integrated financial reporting and IT audit through the Project to Improve Financial Reporting and Auditing (PIFRA). PIFRA ensures timely and accurate accounts through development of a New Accounting Model (NAM) by adopting international best practices and introduction of an integrated financial and budgeting system FABS through state of the art ERP solution SAP R3. These developments have opened new challenges for auditing environment, as now the auditors have to audit the accounts prepared on ERP systems. In order to meet the challenges, Auditor-Generals office has acquired ACL to enable the auditors to use Computer Assisted Audit Techniques. In addition a comprehensive IT plan for strategic top down control of audit is being put in place. Strategic Audit Management in the DAGP will provide the basis for top-down control of the Audit Department by the Auditor General of Pakistan (AGP) and the senior management. This would require macro level data for planning like Federal, Provincial and District accounts, and budget information (provided through the NAM/FABS databases). This information will be analyzed to study changes in spending priorities, new organizations in the budget, entities receiving more than the normal budget increase, problems of budget management, expenditure on items beyond a certain threshold level. The other major parameters of the MIS will emerge from the cumulative building up of audit information like audit plans, organizations covered in one audit year and organizations
remaining uncovered, previous audit history of organizations, types of audit observations
made by different teams, emerging from different organizations, auditee management
response and responsiveness, PAC decisions and follow-up. This information will linkup
with Field Audit Offices information to provide a comprehensive perspective of audit
resources as well as with Human Resource and Training information to establish a
comprehensive information base. The information base will be converted into an MIS for
structured information and will also provide the basis for a DSS to meet unstructured
For an appropriate operation of information systems discussed above they should have
access to an adequate information base. One huge system of databases will emerge from
the budgeting and accounting data (of over 100 government sites) including, but not
limited to the data that will be brought on the NAM / FABS systems. The powerful new
system of classification / CoA (Chart of Accounts) the integration between core
accounting systems and the outreach of the network extending to district and sub-district
levels will give tremendous breadth and depth to this body of information that will
continue to grow with daily transaction processing.
In addition there would be a need to establish a counterpart audit databases in the
i. Auditee profiles (on countrywide basis over 100,000 large and small
entities may be involved). The development of this database will be
facilitated by budget and accounts data discussed above.
ii. All audit reports from the stage of draft audit reports to the stage of
action taken on the directives of the PAC. The audit findings being
‘searchable’ not only by audit related parameters like reference audit
report, year of account etc, but by suitable heads of the classification
system, making macro views of audit findings and linkage with
budgetary accounting data possible.
iii. All rules, regulations, policies, relevant laws under which auditee
iv. Comprehensive HR data of all staff of DAGP and related entities like
CGA, MAG officers on deputation etc including such information as
training, audits conducted / supervised, subject specializations etc.
v. All DAGP standards, guidance, polices
vi. All relevant guidance, best practices reference works available
elsewhere pertaining to audit
vii. Details of all course, workshops, seminars offered by DAGP internally
and through outsourcing
viii. Archiving of audit-related record, including digital imaging of
essential audit evidence
ix. Database of Audit Plans and operations
x. Database of the department budgeting and administration going down
to Field Audit Office level.
2.1 Infrastructure Base for the Integrated Audit MIS
The three tier information architecture with its linkages with FABS and beyond with National Bank/State Bank, CBR (etc.) networks, and the audit focused data bases as discussed above taken together are called the ‘Integrated Audit Management Information System’ (A-MIS). The A-MIS will require host hardware, software,
communication network and proper physical premises to house the facilities.
The nerve center of A-MIS will be the Audit House or the HQ of DAGP at Islamabad. The DAGP HQ will undergo change through strategic planning of audit operations and the establishment of linkages between HRM and audit operations The nerve center of A-MIS at Islamabad will have a dual role. It will be central point of the entire audit IT network. It will have on-line linkage with the FABS systems and other government bases that can be linked up like Ministry of Finance, Planning Division etc. It will establish a comprehensive computer center manned by technical IT people. The center will process, access, analyze all types of data for top level planning, monitoring and control. At the same time the center will provide A-MIS access to the local field audit offices like DG Audit Federal Government, or Defense, or Zakat Audit. A comprehensive training center will be attached to the nerve center.
Each of the field offices will have their server that will be attached to the central nerve center and an appropriate sized network of workstations.
Net worked to the central nerve center of A-MIS will be provincial A-MIS nerve centers at each provincial capital. The centers will function under the Central A-MIS and will serve the field offices through main cities like Lahore, Karachi, Peshawar and Quetta. In each case a training unit will be attached and the five centers-training units (FOTC clusters) will be linked through video conferencing once they are fully operational.
Below this upper network will be the downward linkages going down to the district level. This network system would operate through the Director General District Audit of each province and will link up to the local nerve center through that route. Under the four Director Generals District Audit located in provincial head quarters there would be a cluster of Directors of audit spread out around the province. For field communication at this level dial-up connections or Internet would be used. If there is a requirement due to information flow congestion, the DG District Audit could be upgraded to the status of a Nerve Center.
3. A case study to assess the the General and Application controls in the
Computer Information Systems at AG Punjab
This exercise was undertaken at the newly developed site of Accountant General Punjab to assess the various General Controls and Application Controls in the Computer Information Systems (CIS). Following findings are noted:
? Within the General Controls comprising Organizational and management controls
of CIS, the segregation of the various functions/duties was found satisfactory.
There were appropriate system design standards and programme standards. While
procedures for absences, vacations and job rotations of key employees was found
unsatisfactory owing to development lag in the Human resource area.
? During check of physical controls the electronic data is physically secure as far as
its physical access by outsiders is concerned but the back up data needs to be
placed in a fire proof and secured place.
? In order to check Data Access controls, a review of entity manuals ,enquiries and
observations were undertaken and it was found that appropriate password and
other controls are in place to limit access to the data and that these controls were
in fact being used.
? EDP safeguards were checked to reveal adequate measures in place for a regular
taking of backup of data and system configuration files, as well as recovery
procedures for use of data in case of loss or destruction of data. Controls for the
use of correct version of offline tape or disk files were satisfactory. We did not
find any provisions for off site processing in the event of disaster.
? There were adequate controls for testing the conversion, implementation and
documentation of new or revised application systems as well as changes to
application systems. The controls over the acquisition of application systems were
also found in place.
? For system software controls it was found the CIS is using authorized
programmes, processing errors are detected and corrected in a timely basis, while
checks for the systems being used by authorized persons for authorized use are
being put in place.
? On the Application Controls side the Input Controls were found satisfactory
? Controls over processing of transactions and computer data files were in place
? The Out put controls were satisfactory and the results of processing were accurate,
timely and accessible to authorized personnel only.
? Controls for Programme Changes as well as authorizations for accessing
programmes or data files were in place. T he controls over maintenance of
programmes were satisfactory.
3. Some caveats for SAIs aspiring for IT based MIS
The crucial role played by communication and change management can not be
emphasized enough for the success of any project, especially one that unleashes reforms
as well. The greatest challenges that the SAI Pakistan has faced during this reform/IT
work stem from change management issues and from a need to instutionalise the
phenomena of change for a successful transition especially when reform is not driven by
a crisis but is a radical change from half a century worth of ancient practices. The reform
is further hindered by a social set up where majority operations are performed manually,
and the electronic media like computerization has to spread more widely. In such a
scenario electronic networking to the extent undertaken by PIFRA is an oasis of activity
for which strong linkages have to be developed with rest of the society (especially those
it has to interface with) for sustainability. We also face many issues that stem from our
political system, which is also evolving which means frequent legal and administrative
changes may disrupt the reform phenomena, which in turn may require updating from
time to time. Mainly the problems faced by the SAI pertain to: Communication and
propagation of the reform/improvement program and Human Resource Management:
? Propogation of the rationale
? Understanding of the new system and related changes at all levels
? Inculcating commitment and ownership of the program at all levels Human resource management:
? Preplaning the new job assignments and responsibilities
? Changing the transfer policy of officials to aid the transition
? Setting a system of Incentive compatibilities for initiating and rewarding the
adoption of the new practices, while also considering the double work that is often
involved in transitions and triggers stress and demotivation Socio-political environment:
? Dealing with cultural resistance and parochialism
? Dealing with provincial disparities
? Frequent policy changes
Institutionalizing the change:
? Putting in place budgetary provisions
? Effective and timely decision making
? Changes in the system
Timeliness of Training activity:
? Neither too early nor too late
? Bridging the gap
? Reiterative-learning and constant training
Although the project was phased, yet coordination problems have cropped up
frequently. It has amply made clear the need for putting into place strategic functions on
the ready before each reform/improvement activity is launched. We have dealt with the
change management and communication issues by setting up a communications
program through seminars, change management workshops and circulation of
documentation about the project, and by developing videos for wide exposure of the
project’s intentions, activities and achievements, multiple poster materials, four
newsletters and a variety of project related mementoes. For greater social and cultural
acceptability the project has gone slow wherever required so as to let the changes absorb,
thus extending the project time and reducing the agenda of change appropriately. A wide
range and intensive training activity has also helped in making the situation more
conducive. It has also been attempted to keep the program dynamic for any up dates or
Governmental policy changes like the devolvement plan for local governments.