Experiences of the Audit Office of Lithuania Dainius Jakimavičius Director Information Technology Department

2 Why self-assessment ? IT Development Strategy (September 2002) main aspects for IT development until 2006 oriented more on technological potential, less on office needs Mid-sized office over 300 working places (230 notebooks - auditors, 80 desktops – administration & audit management) 6 remote locations (branch offices) less posibilities for ad-hoc management

3 Objectives Introduce principles (practices ?) of corporate IT governance by integration of the main office processes with IT processes as well as increase awareness of the main office processes owners consolidating their inputs for IT development disclose the most important IT processes supporting the main office business processes set priorities for subsequent actions in the NAO

4 Findings PO1Define a Strategic IT Plan15/182 AI1Identify Automated Solutions14/182 DS5Ensure Systems Security14/182

5 PO1: Define a Strategic IT Plan Indicated Shortcoming: “Policy not known, no business planning system”, Pilot LT NAO, October 2003 Actions: Clear Procedures & Priorities for Allocation of Resources (importance ranking: 10) Setting up Business Requirements

6 Enforcement (1) Establishment of LT NAO Strategic Management & Risk Management Commission (November 2003). IT Management – among 7 most important risk areas Approval by LT NAO Council Implementation Plan of LT NAO IT Strategy (January 2004): IT Infrastructure Development System Policies & Procedures Business Software Remote access & direct links to NAO clients

7 Enforcement (2) Approval by LT NAO Council of outline of the new LT NAO information system (March 2004) Establishment of WG for elaboration proposals for development of future audit management and documentation system (May 2004) Establishment of IT Management Committee (February 2004) - sharing responsibility for IT development with owners of the main processes (auditors)

8 Practical Hints Mixing auditors & IT professionals – corporate nature of IT management Closing seminar – summing up things to be done Involvement of Head of SAI at the very early stage of self-assessment – demonstrating importance of the issue

9 Other Added Values Demonstrating IT awareness to SAI clients Recognition of SAI by ISACA community (locally). Presentation of self-assessment to the LT Chapter meeting (February 2004)