Skills and competencies for authenticating digital records in

Skills and competencies for authenticating digital records in the audit process in Botswana’s public sector Paper presented at the South African Society of Archivists Conference, Birchwood Hotel, 4 July 2019, Johannesburg, South Africa Olefhile Mosweu (Ph. D) Civil Aviation Authority of Botswana

Introduction • The adoption of information and communication technologies (ICTs) in Botswana has seen many information systems implemented in the public service • Such systems, e. g. CRMS, CPMS, Teacher Management System etc. generate digital records • Poor capacity to manage digital records is a challenge for records management professionals in Botswana, and the ESARBICA Region (Kemoni 2009; Moatlhodi & Kalusopa 2016)

Study background • The Ministry of Finance and Economic Development (MFED) implemented GABS, an ERP system in 2004 to manage the financial management processes • Accountant General’s Department (AGD) is the custodian of the system. It monitors expenditure against budget and the accounting records are audited every year by the Office of the Auditor General of Botswana • For the Auditor General to make an audit opinion on the financial statements, authentic and reliable records are required.

Problem statement • The audit process relies on trustworthy records as evidence. Auditors have rejected digital records in the audit process because they were not authentic and unreliable as evidence (Ngoepe & Ngulube 2014; Inter. PARES Trust 2018). • In most cases auditors and records management professionals lacked the capacity to authenticate digital records in the audit process • Managing records in the digital environment has proven a challenge for those entrusted with their management due to lack of skills and competencies (Moatlhodi & Kalusopa 2016) • This study therefore sought to determine the skills and competencies required to authenticate digital accounting records generated in GABS, among auditors, records management professionals and ICT professionals

Objectives of the study • To determine whether auditors, records management and ICT professionals in Botswana Government ministries possessed required skills and competencies to authenticate digital records generated in GABS to support the audit process. • Establish the impact of inadequate skills and competencies to authenticate digital records generated in GABS.

Methodology • Approach: Qualitative • Design: Case study • Population: 25 Government Ministries • Sample: 6 Departments purposively selected (BNARS, AGD, OAGB, DIT, DCS –MFED and DIA) • 25 participants purposively selected • Data collection instrument: Interviews • Data analysis: Thematic

Findings – Skills and competencies • Records Management professionals v. Digital preservation v. Computing skills, and Electronic records management v. Analytical, planning and effective communication skills v. Metadata and auditing v. Security and privacy control in the digital environment v. Legal aspects of information management • Archivists need a variety of skills such as metadata schema, designing, implementing and managing recordkeeping systems, analysis of business functions especially in the digital environment (Eastwood 2006)

Findings – Skills and competencies • ICT professionals v. System design v. Business process analysis v. Data analytics v. Computer forensics and security v. Database administration v. IT Certification (Information Systems Auditor) • A secure network is essential for an operational information system. ICT professionals should secure IT networks, conduct audit checks on systems, implement safety rules to ensure security of information and enforce standards, policies and procedures related to security of

Findings – Skills and competencies • Auditors • Data analytics, and Business process analysis • Knowledge of, and use of auditing software • Monitoring and evaluation • Understanding of system design and development • Information systems audit • Presentation skills • The cited skills would enable auditors to authenticate digital records without inhibition. Without requisite skills, auditors may not spot accounting information system risks inherent in

Findings – Impact of inadequate skills and competencies • Auditors • Lack of requisite skills and competencies would have negative consequences for the audit process IA 2> ‘It would not be easy to establish the authenticity of data and transactions in the system. Fraudulent activities on transactions and data manipulation would not be easily identified. Government would lose a lot of money and officers who process transactions would take advantage of that to misuse government funds’ • Another auditor, IA 3 added> ‘There will be failure to capture

Findings – Impact of inadequate skills and competencies • Auditors • IA 4> ‘Lack of skills and competencies leads to unreliable audit findings without any value. Using unreliable data is more like distorting the risk management process and accountability. Inadequate analysis of audit evidence collected can lead to wrong conclusions and risks of issuing contradictory audit opinions’ • Records management professionals RM 1> ‘Weakened capacity to authenticate digital records. Inability to provide necessary guidance and direction on digital records management’ RM 2> ‘It would not be easy to identify authentic records from those that have been altered for someone who used a system to commit fraud’ RM 5> ‘Tampering with records is one critical step towards committing fraud, so lack of knowledge and skills about electronic systems leaves room unspotted data manipulation’

Findings – Impact of inadequate skills and competencies • ICT professionals • IC 2> ‘There is a likelihood of making mistakes or accidentally deleting data by overriding functions if one does not the impact of such actions. This may cause data loss or corruption. ’ • ICT 3> ‘Mistakes that can compromise data quality data in the system can happen. Information leakage, i. e. unauthorized personnel may have access to vital information’ • ICT professionals are crucial in the authentication of digital records in GABS especially that records managers lack capacity (Moloi & Mutula 2007; Mosweu & Kenosi 2018)

Recommendations • For auditors; • Auditors should be trained on technical aspects related to auditing in the digital environment, including the acquisition of skills and competencies on computerized auditing and metadata management • For records managers • It is recommended that records management professionals be capacitated on digital records management, exposed to financial management, and records management standards

Recommendations • For ICT professionals • ICT professionals should collaborate with Auditors and Records Managers during the deployment of business applications to ensure that they meet each’s functional work requirements to support both records and audit requirements to support the audit process

Conclusion • The authentication of records in GABS needs personnel with appropriate skills and competencies • The impact of lack of skills and competencies for Auditors, ICT professionals and records managers would yield negative results for the audit process • Continuous capacity building to enhance skills and competencies for both Auditors, Records Management and ICT professionals is a necessity in the face of everchanging technologies