Management and IT security lapses found at several Singapore government agencies

The Auditor-General’s Office (AGO) of Singapore, a government organ that audits and monitors the use of public money and resources at government ministry and agencies, has released an annual report detailing the lapses it has found.

The report follows a pattern: it lists and describes in detail the irregularities that were discovered, then highlights the corrective actions that respective agencies have taken.

While the report details corrections that have been or will be carried out by the organizations under audit, it’s unclear if the AGO has a follow-up process to ensure promised actions were taken.

Inspection of certain agencies are rotated each year, based on the materiality of the agency’s funds and the number of years since the last audit. This adds a certain amount of predictability to the selection process, since the more significant the agency’s spending or discrepancies are in public impact, the more likely it is to be audited.

Highlights from this year’s report:

Wastage at Central Provident Fund Board (CPFB) from software not installed after licence purchases.

In a case of buyer’s remorse, the AGO has found after receiving complaints that installation of software was not carried out for 55 out of the 180 licences purchased between one and 3.5 years ago as at January 2013. The CPFB is an agency that runs a compulsory retirement saving scheme for Singapore Citizens and Permanent Residents.

The unused licenses and their maintenance costs amounted to SGD 0.99M. For 12 of these licenses, their maintenance were extended in December 2011 even though the software were not used in the 12 months before and after the extension date.

The AGO found no evidence of monitoring and reconciliation of installed software against a list of licences.

CPFB has said that it will put in place a monitoring system for software management. While 12 licenses were no longer need by the Board, the remaining unused ones will be assessed for redeployment.

Processes for evaluation and approval of research projects at MDA’s Gambit Game Lab were not followed.

The Lab was a SGD 40M (USD 31M) six-year research initiative to bolster Singapore’s video games industry. As of 30 September 2012, SGD 33.46M in grants were doled out to fund R&D projects. A final report was issued last year.

The AGO found lapses in the way projects funded by the initiative were evaluated and approved.

Projects were supposed to be scrutinized by an independent research panel or committee, then approved by an “appropriate authority” before funding could be given. However, in six of the projects checked by the AGO, no external validations and approvals were given.