Annual General Report On The Audit of Information Systems FY 2021-22
Annual General Report On The Audit of Information Systems FY 2021-22
Controller and Auditor General, National Audit Office, Audit House, 4 Ukaguzi Road,
P.O. Box 950, 41104 Tambukareli, Dodoma. Telegram: “Ukaguzi", Telephone: 255(026)2161200,
Fax: 255(026)2117527, E-mail: [email protected], Website: www.nao.go.tz
I humbly submit,
Charles E. Kichere
The Controller and Auditor General
United Republic of Tanzania
About Nat ional Audit Off ice T anzania
iv
LIST OF TABLES
v
LIST OF FIGURES
vi
ABBREVIATIONS
ABS Aeronautical Billing System
AFROSAI-E African Organisation of Supreme Audit Institutions-English speaking countries
ATCL Air Tanzania Company Limited
BCP Business Continuity Plan
BOT Bank of Tanzania
CASIP Civil Aviation System Integrated Portal
CBE College of Business Education
COBIT 5 Control Objectives for Information and Related Technology
CRIMS Civil Registration Management Information System
CRS Civil Registration System
DIT Dar es salaam Institute of Technology
DRP Disaster Recovery Plan
EA Enterprise Architecture
e-GA electronic Government Authority
ERMS Enterprise Resource Management System
EWURA Energy And Water Utilities Regulatory Authority
FAAS Foreign Award Assessment System
FCC Fair Competition Commission
FOB Free On Board
GePG Government Electronic Payment Gateway
GIMIS GPSA Integrated Management Information System
GPSA Government Procurement Services Agency
GRMS Government Real Estate Management System
HESLB Higher Education Students’ Loans Board
ICT Information and Communication Technology
INTOSAI International Organisation of Supreme Audit Institutions
IPD ICT Project Document
IPSAS International Public Sector Accounting Standards
ISO/IEC International Organization for Standardization
ISSAI International Standards of Supreme Audit
JOT Judiciary of Tanzania
JSDS Judiciary Statistical Dashboard System
LGRCIS Local Government Revenue Collection Information System
LIMS Laboratory Information Management System
LPMS Land and Properties Management System
MAC Member Administration System
MC Mining Commission
MCIMS Mining Cadastre Information Management System
MEMS Members and Examinations Management System
vii
MIIT Ministry of Investment, Industry and Trade
MIMS Mineral Information Management System
MLF Ministry of Livestock and Fisheries
MMMIS Minerals Markets Management Information System
MNH Muhimbili National Hospital
MOCLA Ministry of Constitutional and Legal Affairs
MOHCDGEC Ministry of Community Development, Gender, Women and Special Groups
MOI Muhimbili Orthopaedic Institute
MORUWASA Morogoro Urban Water Supply and Sanitation Authority
MoU Memorandum of Understanding
MSD Medical Stores Department
MUSE Mfumo wa Ulipaji Serikalini
MWAUWASA Mwanza Urban Water Supply and Sanitation Authority
NAOT National Audit Office of Tanzania
NBAA National Board of Accountancy and Auditors
NCAA Ngorongoro Conservation Area Authority
NECTA National Examination Council of Tanzania
NHC National Housing Corporation
NIDC National Internet Data Center
NIMR National Institute for Medical Research
OLA Operational Level Agreements
OTR Office of Treasury Registrar
PCCB Prevention and Combating of Corruption Bureau
PEs Procuring Entities
PML Primary Mining Licence
Prime Minister's Office – Labour, Youth, Employment and Persons with
PMO-LYED Disabilities
POAS Port Operations Application System
PO-RALG President's Office - Regional Administration and Local Government
POS Point of Sale
PSSSF Public Service Social Security Fund
REIMS Research Ethics Information Management System
RGS Revenue Gateway System
RITA Registration, Insolvency and Trusteeship Agency
RMMS Road Maintenance Management System
RPO Recovery Point Objective
RTO Recovery Time Objective
RUWASA Rural Water Supply and Sanitation Agency
SLA Service Level Agreement
SOFIA Safety Oversight Facilitated Integration Application
viii
SOP Standard Operating Procedure
STAMICO State Mining Corporation
TAA Tanzania Airports Authority
TAESA Tanzania Employment Service Agency
TAMIS TCU Asset Management Information System
TANCIS Tanzania Customs Integrated System
TANROADS Tanzania National Roads Agency
TASAC Tanzania Shipping Agencies Corporation
TBA Tanzania Buildings Agency
TCAA Tanzania Civil Aviation Authority
TCU Tanzania Commission for Universities
TCRA Tanzania Communications Regulatory Authority
TEMESA Tanzania Electrical, Mechanical and Electronics Services Agency
TESWS Tanzania electronic Single Window System
TIN Taxpayer Identification Number
TOS Terminal Operating System
TPA Tanzania Ports Authority
TPDC Tanzania Petroleum Development Corporation
T-PESA TTCL Pesa
TR Treasury Registrar
TRA Tanzania Revenue Authority
TRC Tanzania Railways Corporation
TTCL Tanzania Telecommunications Company Limited
TTE Travelling Ticket Examiner
TTMS Tele-Traffic Monitoring System
TZS Tanzanian Shillings
UAT User Acceptance Test
USD United States Dollar
WCF Workers Compensation Fund
ix
Statement of the Controller and Auditor General
x
EXECUTIVE SUMMARY
Below are key audit findings that provide insight into the effectiveness of
the National e-Government Strategy's implementation and the compliance
of information systems with established standards and guidelines.
(ii) Medical items at MSD have expired items and items without expiry
dates due to inadequate validation of expiry dates in the system
during the receiving process. (Refer Para 2.1.1)
(iv) The RITA billing system allows payments below or above the
configured rate and issues certificates without payment, causing
revenue loss. (Refer Para 2.2.4)
xi
(vi) TANCIS has configuration issues and lacks harmonization of tariffs,
leading to undercharged or overcharged vehicle transit road fee.
(Refer Para 2.2.5)
(vii) Procuring Entities (PEs) ordering items from GPSA had negative
balances in their wallet accounts in the GIMIS application,
resulting in GPSA losing funds due to excessive spending beyond
the deposited amount. (Refer Para 2.2.1)
xii
ICT infrastructure management and third-party management have the
highest percentage of organizations that have achieved the required
levels of compliance. On the other hand, application systems change
management and ICT service continuity management have the lowest
percentage of organizations that have achieved the required level of
compliance.
There is a lack of clear vision and ICT strategy for Tanzania Ports
Authority (TPA), resulting in significant amounts of money being spent
on developing systems that are discarded before completion. (Refer
Para 4.5)
Based on the findings presented, it is evident that there are significant gaps
in the controls, processes, and systems of various government organizations
in Tanzania. These gaps pose a significant risk to the efficiency and
effectiveness of government operations and could lead to financial losses
and inaccuracies in financial statements.
xiii
To address these gaps, the following recommendations are suggested:
xiv
(iv) Operational Efficiency of eGA: eGA should prioritize completing
compliance enforcement assessments and conducting monitoring visits
to various entities to ensure that they comply with regulatory
requirements.
xv
CHAPTER ONE
1
INTRODUCTION
1.0 Background
2
1.3 Audit methodology
3
CHAPTER TWO
4
APPLICATION SYSTEMS CONTROLS
2.0 Introduction
Data output is evaluated to ensure that online or hard copy reports are
accurate and complete.
Audit trail is evaluated to ensure that controls over transaction logs ensure
the history is accurate and complete.
5
The figure below illustrate these elements.
6
Entity Information Issues identified Impact
System
Public Service Member Monthly contribution receipts Revenue loss for
Social Security Administration lacked proof of payment from the Fund.
Fund (PSSSF) System (MAS) 34 employers.
Medical Stores Epicor system 5 items had an expiry date Potential harm
Department that matched the to patients and
(MSD) manufactured date, and 171 financial loss to
items were recorded without MSD.
an expiry date.
Mining Mineral The MIMS allows mineral Potential loss of
commission Information auditors to adjust mineral revenue for the
Management quantity at inspection points mining
System (MIMS) without restrictions, resulting commission.
in incorrect charging.
I recommend that the Mining Commission integrate MIMS with TRA for
automatic weight determination and implementing an approval process
for quantity modifications.
7
I recommend that HELSB review and enhance system control in the loan
repayments verification process to ensure that the system validates all
the inputs and restricts posting of payments without a receipt number.
8
2.2.2 Information System Issues in National Institute for Medical Research
(NIMR)
Table 3 provides a detailed account of the issues that were identified in the
information systems and applications used by the National Institute for
Medical Research (NIMR) and the potential impact they may have on the
institute's operations.
I recommend that NIMR act on: (a) improving the accuracy of product
balance recording, reinforcing controls for proper request and approval
processes in the Store Management System; (b) improving system
controls and automation for document validation in the Research
Proposal Application Process, and (c) implementing a sample tracking
mechanism in the DISA Lab System to maintain compliance and improve
efficiency in research.
9
2.2.3 Inadequate system controls over management of medical items with low
shelf life
A review of MSD medical items stock in Epicor system revealed 4,894 expired
medical items worth TZS 235,4967,2892.78 prior to distribution. This is non-
compliance with the SOP for receiving stock which requires stock position
analysis from demand and planning unit before accepting medical items
with a shelf life below 80% or 24 months. This weakness is attributed to
inadequate system controls to validate shelf life and approval process for
the receipt and recording of medical items with a shelf life below 80%.
I recommend that MSD enhance system control to validate shelf life and
ensure the approval process for such items is properly accommodated.
10
Vehicles Transit Charges Act, [CAP 84 R.E 2019] and noted the following
anomalies:
(a) 11,526 out of 143,792 equivalents to 8% of total number of transit
vehicles undercharged road fee by USD 2,020,270.
(b) 7,501 out of 143,792 equivalents to 5% of total number of transit
vehicles overcharged road fee by USD 698,528; and
(c) There were inaccurate driver names which may not be traceable in
case of breaching applicable transit regulations and procedures.
11
I recommended that PO- RALG implements controls to prevent changing
of transaction dates to later or earlier dates than the actual transaction
date by restricting access to change transaction dates to authorized
personnel.
12
Table 4: Unreconciled transactions between Billing systems and GePG
Organization Transactions Discrepancy Amount (TZS)
TRC 27 Higher amount in e-ticketing system 662,994,919
than in GePG
GPSA 58 Higher amounts in GePG than in GIMIS 1,318,970,961
GPSA 1 Higher amount in GIMIS than in GePG 480,000
RITA 65,531 Higher amounts in billing system than 1,540,040,705
in GePG
TCAA 15 Higher recorded paid amount in billing 4,646,620
systems than in GePG
TBA 60 Higher amounts in GePG than in GRMS 40,468,284
real estate management system
TBA 2 Lower amounts in GePG than in GRMS 2,400
real estate management system
TANROADS 682 Overpaid bills between Databridge 16,601,526
billed amount and GePG settled
amount
TANROADS 487 Underpaid bills between Databridge 7,557,402
billed amount and GePG settled
amount
Judiciary 40 GePG recorded payment transactions 555,245
higher than in JDS 2
13
S/N Institution Applications not integrated Impact of non-integration
• Votebook (Accounting • Hinders the visibility of
System) with REIMS system, supplier payments from
which collects revenue for the procurement process.
research permits.
• Votebook with TANEPS
2. NECTA SAGE Accounting System with Human errors, incompleteness
Bank payment applications. and inaccurate transactions,
lack of accountability for action
performed by users in the
system, and potential
misstatements in financial
statements.
3. GPSA GIMIS with Electronic Single • Hinders the visibility of tax
window, TANEPS, and MUSE assessments.
• Unqualified suppliers in
GIMIS; and
• Payment of an ineligible
supplier and/or
overpayment to suppliers.
4. TCAA SOFIA-Landing and Overfly Incorrect reporting of collected
Permits System, CASIP- License revenue to intentional or
issuance System, and Billing unintentional human error.
System with the accounting
system (ERMS) for the automatic
posting of collected revenues.
5. TANROADS • RMMS application system • Unqualified contractors in
used to keep and monitor RMMS;
the road projects • Loss of collections from
information including with overloading charges; and
TANEPS; and • Misstatement of revenue
• Databridge application
system that installed in 13
weigh bridge stations with
revenue system (Epicor) and
GePG.
6. MSD • Epicor with Bank • Overpayment of supplier
Applications. claims compared to
approved amounts; and
• Epicor with Tanzania • Failure to detect
electronic Single Window overcharging caused by
System (TESWS) under or over-declaration
of extra cost.
14
S/N Institution Applications not integrated Impact of non-integration
• SAGE PASTEL with banking TAMIS into PASTEL through
systems. a journal.
• SAGE PASTEL with the • Can result into
budgeting system overpayment.
(PlanRep). • Can result overriding of
• SAGE PASTEL with billing budget controls during
portal - GePG. budget execution; and
• Can result in the posting of
incorrect revenue in the
accounting system
8. Judiciary of • JSDS 2 with NIDA system to • Manual verification and
Tanzania validate the applicant's validation of submitted
information information resulting in
inefficiencies and
inconveniences.
9. ATCL • SAGE Accounting System • Manual posting of cargo
and Cargo Management related revenue into Sage
System accounting system which
may lead to unrecognized
revenue amounting TZS
8,978,231.24 in sage
accounting system.
•
10. Treasury • PlanRep with HCMIS and • Insufficient and
Register PlanRep with TANEPS. unauthorised payments to
suppliers and employee; and
• Procurement executed out
of budget.
11. Mloganzila • Wellsoft and Jeeva Hospital • Human errors in recording
Hospital Information Management patients’ payments details.
System
12. MOCLA • Legal Aid and Arbitration • Loss of revenue due to
with GePG; failure in payment
• Arbitration and NGOs verification
Information System of the • Certifying unregistered
Ministry of Community NGOs due to intentional or
Development, Gender, unintentional human error.
Women and Special Groups
(MOHCDGEC)
13. Mining • MMMIS and MIMS systems • License details are manually
Commission which are used for filled in the 2 systems
management of mineral without verification and
sales are not integrated approval.
with MCIMS for automatic • use generic GePG portal and
validation of licences. manually update payments
details in these systems.
15
S/N Institution Applications not integrated Impact of non-integration
• MCIMS and MMMIS are not
integrated with GEPG to
automate the bill
generation process during
licence processing.
14. PMO – LYED • ePermit System with TIN • Provision of work permits to
and BRELA unqualified individuals and
illegal companies.
15. TBA • GRMS and HCMIS • Sales of houses to non-
• GRMS and GePG public servant
• Settling house debt for
ineligible payments.
16. EWURA • CAP Price Computation • Manual importing of
Information System (CPS-IS) exchange rates and FOB
is not integrated with Bank prices into CPS-IS is
of Tanzania (BOT) systems. subjected to human errors
• CPS-IS is not integrated with and delays; and
Platts API for the automatic • Manual verification of
transfer of Free on Board business licenses is
(FOB) prices. subjected to human errors
• LOIS is not integrated with which could result into
BRELA Systems for issuing license to
automatic business license unqualified applicants.
verification.
17. TRA CMVRS and RGS 501 motor vehicle payment
transactions worth 4.68 million
recorded in CMVRS could not be
traced in RGS
Source: 2021/22 Management letters of the respective entities
16
central server, which poses a risk of fraudulent activities due to ineffective
monitoring.
RITA has four different application systems for birth and death registration,
namely Civil Registration System (CRS), under-five birth registration system,
the civil registration management information system (CRIMS), and online
registration system. This duplication of systems increases administration,
maintenance, and support costs and overhead.
In my review of NIMR's ICT initiatives, I found that the organization has two
different lab application systems, one used by Mbeya center and the other
used by Mwanza center, which perform the same function but were acquired
independently without coordination. Additionally, while Mbeya center has
a store management system to manage inventory, Mwanza center uses
Microsoft Excel for this purpose.
17
Table 6: Underutilisation of financial and operational systems
Institution Underutilized Modules/Functionality
NIMR Procurement, Vehicle, Payroll, and Fixed Assets modules
NIMR Payments to suppliers not made within the system
TRC Cargo transhipments, cargo delivery and offloading, cargo storage, cargo
diversion, stoppage and extension, cross-border cargo management, and
adjustments functionality in the Cargo Management system not in use
TRC LPMS: Some properties are registered outside the system
TRC LPMS: Leasing bills for properties are generated in the miscellaneous bill
module of the E-ticketing system
ATCL Cargo Management Revenue system: International cargo are processed
outside the system
I recommend that both NIMR, TRC and ATCL take steps to assess and
establish the reasons for the reluctance to use these modules and
systems effectively, ensure that all modules and functionalities are fully
utilized, and discourage the manual operations for already automated
business processes.
18
System Issue Impact
MIMS 1060 Primary Mining Licence (PML) licenses missing Confusion surrounding
from Mining Cadastre Information Management validity of licenses,
System (MCIMS) potential loss of
government revenues
MIMS 311,910 transactions had incorrect calculated Loss of revenue due to
selling prices, 198,824 transactions had incorrect selling prices
undercharged loyalty and inspection fees, 113,086 and fees
transactions had overcharging of loyalty and
inspection fees
19
and Postal Communications (Tele-Traffic) Regulations, 2021. However, I
noted differences between the stated chargeable rates and charged rates
caused by TTMS capturing transactions fee and levy as they are from
operators' systems and not having a mechanism to re-compute levy to
confirm and verify that operators' systems are using the correct charge and
accurately computing fee and levy. This discrepancy may lead to under or
overcharging of the required levy, which may go undetected.
I recommended that TCRA develop a mechanism to re-compute levies to
ensure that the correct charge is used and that the fee and levy are
accurately computed.
(ii) Inadequate Reconciliation of Government Levies on Mobile
Money Transactions
The audit found that there were discrepancies between the reported levies
in TCRA Tele-Traffic Monitoring System and the levies filed to TRA by
operators. The cause of these anomalies was attributed to inadequate
reconciliation processes. As a result, the accuracy of government levies
collected by the operators cannot be fully assured.
I recommend that TCRA enhance the reconciliation process by
considering the reported figures to TRA by Mobile Operators. Also,
implement integration with TRA e-filling system for a more efficient
reconciliation and verification.
(iii) Non-monitoring of mobile money rollback transactions
20
2.3 Output Controls
Reliable reporting systems are crucial for organizations to make informed
decisions and maintain transparency and accountability. A thorough review
of the application systems output controls in Public Entities noted the
following challenges.
21
Organization Application Missing Reports/key details
system
PO-RALG TAUSI's POS collector’s cash on hand
application
controls
HELSB Employer portal Outstanding loans balance
system
Lack of key reports in the systems can result in a lack of transparency and
accountability such as untimely detection of revenue loss, difficult for
organizations to make informed decisions and manual interventions which
may increase the risk of errors.
22
CHAPTER THREE
23
NFOR A ON ECHNOLOGY GENERAL CON ROL
. nt oduction
- - - - - -
The result of my compliance assessment of 21 public entities (Appendix II)
in eight domains of IT general controls are as follows:
. t at ana nt o ic s
Strategy Management for ICT Services involves developing and executing a
plan to achieve organizational goals and objectives through the effective
use of ICT. It involves aligning technology with business needs and making
decisions on technology investments, policies, risks management and
service offerings. Effective strategy management ensures the successful
delivery of ICT services that support and drive business growth.
Fi u : st at ana nt co plianc i w
t at ana nt o ic s
These anomalies and weaknesses may hinder the effective use of ICT to
support organizational objectives, as well as increase the risk of security
breaches and data loss.
26
help entities recover critical business processes and ICT operations quickly,
minimize the impact of the disruption, and continue delivering services to
their customers and stakeholders.
ic ontinuit ana nt
27
Ano ali s Entiti s
defined disaster recovery team in DRP documents,
and lack of defined recovery procedures for critical
application systems in DRP documents)
Untested DRP and lack of awareness training ECTA, TCU, GPSA, IMR, MSD,
RITA, M H, STAMIGOLD, CAA,
MC, MoCLA, PO-RALG,
MORUWASA
Lack of data backups TCAA, TA ROADS, RITA, PMO-
LYED
o offsite backup location PSSSF, STAMIGOLD, T-PESA,
TEMESA
o offline backup MSD, Mining Commission, CAA
o defined backup restoration testing procedures IMR, MOI, PMO-LYED,
STAMIGOLD
o backup restoration tests TCU, GPSA, TA ROADS, TAA,
MoCLA, PO-RALG, TBA, M H
The noted anomalies and weakness can lead to prolonged recovery times
and significant data loss during a disaster.
28
Fi u 6: in ast uctu ana nt co plianc vi w
29
The audit assessed the compliance of 21 public entities with e-government
standards and guidelines for ICT Incident Management. The overall level of
compliance is shown in Fi u 7 and the details of its results is summarized
in App n ix .
nci nt ana nt
30
Ano ali s Entiti s Impact
n cti R po tin ECTA, TCU, IMR, GPSA, TCAA, Difficulties in recording
an ackin o M H, MOI, RITA, TRC, JOT, PMO- and keeping incidents for
nci nts LYED, TBA, MoCLA, MC, MIIT, later analysis to identify
MLF-Livestock sector, and MSD recurring issues for
identification of root
causes and finding
permanent solutions
3.5 S st ana nt
31
Fi u 8: st ana nt co plianc vi w
st ana nt
32
3.6 hi a t ana nt
Fi u 9: hi pa t ana nt co plianc vi w
hi a t ana nt
33
3.6.1 Lack of Contract and Service Level Agreements with ICT Service
Providers
The audit of ICT vendor management revealed government agencies that
lack contracts and Service Level Agreements (SLA) with their respective ICT
service providers, as shown in Table 12.
Table 12: Lack of Service Level Agreements with ICT Service Providers
Entity Service provider Service
GPSA eGA Hosting and internet services
TCAA Indra Aeronautical billing system
(ABS)
NIMR Mwanza centre TTCL Internet service provision
Prelink Medical Solutions LIMS Application System
RITA DIT Consulting service on
designing, developing, and
implementing trustees’
management system
eGA Marriage and Divorce System
TTCL Internet service
STAMICO TTCL Internet service provision
MNH TTCL Network services
Vodacom Network services
MoCLA e-Government Hosting and providing of
internet service
National Internet Data Outdated Service Level
Center (NIDC) Agreement (SLA) for hosting
secondary sites
TBA National Internet Data Internet service and
Centre (NIDC) application hosting
MLF eGA Application hosting service
TTCL Internet service
Lack of contracts and SLAs with ICT service providers could pose risks to
these government agencies, including service disruption, data breaches,
and vendor lock-in.
34
Ministry of Constitutional and Legal Affairs, revealed inadequate monitoring
which leads to a hindrance in service improvement.
During my audit of TTCL-PESA at TTCL and TASAC, I found out vendors were
granted uncontrolled access to the information systems. Vendors had
unrestricted access to the database servers and remote network access was
granted indefinitely without regular review of vendor activities. This poses
a risk to the security and sustainability of the system, as data may be
inappropriately used and disseminated by the vendors or their employees.
I recommend that TTCL and TASAC revoke vendor access and only grant
access on a need basis to ensure the security and sustainability of their
information systems.
35
Fi u 10: Application s st chan ana nt co plianc vi w
36
original state, implementation delay of critical changes, and difficulty in
support, maintenance, and modification of the application systems.
s Acc ss ana nt
37
Alongside the assessment of compliance level for user access management
in 21 audited public entities, my audit also evaluated the implementation
of user access management in other entities without ranking and identified
various anomalies and weaknesses as depicted in Tabl 14.
Lack of review can lead to unapproved and unauthorized users having access
to applications or infrastructure.
38
CHA TER FOUR
39
ICT PROJECT MANAGEMENT
4.0 Introduction
40
projects. My audit of ICT projects implementation noted the following
anomalies.
These delays can potentially result in project cost overrun and hinder the
achievement of the intended goals.
41
documentation, which can lead to unsustainable systems, missed
objectives, delays, and cost overruns.
TRC, TANROADS, and NECTA, did not have a mechanism for tracking the
costs associated with developing their application systems. This lack of a
costing mechanism could lead to misstated values of reported intangible
assets in the financial statements as required by Para 55 of IPSAS 31
Intangible Asset. This could potentially misleading management's decision-
making process.
42
simultaneously initiating a project to develop the Port Operations System
(POS) to replace TOS. Later, the Authority also commenced development of
the Port Operations Application System (POAS) for Lighter Quay operations
only but decided to include deep sea operations in the same project before
its completion.
43
CHAPTER FIVE
44
OPERATIONAL EFFICIENCY OF THE E-GOVERNMENT AUTHORITY
5.0 Introduction
The e-Government Authority is responsible for enforcing compliance of
public institutions with the e-Government related laws, regulations,
standards, and guidelines for the planning, acquisition, implementation,
delivery, support, and maintenance of ICT infrastructure and systems.
45
I recommend that the e-Government Authority improve its monitoring of
compliance recommendations that are issued to public institutions by
implementing a more effective system. Additionally, the e-Government
Authority should include the status of the implementation of these
recommendations in its biannual compliance assessment report.
There were 216 incidents where e-GA took more than 30 days to attend to
customers' complaints, which is in contravention of the Client Service
Charter that mandates the Authority to resolve issues between 72 hours to
30 days. Such delays in attending to customer complaints could cascade to
public institutions and ultimately delay service delivery to citizens.
46
Further, e-GA failed to conduct an annual customer satisfaction survey in
the year under review, which hinders the Authority's ability to improve its
services. To enhance its ICT support service delivery in public entities
47
CHAPTER SIX
48
CONCLUSION
The audit findings demonstrate the critical need for Tanzanian government
to address significant weaknesses and deficiencies in their information and
communication technology internal controls. These issues have the
potential to result in revenue loss and potentially fraudulent activities.
49
Appendix I: Compliance Levels and Entities for Various ICT Management
Domains
Domain Compliance No of Entities
Level Entities
Access Management level-0 4 MIIT, PMO-LYED, NECTA, TRC
level-1 3 MLF, MINING COMMISSION,
RITA
level-2 2 NIMR, JOT
level-3 7 TBA, MoCLA, EWURA, WCF,
UTT, TCU, MSD
level-4 3 TANROADS, TCAA, PO-RALG
level-5 2 PSSSF, GPSA
21
Application systems level-0 8 MLF, MIIT, PMO-LYED,
Change MINING COMMISSION,
Management TANROADS, RITA, NIMR, TRC
level-1 6 TBA, UTT, TCU, NECTA, MSD,
JOT
level-2 3 TCAA, GPSA, PO-RALG
level-4 3 MoCLA, WCF, PSSSF
level-5 1 EWURA
21
ICT Incident level-0 8 TBA, MLF, MIIT, MoCLA, PMO-
Management LYED, MINING COMMISSION,
TCU, NIMR
level-2 4 RITA, JOT, GPSA, TRC
level-3 7 EWURA, WCF, UTT,
TANROADS, TCAA, NECTA,
MSD
level-4 1 PO-RALG
level-5 1 PSSSF
21
ICT Infrastructure level-0 1 MIIT
Management level-1 1 MINING COMMISSION
level-2 2 MLF, TRC
level-3 5 TBA, UTT, TCU, MSD, GPSA
level-4 5 MoCLA, TANROADS, RITA,
NIMR, NECTA
level-5 7 PMO-LYED, EWURA, WCF,
TCAA, PSSSF, JOT, PO-RALG
21
level-0 6 MLF, MIIT, PMO-LYED,
TANROADS, NIMR, TRC
50
Domain Compliance No of Entities
Level Entities
ICT Service level-1 2 NECTA, JOT
Continuity level-2 8 TBA, MoCLA, MINING
Management COMMISSION, TCAA, RITA,
MSD, GPSA, PO-RALG
level-3 2 UTT, TCU
level-4 2 EWURA, PSSSF
level-5 1 WCF
21
Strategy level-0 1 MLF
Management for IT level-1 3 MIIT, TRC, PO-RALG
Services
level-2 5 TBA, PMO-LYED, MINING
COMMISSION, TANROADS,
RITA
level-3 4 MoCLA, UTT, NIMR, GPSA
level-4 7 EWURA, WCF, TCU, TCAA,
PSSSF, NECTA, MSD
level-5 1 JOT
21
System Management level-0 2 MLF, NECTA
level-1 4 PMO-LYED, RITA, NIMR, TRC
level-2 6 MoCLA, MINING COMMISSION,
UTT, TCU, MSD, JOT
level-3 4 TBA, EWURA, TANROADS,
GPSA
level-4 3 WCF, TCAA, PO-RALG
level-5 1 PSSSF
level-N/A 1 MIIT
21
Third Party level-0 3 TBA, PMO-LYED, GPSA
Management level-2 1 RITA
level-3 7 MIIT, MoCLA, MINING
COMMISSION, UTT,
TANROADS, NIMR, MSD
level-4 5 MLF, EWURA, TCAA, NECTA,
TRC
level-5 5 WCF, TCU, PSSSF, JOT, PO-
RALG
21
51
Appendix II: List of Audited Public entities.
Sn Name of Entity
1 Public Service Social Security Fund (PSSSF)
2 National Examinations Council of Tanzania (NECTA)
3 National Institute for Medical Research (NIMR)
4 Tanzania Railways Corporation (TRC)
5 Registration Insolvency and Trusteeship Agency (RITA)
6 Government Procurement Services Agency (GPSA)
7 Unit Trust of Tanzania (UTT)
8 Medical Stores Department (MSD)
9 Tanzania National Roads Agency (TANROADS)
10 Tanzania Civil Aviation Authority (TCAA)
11 Workers Compensation Fund (WCF)
12 Judiciary of Tanzania
13 Tanzania Buildings Agency (TBA)
14 Tanzania Commission for Universities (TCU)
15 Energy and Water Utilities Regulatory Authority (EWURA)
16 Mining Commission
17 President's Office Regional Administration and Local
Government (PO-RALG)
18 Ministry of Investment, Industry and Trade (MIIT)
19 Ministry of Livestock and Fisheries (Livestock section)
20 Ministry of Constitutional and Legal Affairs (MoCLA)
21 Prime Minister's Office – Labour, Youth, Employment and
Persons with Disabilities (PMO-LYED)
52