2014-11-25
Ministry of Justice should pay more attention to the management of its information resources
The Minister of Justice is responsible for managing information resources which are of particular relevance for the whole country, namely, public registers and public information systems. The National Audit Office assessed how the Ministry of Justice managed these resources over the period 2010-2013. “The audit showed that the Ministry of Justice has not established an information technology (IT) management system covering the entire area falling under the responsibility of the Minister of Justice, it does not follow the recommended IT services management standards, and does not pay enough attention to the development and validation of the information systems and registers. However, there were also a number of good practice examples identified in individual bodies assigned to the management area of the Minister of Justice,” said Auditor General Giedrė Švedienė.
The audit found that the Ministry lacks a coherent and comprehensive IT management strategy covering its entire management area, so that activity priorities and strategic goals specified in the strategy are linked to the development and modernisation of the information technology/information systems (IS) of the bodies assigned to the management area of the Minister. An analysis of the registers under the responsibility of the Minister of Justice and the public IS performance and IT development planning scheme revealed that IT development planning documents cover the IT development in the activity areas of only two (out of 16) bodies assigned to the management area of the Minister of Justice. In addition, it is the Ministry itself that should be the manager of some public information systems and registers, rather than the bodies assigned to the management area of the Minister.
The auditors also noted that the management of the Ministry has no data on the efficiency of some IT processes and their compliance with operational requirements, which prevents detecting IT process control gaps. The Ministry does not have a management structure in which the participating persons would represent the IT demands of all management areas of the Ministry, analyse the risks arising to the public information systems and registers managed by the Ministry, summarise these risks, and provide suggestions for strategic decisions on IT development priorities and investments. Without addressing these issues, there is a risk that the development of the public registers and information systems managed by the Ministry will not meet the strategic directions of the Ministry and that IT benefits to the activities undertaken within the Minister’s management area will not be assessed.
It was also found that the Ministry pays insufficient attention to the development and validation of information systems and registers, since it does not have accurate information on the number of the information resources assigned to the management area of the Minister and the bodies subordinate to the Ministry are using information systems that have not been validated. For example, the Prison Department has not been following the IS development procedure – it has not approved mandatory documentation, it collects sensitive data about individuals and provides it to other institutions from an system which has not been completed and validated.
The controls applied by the Ministry to ensure the confidentiality, integrity, and availability of e-information (data) are deemed to be insufficient. However, it should be noted that there are some good IT project management examples in the bodies assigned to the management area of the Minister.
The National Audit Office issued recommendations to the Ministry of Justice to help improve the management of its information resources and also recommended to evaluate the good practices observed in bodies assigned to the management area of the Minister and to apply these practices on other bodies falling within the responsibility of the Ministry.