Objectives

The primary objective of this tender is to engage a qualified service provider to conduct a comprehensive review of the municipality’s IT application controls, specifically focusing on Payroll and Supply Chain Management (SCM) systems. The review aims to assess the effectiveness, design, and implementation of controls to ensure data integrity, security, regulatory compliance, operational efficiency, and risk mitigation.

Scope

The scope encompasses conducting detailed audits of two key applications (Payroll and SCM), covering the following control areas:

• Administration: Evaluate application ownership, accountability, and administrative controls.
• Input, Processing, and Output Controls: Assess controls over data entry, processing integrity, and output accuracy.
• Logical Security: Review user access management, authentication, and segregation of duties.
• Disaster Recovery Plan (DRP): Verify existence and adequacy of documented DRP processes.
• Change Management: Assess documentation and implementation of change procedures.
• User Support: Evaluate support mechanisms, documentation, and training resources.
• Third Party Services: Review controls over third-party service providers, including SLA management and continuity planning.

The review will produce detailed reports, testing evidence, and recommendations for strengthening controls.

Technical Requirements

• Provision of comprehensive audit reports for each application, highlighting findings, risks, and improvement recommendations.
• Evidence of testing controls to verify design adequacy and operational effectiveness.
• Demonstration of a structured approach to conducting IT application control reviews, including methodology and project plan.
• Assistance in aligning with international ICT management standards.
• Skills transfer and training to municipal staff on system operations and control environment.
• Adherence to confidentiality and legal compliance, including data protection laws.

Skills Requirements

• Qualified professionals with certifications such as CISA, CISSP, or equivalent in IT auditing/security.
• Minimum of 5 years’ experience in IT application auditing, preferably within municipal or public sector environments.
• Proven track record in conducting IT control reviews, risk assessments, and compliance audits.
• Strong understanding of IT governance frameworks, change management, disaster recovery, and logical security controls.
• Ability to transfer skills and knowledge to municipal staff effectively.
• Excellent report writing, presentation, and stakeholder engagement skills.