Digital Transformation and Data Analytics in a Rwandan SACCO Audit
Umurava SACCO is a Rwandan savings and credit cooperative with 40,000 members and 12 branches. It has just implemented a new core banking system with a cloud-based general ledger, mobile money integration, and automated loan approvals below RWF 500,000. You are the IT audit manager. Preliminary analytics show:
- 1,200 loans were approved below RWF 500,000 in the year, of which 180 were approved outside normal working hours (between 22:00 and 05:00).
- 45 loans were disbursed to the same mobile money number.
- The general ledger has 2,300 manual journal entries, 15% of which were posted by the finance manager.
- Access logs show the finance manager has 'super user' rights and can post and approve entries.
- The SACCO's regulator requires monthly reporting and a full audit trail.
The board asks whether the new system has improved controls.
1. Analyse the control weaknesses revealed by the data analytics and explain the risks they create.
Read the worked answer
Weakness 1 - After-hours approvals (180 loans): Automated approvals outside working hours suggest either automated rules operating without oversight or staff processing loans off-system. Risk: fraudulent loans, circumvention of approval limits.
Weakness 2 - 45 loans to one mobile money number: This is a strong indicator of a 'loan stacking' or related-party fraud. Risk: credit losses, money laundering, breach of member-lending rules.
Weakness 3 - 2,300 manual journal entries, 15% by the finance manager: High volume of manual entries indicates weak automated controls and reliance on manual intervention. Risk: earnings manipulation, misstatement.
Weakness 4 - Super user rights for the finance manager: A single individual can initiate, post, and approve entries. This breaches segregation of duties and the audit trail requirement. Risk: undetected fraud, override of controls (ISA 240).
Weakness 5 - Cloud GL and mobile money integration: Without reconciliation controls, transactions may be lost or duplicated. Risk: completeness and accuracy of member balances.
Regulatory risk: The regulator requires a full audit trail; super user rights and manual overrides may breach this, exposing the SACCO to sanctions.
Overall: The system has not improved controls; it has automated existing weaknesses and created new ones. Data analytics has surfaced red flags that traditional sampling might miss.
2. Recommend the controls and audit procedures the SACCO should implement, and explain how data analytics should be embedded in the audit.
Read the worked answer
Recommended controls:
- Segregation of duties: Remove super user rights from the finance manager; implement maker-checker for all journal entries; restrict system administration to IT.
- Automated approval rules: Cap automated approvals, require dual authorisation for repeat borrowers, and flag loans to the same mobile money number.
- After-hours monitoring: Generate exception reports for approvals outside working hours and require review by the credit committee.
- Manual journal entries: Require supporting documentation and approval; review all entries above a threshold and all entries by senior finance staff.
- Reconciliation: Daily reconciliation of mobile money to the GL, with independent review.
- Audit trail: Enable immutable logging and restrict deletion; align with regulatory requirements.
- Fraud risk assessment: Perform a fraud risk assessment (ISA 240) covering loan origination and disbursement.
Embedding data analytics in the audit:
- Full-population testing: Analyse all 1,200 loans rather than a sample; test for duplicate mobile numbers, after-hours approvals, and round-sum amounts.
- Journal entry testing: Analyse all 2,300 entries for unusual users, timing, and round amounts.
- Continuous monitoring: Set up dashboards for red flags and review monthly.
- Visualisation: Present findings to the audit committee to support governance.
- Limitations: Analytics identifies anomalies, not intent; each red flag must be investigated with corroborating evidence.
Judgement: The board should not conclude that controls have improved. The analytics reveal control gaps that require remediation before the next audit cycle.