Auditor-General Nancy Gathungu has expressed concern over the limited control the government has over the e-Citizen self-service and payment portal, emphasizing that this could jeopardize the accountability of the substantial sums of money processed through the platform.
Collections via the platform have surged to an average of Sh350 million daily, a significant increase from Sh50 million in the financial year ending June 2023.
Despite over 19,000 public services being available on e-Citizen, with 15,440 fully on-boarded, Gathungu highlighted in a recent audit report that the government lacks full control of the system. The Auditor-General noted a heavy reliance on the vendor for critical functions, making it challenging for the Government Digital Payments Unit (GDPU) to integrate certain services.
The lack of complete control, according to Gathungu, exposes the government to risks such as revenue leakage, accountability issues, system unavailability, security vulnerabilities, and potential business continuity disruptions.
Gathungu’s assessment is that the “current IT controls may not guarantee the integrity of the data processed through the system.”
The audit report also revealed that, despite the transition to the digital platform, the National Treasury is manually handling reconciliations and settlement of payments, posing a risk of human error. The adequacy of internal controls over these processes through e-Citizen could not be confirmed by the Auditor-General.
Furthermore, it was disclosed that the Treasury declined to provide the consultancy agreement between itself and the vendor managing the e-Citizen system, preventing the establishment of the terms and responsibilities of each party.
Gathungu also highlighted that e-Citizen operates without an approved IT policy for governance and management of its ICT resources, and lacks an ICT Steering Committee. The absence of an approved IT Policy raises concerns about information security and the safeguarding of ICT assets.
Additionally, the system lacks an approved Business Continuity Plan and a secondary backup site, further adding to the identified weaknesses in the audit report. The Office of the Auditor-General is currently conducting a special audit of e-Citizen to assess the credibility and reliability of the system.
