Frank Owusu, Senior Specialist Network Audit and Security.

Mobile money services have revolutionised the financial landscape in several African countries, including Ghana, providing millions of users with convenient and secure financial transactions.

However, as mobile money transactions continue to grow, the need for effective IT audit and assurance grows increasingly important.

Here, we explore the importance of IT audits, their scope, and the benefits they offer in ensuring the security, integrity, and compliance of mobile money services.

Why IT audit is important

IT audit plays a critical role in identifying and mitigating risks associated with mobile money operations. These risks include cyber threats, data breaches, and system downtime, which can have severe consequences on the security and integrity of mobile money transactions.

IT audit also ensures compliance with regulatory requirements, industry standards, and organisational policies. In Ghana, mobile money operators must comply with the Payment Systems and Services Act (2019), which requires operators to implement robust security controls and measures to protect mobile money transactions.

The scope of IT audits

The scope of IT audit in mobile money operations is comprehensive. The component areas of focus are:

• Infrastructure and network security: Evaluation of network architecture, firewall configurations, and intrusion detection systems.
• Application security: Review of mobile money application security, including authentication, authorisation, and data encryption.
• Data management: Assessment of data backup and recovery processes, data storage, and data retention policies.
• Transaction processing: Verification of transaction processing procedures, including authorisation, clearing, and settlement.
• Compliance and regulatory requirements: Evaluation of compliance with relevant laws, regulations, and industry standards.

The benefits of IT audits

The benefits of IT audit in mobile money operations are numerous and include:

• Improved risk management: Identification and mitigation of risks associated with mobile money operations.
• Enhanced compliance: Ensured compliance with regulatory requirements and industry standards.
• Increased data integrity: Verification of the accuracy, completeness, and integrity of mobile money transaction data.
• Better system security: Evaluation and improvement of system security controls and measures.
• Operational efficiency: Identification of opportunities for process improvements and cost optimisation.

Challenges and recommendations

Despite the importance of IT audit in mobile money operations, there are several challenges that must be addressed. These include limited resources, lack of expertise, complexity of systems, and regulatory requirements.

To address these challenges, mobile money operators should allocate sufficient resources, including budget and personnel, to support IT audit activities. We also recommend that operators engage experienced IT audit professionals with expertise in mobile money operations and technology.

In conclusion, IT audit plays a critical role in ensuring the security, integrity, and compliance of mobile money operations. 

By identifying and mitigating risks, ensuring compliance, and improving operational efficiency, IT audit helps to promote trust and confidence in mobile money services whiles considering the Bank of Ghana Cyber and Information Security Directives as well as controls in ISO 27001:2022 etc.