System Auditors

Systems Auditor is a person who is engaged on a commercial basis by the Applicant to review and/or audit Innovative Technology Arrangements and smart contracts, or parts thereof. A Systems Auditor may not necessarily be an accountant or auditor with a practising certificate under the Accountancy Profession Act.

The Systems Auditor will be responsible for the final deliverable of the Systems Audit (prepared in conjunction with nominated Subject Matter Experts) and to conduct a quality-based assignment focusing on professional ethics. Systems Auditors and their nominated Subject Matter Experts will be required to demonstrate their key competencies and suitable expertise to MDIA.

A Systems Auditor (in the case of an individual), and the Subject Matter Experts, must, in aggregate, meet all of the following criteria:

Hold a qualification in ICT and/ or Information Security at MQF level 6 or higher
Hold a certification in IT Audit or IT Risk or Security Management
Have experience in carrying out audits and reporting based on audit established standards
Have suitable experience in Innovative Technology Arrangements in the fields that would be subject to audit of not less than two years during the last three years.

In addition, each Subject Matter Expert is required to demonstrate suitable work experience of not less than three years in performing IT audits, developing or implementing web/ enterprise-grade applications, or Information Security.

An Innovative Technology Service Provider shall be granted a Certificate of Registration, having a unique number for purposes of identification and listing the class or classes of services that the Innovative Technology Service Provider has been registered to provide. Furthermore, the Certificate shall be posted in a specific location or on the website (if available).

The Systems Audit Control Objectives are designed to provide and assist the Systems Auditor with an audit framework in the field of Innovative Technology Arrangements. The Control Objectives are based on five key principles, namely:

Security
Processing Integrity
Availability
Confidentiality
Protection of Personal Data.

The Authority directs Systems Auditors to follow standards issued by the International Auditing Standards and Assurance Board in preparing the Systems Audit report.

Furthermore, the Systems Auditor Guidelines issued by MDIA set out the required contents of a Systems Audit report.

A Systems Audit report is typically carried out :

when an Innovative Technology Arrangement is in the process of applying to be certified by the Authority (Type 1 Systems Audit report); or
periodically during the operational lifetime of an Innovative Technology Arrangement (Type 2 Systems Audit report) or when deemed necessary or requested by the Authority or other Lead Authority in Malta.

A Type 1 Systems Audit report assesses whether the description of the Innovative Technology Arrangement is fairly presented and whether controls are suitably designed to meet the applicable criteria (i.e. relates to new technology).

A Type 2 Systems Audit report contains the same opinions expressed in a Type 1 report and also includes an opinion on the operational effectiveness of the controls during the period covered by the audit (i.e. relates to technology that has already been audited).

Systems Auditors and Subject Matter Experts are expected to stay updated on the subjects on which they perform Systems Audits. Furthermore, they are required to demonstrate a minimum of twenty (20) hours of Continuous Professional Education per annum.

Moreover, the Systems Auditor is required to be covered by a Professional Indemnity Insurance policy for an amount of not less than € 1,000,000.

A Subject Matter Expert is an individual who is assigned a specific technical role by the Systems Auditor based on their expertise. A Subject Matter Expert may be an employee of the Systems Auditor or an employee of a sub-contracted entity.

The Authority expects the Systems Auditor to have a complement of at least two (2) Subject Matter Experts. Furthermore, the Authority, as part of the Systems Auditor registration process must recognise all Subject Matter Experts.