Full IT Systems Audit

Read this first · 4 minutes

San Isidro de Calatagan runs on systems that work today — and on a small handful of people who could stop them tomorrow.

Mayor Mendoza, this briefing condenses sixteen days of fieldwork into the picture you would want before your next executive committee meeting. The full technical report follows; nothing in it contradicts what is on this page.

§0B.1What we are asking you to decide

Three decisions only the Mayor can make. The rest are operational and addressed in §9 Roadmap.

1. Decision

   01

   Critical · F-01

   Authorise immediate source-code repatriation for eBPLS.

   Direct the MIS Chief to invoke clause §11(b) of PO 2022-IT-0089 and bring the eBPLS source code, deployment scripts, and credentials under City control within thirty (30) days. Cost: ₱120,000. This single decision removes the largest non-financial risk in this report.

2. Decision

   02

   Critical · F-02

   Re-lodge the Data Protection Officer designation with the NPC.

   Sign the formal designation of Atty. Sheryl Ramos-Tan and direct that it be transmitted to the NPC within fifteen (15) days, in line with NPC Advisory 2017-01. Cost: ₱25,000. This closes the City's largest statutory exposure.

3. Decision

   03

   Funding decision

   Approve a one-time supplemental allocation of ₱2.64M for FY2026 IT remediation.

   Funds the full twelve-month roadmap in §9. Pays for itself within the first averted incident. Can be sourced from the IT Modernisation line of the 20% Development Fund or proposed as a supplemental appropriation at the next sanggunian session.

The remainder of this report sets out the evidence, the technical detail, the statutory references, and a costed twelve-month plan. We are available to walk the executive committee through any portion of it.

§1.1Overall conclusion

The City Government of San Isidro de Calatagan operates an IT estate that is broadly functional in day-to-day terms but materially under-controlled in three respects: (a) resilience — the City cannot demonstrate that critical systems can be restored within an acceptable window; (b) insider concentration — operational and developmental knowledge is concentrated in a small number of individuals, two of whom are non-plantilla; and (c) privacy compliance — statutory designations and registrations under RA 10173 have not been maintained.

None of the deficiencies observed are, individually, indicative of fraud or wrongdoing. They are, taken together, the predictable outcome of an IT function that has grown faster than its governance arrangements. They are remediable within twelve months at modest cost.

§1.2By the numbers

§1.3Severity composition

§1.4Findings at a glance

§2.1Approach

Fieldwork was conducted on-site at the City Hall and the Mayor's Office Annex over a sixteen working-day period. The engagement followed Auditly's structured methodology, comprising five phases: Plan, Discover, Test, Analyse, Report. Procedures included documentary review, structured interviews, system walkthroughs, sampled transaction testing, configuration inspection (read-only), and external scanning of public-facing assets with prior written authorisation (Authorisation Memo dated 03 March 2026).

§2.2Standards applied

• — International Professional Practices Framework (IPPF) of the IIA, 2024 edition.
• — COBIT 2019 — for governance and management objective benchmarking.
• — ISO/IEC 27001:2022 and ISO/IEC 27002:2022 — for control benchmarking only; no certification claim is made.
• — COA Circular 2020-006 — IT audit guidelines for the public sector.
• — DICT Memorandum Circular 2020-011 — Cloud-First & Cybersecurity Policy.
• — NPC Circulars 16-01 and 16-03; NPC Advisory 2017-01.

§2.3Limitations

Our examination did not include penetration testing of internal network segments beyond the publicly addressable perimeter. One server (HRMS-DB-02) was unavailable for inspection on 11 March 2026 due to a scheduled maintenance window; it was re-tested on 18 March 2026. The sampling intervals applied to change-management evidence (n=23 of population 47) are documented in working paper WP-CHG-001.

§3.1Organisation profile

§3.2Systems in scope

§4Findings — IIA / COA standard format

Each finding is presented with Observation, Condition, Criteria, Cause, Effect, Recommendation, and Management Response, in accordance with the structure recommended by the Institute of Internal Auditors and reflected in COA Circular 2020-006.

§5.1Likelihood × impact

Plotted using the COSO ERM 5×5 convention. Each cell shows the finding references that fall within that combination of likelihood and impact, as judged at the close of fieldwork.

§5B.1Risk register — inherent vs residual

The heatmap in §5.1 plots inherent risk at the close of fieldwork. The table below carries that further: for each finding it states the residual risk after the §09 remediation completes, the named risk owner, whether the residual remains above the City's stated risk appetite, and the velocity at which the risk could materialise if no action is taken.

Two findings (F-04, F-05) leave residual risk above the City's stated appetite even after remediation, owing to vendor and platform dependencies that extend past the 12-month plan window.

§5B.2Risk concentration — where exposure clusters

Three systems carry roughly 73% of the total annual loss exposure. Any remediation budget that doesn't address RPTAS, eBPLS, and the backup infrastructure first will leave the bulk of the City's risk untouched.

§5B.3Risk trajectory — twelve months out

The composite risk index combines residual likelihood and impact across all twelve findings. Without intervention, the index drifts upward — driven mainly by the slow EOL of RPTAS infrastructure (F-05) and the compounding probability that a backup restore (F-04) will be needed before being tested. The dashed line shows the trajectory if the §09 roadmap is executed on schedule.

§5B.4Tail-risk scenarios

Three named scenarios illustrate how the findings interact when stress is applied. Each is plausible within the next 18 months on current evidence; the cascade column shows which other findings amplify the original event.

§6.1Annual loss exposure (ALE) and remediation cost

ALE estimates use a single-loss-expectancy × annualised-rate-of-occurrence model, with figures benchmarked against comparable PH LGU incidents reported by the DICT-CERT (2022–2024). Remediation costs are bottom-up estimates from current local market quotes.

Benefit-to-cost ratio: ₱15,280,000 ÷ ₱2,640,000 ≈ 5.79×. Excludes intangible reputational and citizen-trust impacts.

§6.2Where the money is — and where it isn't

§6B.1Multi-lens loss model — point estimates lie

§6.1 expressed loss as a single ALE figure. In practice, each finding has a range of plausible annual outcomes. The bars below show the 10th–95th-percentile band of modelled annual loss per finding; the dot is the most-likely (median) value. The right-hand label is the 95th-percentile worst case — what the City should plan to absorb in a bad year.

§6B.2Five-year cumulative loss — the cost of standing still

Compounded year-on-year, the “do nothing” trajectory accumulates ~₱99.6M of loss exposure over five years. Executing the §09 roadmap caps that figure at ~₱13.5M — a net improvement of ₱86M for ₱2.6M of one-time remediation spend.

§6B.3Hidden cost ledger

§6B.4Cost-of-inaction calendar

Every month the roadmap is deferred, expected loss accumulates at roughly the rate shown below. By Month 12 of inaction, the cumulative loss exceeds the entire ₱2.6M remediation budget by a factor of nearly six.

§6B.5Budget reallocation — current vs proposed

The current FY2026 IT spend mix is dominated by hardware refresh and license carryover; security, training, and personnel — the three line items most strongly correlated with audit findings — together command less than 20% of the budget. The proposed FY2027 mix shifts roughly 12 points of share into those areas without increasing the envelope.

§6B.6Revenue-at-risk from digital channels

Revenue-at-risk is computed as annual fees × probability-of-extended-outage based on the SLA history in §OP.1.

§6B.7ROI by initiative — what to fund first

§7.1Mapping of findings to statutes and standards

§7B.1Per-statute attainment

Compliance is rendered here as a percentage of applicable controls satisfied, weighted by control criticality. The two lowest readings — Data Privacy Act and NPC Circular 16-01 — are the same two regimes carrying the largest direct fine exposure for the City.

§7B.2Regulator exposure (₱)

Exposure figures use mid-band penalties published in 2024 NPC and COA decisions involving comparably-sized PH LGUs.

§8.1Why we look here

Conventional IT audits are perimeter-oriented. Auditly's methodology layers an additional examination focused on the people who hold operational keys — recognising that, in PH government practice, the most consequential disruptions in the past five years have not come from outside attackers but from the unmanaged departure, dispute, or under-supervision of an internal or contracted technical worker.

Key-person concentration map

Of the six (6) most critical systems, four (4) have no cross-trained backup. This concentration is the single highest non-financial risk identified in this engagement.

§8.2Dependency map — people to systems

The bipartite graph below visualises that concentration. Each red line connects a single person to a system on which the City would be operationally dependent in their absence. Mission-critical systems are flagged on the right.

§8.3Integrity scorecard — procurement and dev oversight

§M.1What we look at — and what we do not

We do not collect, infer, or store party affiliation. What we surface are operational and public-record signals that, taken together, indicate where the Mayor's directives could be quietly resisted, slowed, or sabotaged through the IT stack. These are facts the audit is entitled to examine.

§M.2Trust-tier classification — privileged-access roster

All fourteen (14) IT and admin staff with privileged access to mission-critical systems have been classified into four trust tiers, based exclusively on the operational and public-record signals catalogued in §M.1.

§M.3Loyalty distribution across critical systems

The bipartite map below shows which staff (left, colour-coded by tier) hold operational reach into which systems (right). Red lines indicate Tier-D access — the visualisation makes the structural problem unmistakable: a single Tier-D staff member controls four of the eight systems on which the City's continuity depends.

§M.4Mayor's Day-1 defensive playbook

The following sequence is engineered to be executed without legal exposure, without optics damage, and without operational downtime. Each step uses controls already authorised under existing LGU policy — no new ordinance required.

§M.5Tail-risk scenario — modelled, not predicted

§OP.1Service-level attainment by month

Twelve-month rolling SLA attainment per mission-critical service. Cells in the <75% band indicate sustained breach territory and warrant management attention; the RPTAS row tells the story of a system slowly degrading as its underlying platform ages out.

§OP.2Citizen-facing performance

§OP.3Helpdesk load vs staffing

§ST.1IT maturity — current vs target

Eight-axis maturity assessment scored 1 (ad-hoc) to 5 (optimised), benchmarked against the COBIT 2019 process capability scale and adapted to PH LGU realities. The shaded interior is the City's present capability; the dashed perimeter is the 18-month target consistent with the roadmap in §09.

§ST.2Capex pipeline vs depreciation cliff

The City faces a 2027–2028 replacement wave: ₱69M of hardware crosses end-of-useful-life inside that window, but only ₱32M of capex has been programmed against it. Without an early reprioritisation, mission-critical systems will be operated past their support horizon — the same condition that produced finding F-05.

§ST.3Project portfolio health (RAG)

Of 12 active IT projects, 4 are Red. Two of those four have no documented Post-Implementation Review owner — a governance gap separate from the technical issues.

§ST.4DR posture — declared vs tested

§9.1Twelve-month phased plan

The following plan sequences the twelve findings against capacity and dependencies. Items in the 0–90 window are intended to close the two Critical findings and the highest-leverage High items.

All evidence items below are retained in the engagement working-paper repository (ATL-WP-2026-0142) for a period of seven (7) years in accordance with Auditly retention policy and PH professional standards.

ALE

Annualised Loss Expectancy. Expected monetary loss per year from a given risk.

ARTA

Anti-Red Tape Authority of the Philippines.

BAC

Bids and Awards Committee, constituted under RA 9184.

BLGF

Bureau of Local Government Finance, Department of Finance.

COA

Commission on Audit.

COBIT

Control Objectives for Information and Related Technology, ISACA framework.

DICT

Department of Information and Communications Technology.

DPO

Data Protection Officer, designated under RA 10173.

EOL

End of Life — date after which a vendor no longer issues security updates.

IPPF

International Professional Practices Framework of the Institute of Internal Auditors.

NPC

National Privacy Commission.

PIA

Privacy Impact Assessment.

RPO / RTO

Recovery Point Objective / Recovery Time Objective.

RPTAS

Real Property Tax Assessment System.

WCAG

Web Content Accessibility Guidelines, W3C.

We have conducted this engagement with due professional care and have based our findings on evidence obtained during fieldwork from 09 March to 03 April 2026. The conclusions expressed are those of the engagement team and have been reviewed in accordance with Auditly's quality control system.