Internal Audit & ITGC / Cybersecurity

ITGC (IT General Controls) audits evaluate access management, change management, IT operations, and data backup/recovery across financial reporting systems. Indonesian companies need ITGC for group SOX compliance, external audit reliance, UU PDP data protection compliance, and OJK regulatory requirements for financial institutions. ITGCs are the foundational layer of IT controls that support the reliability of automated financial reporting controls. If ITGCs are weak — for example, if system administrators can modify financial data without approval workflows — then no application-level control can be trusted. For Indonesian PT PMAs that are subsidiaries of listed parent companies, ITGC audit results directly feed into the group's SOX 404 or equivalent internal control assessment. Under Indonesia's UU PDP (Personal Data Protection Law), companies processing personal data must implement technical safeguards including access controls, encryption, and breach notification procedures — all of which fall within ITGC scope. For companies regulated by OJK, POJK 38/2016 on IT Risk Management requires documented IT risk assessments and control testing.

UU PDP (Law 27/2022) requires companies processing personal data in Indonesia to implement: data minimization, purpose limitation, consent mechanisms, data breach notification within 72 hours, Data Protection Officer appointment for large-scale processors, and technical safeguards — all testable through ITGC frameworks. UU PDP applies to any entity processing personal data of Indonesian data subjects, regardless of where the entity is incorporated. For PT PMAs, this means employee payroll data, customer records, vendor contact information, and even director KTP data fall within scope. The technical control requirements map directly to ITGC domains: access management, change management, IT operations, and data lifecycle management. Companies that fail to implement adequate safeguards face administrative sanctions including fines up to 2% of annual revenue and potential criminal liability for directors under Article 57–67 UU PDP. The 72-hour breach notification requirement to both the data subject and the supervisory authority makes incident detection controls critical.

A COSO-based internal audit for an Indonesian manufacturer covers five components: Control Environment (tone at top, ethics), Risk Assessment (operational and financial risks), Control Activities (procurement, inventory, revenue, payroll controls), Information & Communication (reporting accuracy), and Monitoring (ongoing evaluation and deficiency remediation). For Indonesian manufacturing companies, the highest-risk areas typically include: procurement and vendor management (kickback risk, related-party vendor transactions, single-source dependency), inventory management (physical-to-book reconciliation, shrinkage, obsolescence provisions under PSAK 14), fixed asset lifecycle (acquisition approval, capitalization thresholds, depreciation accuracy per PSAK 16, disposal controls), revenue recognition (cut-off, bill-and-hold, consignment), payroll and BPJS compliance (ghost employees, overtime calculation accuracy, PPh 21 withholding correctness), and treasury/cash management. For PT PMAs reporting to a parent group, the internal audit scope must also cover group-mandated controls — which may include anti-bribery (FCPA/UK Bribery Act), sanctions screening, and ESG reporting controls.

ISO 27001 risk assessment for Indonesian companies requires: asset inventory (data, systems, people, physical), threat identification (ransomware, insider threats, regulatory non-compliance), vulnerability assessment, risk evaluation using likelihood × impact matrix, and treatment plans — mapped to Annex A controls and UU PDP requirements. Indonesian companies face a specific threat landscape that generic global frameworks may understate: high prevalence of business email compromise (BEC) targeting finance teams, ransomware attacks on manufacturing OT/IT converged networks, social engineering via WhatsApp, and insider threats amplified by high employee turnover rates. The risk assessment should be conducted at least annually and after significant changes. For companies pursuing ISO 27001 certification (increasingly requested by multinational clients and group auditors), the Statement of Applicability (SoA) must document which of the 93 Annex A controls (ISO 27001:2022) are applicable, implemented, and justified. The intersection with UU PDP creates a dual compliance mandate: ISO 27001 provides the control framework, while UU PDP specifies the legal obligations.

External audit (by a registered KAP) provides an independent opinion on financial statements under PSAK — it is backward-looking and mandatory for PT PMAs above threshold. Internal audit is forward-looking, tests operational controls, identifies risks, and reports to the Board/Audit Committee — it is governance-driven, not just compliance-driven. In Indonesia, external audit is performed by a Kantor Akuntan Publik (KAP) registered with OJK and the Ministry of Finance. It is mandatory for companies with assets or annual revenue above IDR 50 billion, publicly listed companies, and companies in regulated sectors. The external auditor provides an opinion on the fair presentation of financial statements — it does not test operational effectiveness of internal controls (except in limited scope for SOX-mandated engagements). Internal audit, by contrast, is management's tool for evaluating control effectiveness, identifying operational risks, and recommending improvements. For PT PMAs that are subsidiaries of listed groups, the parent's Audit Committee typically mandates internal audit coverage over the Indonesian subsidiary — covering areas the external auditor does not: procurement fraud, inventory leakage, payroll ghost employees, IT access violations, and regulatory compliance beyond financial reporting.