Effective utilization of electronic data not only helps the State Audit Office of Vietnam (SAV) improve audit quality and reduce audit time, but also serves as a key pillar in modernizing its operations, ensuring transparency and adapting flexibly to the digital economy.
The SAV needs to codify data access rights into law and standardize data structures. Photo: TL
Changing Mindsets and Approaches
According to the guidance of the International Organization of Supreme Audit Institutions (INTOSAI), digital auditing goes beyond digitizing manual operations. It requires a fundamental shift in mindset, moving from probability sampling to analyzing entire datasets, and from post-audit reviews to continuous, real-time monitoring and risk alerts.
In China, the National Audit Office of China (CNAO) launched the Golden Audit Project at an early stage and established the National Audit Data Analysis Center (NADAC), which operates on a dedicated cloud platform. The platform integrates financial, tax, banking, public investment, land and social security data, processing more than 50 billion data records annually. The CNAO has incorporated requirements for electronic data collection into the Audit Law and led the development of the international audit data standard ISO 21378, helping standardize financial and accounting transaction data formats and reduce data collection costs.
Indonesia's Audit Board (BPK) has also codified the right to direct access to the data systems of all audited entities. These entities are required to submit periodic transaction data to the BPK every month. Notably, the BPK has developed an information technology system connecting three parties: audited entities, the BPK and the Parliament. This system monitors the implementation of audit recommendations, automates follow-up procedures, reduces the need for meetings and enhances transparency.
Meanwhile, the Australian National Audit Office (ANAO) has developed the AIE platform, which applies artificial intelligence (AI) and machine learning to analyze public financial data. Connected to databases from more than 100 government agencies, the platform supports auditors in identifying risks in real time. The ANAO has also established an audit data governance framework to ensure information security and compliance with privacy legislation.
International experience shows that optimizing digital data utilization requires audit institutions to codify data access rights into law, standardize data structures, establish centralized data analytics centers and develop tools to monitor the implementation of audit recommendations.
Technology is a supporting tool, but professional judgment and ethics remain decisive factors. Every auditor must take the initiative to master technology and transform data into knowledge to improve audit quality, reduce audit time and reinforce the SAV's position in the digital economy.
MSc. Huynh Ngoc Quang – Chief Auditor, SAV Regional Audit Office VIII
Challenges in Institutional Frameworks, Data and Human Resources
In recent years, the SAV of Vietnam has achieved several notable results, including operating nearly 40 professional software applications, launching an information exchange portal for audited entities, signing data-sharing agreements with the Ministry of Finance, Vietnam Social Security, the State Bank of Vietnam, and the Ministry of Planning and Investment, and piloting remote audits.
However, according to MSc. Huynh Ngoc Quang, Chief Auditor of SAV Regional Audit Office VIII, the application of information technology in auditing continues to face several difficulties and challenges.
Regarding the legal framework, although the State Audit Law grants access rights to national databases and electronic data held by audited entities, detailed implementing regulations have yet to be issued. This has resulted in a lack of specific, binding mechanisms governing data provision procedures and frequency.
Data standardization and quality remain limited due to the absence of a common set of audit data standards, resulting in fragmented and inconsistent datasets. Many important documents, including construction designs, cost estimates and acceptance records, remain in PDF or scanned, unstructured formats. As a result, auditors must spend considerable time cleaning data and processing documents manually.
Despite the progress achieved, the SAV's data infrastructure and capacity for connectivity and information sharing still need further development, particularly in establishing a centralized big data repository and strengthening real-time connectivity through application programming interfaces (APIs). Timely funding for software security licenses and equipment maintenance must also receive greater attention to meet digital transformation requirements and strengthen cybersecurity and network security.
Human resources and auditing mindsets also pose significant challenges. Auditors still lack sufficient skills in big data analytics, AI and specialized software, while the dedicated technology workforce remains limited.
Finally, resistance from audited entities presents another barrier, as some organizations are concerned about data exposure. Readiness for information technology adoption and data connectivity across ministries, sectors and local authorities also varies considerably.
Moving from Passive Adoption to Proactive Technology Application
Drawing on practical auditing experience, MSc. Huynh Ngoc Quang believes that the SAV should first strengthen its legal framework and standardize data into three categories: data held by state agencies, data provided to state agencies, and specialized data required by the SAV. It should also issue regulations governing the management of publicly disclosed audit accounts, ensuring that access is authorized and compliant with applicable powers and responsibilities.
“To utilize data effectively, investing in isolated tools is not enough. We need to determine what data auditing requires, the legal basis for accessing it, whether the data is sufficiently reliable for analysis, who is authorized to use it, and how the analytical results will be verified,” emphasized MSc. Huynh Ngoc Quang.
In addition, audit methods should be reformed by transitioning toward remote auditing and comprehensive data analytics. Every stage of the audit process should incorporate AI, machine learning, robotic process automation (RPA), natural language processing (NLP) and specialized analytical tools, such as ACL, CaseWare IDEA, Power BI and Python/SQL, to automatically identify risks involving tax refunds, unauthorized expenditure beyond approved estimates, bad debts and fraudulent financial transactions.
The SAV needs to accelerate human resource development alongside a shift in digital auditing mindsets. Auditors should receive training tailored to different proficiency levels, with practical exercises accounting for more than 60% of training. The SAV should also develop a workforce of data analytics engineers and strengthen information technology units within its specialized and regional audit offices.
In line with the SAV Development Strategy to 2030, the SAV should accelerate the development of an enterprise-wide data architecture and complete the relevant institutional framework, while establishing a centralized data repository and facilitating data connectivity and sharing with ministries, sectors and local authorities. Building on this foundation, during the 2026–2030 period, the SAV should expand its big data infrastructure and undertake more advanced modernization, roll out remote and continuous auditing on a wider scale, and apply AI models more extensively to automated risk assessment and fraud detection.
MSc. Huynh Ngoc Quang noted that in a digital environment, the SAV must pay particular attention to the legal validity and integrity of electronic audit evidence through digital signatures, encryption and audit logs. It must strictly comply with regulations on state secret protection and cybersecurity while strengthening audited entities' accountability for providing data. Above all, auditors' professional judgment must remain paramount, as it is the decisive factor in determining audit quality.