The State Digital Development Agency (VDAA) announced a procurement on 26 June to carry out an audit of the IT platforms used to support the 2025 municipal elections. Interestingly, the agency apparently expects that someone will carry out such an audit in a single working day.
The procurement documentation shows that the theoretical contract performance period is 15 days, but, taking into account the overall task and the requirements for bidders, as well as the expected price, it can be concluded that VDAA has no idea where it stands or what it is asking for.
The documentation states that, to perform the task, the bidder must offer at least the following qualified specialists: an information systems auditor with a valid CISA (Certified Information Systems Auditor) or equivalent certificate; an information systems architect with a TOGAF or equivalent certificate; a systems analyst with a CPRE or equivalent certificate; a testing manager or test analyst with an ISTQB Advanced Level or equivalent certificate; a Linux systems administrator and a PostgreSQL administrator with at least 5 years of work experience gained in the last 10 years.
At the same time, the requirements specify that the bidder must, during the previous three years, have experience in the development or auditing of at least one modular information system with a contract development price of no less than 500,000 euro. As a rule, those who develop such systems do not perform audits, and vice versa. In any case, the price of each such specialist in the IT market starts from 150 euro and goes up in some places to 500 euro per hour. For easier calculation, we will use an hourly rate of 250 euro, which is rather lower than in reality. If the specialists cost more, then the situation is even worse.
So, if the amount of money allocated for the audit is 10,000 euro, then, divided among five specialists, this comes to 2,000 euro per specialist. Dividing that by 250 euro per hour gives eight hours, i.e. one working day. Accordingly, VDAA expects that in this time five specialists will be able to familiarize themselves with all the information, with eight modules (including the election platform’s election information system, the electronic online voter register, the ballot scanning system, the management portal, etc.), examine documents such as technical specifications, testing scenarios, test result protocols, test the system themselves, and then compile all this in writing. Is that possible? No, it is not.
In addition, among the requirements for bidders it is specified that the bidder agrees that the personnel involved in the performance of the contract will be vetted in terms of security in accordance with Cabinet of Ministers regulations – in simpler terms, these people will be checked by Latvia’s security services. Usually such checks take at least half a year and can be done faster only by order of some particularly high-ranking official. This in turn means that most likely only those companies whose staff have already undergone such checks previously could participate in the announced procurement. However, the application deadline for bidders for the procurement announced on 26 June is 1 July, and taking into account that there are holidays in between, the application period for the entire election system audit is three working days.
Considering all these circumstances and the impossibility of such an audit, one can only conclude that this audit might already be ready, and it is only necessary to find which company it can be “hung on”. By the way, perhaps it should be “hung on” those VDAA employees who were once hired specifically to oversee the entire election system development process and whose remuneration, according to Cabinet of Ministers documents, was allocated 356 thousand euro? Then there would also be someone from whom to demand accountability.
Originally published at https://inc-baltics.com/vdaa-ir-izsludinajusi-iepirkumu-lai-veiktu-auditu-it-platformam-ar-kuram-nodrosinatas-2025-gada-pasvaldibu-velesanas/
Like
Love
Happy
Haha
Sad
