AFROSAI-E’s five-day workshop strengthened practical Oracle database audit skills and peer learning across six Supreme Audit Institutions.

By Cedric Ishimwe — SAI Rwanda

In Kigali, Oracle database security moved from theory to practice. Over five days, auditors from six Supreme Audit Institutions worked through the access, privilege, authentication and security controls at the heart of an Oracle database audit.

Rwanda hosted the Information Systems Audit Champions Program (ISACP) Module 3: Basic Audit of Oracle Database workshop from 17-21 August. Organised and delivered by AFROSAI-E, the workshop brought together participants from Rwanda, Palestine, Eswatini, Lesotho, Namibia and Uganda.

A regional workshop with a practical focus

The five-day programme created space for participants to share experience, take part in practical exercises and learn new approaches to auditing Oracle databases. Module 3 centred on four connected objectives:

• Strengthen participants’ knowledge of Oracle databases and their security features.
• Build practical skills in auditing database access, privileges and authentication.
• Help participants identify and assess security risks and weaknesses in Oracle databases.
• Improve participants’ ability to apply information systems audit methods when auditing Oracle databases.

Learning by doing

The workshop combined technical grounding with applied learning. Sessions covered Oracle database fundamentals; access and privilege auditing; authentication and password security; auditing methods; system security; and patching.

Participants then worked through practical exercises involving database information extraction, access reviews and security checks. Presentations and experience-sharing complemented the exercises, allowing audit professionals from different SAIs to compare approaches and learn from one another.

Participant Reflection

Bruce Ngabo — SAI Rwanda

“We also gained hands-on experience using Oracle commands and data dictionary views to review database configurations and security controls.”

Bruce highlighted the practical value of learning about Oracle architecture, administration, security and auditing, including CDB/PDB architecture, user and role management, privileges, database profiles, password policies and Unified Auditing.

Turning controls into audit evidence

By the end of the workshop, participants had strengthened their understanding of Oracle databases and security controls. They had also improved their ability to assess users, privileges, access rights and authentication settings, while gaining hands-on experience in database auditing.

The exchange among participants reinforced another important outcome: peer learning, cooperation and knowledge-sharing across SAIs.

Participant Reflection

Ophelia Manga Ntelamo — SAI Namibia

“The training strengthened my ability to identify risks such as excessive privileges, inappropriate role assignments, inactive or shared accounts, weak authentication controls and inadequate logging and monitoring.”

Ophelia plans to apply the learning in Oracle and ERP-related IT audits by developing standard procedures and checklists, reviewing database configurations and access, assessing privileged accounts and audit trails, and using appropriate Oracle queries to obtain reliable audit evidence. She also intends to share the learning with her audit team and develop reusable working papers to strengthen her SAI’s Oracle database audit capability.

From the workshop to the audit

The next step is application. Participants are expected to use their new skills in pilot Oracle database audits within their respective SAIs. As they do so, they will share their experiences and challenges with AFROSAI-E, helping to inform future training and the support provided as the knowledge is put into daily audit practice.

That progression—from technical understanding to practical audit work—captures the value of Module 3. By combining focused instruction, hands-on exercises and exchange across institutions, the workshop strengthened both individual capability and the wider culture of cooperation around information systems auditing.