{"id":5465,"date":"2026-07-24T11:21:00","date_gmt":"2026-07-24T04:21:00","guid":{"rendered":"https:\/\/audithink.com\/?p=5465"},"modified":"2026-08-03T11:37:34","modified_gmt":"2026-08-03T04:37:34","slug":"internal-audit-application-for-gcg","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/aplikasi-audit-internal-untuk-gcg\/","title":{"rendered":"Internal Audit Application for GCG: Implementation Guide for State-Owned Enterprises and Government Agencies"},"content":{"rendered":"

The internal audit application for GCG is a digital system that manages the entire internal audit cycle<\/a><\/strong> \u2014 from risk-based planning, implementation, working paper documentation, to follow-up monitoring \u2014 so that the internal audit function can produce documented, traceable, and audit-ready evidence of governance compliance.<\/p>\n\n\n\n

For state-owned enterprises (BUMN), regionally-owned enterprises (BUMD), and government agencies, implementing good corporate governance is no longer merely a formality. Minister of State-Owned Enterprises Regulation No. PER-2\/MBU\/03\/2023 emphasizes that SOEs are required to implement the principles of transparency, accountability, responsibility, independence, and fairness, and must have Internal Control System (ISC)<\/a><\/strong> and information disclosure policies. Consequently, the Internal Audit Unit is required to provide a reliable audit trail at all times\u2014something that is difficult to achieve with spreadsheet-based management and scattered documents.<\/p>\n\n\n\n

This article discusses the relationship between internal audit and GCG, mandatory features of GCG internal audit software, selection criteria, and implementation steps in public sector organizations and regulated corporations.<\/p>\n\n\n\n

The Relationship Between Internal Audit and GCG Implementation<\/h2>\n\n\n\n

Internal audit is one of the main pillars in the governance structure. Within the framework three lines model<\/em> Promoted by The Institute of Internal Auditors (IIA), internal audit occupies the third line: providing independent assurance on the effectiveness of internal control and risk management to the Board of Commissioners and the Audit Committee.<\/p>\n\n\n\n

The contribution of internal audit to the five GCG principles can be mapped as follows:<\/p>\n\n\n\n

GCG Principles<\/th>Contribution of Internal Audit Function<\/th><\/tr><\/thead>
Transparency<\/td>Provide audit results reports that are documented and can be traced back to the source of evidence.<\/td><\/tr>
Accountability<\/td>Ensure each finding has a risk owner (risk owner<\/em>) and clear follow-up PIC<\/td><\/tr>
Accountability<\/td>Testing business process compliance with regulations and internal policies<\/td><\/tr>
Independency<\/td>Maintaining separation of assurance functions from the operational functions being audited<\/td><\/tr>
Fairness<\/td>Ensuring equal treatment between stakeholders through control testing<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The problem is, without system support, these contributions are often inadequately substantiated. Audit findings recorded in separate documents, working papers disconnected from supporting evidence, and follow-up status updates only prior to Audit Committee meetings are commonplace\u2014and actually pose weaknesses when assessing an organization's governance maturity.<\/p>\n\n\n\n

\"internal\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

Why Organizations Need Internal Audit Applications for GCG<\/h2>\n\n\n\n

1. The Need for a Traceable Audit Trail<\/h3>\n\n\n\n

GCG maturity assessment requires evidence, not statements. Internal audit application<\/a><\/strong> record every activity \u2014 who created the working paper, who reviewed it, when the findings were approved, and how they were changed \u2014 in audit log<\/em> which cannot be modified. This track record is the basis for proving accountability.<\/p>\n\n\n\n

2. Consistency of Risk-Based Audit Methodology<\/h3>\n\n\n\n

Risk-Based Internal Audit (RBIA)<\/a><\/strong> requires that the preparation of the Annual Supervisory Work Program (PKPT) be based on the organization's risk map, not on previous years' practices. A good system links the risk register to the audit object, so that the allocation of supervisory resources can be methodologically justified.<\/p>\n\n\n\n

3. Acceleration of Follow-up Monitoring<\/h3>\n\n\n\n

The completion rate of audit recommendations is an indicator frequently highlighted by the Audit Committee and external auditors. GCG internal audit software allows for accurate monitoring of follow-up status. operated<\/em>, complete with automatic notification to the PIC and escalation of recommendations that pass the deadline.<\/p>\n\n\n\n

4. Reports Ready to be Presented to the Board of Commissioners<\/h3>\n\n\n\n

Manually preparing monitoring reports takes up auditor time that could be used for substantive testing. A centralized dashboard allows for a direct presentation of the findings profile, risk distribution, and follow-up progress, eliminating the need for repetitive recapitulation processes.<\/p>\n\n\n\n

Mandatory Features in GCG Internal Audit Software<\/h2>\n\n\n\n
\"GCG\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

The following features need to be available in an internal audit application to adequately support the implementation of GCG:<\/p>\n\n\n\n

    \n
  1. Risk management and preparation of risk-based PKPT<\/strong> \u2014 mapping organizational risks to determine audit object priorities in a measurable manner.<\/li>\n\n\n\n
  2. Audit assignment management<\/strong> \u2014 team formation, allocation of working hours, and monitoring progress per assignment stage.<\/li>\n\n\n\n
  3. Audit papers<\/a> digital (electronic working paper)<\/strong> \u2014 preparation of structured working papers with direct linking of audit evidence.<\/li>\n\n\n\n
  4. Multi-level review flow<\/strong> \u2014 approval mechanism from team leader, technical controller, to quality controller according to professional standards.<\/li>\n\n\n\n
  5. Management of findings and follow-up<\/strong> \u2014 recording findings, recommendations, PIC, deadlines, and completion status.<\/li>\n\n\n\n
  6. Centralized audit evidence repository<\/strong> \u2014 storage of supporting documents with version control and access rights.<\/li>\n\n\n\n
  7. Executive dashboard and reporting<\/strong> \u2014 visualization of supervisory performance for the needs of the Board of Directors, Audit Committee, and Board of Commissioners.<\/li>\n\n\n\n
  8. Role-based access control (RBAC)<\/strong> \u2014 access restrictions according to authority to maintain the independence and confidentiality of audit data.<\/li>\n\n\n\n
  9. Audit trail<\/a> system<\/strong> \u2014 recording all user activity as proof of data integrity.<\/li>\n\n\n\n
  10. Whistleblowing system integration<\/strong> \u2014 linking violation reports with special audit processes, in line with the obligation to implement WBS in BUMN.<\/li>\n<\/ol>\n\n\n\n

    See also:<\/strong> 7 Best Internal Audit Software Recommendations for Businesses in 2026<\/a><\/p>\n\n\n\n

    Internal Audit Application Selection Criteria for GCG<\/h2>\n\n\n\n

    Before making a choice, it is recommended to evaluate candidate systems based on the following criteria:<\/p>\n\n\n\n