Bosnia’s Financial-Control App Lacks Change Logs for Government Risk Records

Bosnia and Herzegovina's public-sector financial-control application lacks a record of changes to key risk-management data and cannot give oversight users read-only access, according to a national audit published on 30 October 2026. The audit also found incomplete risk and business-process information for 10 of 79 institutions in the system, raising questions about how reliably officials can monitor government financial controls.

The finding concerns the PIFC application, which supports internal financial control and audit reporting across state-level institutions. It is not a finding that financial records were deliberately altered, that money was stolen or that an outside attacker accessed the system.

The 49-page performance audit by the Audit Office of the Institutions of Bosnia and Herzegovina says the software cannot maintain an audit trail of changes to the core data used for financial management and control. It also lacks a read-only role: users granted access cannot be limited to viewing records without the ability to modify them. The Central Harmonisation Unit of the Ministry of Finance and Treasury, which oversees the system, identified the ability of its own staff to alter information entered by other institutions as a problem.

The auditors reported that the application was unavailable from February 2024 until February 2025. Some functionality problems remained unresolved after service resumed, and the report said limitations on further development were linked to the absence of the application's source code. These findings concern the government's ability to maintain and oversee risk records; the report does not document an actual unauthorized edit or a data breach.

According to information supplied by the Central Harmonisation Unit, complete business-process maps and risk-register information were unavailable for 10 of 79 institutions. Eight institutions had neither item recorded and one lacked a risk register. The auditors separately noted that access to information from four institutions was restricted at those institutions' request on confidentiality grounds. Those categories must not be added together as if they represent distinct missing-data cases.

Weaknesses beyond the software

The review examined financial-control arrangements from 2021 through 2025, studying five institutions in detail and using consolidated reporting for broader context. It found that 41 institutions had some financial-control establishment deficiencies recorded in audits from 2021 to 2024; 14 had such deficiencies over three or four years. These historical figures are not a count of fraud cases.

The audit also examined four separate quality assessments that had produced 91 recommendations across four institutions. For the Ministry for Human Rights and Refugees, a 2025 implementation report showed nine of 26 recommendations completed, 13 under way and four unimplemented. The auditors said the system's reporting did not reliably demonstrate whether completed recommendations had improved the controls themselves.

The Audit Office concluded that the institutions sampled had not made financial-management and control systems work as a connected, reliable basis for managing risks and decisions. It recommended improving access controls, change tracking, the application's functionality and the way institutions report the effects of corrective measures.

The audit says affected institutions were given the draft findings and their comments were considered, with changes made where warranted. A parliamentary record dated 30 October lists the financial-control performance audit as a submitted document. The next substantive reporting questions are whether the government secures the software's source code, introduces an edit history and read-only permissions, and publishes measurable evidence that institutions have corrected the identified gaps.