Najvyšší kontrolný úrad Slovenskej republiky NKÚ SR

The main system that works out what a pension is worth is an IBM mainframe programme introduced in the 1990s and written in COBOL - 'an old programming language which fewer and fewer specialists command', stable and secure, but whose 'maintenance will be increasingly demanding in future' (p.3). The language is the smaller half of the problem. Decades of legislative change have been translated into 'approximately 800 programs which the pension insurance information system carries within its code', and that knowledge 'can be acquired by a new programmer only through practical experience and a detailed understanding of the whole pension insurance ecosystem' (p.6). The arithmetic of who holds it is set out exactly: at the end of April 2026 the agency had 13 employees who knew COBOL, three of them already at pension age and five more reaching it within four to five years; only five were under 60 and only one under 50. Since 2022 the agency had advertised for programmers several times and 'managed to find only one employee' (p.6). Replacement of the mainframe is planned for 2027 to 2032 at an estimated EUR 30 million, but at the time of the audit there was still no detailed timetable for it (p.6).

• Function: IT, Human resources, Planning
• Value: Human capital, Domain knowledge, Assets
• Stakeholders: Management, Staff, Operator
• Quality: Adequately staffed, skilled workforce Adequate resources and competences Appropriate use of technology and automation

Thirteen further subsystems feed the main pension system. Each 'was developed in a different period and under different conditions, and what was primarily addressed was the connection to the main pension information system, while the mutual interconnection of the individual systems and their databases was not addressed' (finding 2). The result is duplication: the same data held in several subsystems in different structures, and employees 'frequently checking data in two systems at once in order to confirm that it was true' (finding 2). The report's own summary of it: 'NKÚ SR points to the considerable fragmentation of the individual subsystems, which were not sufficiently interconnected and often did not exchange data among themselves. This state increased the administrative burden, the risk of errors, the need to print documents and the physical movement of files' (p.3). The audited body had written the same thing about itself, in the architecture document for the system meant to replace them: the systems 'are isolated and unconnected, do not exchange data among themselves, which leads to duplication, inconsistency of data and unnecessary manual work' (finding 2). Many of the subsystems were operated by outside firms, which raised costs and added the risk that they would not work with one another. Between 2020 and the end of April 2026 the agency paid EUR 8,071,350 for their administration and development, about EUR 1.2 million a year (finding 2), and against the record of failed modernisation the report calls the usefulness of that spending 'questionable' (p.3).

• Function: IT, Infrastructure, Outsourcing, Work process design
• Value: Assets, Finance
• Stakeholders: Operator, Supplier, Staff
• Quality: Avoidance of duplication and fragmentation Streamlined, standardized processes Interoperability that spares users redundant effort

The auditors did not estimate the level of digitalisation; they walked the process and classified every step as fully digitalised, partly digitalised or not at all (p.2). Sixty-two steps were checked, from the lodging of an application at a branch to the final decision by the approving officer. 'Of those steps, 77 per cent (48 steps) were not digitalised at all (manual entry of data) and 23 per cent (14 steps) were fully digitalised, without the need to complete or retype data' (p.4). The manual share was heaviest at the branch, where the application is written up and the file is created; the highest share of digitalisation, almost 40 per cent, was in the calculation of the pension itself (p.4). The conclusion is one sentence long: 'NKÚ SR found that the weak point of the whole process was paper' (p.4). The application arrives in printed form, a paper file is built at headquarters, and that file then travels from department to department for each action it needs. 'Given the volume of files (approximately 150 to 400 a day for old-age and early pensions alone) which had to be processed every day, the agency used shopping trolleys to move them around the building' (p.4).

• Function: Work process design, Product/service delivery, IT
• Value: Assets
• Stakeholders: Staff, Operator, Client
• Quality: Streamlined, standardized processes Appropriate use of technology and automation Efficient office

The agency has to absorb legislation it cannot influence, and the law in question moves constantly: the social insurance statute 'was changed 57 times between the beginning of 2020 and 30 June 2026', with many of the changes touching tens or hundreds of thousands of pensioners (p.4). 'On the one hand, the limitations of the IT systems did not permit flexible incorporation of these changes. On the other, an unstable and too rapidly changing legislative environment also meant that the agency invested its resources in changes which in the end were not implemented, or were abolished' (p.4). Routine recalculations - indexation, the thirteenth pension - run automatically. Extraordinary ones do not: the recalculation of early old-age pensions after 40 years of service took effect on 1 January 2023, but 'the first mass recalculations were launched only in April 2024' (p.4), which the formal finding puts at almost a year and five months (finding 3). The same pattern is building again for the recalculation of pensions for periods of childcare, in force from 1 January 2026: some 800,000 to 1 million pensioners must be assessed and around 400,000 may be entitled to more, yet as at 30 June 2026 the agency still had no detailed working guidance, 'because the IT systems had to be modified first' (p.4). Who pays for the delay is stated without hedging: 'people may wait several years for a higher pension. Even though the agency pays the money back retrospectively, over time it may be worth less because of inflation. In the worst cases some clients may not even live to see the increase' (p.5).

• Function: IT, Regulations, Planning
• Value: Regulatory system, Domain knowledge
• Stakeholders: Lawmaker, Client, Beneficiary, Staff
• Quality: Responsiveness to user needs and feedback Appropriate use of technology and automation Streamlined, standardized processes

Some of the cost of legislative churn is not delay but construction. 'NKÚ SR also points to situations where the implementation of some legislative changes and their subsequent abolition burdened the budget and the capacity of the agency without a long-term effect for the system. An example was the introduction of the parental pension in 2023. Because of the specific nature of this benefit - above all the gathering of information about pensioners' children and the recalculation of the benefit for service pensioners as well - the agency had to create a new information system worth EUR 2.6 million. After two years this pension in its original form was abolished and replaced by another form of calculation, so-called tax assignment' (p.5). The audit office's president called it, in the English press release of 2 October 2026, 'an example of inefficient use of public funds'. Nothing in the report suggests the agency could have refused to build it: the money followed a decision taken, and then reversed, somewhere else.

• Function: IT, Regulations, Finance
• Value: Regulatory system, Finance
• Stakeholders: Lawmaker, Policy setter, Management
• Quality: Cost control and value for money Clear objectives and goal-setting

The calculation is prepared by one officer and checked by a second. 'This check, however, took place mainly through paper files. The approving officer compared the data from the file with the data in various systems. If he found an error, he could write it into the paper file. In practice, however, errors were often also resolved in person, without being formally recorded. The information system did not allow these errors to be entered directly, corrected or further evaluated' (p.5). From January 2026 errors began to be written by hand into shared spreadsheets, 'but even this solution was not part of the main information system' (p.5). The deeper problem is that nothing caught an error inside the calculation at all: 'the system could not automatically flag possibly incorrect data. Since error records were not kept systemically until 2026, the agency could not track recurring errors, their types or possible failures of particular procedures' (p.5). The formal finding adds that no statistics existed on categories of error, and that 'the whole control process was thus dependent exclusively on the human factor, which significantly increased the risk of failure' (finding 4). The person who carries that risk is the applicant, for whom, the report notes, 'it is very difficult to detect such an error' (p.5).

• Function: Governance, Work process design, IT
• Value: Regulatory system, Human capital
• Stakeholders: Staff, Management, Oversight, Client
• Quality: Reliable, integrated information base Functioning oversight and governance Appropriate use of technology and automation

'The agency did not keep an identical electronic backup of whole files as they were issued in paper form. Important documents, such as proofs of employment or assessment bases, were digitised and backed up, but not all the data from the files were stored electronically. The agency kept electronically only the data for which it had a legal reason' (p.5). The registry system covered the recording and archiving of files, but 'did not ensure the protection of the information content of the documents themselves against their irretrievable destruction in the event of an extraordinary occurrence' (finding 5). The exposure is named and located: destruction of the archive on Hagarova street, where files were kept once processing was complete, could make it substantially harder to verify facts not held electronically, 'and consequently make the correct recalculation of pensions impossible for part of the insured' (finding 5). That is not a hypothetical: the childcare-period recalculation now under way needs exactly those data, which 'were not always systematically kept in electronic form in the past, so the agency will be forced to obtain selected data directly, by consulting the physical file again' (p.5). The remedy is the electronic benefit file, due to go live from August 2026, and on it the auditors make the only observation that is available to them: 'the sooner the agency introduced the electronic form of files, the fewer of them would be at risk at present' (p.5).

• Function: IT, Security, Infrastructure
• Value: Assets, Regulatory system
• Stakeholders: Management, Operator, Beneficiary
• Quality: Reliability and availability Sound risk management Reliable, integrated information base

The agency supplies data to 39 institutions of state and public administration, each under a contract published in the central register of contracts (p.6). The audit looked at the requests that were turned down. 'Since 2022, 14 such requests were refused. The applicants were mainly towns, municipalities, associations, institutes and other bodies' - requests which met the statutory conditions, but where the agency did not hold the data in the necessary form (p.6). The examples are ordinary and telling: it could not supply the age and sex of pensioners at district or local-government level, nor figures broken down by band for pensions paid above EUR 1,000 (p.6). The formal finding records the agency's own reasoning - that it did not hold the information, had not processed it and was not obliged to create it, so under the freedom of information statute it could not be made available (finding 6). The audit sets that against the state's declared direction: 'the absence of data in digital form and in the required structure limited adequate data awareness for selected entities of public administration and other entitled bodies', in conflict with the national concept for the informatisation of public administration, and weakening the state's own 'once and enough' principle for documents citizens must supply (p.6).

• Function: IT, Governance, Regulations
• Value: Regulatory system, Assets, Community
• Stakeholders: User, Partner, Policy setter
• Quality: Interoperability that spares users redundant effort Reliable, integrated information base Useful service

Strategic direction here is tied to a person rather than to a period. 'Under the law, every new director general of the agency must submit a proposal of strategic plans to the government within six months of appointment. This may lead to the priorities of the agency changing with every change of management' (p.8). The count is itself the finding: 'Since 2007, 8 directors general have succeeded one another at the head of the agency and 7 strategic plans have been approved. Although the strategic plans were as a rule prepared for 6 years, in practice they arose on average every not quite 3 years. In the years 2017 to 2026 the director general changed four times and four strategic plans were approved' (p.8). The names of the objectives changed between successive documents too, 'which reduced clarity and made it harder to check whether they were met' (finding 7). The report ties the churn straight to the outcome: 'because continuity and consistent tracking and fulfilment of the objectives were not ensured, the desired progress in the area of digitalisation was not achieved' (finding 7). Its recommendation on this point goes not to the agency but to the parliamentary social affairs committee - that a change in the law tie strategic plans 'to the period of time and the strategies of the state in this area, and not to personnel changes in the management of the agency' (p.2).

• Function: Strategy, Governance, Planning, Regulations
• Value: Regulatory system, Domain knowledge
• Stakeholders: Governing body, Management, Policy setter, Lawmaker
• Quality: Clear objectives and goal-setting Functioning oversight and governance Effective state

Table 1 lists what was attempted: Electronification of the agency's services, 2012 to 2016, EUR 67 million, closed because the deadlines for implementing EU-funded projects were missed; Modernisation of benefit agendas, 2019 to 2022, EUR 18.4 million, closed after an unsuccessful public procurement and, again, missed deadlines; and the technological transformation now planned for 2027 to 2032 at EUR 30 million (p.7). The second of them was not a sketch. 'It was a properly approved project under OPII with underlying analyses, a feasibility study, a cost-benefit analysis and tender documents prepared for public procurement, and with an assessment by the Value for Money Division. The public procurement was even started; in the end, after delays, it was not completed and the project was terminated extraordinarily' (p.8). Because its indicators were measurable, the auditors costed what was forgone: a shortening of selected processes in the pension agenda by up to 61 per cent; a possible saving of 137.30 full-time posts out of the 329 staff running that agenda, which for May 2024 to December 2025 alone would have been 'approximately EUR 3.18 million' in wages; and 'approximately EUR 23.12 million' on IT services over ten years (p.8). The formal finding is careful with that last figure - the IT saving assumed modernisation of all the benefit agendas, and for the pension agenda taken alone an increase in spending was expected, because only consolidation across agendas produces a real saving (finding 8). The report does not leave the failure with the agency alone: an institution providing benefits for millions of inhabitants 'should have priority at the highest level in the country', and the project 'should have received support at the level of the highest authorities, above all the Government of the Slovak Republic, which approves the strategic direction of the agency' (p.9).

• Function: Planning, Project methodology, Product/service purchase, Strategy
• Value: Finance, Regulatory system, Assets
• Stakeholders: Funder, Policy setter, Mandating authority, Management
• Quality: Cost control and value for money Clear objectives and goal-setting Functioning oversight and governance Sound risk management