IT Audit

konichiwawa — Tue, 12 May 2009 15:05:15 +0800

Recently, I had a couple of friends asking me to explain about IT Audit as I am currently working in this line. Therefore, I thought I'd share some of my views as well as some which I found online with the people here.

Background

IT audit involves reviewing all the organisation's IT business processes and data that are integrated with the organisation's financial system. The review covers review of controls and compliance with the organisation's pre-set policies and procedures. IT audits are generally well planned procedures that focus on high-risk areas within the organisation that can be determined by the AGO, the audit committee, the board of directors or even the financial auditors of the organisation.

The objective of an IT audit could, for example, include
- a systems implementation project that has exceeded its budgetted time and cost
- a revenue generating system (ie. telecommunications billing system) that has wrongly reported the monthly revenue for financial reporting
- a financial system that is deemed critical in churning out the organisation's yearly financial reports
- compliance with international or even local legislation such as Sarbanes-Oxley Act or BURSA requirements

In general, IT audits help organisations monitor how the IT systems and controls supports their main business functions while validating the reliability, security, integrity and privacy of the IT systems. IT audits can also help organisations implement control structure processes such as Control Objectives for Information and Related Technology (COBIT), the Committee of Sponsoring Organizations of the Treadway Commission (COSO), and Internal Organization for Standardization (ISO) standards 27001, 27002, 17799, and their amendments.

Process

IT audits focus on controls to prevent, detect, and correct any erroneous, abnormal, or illegal transaction from occurring. The typical IT audit cycle consists of the following steps:
- define the risks
- define the control objectives to mitigate the risks
- define the scope of work to meet the control objectives
- perform a walkthrough or review organisation's policies and procedures to understand the procedures in place
- perform a test of 1 to ensure understanding of the procedures is in compliance to current practice
- perform sampled testing to ensure procedures are performing effectively throughout audit period
- evaluate control weaknesses as a result of testings performed
- highlight control weaknesses and recommendations to the organisation

After all fieldwork is performed, the IT auditor submits a final report that includes auditee responses (includes corrective actions taken or planned) for each of the control weaknesses noted. A follow-up audit which will happen later will be performed to ensure that corrective actions were carried out as per management responses and risks identified earlier have been minimised or mitigated.

IT Auditors

The IT auditor is also critical component in the financial auditing process and as such should be certified, whether as a CPA, Certified Information Systems Auditor (CISA) or Certificated Information Security Manager (CISM). Both certifications are issued by the Information Systems Audit and Control Association (ISACA). Other certifications that can be considered by IT auditors are Certified Internal Auditor (CIA), issued by the Institute of Internal Auditors (IIA), or Certified Information Systems Security Professional (CISSP), issued by the International Information Systems Security Certification Consortium (ISC)2.

IT auditors are found in most major companies as part of the Corporate Audit department. In addition, the Big4 audit firms (PwC, EY, KPMG and DTT) also offer IT audit services to assist their financial auditors as well as direct to other organisations. There does not seem to be any fixed requirements to be an IT auditor, however familiarity with IT systems and financial statements would be beneficial. In addition, IT auditors should have decent oral and written communication skills as they will be dealing with various types of clients from the groundwork staff (walkthroughs and IT systems understanding) to upper management (reports discussion and presentations).

I'm not sure if this will help anybody but just wanted to share my thoughts and views on this. However if there are anyone else in this industry that would like to correct me or add on, please do. I appreciate the feedback. Do PM me if you need any clarification.

Lowyat.NET: Latest topics by konichiwawa

IT Audit