Information technology audit
Encyclopedia : I : IN : INF : Information technology audit
An information technology (IT) audit or information systems (IS) audit is an examination of the controls within an entity's Information technology infrastructure. These reviews may be performed in conjunction with a financial statement audit, internal audit, or other form of attestation engagement. Formerly called an Electronic data processing (EDP) audit, an IT audit is the process of collecting and evaluating evidence of an organization's information systems, practices, and operations. Obtained evidence evaluation can ensure whether the organization's information systems safeguard assets, maintains data integrity, and is operating effectively and efficiently to achieve the organization's goals or objectives.
IT audits are also known as automated data processing (ADP) audits and computer audits.
Purpose
An IT audit is similar to a financial statement audit in that the study and evaluation of the basic elements of internal control are the same. However, the purpose of a financial statement audit is to determine whether an organization's financial statements and financial condition are presented fairly in accordance with generally accepted accounting principles (GAAP). Regarding Protection-of-Information-Assets, one purpose of an IT audit is to review and evaluate an organization's information system's availability, confidentiality, and integrity by answering questions such as:
- Will the organization's computer systems be available for the business at all times when required? (Availability)
- Will the information in the systems be disclosed only to authorized users? (Confidentiality)
- Will the information provided by the system always be accurate, reliable, and timely? (Integrity).
- Will the organization's computer system provide useful information when required? (Utility)
- Will the physical aspects of the organization's computer systems be protected from the threat of theft? (Possession)
- Will the information provided by the system always be genuine, original without unauthorized change? (Authenticity).
Types of IT Audits
- Computerized Systems and Applications: an audit to verify that systems and applications are appropriate to the entity's needs, are efficient, and are adequately controlled to ensure valid, reliable, timely, and secure input, processing, and output at all levels of a system's activity.
- Information Processing Facilities: an audit to verify that the processing facility is controlled to ensure timely, accurate, and efficient processing of applications under normal and potentially disruptive conditions.
- Systems Development: an audit to verify that the systems under development meet the objectives of the organization, and to ensure that the systems are developed in accordance with generally accepted standards for systems development.
- Management of IT and Enterprise Architecture: an audit to verify that IT management has developed an organizational structure and procedures to ensure a controlled and efficient environment for information processing.
- Client/Server, Telecommunications, Intranets, and Extranets: an audit to verify that controls are in place on the client (computer receiving services), server, and on the network connecting the clients and servers.
IT Audit Process
The following are basic steps in performing the Information Technology Audit Process:
- Planning
- Studying and Evaluating Controls
- Testing and Evaluating Controls
- Reporting
- Follow-up
History of IT Auditing
The concept of IT auditing was formed in the mid-1960's and has gone through numerous changes due to advances in technology and the incorporation of technology into business.
IT Audit Topics
Regulations and Legislation Related to IT Audits
Several information technology audit related laws and regulations have been introduced since 1977. These include the Gramm Leach Bliley Act, the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act, the London Stock Exchange Combined Code, King II, and the Foreign Corrupt Practices Act.
- Health Insurance Portability and Accountability Act (HIPAA)
- Gramm-Leach-Bliley Act (GLBA)
- Sarbanes-Oxley Act (SOX)
- Foreign Corrupt Practices Act (FCPA)
- Captaris Inc. - material weakness and filing delay due to inadequate internal controls and related IT controls per SOX requirements
- Cray Inc. - numerous material weaknesses in internal control over financial reporting, specifically, inadequate review of third-party contracts and lack of software application controls and documentation
Security
Auditing information security is a vital part of any IT audit. Within the broad scope of auditing information security we find topics such as data centers, networks and application security. Auditing information security covers topics from auditing the physical security of data centers to auditing the logical security of databases and highlights key components to look for and different methods used for auditing these areas. It is important to remember that in this ever expanding technical realm these things are always changing and as such IT auditors must continue to expand their knowledge and understanding of systems and the systems environment to help verify and ensure information security.
Evaluating IT Audit Personnel Qualifications
There is no pre-defined skill set that is required when evaluating the qualifications of IT audit personnel. Since auditors will be responsible for evaluating the controls affecting the recording and safekeeping of assets, it is recommended that IT personnel have detail knowledge regarding information systems with a general understanding of accounting principles. Usually, it is desirable that IT audit personnel have received or qualify to receive the CA, CIA, CISA, or CPA credential.Employees involved in IT audits
- Board of directors
- Senior management
- Audit management
- External audit staff
- Internal audit staff
- Operations managers
Emerging Issues
Technology changes rapidly and so do the issues IT auditors must face. From biometric retinal scans to protecting physical security to transmitting data from a cell phone, this issue is truly limited only to one’s imagination.
See also
- IT audit resources
- Famous IT Auditors & Experts
- Information technology audit - operations
- Ethical Hacking - operations
Operations
- Backup systems and recovery
- Change management auditing
- Software development life cycle auditing
- Helpdesk and incident reporting auditing
- SAS 70
- Disaster recovery and business continuity auditing
Auditing systems, applications and networks
- Operating system audit
- Mainframe audit
- Database audit
- Enterprise Resource Planning audit
- Systems applications products audit
Computer Forensics
Irregularities and Illegal Acts
- [ISACA Standard: S9 Irregularities and Illegal Acts]
- AICPA Standard: SAS 99 Consideration of Fraud in a Financial Statement Audit
- Computer fraud case studies
External links
- [A career as Information Systems Auditor], by Avinash Kadam (Network Magazine)
- [Did IT Auditing Forget The Foreign Corrupt Practices Act?], by Robert E. Davis (ITAudit Magazine)
- [IT Auditing: An Adaptive Process], by Robert E. Davis
- [Federal Financial Institutions Examination Council] (FFIEC)
- [Information Systems Audit & Control Association] (ISACA)
From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.