Information technology audit

Summary

An information technology audit examines the management controls within an IT infrastructure, evaluating evidence to determine if systems safeguard assets, maintain data integrity, and function effectively to achieve organizational goals. It differs from a financial audit by focusing on internal control design, security protocols, and IT governance. IT audits assess risks to a company's information assets, ensuring systems are available, reliable, and secure. Various audit types exist, including technological innovation process audits and management of IT and enterprise architecture audits. The history of IT auditing dates back to the 1960s, evolving with technology advancements. Professional certifications are essential for IT auditors, with credentials like CISA and GSNA recognized worldwide. The evolving field continually addresses emerging issues, incorporating web presence audits and compliance with standards like ISO 271.

Highlights

• An IT audit examines management controls within IT infrastructure. 📈
• It evaluates evidence to ensure data integrity and asset protection. 🔍
• Different from financial audits, IT audits emphasize security protocols. 🛡️
• They assess system availability, reliability, and security. 📡
• Professional certifications are vital for credibility in IT auditing. 💼

Key Takeaways

• IT audits ensure systems are safeguarding assets and maintaining data integrity. 🔒
• They focus on internal control design and IT governance, unlike financial audits. 📊
• Various types of audits exist, including technological innovation and management audits. ⚙️
• Professional certifications like CISA are crucial for IT auditors. 🎓
• With technological advances, IT auditing has evolved since the 1960s. 🚀

Overview

Information Technology audits are critical examinations that ensure an organization's IT systems are protecting assets and maintaining data integrity. These audits differ from financial audits by focusing on the internal controls and effectiveness of security protocols as well as IT governance. They aim to assure systems are available, reliable, and secure, ultimately assessing the risks to a company's valuable information assets.

There are various types of IT audits, including technological innovation process audits that assess new and existing projects, and management of IT and enterprise architecture audits. These audits review the organization’s IT management processes to ensure controlled and efficient environments for processing information. The necessity for audits evolves with technological advancement.

Professional certifications, like CISA and GSNA, are essential for those in the IT audit field, demonstrating expertise in both technology and auditing practices. As technology continues to advance, IT auditing practices grow to incorporate emerging issues, such as web presence audits and adherence to new compliance standards like ISO 271, ensuring organizations remain secure and compliant.

Chapters

• 00:00 - 03:00: Introduction to IT Audit An information technology audit, often called an information systems audit, involves examining management controls within IT infrastructure. This process evaluates whether information systems are effectively safeguarding assets, maintaining data integrity, and operating efficiently to help an organization achieve its goals. These audits can accompany financial audits, internal audits, or other types of attestation engagements.
• 03:00 - 06:30: Types of IT Audits Engagement IT audits, previously termed electronic or automated data processing audits, are primarily focused on evaluating the internal control design and effectiveness of IT systems. This contrasts with financial statement audits, where the goal is to assess adherence to standard accounting practices.
• 06:30 - 09:00: IT Audit Controls and Processes The chapter discusses the importance of installing IT audit controls and processes, emphasizing that while installing controls is necessary, it is not sufficient for ensuring adequate security. It highlights the need for constant evaluation of controls to ensure they are installed correctly and functioning effectively. The necessity of investigating security breaches and implementing corrective measures is also covered. Moreover, it points out that these evaluations should be conducted by independent and unbiased bodies to maintain integrity and trust in the process.
• 09:00 - 11:30: Information Security in IT Audits The chapter focuses on Information Security within the context of IT Audits, where observers act as Information Systems auditors in various environments. It defines an audit as an extensive examination of Information Systems, including inputs, outputs, and processing. The IT Auditor plays a crucial role in assessing the systems that safeguard an organization's information. IT Audits are instrumental in evaluating the organization's capability to protect its information assets effectively.
• 11:30 - 14:00: History and Evolution of IT Auditing The chapter titled 'History and Evolution of IT Auditing' delves into the fundamental objectives and importance of IT auditing within organizations. It highlights that IT audits aim to ensure that a company's computer systems are consistently available to the business when needed, that information is disclosed only to authorized users, and that the data provided by these systems is accurate, reliable, and timely. Furthermore, the chapter discusses how these audits assess the risks to a company’s valuable assets and outline strategies to minimize these risks, encapsulating what is also referred to as Information Security.
• 14:00 - 17:30: Professional Certifications and Qualifications This chapter delves into the realm of IT audits, often referred to as systems audits, ADP audits, EDP audits, or computer audits. It discusses the different types of IT audits and the authorities that have developed various taxonomies to differentiate them. The chapter highlights Goodman and Lawless's identification of three systematic approaches specifically designed to execute an IT audit. One key approach described is the technological innovation process audit, which aims to establish a risk profile for both existing and new technologies.
• 17:30 - 20:00: Emerging Issues and New Audits The chapter delves into various aspects of auditing a company's technology experience and market presence. It emphasizes the importance of evaluating how a company organizes its projects and its role within its industry sector. Additionally, it introduces the concept of an 'Innovative comparison audit,' which is a process analyzing a company's innovation capabilities against its competitors, requiring a thorough examination of various factors.
• 20:00 - 21:00: Web Presence and IT Audits The chapter titled 'Web Presence and IT Audits' discusses the importance of evaluating a company's technological assets in its research and development facilities. It emphasizes conducting a 'technological position audit' to assess current technologies and identify those that need to be acquired. Technologies are classified into key, baseline, pacing, or emerging. Additionally, the chapter outlines a spectrum of IT audits categorized into five types, with systems and applications audits being one of them. This particular audit verifies the effectiveness and integrity of a company's systems and applications.
• 21:00 - 25:00: Additional Topics Related to IT Audits This chapter discusses the importance of verifying that information processing facilities are efficient and adequately controlled. It ensures that input, processing, and output of system activities are valid, reliable, timely, and secure.

Information technology audit Transcription

• 00:00 - 00:30 an information technology audit or information systems audit is an examination of the management controls within an information technology infrastructure the evaluation of obtained evidence determines if the information systems are safeguarding assets maintaining data integrity and operating effectively to achieve the organization's goals or objectives these reviews may be performed in conjunction with a financial statement audit internal audit or other form of attestation and
• 00:30 - 01:00 engagement it audits are also known as automated data processing Audits and computer audits they were formally called electronic data processing audits purpose an IT audit is different from a financial statement audit while a financial audits purposes to evaluate whether an organization is adhering to standard accounting practices the purposes of an IT Auditor to evaluate the systems internal control design and Effectiveness this includes but is not
• 01:00 - 01:30 limited to efficiency and security protocols development processes and it governance or oversight installing controls are necessary but not sufficient to provide adequate security people responsible for security must consider if the controls are installed as intended if they are effective if any breach in security has occurred and if so what actions can be done to prevent future breaches these inquiries must be answered by independent and unbi first
• 01:30 - 02:00 observers these observers are performing the task of Information Systems auditing in an information systems environment an audit is an examination of Information Systems their inputs outputs and processing the primary functions of an IT Auditor to evaluate the systems that are in place to guard an organization's information specifically Information Technology audits are used to evaluate the organization's ability to protect its information assets and to properly
• 02:00 - 02:30 dispense information to authorized parties the it audit aims to evaluate the following all the organizations computer systems be available for the business at all times when required will the information in the systems be disclosed only to authorized users will the information provided by the system always be accurate reliable And Timely in this way the audit hopes to assess the risk to the company's valuable asset and establish methods of minimizing those risks also known as Information
• 02:30 - 03:00 Systems audit ADP audits EDP audits computer audits types of it audits various authorities have created different taxonomies to distinguish the various types of it audits Goodman and Lawless state that there are three specific systematic approaches to carry out an IT audit technological innovation process audit this audit constructs a risk profile for ex existing and new
• 03:00 - 03:30 projects the audit will assess the length and depth of the company's experience in its chosen Technologies as well as its presence in relevant markets the organization of each project and the structure of the portion of the industry that deals with this project or product organization and Industry structure Innovative comparison audit this audit is an analysis of the Innovative abilities of the company being audited in comparison to its competitors this requires examination of
• 03:30 - 04:00 company's research and development facilities as well as its track record in actually producing new products technological position audit this audit reviews the technologies that the business currently has a that it needs to add Technologies are characterized as being either Bas key pacing or emerging others describe the spectrum of it audits with five categories of audits systems and applications an audit to verify that system and applications are
• 04:00 - 04:30 appropriate are efficient and are adequately controlled to ensure valid reliable timely and secure input processing and output at all levels of A System's activity information processing facilities and audit to verify that the processing facility is controlled to ensure timely accurate and efficient processing of applications under normal and potentially disruptive conditions systems development an audit to verify
• 04:30 - 05:00 that the systems under development meet the objectives of the organization and to ensure that the systems are developed in accordance with generally accepted standards for systems development management of it and Enterprise architecture an audit to verify that it management has developed an organizational structure and procedures to ensure a controlled and efficient environment for information processing client server telecommunications internets and extranets an audit of verify that
• 05:00 - 05:30 telecommunications controls are in place on the client server and on the network connecting the clients and servers and some lump all it audits as being one of only two type General control review audits or application control review audits a number of it audit professionals from the information assurance realm consider there to be three fundamental types of controls regardless of the type of audit to be performed especially in the it realm many Frameworks and standards try to
• 05:30 - 06:00 break controls into different disciplines or Arenas terming them a Euro OE security control so euroa a Euro access control a euroa a Euro oia control a Euro and an effort to Define the types of controls involved at a more fundamental level these controls can be shown to consist of three types of fundamental controls protective preventative controls detective controls and reactive corrective controls in inner system there are two types of
• 06:00 - 06:30 Auditors and audits internal and external is auditing is usually a part of accounting internal auditing and is frequently performed by corporate internal Auditors an external auditor reviews the findings of the internal audit as well as the inputs processing and outputs of Information Systems the external audit of Information Systems is frequently a part of the overall external auditing performed by a certified public accountant firm is auditing considers all the potential
• 06:30 - 07:00 hazards and controls in Information Systems it focuses on issues like operations data Integrity software applications security privacy budgets and expenditures cost control and productivity guidelines are available to assist Auditors in their jobs such as those from Information Systems audit and Control Association it audit process the following are basic steps in performing the information Tech technology audit
• 07:00 - 07:30 process planning studying and evaluating controls testing and evaluating controls reporting follow-up reports equal security equals auditing information security is a vital part of any it audit and is often understood to be the primary purpose of an IT audit the broad scope of auditing information security includes such topics as data centers networks and application security like most technical Realms these topics are
• 07:30 - 08:00 always evolving it Auditors must constantly continue to expand their knowledge and understanding of the systems and environment and pursuit in system company several training and certification organizations have evolved currently the major certifying bodies in the field are the Institute of internal Auditors the SS Institute and isaca while CPAs and other traditional Auditors can be engaged for it audits
• 08:00 - 08:30 organizations are well advised to require that individuals with some type of it specific audit certification are employed when validating the controls surrounding it systems history of it auditing the concept of it auditing was formed in the mid 1960s since that time it auditing has gone through numerous changes largely due to advances in technology and the incorporation of Technology into business current Curr there are many it
• 08:30 - 09:00 dependent companies that rely on the information technology in order to operate their business for example telecommunication or Banking Company for the other types of business it plays the big part of company including the applying of workflow instead of using the paper request form using the application control instead of manual control which is more reliable or implementing the EOP application to facilitate the organization by using only one application according to these the importance of it audit is constantly
• 09:00 - 09:30 increased one of the most important role of the it audit is to audit over the critical system in order to support the financial audit or to support the specific regulations announced for example socks audit Personnel equals qualifications equals the cism and capap credentials are the two newest security auditing credentials offered by the isaca and a squad respectively strictly speaking only the cisa or gsna title
• 09:30 - 10:00 would sufficiently demonstrate competences regarding both information technology and audit aspects with the cisa being more audit focused and the gsna being more information technology focused outside of the US various credentials exist for example the Netherlands has the re credential which among others requires a post-graduate it audit education from an accredited University subscription to a code of ethics and adherence to continuous
• 10:00 - 10:30 education requirements equals professional certifications equals certified Information Systems auditor certified internal auditor certified in risk and information systems control certification and accreditation professional certified computer professional certified information privacy professional certified information system security professional certified information security manager certified public accountant certified
• 10:30 - 11:00 internal controls auditor forensic certified public accountant certified fraud examiner chartered accountant certified commercial professional accountant certified accounts executive certified professional internal auditor certified Professional Management auditor Chartered Certified accountant GIA certified system and network auditor certified Information Technology professional to certify Auditors should have 3 years
• 11:00 - 11:30 experience certified e forensic accounting professional certified Erp audit professional emerging issues there are also new audits being imposed by various standard boards which are required to be performed depending upon the audited organization which will affect it and ensure that it departments are performing certain functions and controls appropriately to be considered compliant examples of such audits are SSA 16 Isa 342 and ISO 271
• 11:30 - 12:00 2013 equals web presents audits equals the extension of the corporate it presence beyond the corporate firewall has elevated the importance of incorporating web presence audits into the it is audit the purposes of these audits include ensuring the company is taking the necessary steps to brain and use of unauthorized tools minimize brand and reputation damage maintain Regulatory Compliance prevent information leakage mitigate third party
• 12:00 - 12:30 risk minimize governance risk see also equals computer forensics equals computer forensics data analysis equals operations equals help desk and incident reporting auditing change management auditing disaster recovery and business continuity auditing sas70 equals miscellaneous equals xbrl Assurance abashi the abashi business and it methodology and framework equals
• 12:30 - 13:00 irregularities and illegal acts equals aicpa standard SAS 99 consideration of fraud in a financial statement audit computer fraud case studies references external links a career as Information Systems auditor by Ain ashadam it audit careers guide federal financial institutions examination Council Information Systems audit and Control Association the need for caat
• 13:00 - 13:30 technology open security architecture controls and patterns to secure it systems American Institute of certified public accountants IT services Library