PRE108: IT AUDIT (Auditing in CIS Environment)

Chapter 1: The Nature of IT Audit

BY: Robert E. Regala

A. DESCRIPTION
Welcome to the module on Information Technology Audit (IT Audit), a crucial discipline
that is fundamental in today's technology-driven business world. Since the mid-1960s,
when computers first entered the business sphere, the practice of IT Audit has
continuously evolved due to rapid advances in technology and the deep incorporation of
IT into every aspect of business operations. In an era where companies rely on complex
information systems—from facilitating workflows to implementing centralized ERP
applications—the importance of IS Audit is constantly increasing. This module will equip
you with the expertise necessary for the examination and evaluation of an organization's
information technology infrastructure, operations, and controls. Your primary objective
in this field will be to determine whether information systems are safeguarding assets,
maintaining data integrity, and using resources efficiently to operate effectively and
achieve the organization's goals.
This is a wonderful field to enter because you will have the unique opportunity to make
a positive impact on the organization by serving as a valued advisor and strategic
thought partner to leadership. Success in IT Audit requires a dedication to continuous
learning, balancing technical knowledge—such as understanding cloud security and
compliance regulations—with critical soft skills like communication, ensuring your
message is understood and received by both technical partners and senior leadership.
We will explore the framework necessary to evaluate critical controls at the entity-level,
general IT-level, and application-level, helping organizations identify potential
vulnerabilities before they can be exploited and ensuring they adapt to evolving security
needs. By mastering the necessary skills, you will be prepared to provide an independent
assessment of how well IT systems are being managed, securing assets, and
maintaining compliance, thereby promoting trust among employees, customers, and
vendors.

B. LEARNING OBJECTIVES
1. Primary: Compare and contrast an IT Audit from a Financial Audit. This objective
encourages learners to analyze the purpose, scope, focus, and methodology of each
type of audit and evaluate their interconnectedness within an organization's overall
assurance services. The evaluation of the difference covers the following specific
areas of comparison and contrast points:
• Primary purpose and core objective
• Scope and areas of focus
• Relationship and integration
• Methodological Differences in a Computerized Environment

This high-order learning objective requires a sophisticated level of analysis. To reach

this goal, learners must first master foundational knowledge regarding the purpose
and objectives of each audit and then analyze the complex technical and regulatory
areas where they intersect and diverge.

2. Secondary (Enabling)
 a. Define the primary purpose and core objectives of each audit type. This enabling
objective requires learners to articulate the distinct, fundamental goals and
functions of both a Financial Statement (FS) Audit and an Information Technology
(IT) Audit, based on their defined roles within an organization. This definition
must include detailing the core operational objectives of IT audit. Furthermore,
the objective requires defining the risk-based goals of the IT audit

b. Analyze and describe the Interdependence of IT and financial reporting controls.

This enabling objective requires learners to critically assess the mandated link
between an organization's technology infrastructure and its financial output,
recognizing that IT Audit often serves as a necessary component to support the
overall Financial Statement (FS) Audit. This analysis must focus on
understanding how the overall audit scope, which does not differ whether the
environment is manual, automated, or combined, requires the auditor to obtain an
understanding of the information system and related business processes
relevant to financial reporting. Additionally, this objective requires learners to
analyze how the IT auditor examines different tiers of controls to ensure that the
entire IT system, which secures company data and results in recorded
transactions, reliably supports the accuracy and consistency of financial data.

c. Explain the methodological differences imposed by computerized systems. This

enabling objective requires the learners to articulate how the inherent
characteristics of an Information Technology (IT) environment fundamentally
alter traditional auditing techniques compared to manual financial auditing.
Specifically, learners must be able to explain three critical differences imposed by
computerized systems: i.e., lack of a visible audit trail, consistency of
performance, and the consolidation of duties at the organizational level, where
functions traditionally requiring segregation (like authorization, processing, and
recording) may be vested in a single computer program (e.g., in an ERP system),
requiring the auditor to employ non-traditional techniques and ensure new
policies are in place to maintain segregation of IT-related functions, such as data
control and computer operation.

C. PRE-ASSESSMENT (NOT GRADED): [Link]

D. LEARNING MATERIALS AND STUDY GUIDE

This module explores the field of IT Audit, covering its history, evolution, and current
practices. It details the key objectives of an IT audit—safeguarding assets, maintaining
data integrity, and ensuring efficient resource use—along with the necessary technical
and soft skills for IT auditors. The module also outlines the audit process, including
planning, execution, reporting, and follow-up, and highlight the importance of IT audit
certifications and automation. Finally, it emphasizes the significance of understanding
and evaluating an organization's control environment and risk assessment processes.
The module also details the differences between IT Audit and Financial Statement Audit.
Key characteristics of Information Systems such as the lack of a visible audit trail and
ease of data access, are discussed. Finally, it outlines the auditor's responsibilities in
understanding and evaluating various levels of internal controls, including entity-level,
general IT controls, and application controls.
1. Watch the lecture video: The Nature of IS Audit
 LINK: [Link]
LENGTH: 01:06:15

TIMELINE TOPICS:

00:01:02 What is IT/IS Audit? (Imperative for IT Audit)

CHECK YOUR UNDERSTANDING:
1. Trace the origin and explain the increasing importance of Information Systems
(IS) Audit, detailing specific ways technology has been incorporated into
business operations that necessitate this audit function.
2. Describe the critical role of IS Audit concerning financial reporting regulations,
specifically referencing the requirements of the Sarbanes-Oxley Law Act of
2002 and the internal control framework managers often adopt to meet these
requirements.
3. Explain why IS Audit is indispensable for modern businesses, contrasting
highly IT-dependent companies with other types of businesses, and providing
examples of how IT applications replace older, manual methods.

00:04:07 Relationship of IT Audit with Other Assurance Services

CHECK YOUR UNDERSTANDING:
1. Explain the relationship between IS Audit and other Assurance services,
detailing how it functions within a general financial audit and contrasting its
scope with operational and technological audits.
2. Trace the origin and explain the increasing necessity of IS Audit, linking the
foundational requirement of an audit trail to modern regulatory mandates
such as the Sarbanes-Oxley Law Act of 2002.
3. Describe specific ways technology has been incorporated into business
operations that necessitate continuous IS Audit oversight, and explain the
relevance of the COSO framework in responding to these technological and
regulatory changes.

00:05:42 Purpose of IT Audit

CHECK YOUR UNDERSTANDING:
1. Define IT Audit and elaborate on its fundamental objective of safeguarding
assets, providing examples of the different types of assets covered under an
IT infrastructure.
2. Explain the necessity for an IT Audit to ensure both data integrity and the
effective operation of systems, detailing the negative consequences that can
arise from a failure in either area.
3. Describe what is meant by the IT Audit objective of "using resources
efficiently," explaining the scope of IT Resource Management and how it
addresses both internal and external (outsourced) resources.

00:09:29 Objectives of IT Audit

CHECK YOUR UNDERSTANDING:
1. Explain the first of the threefold objectives of IT Audit in a risk-based
approach, detailing the symbiotic relationship between an entity's business
processes and its information system and why documenting this relationship
is crucial for the auditor.
2. Detail the roles and responsibilities of both management and the IS auditor
concerning risk determination and mitigation as outlined in the second and
third objectives of IT Audit, including the specific recommendations auditors
may offer when control weaknesses are found at a third-party organization.
3. Explain how evaluating an entity's business processes supports compliance
efforts and the overall security objectives of the IT Audit.

00:13:38 Characteristics of IT Significant to IT Audit (1 - 4)

CHECK YOUR UNDERSTANDING:
1. Discuss the concept of the "Lack of visible audit trail" as a characteristic of IT
significant to IS Audit. Explain the historical context of its disappearance, the
risks it poses to conventional audit tests, and the functionality modern
information systems incorporate to mitigate these risks.
2. Explain the concept of "Consistency of performance" in a computer-based
information system and analyze its dual implications for the IS Auditor,
focusing on how errors are introduced and subsequently corrected.
3. The "Ease of access to data and programs" is described as a "double-edged
sword" for organizations. Explain the significant business benefits this
characteristic provides, focusing on customer service, profitability, and
decision-making.
4. Discuss the risks associated with the "Ease of access to data and programs"
from an IS Auditor's perspective, distinguishing between digital security risks
and the increasing impact of personal data breaches. Provide examples of the
consequences of data breaches.
5. Analyze how the IT characteristic of "Consolidation of Duties Without
Weakening Control" changes the traditional approach to segregation of duties
(SoD) from a manual environment to an IT environment. Detail the specific IT-
related functions that require segregation in a computer processing system.
6. Describe the nature of "System-generated transactions" and explain the
specific audit procedures an IS Auditor must perform regarding the business
rules (or parameters) that drive these transactions.

00:47:03 The Auditor’s Responsibility Related to IT Controls

CHECK YOUR UNDERSTANDING:
1. Explain how the overall objective and scope of an audit are affected by the
nature of an entity's operational environment (manual, automated, or
combined), and state the specific requirement of PSA 315 concerning the
auditor's understanding of the entity’s information system.
2. According to PSA 315, what specific procedures and records related to
financial reporting transactions must the auditor understand, detailing the
system's responsibilities from initiation through transfer to the general
ledger?
3. Describe the auditor's required understanding of how the information system
captures and processes information relating to events and conditions other
than transactions, and explain the system's ultimate responsibility concerning
disclosure in the financial statements.

00:51:24 Entity-level Controls

CHECK YOUR UNDERSTANDING:
1. Identify and define the three components that constitute Entity-Level
Controls according to PSA 315, and explain why deficiencies in their operation
can have a pervasive effect on the preparation of financial statements.
2. Explain the difference in how the auditor's understanding of the various
internal control components affects the identification and assessment of risks
of material misstatement, distinguishing between those that affect the
financial statement level and those that affect the assertion level.
3. Describe the auditor's responsibility in evaluating the Control Environment,
focusing specifically on how this evaluation relates to the entity's use of IT
and the sufficiency of resources allocated.
4. Explain the purpose of the auditor's evaluation of the entity's risk assessment
process, distinguishing between the two types of risks the auditor must
assess, and discuss how evidence of risk assessment may be found in less
complex or owner-managed entities.
5. Detail the specific matters an auditor should consider when understanding
how an entity monitors its system of internal control, focusing on activities
involving the use of IT and the evaluation of information sources.

01:04:02 General IT and Application-Level Controls

CHECK YOUR UNDERSTANDING:
1. Define General IT Controls and explain their purpose within an IT environment.
Detail the four categories of General IT Controls and explain why two of these
categories are more likely to be prioritized by the auditor.
2. Contrast General IT Controls and Application Controls across the dimensions
of definition, scope, and the different types of control they encompass.
3. Define Application Controls, explain their primary goal concerning data, and
detail the three primary categorizations of these controls. Provide an example
of how one of these categories ensures data accuracy and completeness.
4. Explain the significance of having both General and Application controls for a
company that employs information technology systems, illustrating how an
example of a general control (like a firewall) differs from an example of an
application-specific control (like a payroll control).
5. In the context of the audit, explain how the auditor uses their understanding
of the IT environment to determine the General IT controls to identify.
Additionally, specify whose actions the auditor considers controls over during
this process.
 2. Watch supplementary video: Introduction to Information Systems - Principles
of Business Information Systems
LENGTH: 00:28:00
LINK: [Link]

CHECK YOUR UNDERSTANDING:

1. Discuss the historical evolution of the IT audit function, detailing the roles and
responsibilities of early auditors compared to the integrated skill set required
in modern audit teams.
2. Explain the necessary technical skills and aptitudes required for success in
modern IT auditing and describe how risk should be defined as the
foundational starting point for the auditor’s work.
3. Analyze the critical importance of balancing technical knowledge with soft
skills in IT auditing, specifically detailing the role of emotional intelligence and
communication when interacting with different organizational stakeholders.

3. Read articles
IT Audit: The ultimate guide
LINK: [Link]

IT Audit (Information Technology Audit)

LINK: [Link]
technology-audit
CHECK YOUR UNDERSTANDING:
1. Define an Information Technology (IT) audit and explain the primary objectives
that guide an IT auditor's examination and evaluation of an organization's
systems.
2. Identify and describe at least four different types of specialized IT audits an
organization might consider, and detail the five key areas generally covered in
a comprehensive IT audit.
3. Outline the five-step process for conducting an IT audit, explaining the critical
activities performed during Step 1 (Planning) and Step 5 (Follow-up).
4. Discuss the critical importance of regular IT audits in the modern business
environment, focusing on how they help mitigate risks and promote trust and
compliance.
5. Why are professional IT audit certifications advantageous for an organization,
and what are three popular, globally recognized certifications available to
professionals in this field?

E. SUMMARY OF LEARNING MATERIALS

IT audits are indispensable for organizations seeking to ensure the security, efficiency,
and effectiveness of their IT systems. By regularly evaluating IT infrastructure, policies,
and procedures, organizations can mitigate risks, achieve compliance, optimize
performance, and foster continuous improvement. While technical expertise is
fundamental for IT auditors, strong soft skills are equally vital for effectively
communicating findings, collaborating with stakeholders, and driving positive change.
Watch the summary videos:
 1. The Strategic Role of IT Audit

Link: [Link]
Length: 00:07:47

2. Architecture of Digital Assurance

Link: [Link]
Length: 00:07:53

Here is a summary of the lessons:

An Information Systems (IS) Audit, also interchangeably known as an Information
Technology (IT) Audit, is a formal examination of an organization's IT infrastructure,
policies, operations, and controls. Its primary purpose is to evaluate whether IT systems
effectively safeguard corporate assets, maintain data integrity, use resources efficiently,
and align with the organization's strategic goals. The discipline evolved from its origins
as Electronic Data Processing (EDP) audits in the 1960s to a critical function essential
for modern, technology-dependent enterprises.
The scope of an IS audit is broad, often forming a component of financial, operational,
or technological audits, and is crucial for regulatory compliance, such as the Sarbanes-
Oxley Act. Audits are structured around a risk-based approach with key objectives:
evaluating systems and business processes that secure data, identifying risks to
information assets, and recommending methods to minimize those risks. The process
typically involves five stages: planning, preparation, execution, reporting, and follow-up.

Auditors must contend with several unique characteristics of IT environments, including

the lack of visible audit trails, the consistency of performance which can propagate
errors system-wide, and the double-edged sword of easy data access, which offers
business benefits but introduces significant security and privacy risks. Furthermore,
auditors must evaluate the consolidation of duties within automated systems, the
integrity of system-generated transactions, and the vulnerability of digital storage
media.
The modern IT auditor requires an integrated skill set that balances deep technical
knowledge with critical soft skills. Technical competencies include an understanding of
frameworks like NIST, cloud security, and compliance regulations. However, equally
important are emotional intelligence, strong communication skills to translate complex
technical findings into understandable business terms, and the ability to act as a
strategic partner to the organization rather than an adversary. Professional certifications
such as CISA, CRISC, and CISSP are widely recognized for validating an auditor's
expertise.
A. Defining the Information Systems Audit
What is an IS Audit?
An Information Systems (IS) Audit, or Information Technology (IT) Audit, is an
internal or independent external examination of the management controls within an
organization's IT infrastructure and business applications. The core purpose of an
IT audit is to evaluate the design and effectiveness of an organization's IT controls.
This evaluation aims to determine if the information systems are:
 1. Safeguarding assets: Protecting hardware, software, and confidential information
from unauthorized access, use, destruction, or theft.
2. Maintaining data integrity: Ensuring the accuracy and consistency of data
throughout its entire lifecycle.
3. Using resources efficiently: Managing IT resources—including personnel,
finances, hardware, and software—effectively, on time, and within budget.
4. Operating effectively to achieve organizational goals: Confirming that information
systems support the organization's operations, management, and decision-making
processes.

These audits can be conducted in conjunction with a financial statement audit, as

part of an internal audit function, or as a standalone attestation engagement.
Evolution and Terminology
The discipline of IS Auditing originated in the mid-1960s as computers began to be
integrated into business applications. Initially known as Electronic Data Processing
(EDP) Audits, the role was often segregated and focused on providing data for
financial auditors. Over the last three decades, as technology became prevalent and
decentralized, the function has evolved significantly.
The following terms are often used interchangeably:

• Information Systems (IS) Audit

• Information Technology (IT) Audit
• Automated Data Processing (ADP) Audits
• Computer Audits
• Electronic Data Processing (EDP) Audits (historical term)

For consistency, "IS Audit" and "IT Audit" are the most common modern terms.

B. Core Objectives and Scope

Risk-Based Objectives

Modern IT Auditing employs a risk-based approach with a threefold objective:

1. Evaluate Systems and Processes: To assess the information systems and
business processes that are in place to secure company data. This involves
understanding how transactions are initiated, recorded, and processed to identify
where manual and computer-based controls interact.
2. Determine Risks: To identify and assess risks to a company's information assets.
While management is responsible for this assessment, the auditor also performs a
risk assessment during audit planning to uncover areas needing improved controls.
3. Minimize Risks: To identify control weaknesses and recommend methods to
mitigate them. This can include suggesting compensating controls if a third-party
organization is unable or unwilling to implement direct recommendations.

Relationship to Other Audits

An IS audit is distinct from a financial statement audit, which focuses on the fair
presentation of financial statements. However, they are often related.
• Financial Audits: IS audits are frequently part of a broader financial audit, verifying
that an organization's accounting records and the systems that process them are
reliable.
• Operational Audits: These audits evaluate the effectiveness and efficiency of
information systems operations.
• Technological Audits: These verify that IT is appropriately selected, configured, and
implemented. An auditor may offer a "Type 2 independent opinion" on the design and
effectiveness of a service organization's controls.
C. Regulatory and Framework Impetus
The importance of IS audits has grown with increased reliance on IT and regulatory
requirements. The Sarbanes-Oxley Act of 2002 (SOX), specifically Section 404,
mandates that management produce an internal control report assessing the
effectiveness of the internal control structure, which explicitly includes IT
components. To comply, many organizations adopt frameworks like COSO
(Committee of Sponsoring Organizations of the Treadway Commission), which
includes "Information and Communication" as a key component focused on
information systems.

D. Key Characteristics of an IT Environment

Auditors must understand the peculiar characteristics of IT environments that
differentiate them from manual systems.
 Characteristic Description & Audit Implication
Lack of Visible Computerized systems can process transactions without leaving
Audit Trail a physical paper trail. An audit trail (or audit log) must exist
electronically to trace transactions from origin to completion. If
not properly designed or activated, the auditor cannot perform
conventional tests. Most modern systems, like QuickBooks, have
built-in audit trail functionalities to track changes, user logins, and
deleted transactions.

Consistency Computer systems process similar transactions uniformly based

of on predefined business rules and constraints. This means an error
Performance in the system's logic will be consistently applied to all similar
transactions, potentially escalating to a material misstatement.
Conversely, this consistency also allows for simple, system-wide
correction of errors once identified.
Ease of A double-edged sword. Benefits include improved customer
Access to service, enhanced employee trust and brand ambassadorship,
Data increased profitability through better decision-making, and
empowerment of business leaders with instant access to critical
data. Risks include heightened digital security threats (hacking),
increased frequency and impact of personal data breaches, and
violations of privacy, intellectual property rights, and contractual
agreements.

Consolidation In advanced systems like ERPs, functions that are traditionally

of Duties segregated in manual environments (authorization, processing,
recording) may be consolidated into a single computer program.
This creates a potential control risk. Auditors must ensure new
policies are in place to segregate key IT-related functions, such as
data control, data entry, computer operations, and data/program
custody.

System- Systems can automatically generate transactions (e.g., monthly

Generated invoices, depreciation) based on pre-set business rules or
Transactions parameters. These rules are typically given blanket approval by
management during implementation. Auditors must verify the
business rules set in the system and trace any updates to
approved documents, ensuring the correct effectivity dates are
applied.

Vulnerability Digital files are vulnerable to media degradation, technological

of Data obsolescence, and physical destruction. Electronic records may
Storage Media only last 10-20 years without active migration, whereas paper can
last centuries. A gap in maintenance or a physical event like a fire
can lead to the complete loss of centralized data, potentially
resulting in a denial of audit opinion. Auditors must ensure robust
backup and recovery policies are in place.

E. The Audit Process and Structure

Types of IT Audits
Depending on an organization's size and complexity, audits can be comprehensive
or focused on specific areas. Common types include:

• Cybersecurity Audits: Look for weaknesses that can be exploited by malicious

actors.
• Enterprise-level IT Structure Audits: Analyze the organization and effectiveness
of IT processes at scale.
• Existing/Developing Systems and Applications Audits: Assess security measures
for current systems and ensure new ones align with standards.
• Physical IT Facility Audits: Evaluate security and conditions at physical locations
like data centers.
• Third-Party Audits: Assess the performance and security of third-party
applications and services.
• Server Audits: Assess overall network security performance and compliance.

The 5-Step IT Audit Process

1. Plan the Audit: Decide whether to conduct an internal audit or hire an external
auditor. The planning phase involves identifying the auditor, setting a timeline,
and establishing processes to prepare employees.
2. Prepare for the Audit: Define the audit's objectives and scope. This includes
determining what areas will be evaluated, how the audit will be documented, and
creating a detailed schedule.
3. Conduct the Audit: Execute the plan created in the preparation phase. This
involves gathering evidence, conducting interviews, and performing tests while
remaining flexible to address any obstacles.
4. Report Findings: Synthesize all documentation into an official audit report. This
report summarizes findings, highlights vulnerabilities, and provides
recommendations for corrective action, new solutions, or risk mitigation.
Individual reports are often created for each audited department.
5. Follow Up: Schedule follow-up reviews to ensure that corrective actions have
been implemented successfully and are operating as intended. This step is
critical, as human error can interfere with the implementation of solutions.

Levels of IT Controls

The auditor's responsibility for understanding internal controls, as defined by

standards like ISA 315 (PSA 315), does not change in an IT environment. The auditor
must obtain an understanding of the information system, including both IT and
manual procedures. Controls are typically assessed at three levels.
1. Entity-Level Controls
These controls are foundational and have a pervasive effect on the financial
statements. Deficiencies at this level can undermine the entire system of internal
control. They include:

• Control Environment: The overall culture of integrity and ethical values. The
auditor evaluates if the entity's IT governance is appropriate for its complexity
and if the IT organizational structure is adequately resourced.
• Entity's Risk Assessment Process: How the entity identifies, assesses, and
responds to business risks, including those related to IT.
• Entity's Process to Monitor Internal Control: How the entity monitors the
effectiveness of controls over time, including controls over complex IT
environments and automated financial reporting.
2. General IT Controls (ITGC)
ITGCs are policies and procedures that relate to many applications and support
the effective functioning of application controls. They are implemented to
address risks arising from the use of IT. Key areas include:

• Applications: Controls over software and business applications.

• Database: Controls over the storage and management of data.
• Operating System: Controls over the core system software.
• Network: Controls over data communication infrastructure.
 Other general control areas include physical security, change management,
backup and recovery, and incident management.
3. Application-Level Controls
These are automated or manual procedures that operate at a business process
level and apply to the processing of transactions by individual applications. They
ensure that data entered is complete, accurate, and valid. They are categorized
into three types:

• Input Controls: Ensure data entered into the system is accurate and complete
(e.g., checking that only numbers are entered in a quantity field).
• Processing Controls: Ensure data is processed correctly after being entered
(e.g., preventing duplicate transactions).
• Output Controls: Ensure that the results of processing are accurate and
distributed only to authorized personnel.
Key Differences: General vs. Application Controls

Aspect General Controls Application Controls

Definition A mixture of software, hardware, Specific controls that differ
and manual procedures that create with each computerized
an overall control environment for application (e.g., payroll vs.
all computerized systems. sales systems).

Types Software controls, hardware Input, processing, and output

controls, data security, computer controls.
operations, administrative
controls.

Scope Broad; affects the operations of the Narrow; applies only to a

entire IT system. specific application or
business process.

Example Antivirus software, firewalls, data A control to ensure every

center access controls, disaster employee is paid only once in
recovery plans. a payroll system; a check for
data entry format.

The Modern IT Auditor: Skills and Competencies

The role of the IT auditor has evolved from a segregated technical function to an
integrated one requiring a blend of technical and soft skills.
Technical Skills and Knowledge
A successful IT auditor possesses a passion for technology and a desire for
continuous learning. Key technical knowledge areas include:

• Frameworks and Standards: Deep understanding of guidance from sources

like NIST (National Institute of Standards and Technology).
• Modern Technologies: Familiarity with cloud security, the Internet of Things (IoT),
and emerging threats.
• Compliance: Knowledge of relevant compliance regulations and laws.
 • IT Infrastructure: Understanding of the entire information system structure, from
networks to applications.
The Risk-Based Perspective
A critical competency is the ability to think from a risk perspective. This involves
defining risk not merely as fraud or a security breach, but as anything that would
impede the organization's ability to achieve its strategic goals. This approach
requires auditors to start with an understanding of the organization's mission and
objectives and then identify potential technological impediments.
Critical Soft Skills
Technical skills alone are insufficient. The ability to communicate and collaborate is
paramount.

• Communication: Auditors must be able to take highly technical concepts and

"boil them down into layman's terms" for senior leadership and the board. Using
excessive jargon can cause an audience to tune out and be afraid to ask
questions.
• Emotional Intelligence: This involves the ability to interact effectively with IT
partners and clients.
• Partnership Approach: The most effective auditors position themselves as
partners, not adversaries. This means getting "on the same side of the table" to
look at issues collaboratively, fostering a more productive relationship and
affecting positive change.

F. Professional Development and Certification

While not always mandatory, professional certifications validate an auditor's skills
and improve audit effectiveness. They demonstrate a commitment to the profession
and a mastery of its core principles.
Key certifications for IT auditors include:
 • Certified Information Systems Auditor (CISA): Offered by ISACA, this is one of the
most widely recognized IT audit certifications globally.
• Certification in Risk and Information Systems Control (CRISC): Also from ISACA,
this focuses on risk management.
• Certified Information Systems Security Professional (CISSP): Offered by (ISC)²,
this is a globally recognized certification for information security professionals.
• GIAC Systems and Network Auditor (GSNA): From the Global Information
Assurance Certification (GIAC), this hones technical auditing skills.
• Certified Internal Auditor (CIA): Offered by the Institute of Internal Auditors (IIA),
this is a broader internal audit certification that is also relevant to IT auditors.

F. POST-ASSESSMENT (NOT GRADED): [Link]

G. TEAM AND INDIVIDUAL ACTIVITY. Will be conducted in-person and graded.

H. SUMMATIVE TEST. Will be conducted in-person and graded.

I. LEARNING OBJECTIVE ACTIVITY

1. Conduct of review discussion of the module lessons using a question-and-
answer format and team competition. Questions are a mix of True or False,
Identification and Multiple Choice with varying points for each item. Teams
compete to answer questions and earn the greatest number of points.
Individual points are also assigned to team members based on their individual
participation when called for by the instructor.

2. Analysis of and solution to the following case study.

Case Study: The Vulnerable Startup
A. Scenario:
"InnovateTech," a rapidly growing startup specializing in developing AI-powered
educational software, has experienced significant growth in the past year, leading
to rapid expansion of its IT infrastructure and workforce. However, this rapid
growth has outpaced the company’s ability to implement robust security
measures and maintain consistent IT processes.
As a result, InnovateTech is facing several challenges:

• Lack of Formal IT Policies: The company lacks documented policies and

procedures for data management, access controls, incident response, and
disaster recovery.
• Weak Password Management: Employees use weak passwords and often
share credentials, increasing the risk of unauthorized access.
• Insufficient Data Backups: The company does not have a comprehensive data
backup and recovery plan, leaving it vulnerable to data loss in the event of a
system failure or cyberattack.
• Reliance on Third-Party Software: InnovateTech heavily relies on third-party
software for essential operations, but it has not conducted thorough security
assessments of these applications.
B. Task:
You are a newly hired IT Auditor tasked with assessing and improving
InnovateTech's IT security and efficiency. You have been asked to design and
execute a comprehensive IT audit plan, analyze the findings, and develop a set of
recommendations to address identified risks and improve IT processes and
controls.
C. Case Study Requirements
1. Design an IT Audit Plan: Using the knowledge acquired from the learning
materials and your understanding of IT audit types, create a detailed audit
plan that addresses InnovateTech's specific challenges. Consider the
following:
• Scope of the Audit: Determine which areas of InnovateTech’s IT
infrastructure will be included in the audit (e.g., network security, data
management, application controls, physical security).
• Objectives: Define the specific goals of the audit, such as identifying
security vulnerabilities, assessing compliance with industry standards,
or evaluating the efficiency of IT processes.
• Methodology: Outline the methods and tools you will use to gather audit
evidence (e.g., interviews, vulnerability scans, penetration testing,
review of documentation).
• Timeline: Establish a realistic timeframe for conducting the audit and
reporting findings.

2. Develop Recommendations: Based on your audit findings, develop a set of

actionable recommendations to mitigate identified risks and improve
InnovateTech’s IT processes. Prioritize recommendations based on
severity and potential impact. Ensure your recommendations are:
• Specific and Measurable: Clearly state what actions should be taken
and how success will be measured.
• Achievable: Consider InnovateTech’s resources and budget constraints.
• Relevant: Address the specific risks and vulnerabilities identified in the
audit.
• Time-Bound: Set deadlines for implementing recommendations.
• Justified: Explain the rationale behind each recommendation, citing
evidence from the audit findings and insights from the sources.
Example Recommendation:
Risk: Weak password management practices.
High Priority: Enforce Strict Password and Access Management

• Specific Action: Implement mandatory technical controls to enforce

strong password complexity (minimum length, special characters),
prohibit the sharing of credentials, and introduce Multi-Factor
Authentication (MFA) for all critical systems and remote access.
• Measurable Success: All user accounts are enrolled in MFA, and
vulnerability scans confirm zero instances of weak or shared
passwords detected after implementation.
• Time-Bound: Implement technical controls (MFA and complexity
enforcement) within 30 days.
 • Justification: Current practices of using weak passwords and
sharing credentials significantly increases the risk of unauthorized
access, which is a critical security vulnerability that must be
mitigated immediately to safeguard assets.

J. GLOSSARY OF KEY TERMS

Term Definition
Application Safeguards related to specific computer applications,
Controls consisting of automated and manual procedures to
ensure only authorized data is processed accurately and
completely. They are categorized as input, processing,
and output controls.

Audit Trail (Audit A security-relevant chronological record (or set of

Log) records) that provides evidence of the sequence of
activities that have affected a specific operation,
procedure, event, or device. It is used to verify and
validate transactions and detect unauthorized use,
errors, and fraud.

Automated Data A term used interchangeably with IT audits and

Processing computer audits.
(ADP) Audits
Business The activities designed to develop, purchase, produce,
Processes sell, and distribute an entity’s products and services;
ensure compliance with laws; and record information.
These processes result in the transactions recorded by
the information system.

Certified A well-known IT audit certification offered by the

Information Information Systems Audit and Control Association
Systems Auditor (ISACA). Professionals must pass an exam and show
(CISA) evidence of continuing education.

Computer Audits A term used interchangeably with IT audits and ADP

audits.

Consistency of A characteristic of computer-based systems where all

Performance similar transactions are processed uniformly according
to predefined rules and constraints. While this ensures
consistency, it also means an error in the rules will be
systematically repeated.

COSO A framework from the "Committee of Sponsoring

Framework Organizations of the Treadway Commission" used by
management for assessing internal controls. It includes
a component focused on "Information and
Communication" in information systems.

Data Integrity The maintenance of, and assurance of, data accuracy
and consistency over its entire life-cycle. A failure of
 Term Definition
data integrity is any unintended change to data, whether
from malicious intent, hardware failure, or human error.

Digital Security The risk of incidents like hacking that can disrupt the
Risk availability, integrity, or confidentiality of data and
information systems. Enhanced access and data sharing
can expose an organization to these threats.

Electronic Data The former name for IT audits, originating when the
Processing (EDP) function was primarily to interface with systems to
Audits provide data for financial auditors.

Entity-Level Foundational controls that have a pervasive effect on the

Controls preparation of financial statements. They include the
Control Environment, the Entity’s Risk Assessment
Process, and the Entity’s Process to Monitor the System
of Internal Control.

General IT Controls that apply to all computerized systems or

Controls applications and shape the overall control environment.
They include a mixture of software, hardware, and
manual procedures covering areas like data centers,
networks, operating systems, and databases.

Information An internal or external examination of management

Systems (IS) controls within an IT infrastructure and business
Audit applications. It is used interchangeably with Information
Technology (IT) Audit.

IT Audit An examination and evaluation of an organization's

information technology infrastructure, operations,
policies, and procedures to ensure systems are
functioning properly, protecting assets, maintaining data
integrity, and are aligned with business goals. Also
known as IS Audit, ADP Audit, or Computer Audit.
IT Resource The process of acquiring, allocating, and managing IT
Management resources—such as individuals, skills, finances,
technology, hardware, and software—to ensure they are
used effectively, on time, and within budget.

Operational Audit An audit used to evaluate the effectiveness and

efficiency of information systems operations.

Sarbanes-Oxley A 2002 law, specifically Section 404, that requires

Act (SOX) management to produce an "internal control report"
assessing the effectiveness of the internal control
structure for financial reporting, which includes IT
components.

System- Transactions automatically created by a computer-

generated based information system based on predefined business
Transactions
 Term Definition
rules or schedules, such as a monthly credit card invoice
or depreciation calculation.

Technological An audit that verifies that information technologies are

Audit appropriately chosen, configured, and implemented.

- end of module -