IT AUDIT AND CONTROLS NOTES FOR PRELIM
An IT audit is a methodical examination of an organization's information
technology infrastructure, including systems, policies, and procedures, to
ensure they are secure, efficient, and compliant with regulations.
An IT audit examines and evaluates a business’s IT infrastructure, systems, processes and
policies.
What IT audit involves?
Examining IT infrastructure: This includes a review of hardware,
software, networks, and data centers.
Evaluating policies and procedures: Auditors assess if the IT
policies and procedures are followed correctly and are sufficient for the
company's needs.
Testing controls: Auditors test specific controls, such as password
requirements and access permissions, to ensure they are working as
intended and mitigating risks.
Assessing compliance: The audit verifies compliance with various
regulations and standards, which can include things like SOX, PCI DSS,
or others relevant to the industry.
Why IT audits are important?
Protecting assets: They ensure that the organization's digital assets
are protected from unauthorized access and theft.
Ensuring data integrity: Audits help confirm that data is accurate,
complete, and reliable.
Improving governance: The process provides an objective view of IT
governance, helping organizations improve their overall IT
management.
Enhancing security: By identifying and addressing vulnerabilities, IT
audits help make an organization less susceptible to security threats.
Aligning with business goals: An audit ensures that the IT systems
and their controls support the company's strategic and operational
objective.
The nature of auditing is a systematic, independent examination of data,
records, and operations to provide an objective assessment.
Nature of Auditing
Systematic and independent: Auditing is a structured process
performed by an independent party to ensure objectivity.
Verification: It involves the examination and evaluation of data,
records, and financial statements to ensure accuracy and reliability.
Scope: The process can be applied to an entire organization or a
specific function, process, or a quality system.
Scope of work: Includes evaluating financial statements for
conformity with accounting standards, reviewing internal controls, and
verifying assets and liabilities.
Purpose of auditing
Primary purpose: To express an expert opinion on whether the
financial statements present a "true and fair view" of the company's
financial position.
Increase credibility: Audits provide assurance to stakeholders, such
as shareholders, creditors, and government agencies, that the financial
reports are reliable and not misleading.
Detect and prevent fraud: Audits help identify and prevent errors
(unintentional misstatements) and fraud (intentional misstatements).
While fraud is the responsibility of management to prevent, audits are
a tool to help achieve this by finding system weaknesses.
Improve internal controls: By evaluating a company's internal
control system, auditors can recommend improvements to strengthen
controls, protect assets, and increase operational efficiency.
Ensure compliance: Audits help ensure a company complies with
applicable laws, regulations, and statutory obligations.
Support decision-making: The accurate information and insights
gained from an audit can be used to assist with future financial
planning and budgeting.
Types of audits (financial, operational, IT)
The three main types of audits are financial, operational, and IT, each
with a different focus: financial audits verify financial records, operational
audits assess efficiency, and IT audits evaluate information technology
systems. Financial audits check for accuracy in financial statements, while
operational audits look at how well a business runs to find ways to
improve its processes. IT audits examine an organization's technology
infrastructure for security, compliance, and performance.
Financial audit
Purpose: To verify the accuracy and fairness of a company's financial
records and statements for stakeholders like investors, lenders, and
regulators.
Operational audit
Purpose: To assess the efficiency and effectiveness of a company's
operations and internal controls.
IT audit
Purpose: To evaluate an organization's information technology
infrastructure, systems, and data security.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Role of IT auditing
An IT auditor evaluates an organization's IT systems, processes, and controls to ensure
they are secure, efficient, and compliant with internal policies and external regulations.
They identify vulnerabilities, weaknesses, and inefficiencies in hardware, software, and
procedures, then recommend improvements to mitigate risks, protect data, and prevent
breaches. Their responsibilities include developing and testing audit procedures,
auditing networks and applications, and ensuring compliance with frameworks like
HIPAA, SOX, and NIST.
Types of Auditor
Internal IT Auditor: Works directly for the organization to analyze and assess its
systems and processes, recommending improvements to internal controls.
External IT Auditor: Works for an independent third-party, often a consulting firm,
to provide an objective evaluation of a client's systems and controls.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Audit Standards and Professional Ethics
Auditing standards provide the framework for conducting audits, while professional
ethics establish the moral and behavioral guidelines for auditors. These principles
ensure the credibility of financial reports and maintain public trust in the auditing
profession.
Auditing standards are generally set by different bodies depending on the type of
company and jurisdiction:
Public Company Accounting Oversight Board (PCAOB): Establishes standards
for the audits of public companies in the U.S.
American Institute of Certified Public Accountants (AICPA): Sets standards for
audits of nonpublic companies in the U.S.
The Institute of Internal Auditors (IIA): Issues the Global Internal Audit
Standards and the Code of Ethics for internal auditors worldwide.
International Auditing and Assurance Standards Board (IAASB): Issues
International Standards on Auditing (ISAs) used in many countries around the
world.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
IT Governance and Control Frameworks
Major IT governance frameworks include COBIT, ITIL, and ISO/IEC 38500, each
offering different principles and best practices for aligning IT activities with business
objectives, managing risk, and ensuring compliance.
An IT Governance Framework is a structured system that outlines how an organization's
IT resources are managed and controlled. It provides clear guidelines for decision-
making, accountability, and the alignment of IT with business objectives.
COBIT (Control Objectives for Information and Related Technologies)
Description: Developed by ISACA, COBIT is a comprehensive and widely used
framework for the governance and management of enterprise information and
technology (I&T).
ITIL (Information Technology Infrastructure Library)
Description: ITIL is a widely adopted framework that focuses on IT Service
Management (ITSM), providing best practices for the delivery and management of
quality IT services. The current version, ITIL 4, introduced a Service Value System that
integrates with modern approaches like Agile and DevOps.
ISO/IEC 38500 - The International Organization for Standardization (ISO) is a global
leader in developing standards across industries such as manufacturing, healthcare,
finance, agriculture, utilities, information technology, and pharmaceuticals to keep our
products and processes safe, effective, and sustainable.
NIST Cybersecurity Framework (CSF)
Description: Developed by the National Institute of Standards and Technology (NIST),
this framework provides guidance on managing and minimizing cybersecurity risks.
CMMI (Capability Maturity Model Integration)
Description: CMMI is a process improvement approach that helps organizations
improve their performance.