|
|
| Information technology audit |
|
An
Information technology
audit (or IT audit) is a review
of the controls within an entity's technology
infrastructure.
These reviews are typically performed in conjunction with a
financial statement audit,
internal audit
review, or other form of attestation engagement. Formerly called an
Electronic data processing
(EDP) audit, an IT audit is the process of collecting and evaluating
evidence of an organization's
information system,
practices, and operations. Evaluation of the evidence ensures whether
the organization's information system safeguards assets, maintains
data integrity,
and is operating effectively and efficiently to achieve the
organization's goals. An IT
audit is also known as an EDP Audit, an Information Systems Audit, and a
computer audit.
|
Purpose
An IT audit is similar to a financial
statement audit in that the study and evaluation of the basic elements
of internal control are the same. However, the purpose of a financial
statement audit is to determine whether an organization's
financial statements and financial condition
are presented fairly in accordance with
generally accepted accounting principles
(GAAP). The purpose of an IT audit is to review and evaluate an
organization's information system's availability, confidentiality, and
integrity by answering questions such as:
- Will the organization's computer
systems be available for the business at all times when required?
(Availability)
- Will the information in the
systems be disclosed only to authorized users? (Confidentiality)
- Will the information provided by
the system always be accurate, reliable, and timely? (Integrity)
Types of IT Audits
- Computerized Systems and
Applications: an audit to verify that systems and applications are
appropriate to the entity's needs, is efficient, and adequately
controlled to ensure valid, reliable, timely, and secure input,
processing, and output at all levels of a system's activity.
- Information Processing
Facilities: an audit to verify that the processing facility is
controlled to ensure timely, accurate, and efficient processing of
applications under normal and potentially disruptive conditions.
- Systems Development: an audit to
verify that the systems under development meets the objectives of
the organization, and ensures the systems are developed in
accordance with generally accepted standards for
systems development.
- Management of IT and Enterprise
Architecture: an audit to verify that IT management has developed an
organizational structure and procedures to ensure a controlled and
efficient environment for
information processing.
- Client/Server,
Telecommunications, Intranets, and
Extranets: an audit to verify that controls are in place on the
client (computer receiving services), server, and on the
network connecting the
clients and servers.
IT audit process
- Main article:
Information Technology Audit Process
The following are the basic steps in
performing the
Information Technology Audit Process:
- Planning the audit
- Evaluation of internal controls
- Audit procedures
- Completing the audit
 History
of IT auditing
Click to enlarge
- Main article:
history of information technology auditing
The concept of IT auditing was
formed in the mid-1960's and has gone through numerous changes
due to advances in technology and the incorporation of
technology into business.
IT audit topics
Regulations and legislation related to IT audits
Several information technology
audit regulations have been introduced in the past few years.
These include the Gramm Leach Bliley Act, the Sarbanes-Oxley
Act, and the Health Insurance Portability and Accountability Act
(HIPAA).
-
COBIT
-
HIPAA
-
Gramm-Leach-Bliley Act
(GLBA)
-
Sarbanes-Oxley Act
- Companies with Sarbanes-Oxley
certification delays and material weaknesses caused by IT issues
-
Captaris Inc.
- material weakness and filing delay due to inadequate internal
controls and related IT controls per SOX requirements
-
Cray Inc.
- numerous material weaknesses in internal control over
financial reporting, specifically, inadequate review of
third-party contracts and lack of software application controls
and documentation
Auditing information security
is a vital part of any IT audit. Within the broad scope of auditing
information security we find topics such as
data centers,
networks and
application security. Auditing
information security covers topics from auditing the physical security
of data centers to auditing the logical security of databases and
highlights key components to look for and different methods used for
auditing these areas. It is important to remember that in this ever
expanding technical realm these things are always changing and as such
IT auditors must continue to expand their knowledge and understanding of
systems and the systems environment to help verify and ensure
information security.
Emerging Issues
Technology changes rapidly and so do the
issues IT auditors must face. From biometric retinal scans to protecting
physical security to transmitting data from a cell phone, this issue is
truly limited only to one’s imagination.
|
Auditing systems, applications and
networks
|
|
|
|
|
