An information technology audit, or information systems audit, is an examination of the management controls within an information technology (IT) infrastructure. The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives. These reviews may be performed in conjunction with a financial statement audit internal audit, or other form of attestation engagement.

IT audits are also known as "automated data processing (ADP) audits" and "computer audits". They were formerly called "electronic data processing(EDP) audits".

IT audit is different from a financial statement audit. While a financial audit's purpose is to evaluate whether an organization is adhering to standard

accounting practices, the purposes of an IT audit are to evaluate the system's internal control design and effectiveness. This includes, but is not limited to, efficiency and security protocols, development processes, and IT governance or oversight. Installing controls are necessary but not sufficient to provide adequate security. People responsible for security must consider if the controls are installed as intended, if they are effective if any breach in security has occurred and if so, what actions can be done to prevent future breaches. These inquiries must be answered by independent and unbiased observers. These observers are performing the task of information systems auditing. In an Information Systems (IS) environment, an audit is an examination of information systems, their inputs, outputs, and processing. IS Audit is the process of collecting and evaluating evidence to determine whether a computer system has been designed to maintain data integrity,

I

safeguard assets, allows organizational goals to be achieved effectively, and uses resources efficiently. Data integrity relates to the accuracy and completeness of information as well as to its validity in accordance with the norms. An effective information system leads the organization to achieve its objectives and an efficient information system uses minimum resources in achieving the required objectives. IS auditors must know the characteristics of users of the information system and the decision making environment in the auditee organization while evaluating the effectiveness of any system. Use of computer facilities has

brought about radically different ways of processing, recording and controlling information and has combined many previously separated functions. The potential for material systems error has thereby been greatly increased causing great costs to the organization, e.g., the highly repetitive nature of many computer applications means that small errors  may lead to large losses. An error in the calculation of income tax paid by employees in a manual system  will not occur in each case but once an error is introduced in a computerized system, it will affect each case. This makes it imperative for the auditor to

test the invisible processes, and to identify 4 the vulnerabilities in a computer information system as the costs involved, because of errors and irregularities, can be high.

IT Audit Process

Audits are a critical component of the regulatory compliance process. In general, it is the auditors who will determine whether your organization is in

compliance with the regulations and standards that it must address. For example, in regard to Sarbanes-Oxley (SOX), external auditors will often determine

 the adequacy of the internal controls in your organization as part of the audit in relation to annual financial reporting. Understanding how the audit process works and how auditors operate is important because it informs IT managers how to establish an environment that is compliant and easy to audit. This topic focuses on how auditors conduct the IT audit process.

It is important to understand what auditors look for during a compliance audit. During the audit, the auditors look for evidence that indicates:

• The organization has designed effective controls to address their compliance requirements and that there are no design deficiencies.

• The organization consistently applies the controls they have designed and that there are no operational deficiencies.

If the auditors do not find evidence of an effective control program, or they find that the organization is not adhering to the control program, they note

these deficiencies in their final audit report. This audit report is generally provided to the organization’s audit committee so that identified issues get the appropriate level of management exposure. Obviously, it is preferable that there be no deficiencies noted in this report.

The following process describes the general activities that auditors conduct during an audit. Your auditor might conduct the audit using a slightly different approach:

• Step 1: Plan the audit (auditor)

• Step 2: Hold audit kickoff meeting (auditor/organization)

• Step 3: Gather data and test IT controls (auditor/organization)

• Step 4: Remediate identified deficiencies (organization)

• Step 5: Test remediated controls (auditor/organization)

• Step 6: Analyze and report findings (auditor)

• Step 7: Respond to findings (organization)

• Step 8: Issue final report (auditor)

Understanding the steps in the IT audit process positions IT managers to know what to expect from the audit. In this way, you can better achieve your organization's regulatory compliance objectives, and optimize the audit process to complete it more efficiently.

How to Optimize the Audit Process

There are many ways to make the audit process more efficient and less difficult. These include:

• Work with the auditor early in the process to understand the key areas on which they plan to focus during the audit. In some cases, you can

•  reprioritize projects to ensure that you address what the auditors see as key risks in the environment, thus avoiding deficiencies in the audit.

• Implement automated IT controls whenever possible. These controls are superior to manual ones because auditors can more easily test and

  validate them. The best way to optimize the efficiency and lower the cost of the IT audit process for your organization is to:

  • Maintain clean and concise documentation of IT controls and keep it updated.

  • Organize your IT controls to work with the framework that your auditors use. This will help ensure that you and your auditors communicate

  • clearly about the regulatory objectives.

  • Take advantage of an IT controls framework. This will help you to more effectively address a variety of regulations with a single set of controls.

Objectives of an IT audit

Most often, IT audit objectives concentrate on substantiating that the internal controls exist and are functioning as expected to minimize business risk.  These audit objectives include assuring compliance with legal and regulatory requirements, as well as the confidentiality, integrity, and availability (CIA –  no not the federal agency, but information security) of information systems and data.

IT audit strategies

There are two areas to talk about here, the first is whether to do compliance or substantive testing and the second is “How do I go about getting the evidence to allow me to audit the application and make my report to management?”  So what is the difference between compliance and substantive testing?  Compliance testing is gathering evidence to test to see if an organization is following its control procedures.  On the other hand substantive testing is gathering evidence to evaluate the integrity of individual data and other information.  For example, compliance testing of controls can be described with the following example.  An organization has a control procedure which states that all application changes must go through change control.  As an IT auditor you might take the current running configuration of a router as well as a copy of the -1 generation of the configuration file for the same router, run a file compare to see what the differences were; and then take those differences and look for supporting change control documentation.  Don’t be surprised to find that network admins, when they are simply re-sequencing rules, forget to put the change through change control.  For substantive testing, let’s say that an organization has policy/procedure concerning backup tapes at the offsite storage location which includes 3 generations (grandfather, father, son).  An IT auditor would do a physical inventory of the tapes at the offsite storage location and compare that inventory to the organizations inventory as well as looking to ensure that all 3 generations were present.

The second area deals with “How do I go about getting the evidence to allow me to audit the application and make my report to management?”  It should come as no surprise that you need to:

• Review IT organizational structure
• Review IT policies and procedures
• Review IT standards
• Review IT documentation
• Review the organization’s BIA
• Interview the appropriate personnel
• Observe the processes and employee performance
• Examination, which incorporates by necessity, the testing of controls, and therefore includes the results of the tests.

As additional commentary of gathering evidence, observation of what an individual actually does versus what they are supposed to do, can provide the IT auditor with valuable evidence when it comes to control implementation and understanding by the user.