Internal Audit and Board Responsibilities

Module I - Introduction to IT Auditing, Fraud, and Internal Controls

• Learning Objectives: Define basic auditing and IT terms, explain basic concepts and procedures, differentiate attest and advisory services related to info systems, discuss internal controls, describe the relationship among general/application controls & financial data integrity, identify business ethics issues, describe fraudulent behavior, discuss fraud schemes, explain fraud motivating forces, and explore fraud detection techniques.

The IT Environment and Basic Concepts

• IT Environment: Refers to the infrastructure, hardware, software, and systems a business uses daily with IT.
• Components:
  • Hardware: Physical components like monitors, CPUs, keyboards, mice, personal computers, servers, and data centers.
  • Software: Instructions that enable hardware to perform tasks, including web servers & applications.
  • Networking: Interconnected computing devices that exchange data/share resources (e.g., routers, switches, hubs, firewalls, cables).
• Importance: Organizations must integrate IT with their business strategies to achieve objectives, obtain value from information, capitalize on available technology, address IT governance, security and privacy, and ensure control of public and organizational information.
• Organization Strategies: viewed as an enabler of their strategy, and now regarded as an integral part of that strategy in terms of profitability and service.

The Auditing Profession

• Financial Auditing: Examines financial statements to determine if they're fair. Scope encompasses equipment/procedures used in processing significant data.
• IT Auditing: Formal, objective examination of an organization's IT infrastructure. Focuses on verifying whether activities (procedures, controls) involved in data gathering, processing, storing, and distribution comply with guidelines, protect assets, maintain data integrity, and operate efficiently, to achieve organizational goals. Provides reasonable but not absolute assurance of accuracy/completeness of application-generated information.

Types of Audit Functions

• Internal Audit (IA): An independent, objective assurance and consulting activity. Improves operations, risk management, and governance. Plays a critical role in IT audits. Monitors IT activities (controls).
• External Audit: Evaluates systems controls, minimizes substantial auditing, and renders an opinion on financial statements, and the reliability of IT systems. Specialized experience/knowledge required. "Big Four" accounting firms often perform these audits.

Roles and Responsibilities of Audit Committees

• Audit Committees are responsible for approving audit charters, evaluating the internal audit function, setting compensation for the CAE/Chief Audit Executive, reviewing ongoing activities of the internal audit function, and providing a mechanism for escalation of findings. They also play a key role in control governance and ethics training.

Information Systems (IS) vs. Information Technology (IT)

• Information Systems (IS): The formal procedure for gathering, processing, and distributing data into information to users.
• Information Technology (IT): Involves integrating hardware, software, networking, or other facilities to support/manage data.

Information Systems Audit and Controls Association (ISACA)

• An international professional association focused on IT governance. Offers certifications like the Certified Information Systems Auditor (CISA).

International Standards of Auditing (ISA) 315

• IT in Accounting Estimates: Management's use of IT in making accounting estimates affects the design and implementation of IT controls.
• Risks: IT applications/environments may cause risks affecting the capability to process large data volumes, complex calculations, and the accuracy/extraction of data from systems and external sources.
• Significant Issues: Access, changing, and maintaining data models, transferring data accurately, and controls over journal entries for accounting estimates.

Business Ethics, Fraud and Internal Controls

• Ethics: Principles guide behavior in situations involving right/wrong conduct.
• Computer Ethics: Analysis of computer technology. Impacts of technology and policies for ethical computer use.
• Fraud: False representation of a material fact to induce reliance for personal benefit.
• Types of Fraud:
  • Employee Fraud: Non-management employees directly misappropriating assets.
  • Management Fraud: Deceptive practices to inflate earnings/conceal insolvency.

The Fraud Triangle

• Incentive: Motivation for committing fraud.
• Opportunity: Presence of conditions that facilitate fraud.
• Rationalization: Actions rationalized to justify fraud.

Concepts of Computer Fraud

• Computer Fraud: Theft, misuse, or misappropriation of assets, altering computer-readable records, illegally using computer-readable information, and intentional destruction of computer resources.
• Computer Crime: Illegal acts using computers.
• Examples involving computer fraud/crime include phishing, altering electronic data, spreading misinformation, unauthorized computer usage and botnet crimes.

Roles of an IT Auditor

• Counselor (Advisory): Assist organizations in developing policies, procedures, and standards, in safeguarding info assets.
• IT Auditor (Part of Senior Management): Provide independent assessments of IT decisions impact, evaluate solutions/alternatives and needs, provide verification that all risks have been assessed accurately, business requirements are met, costs are reasonable.
• Investigator: Specialist role in the field of computer forensics, which assists in understanding specific system or network related issues quickly.

Other Forms of Computer Crimes

• Business Email Compromise (BEC): Sophisticated scams targeting businesses.
• Ransomware: Malware that encrypts data.
• Tech Support Fraud: Fraudulent technical support claims.
• E-mail/Government Impersonation: Posing as government officials for theft of information.
• Intimidation/Extortion: Gaining assets and data using threats.
• Confidence/Romance Frauds: Scams that look for partnerships, friendships via online resources.

Responsibility for Fraud Prevention and Detection (ISA)

• Primary Responsibility: rests with both those charged with governance and entity management. They must place strong emphasis on fraud prevention and create a culture of honesty/ethical behavior.

Anti-Fraud Detection Techniques

• Traditional Methods: Rule-based systems, manual reviews. Inefficient/slow with evolving fraud. Generate many false alerts.
• Modern Methods: AI, machine learning, predictive analytics, and data modeling. More adaptable; detect anomalies in real-time.

Audit Risk

• Definition: Risk auditor expresses an inappropriate audit opinion when financial statements contain material misstatements.
• Material Misstatement/Detection Risk: A function of the risk.
• Importance: Auditors can't check every transaction. Hence the importance of the risk-based approach.

Risks Applicable to IT Audits

• IT System Risks: Probability of negative events, financial losses, and reputational damage. Arise from internal control weaknesses/inadequate/insufficient security measures and disaster recovery plans.

Concepts of Internal Controls

• Internal Control System (ICS): Policies a firm employs to safeguard assets, ensure accurate records, and promote efficiency.
• Objectives: Ensure accurate accounting, safeguard assets, promote efficiency, and compliance with policies.
• Modifying Assumptions: Management maintains responsibility/establishes & maintains the internal control system. Reasonable assurance (by the system) that the four broad objectives of internal control (above) are met cost-effectively.

Types of IT Controls

• General Controls (ITGC): Controls over the IT infrastructure, systems, and applications. (e.g., security, change management, and business continuity).
• Application Controls: Specific to a particular application. Verify data accuracy, completeness, and validity of the processing of transactions.

IT Entity-Level Controls

• Impact: Broad impact on the entire IT environment (not limited to a specific application).
• Management Oversight: Controls driven by management, setting standards.
• Components: Affect the entire control environment, risk assessment, control activities, information & communication, and monitoring (COSO framework).
• Examples: Access controls, change management, data backup & recovery, incident response plans, IT governance frameworks, etc.