Preventive, Corrective, and Directive Controls

• Risks and controls are documented in a matrix, enabling management to review risks, controls, risk classification, inherent/residual risk assessments, and control weaknesses.

Preventive Controls

• Designed to stop errors or anomalies from happening.
• Examples include segregation of duties, proper transaction authorization, and asset documentation/control.
• Aims to prevent errors via concepts like maker-checker and authorizations.
• Senior management authorization for fixed asset purchases prevents unauthorized purchases, ensuring only approved assets are reflected in financial statements.

Corrective Controls

• Correct errors and irregularities, preventing their recurrence.
• Built into procedures/manuals and systems that automatically correct errors.
• Examples include policies for reporting errors, employee training on new policies, positive discipline, and continuous improvement processes.

Directive Controls

• Manage risks through formal directions to management and employees.
• Requires cross-departmental process understanding, including regulatory requirements converted into policies/procedures.
• Compliance policies ensure broader regulatory requirements are met.
• Specific operating procedures or directives guide employees, referencing compliance policies and regulatory requirements for customer onboarding.

Detective Controls

• Detect errors promptly to minimize their impact.
• Timely detection is crucial for effectiveness.
• Designed to find errors/irregularities after they occur.
• Examples include exception reports, reconciliations, and periodic audits.
• Reconciliations involve relating different data sets, investigating differences, and taking corrective action.
• Periodic audits (internal and external) detect errors, irregularities, and non-compliance with laws/regulations.

Internal Control Structure

• Derived from management's operational approach and integrated into the management process.
• Consists of five inter-related components designed to provide reasonable assurance that established objectives and goals are met.

Control Environment

• Sets the organization's tone, influencing control consciousness.
• Factors include integrity, ethical values, competence, management's philosophy/style, authority/responsibility assignment, and attention/direction provided.
• Examples: tone from the top, university policies, organizational authority.

Risk Assessment

• Identifies and analyzes relevant risks to achieving objectives, forming the basis for risk management.
• Examples: monthly meetings to discuss risk issues, internal audit risk assessment, formal internal departmental risk assessment.

Control Activities

• Policies and procedures ensuring management directives are carried out.
• Include approvals, authorizations, verifications, reconciliations, performance reviews, asset security, and segregation of duties.
• Examples: purchasing limits, approvals, security, specific policies.

Information and Communication

• Pertinent information is identified, captured, and communicated in a timely manner.
• Information systems produce reports for operational, financial, and compliance-related information.
• Effective communication flows down, across, and up the organization.
• Examples: vision and values, engagement surveys, issue resolution calls, reporting, university communications.

Monitoring

• Assesses the quality of the internal control system's performance over time.
• Achieved through ongoing monitoring activities, separate evaluations, or a combination.
• Internal control deficiencies are reported upstream.
• Examples: monthly reviews of performance reports, internal audit function.

IT Governance

• Effective IT governance safeguards against information security breaches and creates business opportunities.
• Ensures IT structures are integrated with the business and aligned with business goals, facilitating changes and improvements.
• Critical for the success of IT projects and larger organizational projects.
• IT Governance department manages business application processes and policies.

IT Governance Roles

• Implementation of guidelines and strategies to provide direction for businesses.
• Adherence to processes as per guidelines; corrective actions are taken for non-compliance.
• Resolving issues related to IT policies and processes, often with help from IT Service Management.

IT Governance Responsibilities

• Applied by regulating influence to guide management and the organization.
• Accountable for the company's performance and conformance, including design, implementation, and compliance.
• Determining IT objectives aligned with organizational goals and a strategic IT plan.
• Designing and implementing the IT governance framework, aligned with organizational responsibilities, utilizing industry standards like COBIT.
• Defining the IT organization's ethics based on morals and values, shaping staff behavior.
• Creating an IT organizational culture that motivates staff to interact beyond the IT domain, led from the top.
• Ensuring ongoing compliance with regulatory, statutory, and legal obligations within ethical and cultural frameworks.

Emerging Trends In IT Audit

• Understanding the evolving IT risk landscape is crucial for IT auditing.
• Rapid technology expansion has shifted the types of risks organizations face.
• Digital transformation shifts focus to safeguarding intangible assets, especially data.

Evolution of IT Risks

• Past focus on protecting physical assets has shifted to safeguarding intangible assets, particularly data.
• Data breaches are a prevalent concern, requiring robust cybersecurity measures.
• Cloud computing introduces risks related to data privacy, compliance, and service disruptions.
• IoT devices create vulnerabilities due to interconnectedness and lack of safeguards.
• AI and ML raise ethical and fairness concerns, requiring careful consideration of biases.

Key Emerging IT Risks

• Data Security: Protecting data from unauthorized access due to its value and vulnerability.
• Cloud Computing: Managing risks related to data privacy, compliance, and service disruptions.
• Internet of Things (IoT): Mitigating risks associated with IoT devices through robust security protocols.
• Artificial Intelligence (AI) and Machine Learning (ML): Addressing ethical and fairness concerns.

Intersection of IT Risks and Auditing

• Auditors play a pivotal role in ensuring organizations manage and mitigate IT risks effectively.
• Auditing provides an independent evaluation of IT controls and processes, identifying gaps/weaknesses.
• Auditors provide insights and recommendations for improving IT risk management practices, helping organizations prioritize risks and establish controls.

Role of IT Auditing in IT Risk Management.

• Auditors provide assurance that IT systems/processes operate effectively and securely.
• Auditors identify potential vulnerabilities/weaknesses in IT controls, evaluating security measures.
• Auditors assess IT governance frameworks and compliance with laws, regulations, and standards.
• Auditors evaluate incident response and business continuity plans.

Impact of IT Risks on Auditing Practices

• New IT risks challenge traditional audit approaches.
• Auditors must stay updated on technological advancements to understand risks.
• Cloud computing introduces risks related to data privacy, security, and service availability.
• Mobile technologies and remote work expand the attack surface.
• Emerging technologies like AI, blockchain, and IoT introduce new vulnerabilities.

Mitigating IT Risks: An Auditing Perspective

• Auditors must adopt proactive strategies to mitigate IT risks effectively.
• IT risks, including cyber threats, data breaches, and system failures, pose challenges to organizations.
• Auditors play a crucial role in identifying and managing these risks, ensuring IT infrastructure integrity and security.