Understanding IS Audits

IS Audits

• Ensure compliance and operational effectiveness.
• Foster stakeholder trust.
• Focus on systems critical to organizational success

IS Audit Formal Evaluation

• Ensures legal and policy compliance.
• Assesses proper governance.
• Examines data security: confidentiality, integrity, availability.
• Gauges operational efficiency and effectiveness.

IS Audit Process

• Auditors evaluate internal controls.
• It involves reviewing the control framework.
• Gathering evidence to identify strengths and weaknesses.
• Providing an objective report with findings and recommendations.
• The audit process is in three phases: planning, fieldwork/documentation, and reporting/follow-up.

Information Systems (IS) vs Information Technology (IT)

• IS involves strategic, managerial, and operational information processes with technology and people.
• IT refers to hardware, software, and tools used to manage data.
• IS includes IT but goes beyond it.

IS Audit Standards, Guidelines, Functions and Codes of Ethics

• Rely on established standards for credibility.
• ISACA provides audit standards, guidelines, and a code of ethics in this field.
• The ISACA standards define practices and guide conduct for members and certification holders.

ISACA IS Audit and Assurance Standards

• Set mandatory requirements for IS auditors, management, and CISA holders
• The framework includes defining required practices and standards.
• Recommended practices are offered with professional judgment via guidelines.
• Non-mandatory examples for applying standards exist as tools and techniques.
• The standards are divided by general ethics, independence, and competence. -Performance includes planning, risk assessment, and evidence gathering.
• Reporting includes report types, communication methods, and content.

ISACA IS Audit and Assurance Guidelines

• Provide guidance for following IS audit standards.
• Auditors should consider the guidelines.
• Use professional judgment to adapt them to specific audits.
• Justify any deviations if necessary.

ISACA Code of Professional Ethics

• Guides the conduct of ISACA members and certification holders.
• They must support effective governance, audit, control, security, and risk management.
• Perform duties with objectivity, diligence, and professionalism.
• They must serve stakeholders lawfully while maintaining high standards.
• Protect confidentiality and privacy unless disclosure is legally required.
• Must maintain competency and performing within their skill set.
• Report significant facts honestly.
• Promote professional education, for an understanding of enterprise information systems.

ITAF TM (IS Audit and Assurance Framework)

• It is a best practice model which sets standards for IS auditors' roles, responsibilities, knowledge, skills, and reporting requirements.
• It defines key terms and concepts for IS assurance.
• Offers guidance, tools, and techniques for planning, conducting, and reporting IS audit tasks.

IS Internal Audit Function

• Defined by an audit charter that needs approval.
• Needs to be approved by the board or senior management if these entities do not exist.
• The audit charter should outline the mandate for the IS audit role.

Audit Charter

• Defines IS audit which can be part of internal audit, an independent group, or integrated with financial/operational audits for IT-related assurance.
• Should clearly state management's responsibility, objectives, and delegation of authority.
• Must be approved by top management or the audit committee.
• Any changes should be thoroughly justified.
• Responsibility, authority, and accountability should be documented in an audit charter or engagement letter.
• An audit charter covers all audit activities.
• An engagement letter focuses on a specific audit task.
• If provided externally, the scope and objectives should be in a formal contract.
• The internal audit function must remain independent.
• Needs to report to the audit committee or top management.

Management of the IS Audit Function

• It ensures that the team meets audit objectives.
• It maintains independence and competence.
• It must add value to senior management by supporting the efficient management of IT.
• Needs to help achieve business objectives.

IS Audit Resource Management

• IS auditors must stay updated on new technologies.
• Auditors must have the necessary technical skills.
• They should use audit techniques through professional education.
• Training plans should align with the organization’s tech direction and risk.
• Management must also provide IT resources to support specialized audits.

Using Services of Other Auditors and Experts

• Auditors should consider legal restrictions, audit charter, and contractual stipulations.
• Also, the impact on audit objectives, risk, and professional liability must be taken into consideration.
• Consider independence, competence, qualifications, and experience of external providers.
• Consider the scope of work, supervision, communication methods, and compliance with standards and regulations.
• Auditors must consider confidentiality, background checks, access to systems, and use of tools like CAATs.
• There should be non-disclosure agreements and methodologies for performance and documentation.
• The IS auditor or entity that is outsourcing auditing services should monitor the relationship.
• This ensures objectivity and independence.
• Although audit work may be delegated to external providers, the professional liability remains with the employing entity.

Responsibilities when Outsourcing IS Audit Services

• Communicating audit objectives, scope, and methodology through a formal engagement letter.
• Monitoring external providers' work, including reviewing work papers, appropriate planning, supervision, documentation, and approval of findings.
• Assessing the usefulness and appropriateness of external reports and their impact on overall audit objectives.

Types of Audits, Assessments, and Reviews

• An IS auditor must understand the various types of audits, assessments, and reviews.
• Assess the basic audit procedures.
• These can be performed by internal or external groups.

IS Audit

• Collection and evaluation of evidence.
• Determines if an information system is adequately safeguarded.
• Maintains data integrity.
• Supports organizational goals.
• Has effective internal controls.

Compliance Audit

• Tests controls to ensure adherence to specific regulations or industry standards.
• Overlaps with other audits.
• Focuses on particular systems or data.

Financial Audit

• Assesses accuracy of financial reporting.
• It involves detailed testing and emphasizes a risk and control-based approach.

Operational Audit

• Evaluates the internal control structure of a process or area.
• IS audits of application controls or security systemsare examples

Integrated Audit

• Combines financial and operational audits.
• Assess financial and asset safeguarding, efficiency, and compliance.

Administrative Audit

• Assesses the efficiency of operational productivity within an organization.

Specialized Audit

• Focuses on specific areas like fraud or services performed by third parties.
• This includes third-party service audits which focus on auditing outsourced financial and business processes.
• Involves evaluating controls in the third-party service providers.
• It also involves fraud audits designed to discover fraudulent activities with specific tools and techniques.
• There are forensic audits which investigate fraud and crime to develop evidence; for law enforcement and judicial review.

Computer Forensic Audit

• Investigates electronic devices to gather and preserve evidence.
• An IS auditor can assist in ensuring compliance with forensic investigation procedures.

Functional Audit

• Evaluates software products to verify that their functionality and performance aligns with requirements.
• Typically before delivery or post-implementation.

Readiness Assessment

• Reviews if an organization's compliance or adherence to standards before a formal audit.
• Focuses on control design rather than effectiveness.
• Identifies areas for remediation.

Control Self-Assessment

• A technique where the staff and management of a unit assess the effectiveness of internal controls.
• The goal is to assure stakeholders that the organization's internal control system is reliable.
• Control self-assessments also raise awareness of risks while periodically reviewing controls.

Objectives of Control Self-Assessment

• To enhance internal auditing.
• Shifting some control monitoring responsibilities to managers.
• Increase control ownership .
• Managers are responsible for controls in their areas.
• Raises risk awareness, and helps identify and manage risks.

Implementation Methods for Control Self-Assessment

• Questionnaires and surveys are used.
• Facilitated workshops where managers and auditors collaborate to improve controls.
• Informal peer reviews are used. Benefits include early risk detection, improved internal controls and improved audit ratings.
• Employee involvement and a sense of responsibility are also benefits.
• Cost reduction in controls and assurance to stakeholders are also positives.
• Disadvantages include being mistaken as a replacement for an audit, or it could be seen as workload.
• Failure to act on suggestions and a lack of audit knowledge are negatives.

The IS Auditor's Role in Control Self-Assessment

• Facilitates the process, guiding managers to assess their own controls.
• Explains the risks and provides advice during workshops

Integrated Auditing

• Requires that all auditors, understand both IT and business control structures.
• This is due to the dependence of business processes on IT .
• Integrated auditing combines different audit disciplines to assess key internal controls.
• Risk is the main focus.

Key Points for Integrated Auditing

• Risk Assessment which identifies risks.
• Assesses the IT auditor's role by understanding and identifying risks in areas such as info management, IT infrastructure and IT governance.
• Business Controls are necessary.
• Integrate an approach where auditors discuss emerging risks and their likelihood.
• Integrated auditing ensures that auditors assess both IT and business processes together.
• Integrated Auditing involves combining various audit disciplines to assess key internal controls.

Integrated Audit Focus

• Manages risk.
• Understanding both IT control structures and business control structures.
• IS auditor’s role is to identify and assess risks related to information management, IT infrastructure, governance, and operations.
• The integrated audit approach identifies risks faced by the organization.
• Identifies and understand key controls.
• Test IT system support for key controls.
• Test the effectiveness of management controls.
• Provide a combined report on control risks, design, and weaknesses.

Benefits of Integrated Audits

• Promotes business risk focus, creative control solutions.
• Supports teamwork among audit professionals with diverse skills.
• Leads to a comprehensive report.
• Allows a holistic view of both functional and IT elements.

Improvements from Integrated Audits

• Improvements to how audits are perceived and valued by stakeholders.
• Process Owners better understand audit goals seeing how controls link to audit procedures.
• Top management recognizes how better controls improve IT resource allocation and usage.
• Shareholders are able to see how better corporate governance leads to more reliable financial statements.
• These benefits led to increased popularity.