Information technology audit

An information technology audit, or information systems audit, is an examination of the management controls within an Information technology (IT) infrastructure and business applications. The evaluation of evidence obtained determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives. These reviews may be performed in conjunction with a financial statement audit, internal audit, or other form of attestation engagement.

IT audits are also known as automated data processing audits (ADP audits) and computer audits. They were formerly called electronic data processing audits (EDP audits).

Purpose

An IT audit is different from a financial statement audit. While a financial audit's purpose is to evaluate whether the financial statements present fairly, in all material respects, an entity's financial position, results

of operations, and cash flows in conformity to standard accounting practices, the purposes of an IT audit is to evaluate the system's internal control design and effectiveness. This includes, but is not limited to, efficiency and security protocols, development processes, and IT governance or oversight.

Installing controls are necessary but not sufficient to provide adequate security. People responsible for security must consider if the controls are installed as intended, if they are effective, or if any breach in security has occurred and if so, what actions can be done to prevent future breaches. These inquiries must be answered by independent and unbiased observers. These observers are performing the task of information systems auditing. In an Information Systems (IS) environment, an audit is an examination of information systems, their inputs, outputs, and processing.

As technology continues to advance and become more prevalent in our lives and in businesses, along comes an increase of IT threats and disruptions. These impact every industry and come in different forms such as data breaches, external threats, and operational issues. These risks and need for high levels of assurance increase the need for IT audits to check businesses IT system performances and to lower the probability and impact of technology threats and disruptions.

The primary functions of an IT audit are to evaluate the systems that are in place to guard an organization's information. Specifically, information technology audits are used to evaluate the organization's ability to protect its information assets and to properly dispense information to authorized parties. The IT audit aims to evaluate the following:

Will the organization's computer systems be available for the business at all times when required? (known as availability)

Will the information in the systems be disclosed only to authorized users? (known as security and confidentiality)

Will the information provided by the system always be accurate, reliable, and timely? (measures the integrity)

In this way, the audit hopes to assess the risk to the company's valuable asset (its information) and establish methods of minimizing those risks.

More specifically, organizations should look into three major requirements: confidentiality, integrity, and availability to label their needs for security and trust in their IT systems.

Confidentiality: The purpose is to keep private information restricted from unauthorized users.
Integrity: The purpose is to guarantee that information be changed in an authorized manner
Availability: The purpose is to ensure that only authorized users have access to specific information

These three requirements should be emphasized in every industry and every organization with an IT environment but each requirements and controls to support them will vary.

Classification of IT audits

Various authorities have created differing taxonomies to distinguish the various types of IT audits. Goodman & Lawless state that there are three specific systematic approaches to carry out an IT audit:

:* Technological innovation process audit. This audit constructs a risk profile for existing and new projects. The audit will assess the length and depth of the company's experience in its chosen technologies, as well as its presence in relevant markets, the organization of each project, and the structure of the portion of the industry that deals with this project or product, organization and industry structure.

:* Innovative comparison audit. This audit is an analysis of the innovative abilities of the company being audited, in comparison to its competitors. This requires examination of company's research and development facilities, as well as its track record in actually producing new products.

:* Technological position audit: This audit reviews the technologies that the business currently has and that it needs to add. Technologies are characterized as being either "base", "key", "pacing" or "emerging".

Others describe the spectrum of IT audits with five categories of audits:

:* Systems and Applications: An audit to verify that systems and applications are appropriate, are efficient, and are adequately controlled to ensure valid, reliable, timely, and secure input, processing, and output at all levels of a system's activity. System and process assurance audits form a subtype, focussing on business process-centric business IT systems. Such audits have the objective to assist financial auditors.

:* Information Processing Facilities: An audit to verify that the processing facility is controlled to ensure timely, accurate, and efficient processing of applications under normal and potentially disruptive conditions.

:* Systems Development: An audit to verify that the systems under development meet the objectives of the organization, and to ensure that the systems are developed in accordance with generally accepted standards for systems development.

:* Management of IT and Enterprise Architecture: An audit to verify that IT management has developed an organizational structure and procedures to ensure a controlled and efficient environment for information processing.

:* Client/Server, Telecommunications, Intranets, and Extranets: An audit to verify that telecommunications controls are in place on the client (computer receiving services), server, and on the network connecting the clients and servers.

And some lump all IT audits as being one of only two type: "general control review" audits or "application control review" audits.

A number of IT audit professionals from the Information Assurance realm consider there to be three fundamental types of controls regardless of the type of audit to be performed, especially in the IT realm. Many frameworks and standards try to break controls into different disciplines or arenas, terming them “Security Controls“, ”Access Controls“, “IA Controls” in an effort to define the types of controls involved. At a more fundamental level, these controls can be shown to consist of three types of fundamental controls: Protective/Preventative Controls, Detective Controls and Reactive/Corrective Controls.

In an IS, there are two types of auditors and audits: internal and external. IS auditing is usually a part of accounting internal auditing, and is frequently performed by corporate internal auditors. An external auditor reviews the findings of the internal audit as well as the inputs, processing and outputs of information systems. The external audit of information systems is primarily conducted by certified Information System auditors, such as CISA, certified by ISACA, Information System Audit and Control Association, USA, Information System Auditor (ISA) certified by ICAI (Institute of Chartered Accountants of India), and other certified by reputed organization for IS audit. Delete --> (frequently a part of the overall external auditing performed by a Certified Public Accountant (CPA) firm.

The use of departmental or user developed tools has been a controversial topic in the past. However, with the widespread availability of data analytics tools, dashboards, and statistical packages users no longer need to stand in line waiting for IT resources to fulfill seemingly endless requests for reports. The task of IT is to work with business groups to make authorized access and reporting as straightforward as possible. To use a simple example, users should not have to do their own data matching so that pure relational tables are linked in a meaningful way. IT needs to make non-normalized, data warehouse type files available to users so that their analysis work is simplified. For example, some organizations will refresh a warehouse periodically and create easy to use "flat' tables which can be easily uploaded by a package such as Tableau and used to create dashboards.

Enterprise communications audits

The rise of VOIP networks and issues like BYOD and the increasing capabilities of modern enterprise telephony systems causes increased risk of critical telephony infrastructure being misconfigured, leaving the enterprise open to the possibility of communications fraud or reduced system stability. Banks, financial institutions, and contact centers typically set up policies to be enforced across their communications systems. The task of auditing that the communications systems are in compliance with the policy falls on specialized telecom auditors. These audits ensure that the company's communication systems:

adhere to stated policy
follow policies designed to minimize the risk of hacking or phreaking
maintain regulatory compliance
prevent or minimize toll fraud
mitigate third-party risk
minimize governance risk

Enterprise communications audits are also called voice audits, but the term is increasingly deprecated as communications infrastructure increasingly becomes data-oriented and data-dependent. The term "telephony audit" is also deprecated because modern communications infrastructure, especially when dealing with customers, is omni-channel, where interaction takes place across multiple channels, not just over the telephone.

One of the key issues that plagues enterprise communication audits is the lack of industry-defined or government-approved standards. IT audits are built on the basis of adherence to standards and policies published by organizations such as NIST and PCI, but the absence of such standards for enterprise communications audits means that these audits have to be based an organization's internal standards and policies, rather than industry standards. As a result, enterprise communications audits are still manually done, with random sampling checks. Policy Audit Automation tools for enterprise communications have only recently become available.

Ethical Dilemmas in IT Audits

The Use of Artificial Intelligence (AI) in IT audits is growing rapidly, with 30% of all corporate audits to be conducted using AI by 2025 as reported by the World Economic forum from 2015. AI in IT audits raises many ethical issues.

The use of Artificial Intelligence causes unintended biases in results An issue that AI faces in completing IT audits for corporations is that unintended biases can occur as the AI filters through data. AI does not have a human element or the ability to understand different situations in which certain data is expected or not expected. AI only understands the data in which it has seen before and therefore is unable to evolve given each unique situation. This causes unintended biases and therefore unintended consequences if the AI systems are given too much trust and not carefully monitored by the human eye. As a result ethical, legal and economic issues arise.

The use of IT systems in audits has transformed the way auditors accomplish important audit functions such as the management of databases, risk assurance and controls, and even governance and compliance. In addition, IT audit systems improve the operational efficiency and aid in decision making that would otherwise be left to hand-held calculations. IT systems help to eliminate the human error in audits and while it does not fully solve the issue, IT systems have proven to be helpful in audits done by the Big 4 and small firms alike. These systems have greatly reduced the margin of error on audits and provide a better insight into the data being analyzed.

As a result of the increased use of IT systems in audits, authoritative bodies such as the American Institute of Certified Public Accountants (AICPA) and the Information Systems Audit Control Association (ISACA) have established guidance on how to properly use IT systems to perform audits. Auditors must now adhere to the established guidelines when utilizing IT systems in audits.

Benefits of Utilizing IT systems on Financial Audits

The use of IT systems and AI techniques on financial audits is starting to show huge benefits for leading accounting firms. In a study done by one of the Big 4 accounting firms, it is expected that the use of IT Systems and AI techniques will generate an increase of $6.6 trillion in revenue