Chapter 1

Chapter 1
INFORMATION
TECHNOLOGY
ENVIRONMENT AND
IT AUDIT
Objectives
1. Describe how technology is constantly evolving and shaping today's
information technology (IT) environments.
2. Discuss the auditing profession and define financial auditing.
3. Differentiate between the two types of audit functions that exist today
(internal and external).
4. Explain what IT auditing is and summarize its two broad groupings.
5. Describe current IT auditing trends, and identify the needs to have an IT
audit.
6. Explain the various roles of the IT auditor.
7. Support why IT audit is considered a profession.
8. Describe the profile of an IT auditor in terms of experience and skills
required.
9. Discuss career opportunities available to IT auditors.
Today’s IT Environment
Increased
Organizations more connectivity,
information dependent availability of
systems
High-speed information
Heavy reliance on processing has become
technology to be indispensable
competitive
Made processes and

procedures more
effective and efficient
For the Business Environment,
IT has also…
Increased ability to capture, store, analyze, and
process tremendous amounts of data
Enhanced control process around systems
Changed the auditing profession in terms of:
 how audits are performed (information capture and
analysis, control concerns)
 knowledge required to draw conclusions about systems’:
 effectiveness and efficiency
 integrity when reporting information
Recent Technologies
Impacting Organizations…
Enterprise Resource
Planning (ERP)
Big Data
Cloud Computing
Mobile Device
Management
The Internet of Things

(IoT)
Also True…
White-collar crime, information theft,

manipulation, abuse, computer fraud,
etc.
Auditing Profession
during recent years…
Auditing Profession
 Enron (2001) – American energy
company. Top executives misled BoD
and Audit Committee on high-risk
accounting practices; pressured Arthur
Andersen CPA Firm to ignore the
issues. AA also gone…
 Worldcom (2002) – North America’s

second largest long-distance company
at the time; $3.3bn in profits
improperly recorded from 1999 to
2002.
Auditing Profession
 Lehman Brothers (2008) –
Investment bank; largest
bankruptcy filing in U.S.
history.
 Anthem Inc. (2015) – Target

of cyberattack; "the largest
health care breach to date“.
Auditing Profession
• Wells Fargo (2016) –
Created over 2 million
unauthorized bank
and credit card (fake)
accounts…
Auditing Profession
Results of financial scandals???

 Evidenced failure of corporations to self-control,
self-regulate, and fully disclose its financial
information.
 Resulted in lack of investor confidence.
 Increased government regulation measures.
Auditing Profession
Most powerful legislation - Sarbanes Oxley Act
(SOX) of 2002
 Created the Public Company Accounting Oversight Board
(PCAOB).
 “authoritative watchdog over the accounting/auditing
profession”
 Required CEOs and CFOs to attest to the correctness of
their company’s financial statements.
 Required independent auditors to express a separate
opinion on the effectiveness of the Company’s internal
control systems.
Financial Auditing
What is Financial Auditing???
Activities and procedures for examining financial
information and rendering an opinion on the fairness
of such financial information (i.e., financial
statements (F/S))
Two groups of U.S. principles and standards affect
the preparation of F/S and audit procedures:
 Generally Accepted Accounting Principles (GAAP)
 Generally Accepted Auditing Standards (GAAS)
Internal vs. External Auditors
Internal auditor:
 Provides assurance to management that policies and
procedures are implemented and working as intended,
through:
 monitoring and testing system reliability
 detailed test work throughout the year
External auditor:
 Independently evaluates the reliability of computer
controls and the validity of the information:
 to render an opinion on the F/S
IT Auditors
IT auditors:
Assess the organization’s exposures (risks)
Examine or assist in designing and implementing
procedures (controls) associated with the use of
technology
Are considered part of the business environment
assessment …why?
IT Auditors
Provide independent & objective assurance that:
1. Information is processed safely and sound
2. Operations are effective and efficient
3. Information assets are safeguarded

IS versus IT
Why have an IT Audit Function?
Increased
IT’s impact on the
dependence on
business
information
Auditing “around the

computer” is not
enough
To identify & test

controls to mitigate To support F/S audit
IT risks
IT Auditing - Definition
Formal, independent, and objective examination of
internal controls within an organization’s IT
infrastructure to
determine whether the activities involved in
gathering, processing, storing, distributing, and
using information and its related technologies are
 consistent with standards, objectives, and guidelines,
 safeguard assets,
 maintain data integrity, and
 operate effectively and efficiently
to achieve the organization's goals or objectives.

Two Groups of IT Audits
General Controls (GC)

 Apply to all aspects of the IT function (operations, information
security, change management)
Application Controls (AC)

 “Automated Controls”
 Apply to processing transactions
 Concerned with accuracy, completeness, validity, and

authorization of the data captured, entered, processed, stored,
transmitted, and reported
 Likely to be effective when GCs are effective
Two Groups of IT Audits
IT Audit Trends
Passages of : have made role of the IT
- Homeland Security Act Auditor critical to verify and
- Patriot Act validate financial
- Sarbanes Oxley Act infrastructures
require knowledgeable and

Rapid diffusion of
well-trained IT auditors to
computer technologies &
ensure controls are
ease of information
implemented to maintain
accessibility
data integrity
IT Audit Trends
Integral part of organizations’ annual
F/S audits
 supports the auditor’s judgment on the
quality of the information processed by
computer systems
Best practices and IT audit objectives are

not only promoted nationally, but
internationally (COBIT)
IT Audit Trends
Control Objectives for Information and Related

Technology (COBIT):
Authoritative, international set of generally
accepted IT practices or control objectives
Helps IT auditors, managers, and executives:
 Discharge fiduciary responsibilities
 Understand their IT systems
 Decide adequate levels of security and controls
Can be downloaded from www.isaca.org

IT Audit Trends
Other best practices, objectives, and guidance include:
AICPA’s Trust Services Principles and Criteria

(TSPC):
 Security
 Availability
 Processing integrity
 Confidentiality
 Privacy
IT Governance
IT Governance
Process that aligns IT strategy with business strategy
Helps ensure that IT:
 supportsbusiness goals
 maximizes business investment in IT
 appropriately manages related risks

 achieves critical success factors by efficiently and effectively
deploying secure, reliable information, and applied
technology
COBIT provides a framework for implementing IT
controls to comply with global governance (SOX)
Role of the IT Auditor
To understand and
assess risks associated
with IT and information
To evaluate processing
environment and
applications
To test general and
application controls
To make
recommendations to
management
Role of the IT Auditor
As Counselor/Advisor (to organizations)
stresses the need for controlled environment
As Management
for decision making purposes
As Investigator
assistscomputer forensics, criminal
investigations
Profession of: IT Audit
Relatively new profession
A profession is supported/characterized
by:
 Common Body of Knowledge
 ISACA, AICPA, IIA, ISSA, etc.
 Certification
 Ex. Certified Information Systems Auditor
(CISA) - rigorous exam + 5 years of experience
and education
 Continuing Education
 Important for career growth
 Supports CISA certification
 To keep up-to-date
 Educational curricula
 Model Curriculum1 developed to support IT
Auditing
1 ISACA Model Curriculum for IS Audit and Control. Available at:

http://www.isaca.org/Knowledge-Center/Academia/Pages/Model-Curriculum-for-IS-Audit-and-Control-3rd-
Edition.aspx
 Professional Associations
 ISACA - leading IT governance, assurance, as
well as security and control professional
association today.
 Provides knowledge and education on IS-related
areas (assurance, security, risk management,
compliance)
 Offers globally-known certifications and designations
(CISA, CISM, CGEIT, CRISC, etc.)
 Develops and/or frequently updates international IS
auditing standards (e.g., COBIT, etc.)
 Ethical Standards
 Ethical standards guide for members
 Ethics principles question legality when
encountering “Grey Areas”
CPA license and CISA certification both

require auditors to follow a Code of
Professional Ethics.
Auditor Ethical Standards
Ethical
Description
Standard
Integrity - honest and forthright when dealing /
communicating with others
Objectivity - impartial, unbiased (free from conflict

of interest)
Independence - independent in fact and in appearance

Competence - required knowledge and professional
skills to adequately perform the work
IT Auditor Profile:
Experience and Skills
Experience comes with time and perseverance
Experience complements well with certifications
Certifications relevant to the IT Auditor:
CPA CIA CITP

CISA
CRISC
CISSP
CFE
CISM
IT Auditor Profile:
Experience and Skills
IT auditors must also possess skills that enable
them to add value to organization and clients.
People skills, supplemental skills, or soft skills on

how to:
 Gather what’s relevant information
 Communicate and present results
 Negotiate and agree action plans, etc.
Combination of
relevant Experience and right Skills -> Success!
Career Opportunities
Application (business/financial) IT audits
Technical/Operational IT audits
(infrastructure, data centers, data
communication)
Compliance IT audits involving national,
international, or regulatory standards
Organizational IT audits (management
control over IT)
 Public accounting firm
 External IT auditors; support financial audits,
compliance, operational
 Can advance to Partner / Sr. Management levels
 Entry level and experienced auditors
Private industry
 Internal IT auditors
 Assist with the implementation of IT Governance
 Opportunities at the C-suite level (e.g., CIO, CTO)
 Management consulting
 Experienced auditors
 Considered experts in the field, subject
matter resources (SMR’s)
 Government
 Support governmental audits (compliance)
Homework Problems
Chapter 1:
 Review Questions: [chosen by Instructor]
 Exercises: [chosen by Instructor]
Due: [chosen by Instructor]

END OF CHAPTER 1

Chapter 1

Uploaded by

Copyright:

Available Formats

Chapter 1

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 1

Uploaded by

Copyright:

Available Formats

Chapter 1

Made processes and

The Internet of Things

White-collar crime, information theft,

 Worldcom (2002) – North America’s

 Anthem Inc. (2015) – Target

Results of financial scandals???

Provide independent & objective assurance that:

1. Information is processed safely and sound

2. Operations are effective and efficient

3. Information assets are safeguarded

Auditing “around the

To identify & test

 operate effectively and efficiently

to achieve the organization's goals or objectives.

General Controls (GC)

Application Controls (AC)

 Concerned with accuracy, completeness, validity, and

require knowledgeable and

Best practices and IT audit objectives are

Control Objectives for Information and Related

 Decide adequate levels of security and controls

Can be downloaded from www.isaca.org

Other best practices, objectives, and guidance include:

AICPA’s Trust Services Principles and Criteria

 appropriately manages related risks

1 ISACA Model Curriculum for IS Audit and Control. Available at:

CPA license and CISA certification both

Objectivity - impartial, unbiased (free from conflict

Independence - independent in fact and in appearance

CPA CIA CITP

People skills, supplemental skills, or soft skills on

Due: [chosen by Instructor]

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.