IT auditors frequently find themselves educating the business community on how their work adds value to an organization. Internal audit departments commonly have an IT audit component which is deployed with a clear perspective on its role in an organization. However, in our experience as IT auditors, the wider business community needs to understand the IT audit function in order to realize the maximum benefit. In this context, we are publishing this brief overview of the specific benefits and added value provided by an IT audit.
IT audits may cover a wide range of technology such as client-server systems and networks, operating systems, software applications, web services, databases, telecom infrastructure, security systems, disaster recovery planning and change management procedures.
The general structure of an audit is to identify risks, assess the design of controls and then test the effectiveness of the controls. Each of these aspects of an audit can add value when performed by skillful auditors.
The key drivers or motivations for an IT audit function are generally the need for assurance and internal control within a company. As organizations make huge investments in technology, IT auditing can provide the assurance that risks are being controlled and that huge losses are not just around the corner. An organization itself may assess a high risk of outage, security threat or vulnerability. There may also be regulatory or compliance requirements such as the Sarbanes Oxley Act or industry specific requirements from the SEC or Federal Reserve.
Below we discuss five key areas in which IT auditors can add value to an organization. Of course, the quality and depth of a technical audit is a prerequisite to adding value. The planned scope of an audit is also critical to the value added. Without a clear mandate on what business processes and risks will be audited, it is hard to ensure success or added value.
So here are our top five ways that an IT audit adds value:
1. Reduce risk. The planning and execution of an IT audit consists of the identification and assessment of IT risks in an organization.
IT audits generally cover risks associated with the confidentiality, integrity and availability of information technology infrastructure and resources. There are also risks related to the effectiveness, efficiency and reliability of IT.
After identifying and assessing risks, the next logical step is to develop a course of action to reduce or mitigate the risks through controls, risk transfer (e.g. insurance) or risk acceptance (e.g. built into the business).
A critical concept here is that IT risk is business risk. Any threat to or vulnerability of critical IT operations can have a direct effect on an entire organization. In short, the organization needs to know where the risks are and then proceed to do something about them.
Auditors will generally use risk best practices such as ISACA COBIT and RiskIT frameworks (www.isaca.org) and the ISO/IEC 27002 standard ‘Code of practice for information security management’ (www.iso.org).
2. Strengthen controls (and improve security). Based on the assessed risks as discussed above, the next step is to identify and assess corresponding controls. If controls are assessed to be poorly designed or ineffective, corrective action can be taken.
The comprehensive COBIT framework consists of four high level domains covering 32 control processes that can be used to reduce IT risk. This framework covers all aspects of information security including control objectives, key goal indicators, critical success factors and key performance indicators.
An IT auditor using COBIT can assess controls and make recommendations that add real value to the IT environment and to the organization as a whole.
Another control framework is the Committee of Sponsoring Organizations of the Treadway Commission (COSO) model of internal controls. IT auditors can use this framework to get assurance on (1) the effectiveness and efficiency of operations, (2) the reliability of financial reporting and (3) the compliance with applicable laws and regulations. The framework contains two elements out of five that directly relate to controls - control environment and control activities.
3. Comply with regulations. Wide ranging regulations at the federal and state levels include specific requirements for information security. The IT auditor serves a critical function in ensuring that specific requirements are met, risks are assessed and controls implemented.
Sarbanes Oxley Act (Corporate and Criminal Fraud Accountability Act) includes specific requirements on all public companies. The act requires companies to ensure that internal controls are adequate as defined in the framework of the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) mentioned above. The IT auditor provides the assurance that such requirements are met.
Health Insurance Portability and Accountability Act (HIPAA) has three areas of IT requirements - administrative, technical and physical. It is the IT auditor who plays a key role in ensuring compliance with these requirements.
Various industries such as the credit card industry have requirements such as the Payment Card Industry (PCI) Data Security Standard e.g. Visa and Mastercard.
All of these compliance and regulatory areas require the IT auditor to play a key role. It is critical to an organization to have assurance that all requirements are met.
4. Facilitate communication between business and technology management. An audit opens channels of communication between an organization’s business and technology management. Auditors spend time interviewing, observing and testing what is happening in reality and in practice. An audit can provide valuable information in written reports and oral presentations. Senior management needs to know first-hand how their organization is functioning.
Technology professionals in an organization also need to know the expectations and objectives of senior management. Auditors help this communication from the top down through participation in meetings with technology management and through review of the current implementations of policies, standards and guidelines.
An important point to consider is the key role of IT auditing in management’s oversight of technology. Organizations invest in technology to support business strategy, functions and operations. Alignment between business and technology functions is very important and IT auditing is critical in maintaining this alignment.
5. Improve IT Governance. The following definition is from the IT Governance Institute (ITGI):
‘IT Governance is the responsibility of executives and board of directors, and consists of the leadership, organizational structures and processes that ensure that the enterprise’s IT sustains and extends the organization’s strategies and objectives.’
The reference to leadership, organizational structures and processes points to IT auditors as key players. The foundation of IT auditing and overall IT management is an understanding of technology’s value, risks and controls. It is a core function of IT auditing to review the value, risks and controls in each of the key components of technology - applications, infrastructure, information and people.
Another perspective on IT governance consists of a framework of four key objectives which are also discussed in the IT Governance Institute’s documentation:
*IT is aligned with the business *IT enables the business and maximizes benefits *IT resources are used responsibly *IT risks are managed appropriately
IT auditors provide assurance that each of these objectives is met. Each objective is critical to an organization and is therefore critical in the IT audit function.
To sum up, IT auditing adds value by reducing risks, improving security, complying with regulations and facilitating communication between technology and business management. Finally, IT auditing improves and strengthens overall IT governance.
References:
ISACA. Control Objectives for Information and related Technology (COBIT). www.isaca.org.
ISO/IEC 27002 Code of practice for information security management. www.iso.org
Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework. www.coso.org
Internet Business
assurance, audit, compliance, computers, control, data security, information assurance, information security, Internet Business, it audit, it risk, it security, privacy, risk, security