Internal Audit
Information Technology Audit
Internal Auditors Can Become Strategic Advisors
By Embracing Technology And Expanding their Strategic Thinking
The 5-steps Information Technology (IT) Auditing Process
Determine the objective and scope of the IT audit
Develop an audit plan to achieve the audit objectives
Gather information on the applicable IT systems, operational processes and controls
Perform audit tests on key IT controls
Report on the audit findings
An extensive Information Technology (IT) Audit examines these four key areas:
1. IT Governance and Risk Management (Board Level)
2. Cybersecurity comprising the following Cyber Essentials Controls:
(i) Firewall & Internet Gateway, (ii) Secure Configuration, (iii) Access Control, (iv) Malware Protection, (v) Patch Management
3. IT Operations and Service Delivery
(i) Hardware Audit, (ii) Website Audit, (iii) Email Audit, (iv) Data Storage Audit, (v) Cloud Audit, [vi] Active Directory Audit, (vii) Business Continuity & Disaster Recovery Plan, (viii) Service Level Management, (ix) IT Finance
4. Accounting IT Controls
An information technology audit conducted as part of a financial statement audit primarily focuses on specific aspects of IT General Controls (ITGC), particularly those governing access to accounting data and programs, segregation of duties, data backup procedures, and change management controls within the financial reporting system. These controls are essential to ensure that the organization records and produces financial information that is reliable, timely, relevant, and complete.
Key objectives of IT audit performed in connection with financial statement audit:
- Ascertain that ERP and financial reporting systems are adequately protected
- Evaluate the risk of data tampering and data loss
- Evaluate the reliability of data from ERP and financial reporting systems having an impact on the financial statements
- Evaluate the effectiveness of IT controls to ensure the ERP and financial reporting systems are functioning as intended
- Ascertain compliance with applicable laws, policies and standards
IT General Controls (ITGC) are controls that relate to the environment supporting IT Applications. The appropriateness and effectiveness of ITGC’s therefore impacts on all the organization’s IT applications. Strong general and application controls are required so that organizations know they can rely on the information produced by IT systems to build trust with investors and other stakeholders.
Contact us to schedule a free one-hour consultation to find out more about our internal audit and IT audit services
Advocating the practice of cybersecurity-by-design
Cybersecurity is a subset of information security, focusing on safeguarding electronic data and systems against cyber threats, while information security encompasses all types of data and threats, including physical and digital.
“I view cyber security as a key enabler to digitalisation.
I view it as the brakes on a car. If you want to drive fast, you need good brakes.
So if you want to go into the digital world, you need good security.”
- Mr David Koh, Chief Executive of Cyber Security Agency of Singapore (CSA)
