IT Audit

BERSAMIN, EMMANELLE S.
BERNARDINO, MAC IBER J.

MW 9:30 – 11:00AM
1. What is IT Audit?
Information Technology (IT) Audit is the process of collecting and evaluating evidence
of the management of controls over an organization’s information systems, practices, controls
and operations. The evaluation of evidence obtained through the IT audit process determines if
the information systems are safeguarding assets, maintaining data integrity and operating
effectively to achieve the organization’s goals and objectives. This may include traditional audits
of technology processes and components as well as integrated audits for audit activities,
technology-dependent regulatory processes (e.g., privacy) or data analytics support.
IT auditors examine not only physical security controls, but also overall business and financial
controls that involve information technology systems.
Information technology audits determine whether IT controls protect corporate assets,
ensure data integrity and are aligned with the business's overall goals. IT auditors examine not
only physical security controls, but also overall business and financial controls that involve
information technology systems.
2. What are the phases of IT Audit?
⮚ PHASE 1: PLANNING
▪ Engagement kick-off meeting
▪ Understanding the business
▪ Perform risk assessment procedures and identify risks
▪ Prepare audit planning memorandum and audit programs
▪ Determine audit strategy
⮚ PHASE 2: CONTROL EVALUATION

▪ Understanding accounting and reporting activities
▪ Evaluate design and implementation of selected controls
▪ Test operating effectiveness of selected controls
▪ Assess Control Risk and Risk of Material Misstatement
⮚ PHASE 3: SUBSTANTIVE TESTING

▪ Perform analytical procedures
▪ Perform selected test of detail
▪ Consider if audit evidence is sufficient and appropriate
⮚ PHASE 4: COMPLETION
▪ Perform completion procedures
▪ Perform overall evaluation
▪ Form an audit opinion
▪ Issue a Management Letter
3. Why do you think IT Audit is relevant now?

Many organizations are spending large amounts of money on IT because they recognize
the tremendous benefits that IT can bring to their operations and services. However, they need to
ensure that their IT systems are reliable, secure and not vulnerable to computer attacks.
IT audit is important because it gives assurance that the IT systems are adequately
protected, provide reliable information to users and properly managed to achieve their intended
benefits. Many users rely on IT without knowing how the computers work. A computer error
could be repeated indefinitely, causing more extensive damage than a human mistake. IT audit
could also help to reduce risks of data tampering, data loss or leakage, service disruption, and
poor management of IT systems.
IT audits are very useful for companies because they ensure information-related controls and
processes are working properly. Companies The primary objectives of an IT audit include:
⮚ Evaluate the systems and processes in place that secure company data

⮚ Determine risks to a company's information assets, and help identify methods to
minimize those risks.
⮚ Ensure information management processes are in compliance with IT-specific
laws, policies and standards
⮚ Determine inefficiencies in IT systems and associated management
4. What is CAATs
Computer assisted audit techniques (CAATs) refer to the use of technology to help you
evaluate controls by extracting and examining relevant data. Sophisticated use of CAATs can be
known as ‘data analytics’ and is increasingly being used across the profession. This tool
facilitates them to search from the irregularities from the given data. With the help of this tool,
the internal accounting department of any firm will be able to provide more analytical results.
Advantages of CAATs
Using CAATs when conducting audit activities has benefits for auditors and management
alike. Auditors can process more data and be more confident in the results and reports than ever.
This leads to better insights and abilities when it comes to detecting inconsistencies or
compliance risks.
Management can be more confident in the data that they receive and report and also
enjoy the benefit of lowering the number of auditors needed and the person-hours involved in
conducting the audit activities. These benefits lower cost overall.
CAATs also help address the increased oversight and accountability demanded by
legislation such as the Sarbanes-Oxley Act, a broad-spectrum set of regulations that grew out of
the accounting scandals at Enron and other large companies in the early 2000s.
Disadvantages of CAATs
CAATs can be expensive and time consuming to set up, the software must either be
purchased or designed. Client permission and cooperation may be difficult to obtain.
The audit team may not have sufficient IT skills and knowledge to create the complex
data extracts and programming required. The audit team may not have the knowledge and
training needed to understand the results of the CAATs
5.Give examples of CAATs
CAATs normally include using basic office productivity software such
as spreadsheet, word processors and text editing programs and more advanced software packages
involving use of statistical analysis and business intelligence tools.
This would include programs such as data analysis and extraction
tools, spreadsheets (e.g. Excel), databases (e.g. Access), statistical
analysis (e.g. SAS), generalized audit software (e.g. ACL, Arbutus, EAS), business
intelligence (e.g. Crystal Reports and Business Objects), etc.
6. What is an ACL?
ACL, which stands for Audit Command Language, is a data analysis software program
that helps auditors remain current with changing technology. Its primary usefulness lies in its
ability to perform analysis and audit tests on 100% of the data available rather than merely
sampling the data. The ability to audit 100% of the available data assists auditors with
identifying potential fraud patterns and data irregularities.
It is a language consisting of several standard commands whose purpose is to facilitate
the audit of computerized data files (data banks) and program files (model banks) within
Management Information Systems (MIS).
Advantages of ACL
⮚ Improved corporate performance and revenue generation
⮚ Increased audit efficiency and reduced audit cost
⮚ Improved human resource allocation
⮚ Reduced frequency and impact of avoidable risk events
7. What is GAS?
Generalized audit software (GAS) refers to software designed to read, process and write

data with the help of functions performing specific audit routines and with self-made macros. It
is a tool in applying Computer Assisted Auditing Techniques. Functions of generalized audit
software include importing computerized data; thereafter other functions can be applied: the data
can be e.g. browsed, sorted, summarized, stratified, analyzed, taken samples from, and made
calculations, conversions and other operations with. GAS software is designed to examine
financial information for quality, completeness, correctness and consistency. It verifies all
calculations, compares data and prints audit samples. Two of the most popular software packages
are Audit Command Language (ACL) and Interactive Data Extraction and Analysis (IDEA,
edited by CaseWare International).
Purpose of GAS
This software allows auditors the ability to sort through large amounts of data in a rapid
manner. GAS can scan and test all data within a computer system, allowing for a more accurate
audit of the books. Instead of random sampling, 100 percent of the company’s data is examined.
Advantages of GAS
Relatively easy to learn and use. Improved efficiencies by automating manual
procedures. Reduced risk by testing entire populations reducing reliance on sampling. GAS can
be applied to a wide variety of clients with minimal customization.
This is a single program that can be applied to a wide range of tasks without having to
incur the cost or inconvenience of developing individualized programs.
Disadvantages of GAS
The high initial cost of their development. It provides a limited ability to verify
programming logic because its application is usually directed to testing client files or databases.
It involves auditing after the client has processed the data rather than while the data is being
processed.

IT Audit

Uploaded by

Copyright:

Available Formats

IT Audit

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IT Audit

Uploaded by

Copyright:

Available Formats

BERSAMIN, EMMANELLE S.

BERNARDINO, MAC IBER J.

⮚ PHASE 2: CONTROL EVALUATION

⮚ PHASE 3: SUBSTANTIVE TESTING

3. Why do you think IT Audit is relevant now?

⮚ Evaluate the systems and processes in place that secure company data

Generalized audit software (GAS) refers to software designed to read, process and write

You might also like