This document discusses information system audits (IS audits). IS audits refer to auditing computer-based systems that provide organizational information to management to ensure the reliability of generated information. As organizations increasingly rely on computerized systems for processes, there is a need for auditors to understand how to audit various aspects of information systems, such as software, hardware, networks, and controls. Several regulatory bodies in India, such as RBI, IRDA, and SEBI, now mandate periodic system audits for financial institutions and listed companies to ensure compliance, manage risks, and improve processes.

1. CISA

2.  What is Information System Audit.(IS Audit)
 Need For Information System Audit
 Subject Matter
 Objective Information System Audit
 Statutory Requirement

3.  IS Audit refers to audit of systems (especially
computer based) which provided information
(like Accounts, Payroll, MIS etc.) to assure
the management that the information
generated from these system are reliable.
- Manger depends on information to take
decision (reliability of information).
-Internet failure affecting not only business
but every field (dependent).
-Control over system and IT Environment.
-Company wants assurance that system is
reliable.

4.  Most of the organization today
-Bank
-Insurance Companies
-Mutual fund
-BPOs
-Manufacturing Companies
Are 100% computerized. While this has lead
to speeding up processes and to ease of
operation, and paper based audit now slowly
disappearing.
-New kind of threats coming-RINOS Virus

5.  Hence there is a need for Auditors/
Chartered Accountants to understand answer
to various question like:
1. What is System Audit ?
2. How to audit various aspects of information
systems ?
3. How to check the existence and reliability
of internal controls on computer based
system ?
4. What would be impact of computer failure
on business continuity ?

6.  Software
 Hardware
 Network
 People etc.
-How to check ATM Transaction occurring a
day.
-How to vouch IRCTC transaction happening
in a day (correct Sample size and method)
System control come into picture,
that control need to be checked.

7.  Financial audit depend heavily upon paper
based evidence Ex(journal, Voucher, Bills,
audit trail)
 In system audit- evidence are in digital
format-firewall, lock, encryption, authorized
need to check
 Separate audit required- I.e. system Audit by
CISA qualified.

8.  Compliance
 Assurance
 Customer specification
 Risk management
internal risk
External risk
 improvement

9.  RBI-Made mandatory the system audit once
in 3months for ATMs, NEFT, RTGS, Internet
Banking, CBS
 IRDA-Has initiated system audit
 SEBI-made mandatory of system audit for
stock broker, BSE, NSE, And mutual fund
it is only a matter of time before
System Audit will become mandatory for all
listed companies.

10. By Pratap