An IT audit evaluates an organization's IT systems, management, operations, and related processes. It ensures that IT controls are adequate, systems provide reliable information, and data/systems are properly protected from unauthorized access. An IT audit typically establishes objectives and scope, develops an audit plan, evaluates controls through tests and analysis, and reports findings. It provides assurance that IT systems are reliable, secure, and achieving their intended benefits for the organization.

1. IT
AUDIT

2. 2
What is IT Audit?
⮚ An Information Technology (IT) audit is an audit of an
organization's IT systems, management, operations and
related processes.
⮚ An IT audit may be carried out in connection with a
financial regularity audit or selective audit. As the records,
services and operations of many organizations are often
highly computerized, there is a need to evaluate the IT
controls in the course of an audit of these organizations.
https://www.ago.gov.sg/docs/default-source/brochure/197b4897-87d6-477d-9bc2-d06afa225a41.pdf

3. 3
Types of Audits:
Compliance audit - This is an
examination of the policies and procedures
of an entity or department, to see if it is in
compliance with internal or regulatory
standards. This audit is most commonly
used in regulated industries or educational
institutions.
Financial audit - This is an analysis of the
fairness of the information contained within
an entity's financial statements. It is
conducted by a CPA firm, which is
independent of the entity under review.
This is the most commonly conducted type
of audit.

4. 4
Information systems audit - This
involves a review of the controls over
software development, data processing,
and access to computer systems. The
intent is to spot any issues that could
impair the ability of IT systems to provide
accurate information to users, as well as to
ensure that unauthorized parties do not
have access to the data
Operational audit - This is a detailed
analysis of the goals, planning processes,
procedures, and results of the operations
of a business. The audit may be conducted
internally or by an external entity. The
intended result is an evaluation of
operations, likely with recommendations
for improvement.

5. 5
The objectives of IT audits include:
❑ Evaluating the reliability of data from IT systems which
have an impact on the financial statements of the
organizations.
❑ Ascertaining the level of compliance with the applicable
laws, policies and standards in relation to IT.
❑ Checking if there are instances of excess, extravagance,
gross inefficiency tantamount to waste in the use and
management of IT systems.

6. Why is IT Audit important?
Many organizations are spending
large amounts of money on IT because
they recognize the tremendous benefits
that IT can bring to their operations and
services. However, they need to ensure
that their IT systems are reliable, secure
and not vulnerable to computer attacks.

7. 7
• IT audit is important because it gives
assurance that the IT systems are adequately
protected, provide reliable information to users
and properly managed to achieve their intended
benefits.

8. 8
• Many users rely on IT without knowing
how the computers work. A computer error
could be repeated indefinitely, causing
more extensive damage than a human
mistake.
• IT audit could also help to reduce risks
of data tampering, data loss or leakage,
service disruption, and poor management
of IT systems.

9. 9
How is IT Audit carried out?
Generally, IT audit is carried out as follows:
1. Establish the IT audit objectives and scope.
2. Develop an audit plan to achieve the IT audit objectives.
3. Gather information on the relevant IT controls and
evaluate them.
4. Perform audit tests, using Computer-Assisted Audit
Techniques (CAATs) such as data extraction and analysis
software or test data, where appropriate.
5. Report on the IT audit findings.

10. 10
• In performing its IT audits, the Auditor-
General’s Office (AGO) also checks for compliance
with the Government policies, standards, laws and
regulations on information and related technology.
• Where appropriate, AGO uses the IT audit tools,
technical guides and other resources recommended
by ISACA (Information Systems Audit & Control
Association), and encourages staff to be certified as
CISA (Certified Information Systems Auditor).

11. 11
IT Audit Process – Real-life
Example
“The auditor here has come and
gone. We don’t have the report yet –
but the things they were looking for
relate directly to the security and
integrity of the accounting and
supporting systems. Who has access
to what – how are usernames and
passwords and associated rights
assigned and reviewed (logical
security), also extending the security
of data exchanged between systems.

12. 12
❑They also want to see that we have periodic reviews
of security and user rights in the accounting and
related systems. They are also interested in reports
generated using tools external to the accounting
system – like Crystal reports. Here, they want to see
integrity, management, and oversight in the
development and maintenance of those reports.

13. 13
❑ Change management was also a focus – they want to see
evidence and documentation of plans for testing,
implementation, training, and the like for updates and
changes to key systems. The auditor also wanted
information on software and processes that feed
information into our accounting system – such as
timecard and production reporting. Unlike previous visits
from our auditors, there were no questions about backup,
disaster planning, or physical security. The auditor said
this would only be a focus if there were data breaches or
losses that raised a flag, and perhaps also this may be
because in prior years we had these items reviewed

14. 14
❑Our prior auditor visits were shorter and less
formal but, they tended to focus much more
heavily on some of the things (backup, etc.) that
were not reviewed this time around. However, as
previously, they also covered the expected:
ensuring that access to the accounting and
related system was properly secured with only
key users having administrative rights, and
reviewing structure and controls in the IT
department.”