Information System Audit

The information system controls effectiveness is evaluated through an information system audit. An audit aims to establish whether information systems are safeguarding corporate assets, maintaining the integrity of stored and communicated data, supporting corporate objectives effectively, and operating efficiently. It is a part of a more general financial audit that verifies an organization’s accounting records and financial statements. Information systems are designed so that every financial transaction can be traced. In short, audit trail must exist and available that can establish where each transaction originated and how it was being processed. Aside from financial audits, operational audits are used to evaluate the effectiveness and efficiency of information systems operations, and technological audits verify that information technologies are appropriately chosen, configured, and implemented.

Growing Importance of Information Technology in Organizations

The adoption of information technology (IT) in organizations has been growing at a rapid pace. The use of the technology has evolved from the automation of structured processes to systems that are truly revolutionary in that they introduce change into fundamental business procedures. Indeed, Well it is believed that More than being helped by computers, companies will live by them, shaping strategy and structure to fit new information technology While the importance of the relationship between information technology and organizational change is evidenced by the considerable literature on the subject, 1 there is a lack of comprehensive analysis of these issues from the economic perspective. Basically, the aim of this paper is to develop an understanding of how information systems affect some key measures of organization structure.

Shifting Focus in Auditing Practices

We know the computers became more sophisticated so auditors recognized that they have had fewer and fewer findings related to the correctness of calculations and more and more on the side of unauthorized access. Moreover, the checks and balances that were devised to maintain correctness of calculations were implemented as software change control measures. These rely heavily on security to enforce controls over segregation of duties between programming, testing, and deployment staff. So technically it’s mean that even changes in the programmed relied in some measure for their effectiveness on system security controls. Nowadays, information systems audit seems almost synonymous with information security control testing.

Defining Audit Scope Based on Objectives

Well, the normal scope of an information systems audit still covers the overall lifecycle of technology under scrutiny as well as including the correctness of computer calculations. Scope word is prefaced by normal because the scope of the audit depends on its objective. Audits are always a result of some concern over the management of assets. The concerned party may be a regulatory agency, an asset owner, or any stakeholder in the operation of the systems environment, including systems managers themselves. That party will have an objective in commissioning the audit. The objective may be validating the correctness of the calculations of the system, confirming that systems are appropriately accounted for as assets, assessing the operational integrity of an automated process, verifying that confidential data is not exposed to unauthorized individuals, and/or multiple combinations of these and other systems-related matters of importance. The objective of an audit will determine its scope.

Data Gathering and Control Objectives

The initial process of gathering data and its effort allows the auditor to verify that the overall scope has been set correctly as well as to form a set of control objectives, which will be the basis for audit testing. The objective of Control is basically management practices which are expected to be in place in order to achieve control over the systems to the extent required to meet the audit objective. The auditor “ll repeatedly focus that control objectives are management practices. There are expectations that the control objectives or objectives have been consciously settled by management, that management provides leadership and resources to get control objective, and the management monitors the environment to ensure that control objectives are met. Control environment is management behavior that provides leadership and accountability for controls.

Checklist for Comprehensive Audit Coverage

The objectives of control are checklist to ensure that the auditor has covered the complete scope of the audit, while the planned technology tests may change during the course of the audit. In advance of any on-site meeting with an audited, an auditor will associate each control objective with a set of activities that would provide evidence that the control objective is met. As far as possible, they will devise tests in advance that should yield evidence that the activities are well established and produce reliable results.