Information Systems

Auditing

Source: http://www.isaca.org
Information Systems Audit: Overview

 Definition of IS Audit
 Elements of IS Audit
 Application software audit

What do we look for?

 Information Systems Audit:

What is it?

The process of collecting evidence to

determine whether the Information
System:
 safeguards assets
 maintains data integrity
 achieves organizational goals effectively
 consumes resources efficiently
Information Systems Audit:

Why is it needed?

Purpose of IT audit is to review and provide feedback,

assurances and suggestions about:

 Availability
 Confidentiality
 Integrity
 Effectiveness
 Efficiency
 Value for money
 Return on Investment
 Culture and people related issues
Information Systems Audit:

What can or should be reviewed?

 Physical and environmental

 System administration
 Application software
 Network security
 Business continuity
 Data integrity
Information Systems Audit:

How to approach the audit?

1. Inventory the information systems in use and

categorize them
2. Determine which of the systems have critical
impact on functions or assets
3. Assess what risks affect these systems and
severity of impact of the business
4. Rank the systems based on the above assessment
and establish audit priority, resources, schedule
Information Systems Audit:

What to look for when auditing software?

 Adherence to business rules in the

flow and accuracy in processing
 Validations of various data inputs
 Logical access control and
authorization
 Exception handling and logging
Information Systems Audit

Q&A