Pages: 6

This chapter introduces IT Auditing, its origins, and its purposes. 2021 was a pivotal year for United States’ Certified Public Accountants (CPAs). The profession and the licensing bodies realized that the licensing standards for CPAs needed to be updated significantly. The purpose of the CPA Evolution Initiative was to update these standards. In the process, the Initiative identified a new CPA discipline, Information Systems and Controls, which acknowledged IT Auditing as a CPA discipline, alongside accounting, auditing, and tax, and the Initiative recognized the ever-increasing role of automation in business. This chapter discusses professional standards and practice frameworks for IT Auditing and sets the context for Internal Controls.

Pages: 16

This chapter identifies seven fundamental IT principles, which lay the foundation for IT Auditing: Availability; Accuracy and Correctness; Completeness, Consistency, and Timeliness; Confidentiality; Integrity; Reliability; and Validity; and an eighth principle that is specific to Data, and its Fitness. The second half of the chapter turns the topics around and addresses these principles from the IT perspective. Internal Controls are not new to IT. They evolved over time as technology discovered its vulnerabilities and adopted policies and procedures to reduce the risks associated with the technologies. These risks are discussed from the perspectives of Product-related Risks, Infrastructure-related Risks, Enterprise Business Software-related Risks, Outside Services-related Risks, and Risks associated with new Technologies, such as Artificial Intelligence.

Pages: 20

IT Audit is about Internal Controls and their effectiveness, which ultimately boils down to Business Objectives and the Risks that can interfere with the achievement of those objectives. The role of IT Audit is to assess and confirm the appropriateness of Internal Controls, the Design test, the effectiveness of the Internal Controls, the Effectiveness test, and their operation during the period covered by the examination, i.e., were the controls in effect continuously during the examination period. This chapter discusses IT Risks from the perspective of IT actions and conditions that can interfere with the achievement of the Business Objectives. This chapter also discusses the various types of Internal Controls, including General IT Controls, Application Controls, and End-User Controls, and Preventive versus Detective versus Corrective Controls. A primary method for assessing these items, Objectives, Risks, and Internal Controls, is Risk and Control Matrices (RACMs).

Pages: 9

Auditing IT Governance examines an Enterprise’s commitment to and oversight of its IT function. As COBIT notes, IT Governance and IT Management are related but distinct from each other. IT Governance focuses on oversight, while IT Management focuses on IT products and service delivery. IT Governance is the convergence of Business Objectives and IT products and services, whereas IT Management focuses on IT operations, including IT’s assets, products, and services. A major underlying governance principle is Value. Value is generally achieved through the alignment of IT’s products and services with the business’ mission, vision, policies, objectives, and strategies. Alignment between IT and the Enterprise creates Value. Nonalignment wastes effort and resources and may be counterproductive.

Pages: 13

IT Management is the administration and execution of IT’s policies, procedures, practices, and standards. This is the broadest area in IT Audit. It includes IT acquisition, maintenance of IT assets, products, and services, the design and maintenance of IT architectures and systems, the delivery of IT services, IT staffing, and standards for IT operations. Of particular interest is the interaction between IT Management and IT’s stakeholders and their issues and concerns regarding IT, its assets, products, and services.

Pages: 8

Auditing IT Infrastructure is in transition from traditional IT Infrastructure on-premises assets, such as servers, storage, networking, etc., to cloud-based services. This transition is challenging on several levels. Physical assets have become virtual, digital services with both positive and potentially negative aspects. On the positive side, businesses are less involved in the physical aspects of IT. They have been replaced by services that can easily scale and leave the technical aspects to cloud service providers; however, in this transition, as businesses reduce their IT staff, knowledge, history, and skill decrease, which increases the business’ dependence on the third parties and diminishes the business’ ability to manage the services that replaced their physical hardware. However, understanding the physical elements of IT is still critical for IT Auditors.

Pages: 13

Cloud Services have changed the IT landscape by replacing some, but not all, on-premises architecture with cloud services. The increase in cloud services is leading to a decrease in on-premises infrastructure. With this change, businesses are becoming more dependent on third parties whose priorities are not necessarily the same as their customers and businesses have less need for local talent. Consequentially, they are losing local expertise and knowledge, which is essential to provision and manage cloud services and to manage their portion of ‘shared responsibilities’. This change means less expertise and knowledge in the business regarding how to properly configure and use these remote services. This change is also affecting IT Audit, which needs to rely on System and Organization Control (SOC) Reports regarding the quality, appropriateness, and suitability of cloud-provided services.

Pages: 8

Enterprise Business Systems, whether on-premises or cloud-provided services, are the backbone of business operations and record keeping. They handle the business of business and in the process become the source of business Data within Enterprises. Most application controls are contained in these systems, making their configuration crucial for both operational purposes and internal control purposes. The larger the Enterprise, the more challenging the selection and implementation of these systems becomes. As these systems go into Production, the business becomes the system and the system becomes the business, inseparable and interdependent. Cloud Services have changed the IT landscape by replacing some, but not all, on-premises architecture with cloud services. The increase in cloud services is leading to a decrease in on-premises infrastructure. With this change, businesses are becoming more dependent on third parties whose priorities are not necessarily the same as their customers and businesses have less need for local talent. Consequentially, they are losing local expertise and knowledge, which is essential to provision and manage cloud services and to manage their portion of ‘shared responsibilities’. This change means less expertise and knowledge in the business regarding how to properly configure and use these remote services. This change is also affecting IT Audit, which needs to rely on System and Organization Control (SOC) Reports regarding the quality, appropriateness, and suitability of cloud-provided services.

Pages: 15

Data is the currency of the 21st century, especially as businesses increasingly look for Data outside their systems that will help them manage their operations. For businesses, this means merging externally generated with internally generated Data to give the business a larger view of its markets and operations. Data is also a fundamental building block of Artificial Intelligence (AI). The growth of AI raises questions about the Data on which it was trained and the applicability of that Data to AI users and their concerns and questions. IT used to talk about Garbage In Garbage Out. What is the analogous metaphor for AI? Throughout any discussion on Data, the inevitable topic is Data Quality and Data Integrity as Data is applied more widely.

Pages: 9

The Acquisition of technology is and remains an important aspect of IT Management. To the degree that Cloud First is the dominant source of new technologies, IT’s orientation has changed from acquiring physical pieces to acquiring complex services. Physical objects were more predictable than services provided by third parties, which can change over time without the knowledge and consent of the customer. Hence, acquisitions are more partnerships than they were previously. Regardless, acquisitions are dependent on requirements; hence, businesses must accurately know their current needs and requirements and more accurately anticipate their future needs and requirements, which is more difficult in a rapidly changing hypercompetitive business environment.

Pages: 12

From the beginning, IT realized that there were many good practices that needed to be instituted to protect the business and to protect the IT Department from chaos. IT Audit needs to be intimately knowledgeable about these basic practices and their application as Internal Controls. They are essential primary General IT Controls that make IT assets, products, and services dependable and reliable. They distinguish well-run IT Departments from mediocre IT Departments.

Pages: 7

IT Service Delivery is another backbone of IT. IT Service Delivery ensures stable operations and resolves user’s problems and questions. As a deliverer of services, IT is responsible for maintaining a stable environment and addressing problems proactively as well as reactively. IT Audit’s role in this connection is confirming the effectiveness of IT as a dependable deliverer of IT services. Central to this responsibility is incident management, service request management, and problem management, which were previously described. As Artificial Intelligence (AI) advances, AI may be able to detect future failures and weaknesses before they manifest themselves and impact operations and dispatch corrections.

Pages: 6

Performance, Conformance, Compliance, and Continual Improvement are essential aspects of IT. As such, they are significant concerns for IT Audits, especially the monitoring of these aspects. Sarbanes-Oxley mandated an Adequate System of Internal Controls making this a fundamental part of business operations, no longer just a nice to have. Conformance considers IT’s conformity to business policies, procedures, practices, and standards whereas Compliance considers IT’s compliance with regulatory and legal requirements. Continual Improvement and Maturity have become significant business concerns as businesses continually seek to improve their products and services to remain competitive.

Pages: 17

Cybersecurity has become a necessity for everyone, for all businesses, for all people. If it was ever optional, optional has disappeared, replaced by adversaries that are competent, sophisticated, well-funded, and in the business of making money or disruption. As infrastructure becomes more complex, more layered, and more prolific, the demands on businesses have escalated exponentially. As adversaries have become more formidable, the task of providing cybersecurity protection has become more arduous. While attacks have become more sophisticated, routine attacks still prey on the unwary requiring sophisticated tools and continual, basic reminders. AI has been suggested as a big assist for cybersecurity. Yes, it will be for both the defender and the attacker, so no easy answer here.

Pages: 10

As IT Auditors, we conduct IT Audits, but our services are not limited to IT Audits alone. Assistance is also a major IT Audit service. This chapter focuses on the conduct of formal IT Audits. The outcome of an assessment may take different forms and formats depending upon the purpose of the effort. This chapter presents several different approaches to IT Audits and their outcomes.

Pages: 16

System and Organization Controls Reports (SOC Reports), formerly called Service Organization Controls Reports, have also become a standard for cloud service providers and a new source of revenue for CPAs. SOCs are not new, they are the descendant of SAS 70 Reports. They have taken on added importance as IT shifts to cloud-based services, i.e., service organizations providing essential services to businesses. While SOC Reports, like Sarbanes Oxley mandates, apply to Financial Reporting, they are at least equally if not more important for businesses because businesses have become operationally dependent on third parties. Keep in mind businesses whose operations were suspended because of cloud service failures.

Pages: 9

Modeling is an essential skill for IT Auditors, as well as analysts, architects, designers, and builders. Being able to ‘read’ models and being able to construct models are essential IT Audit skills. They are essential to understanding and documenting situations and processes and their internal and external Internal Controls. One way to confirm an understanding is to model a situation or process as you believe it is and then get feedback from Subject Matter Experts (SMEs) who work with these situations and processes on a daily basis. IT Auditors do not necessarily need to be model-building experts, but having skill in this area is very helpful.

Pages: 8

Looking downstream, one sees both clear trends and chaos. Gartner coined ‘Hype Cycle’, an apt phrase for technology. Gartner sees technologies as going through a cycle of great expectations, delusion and either failure or acceptance. Some technologies disappear, some emerge with adjusted expectations. At this writing, clear trends include more automation, especially of processes that were primarily manual processes typically because they involve multiple systems. They cross traditional boundaries. Continuous Improvement, which developed out of the ashes of World War II, remains a potent force as businesses compete in a hypercompetitive environment. Artificial Intelligence, which is covered in the Epilogue, is clearly here to stay and will have major, gigantic effects on business and on our personal lives as well. One commentator suggested we are overestimating AI today and underestimating its future impact, an interesting take on AI. Regardless, this is a great time to be involved in IT.

Pages: 10

As with other Professions, Information Technology (IT) has its professional guidance, which means we do not have to figure out things on the fly, on an ad hoc basis. Professional guidance provides a foundation for IT Governance, Management, and Operations. Different standards see things differently. Hence, being familiar with several standards and guidance is often helpful. This chapter compares two leading methods, COBIT and ITIL, and summarizes TOGAF.