1. Introduction to IT Auditing
Chapter One
Introduction to IT Auditing

2. Outline IT Governance The Systems Development Life Cycle (SDLC)
Types of Information Systems
The Role of the IT Auditor

3. IT Governance
…the process for controlling an organization’s IT resources, including information and communication systems, and technology.
…using IT to promote an organization’s objectives and enable business processes and to manage and control IT related risks.

4. Strategic Alignment

5. Information Criteria CIA Triangle Cobit “add-ons” Confidentialilty
Integrity
Availability
Cobit “add-ons”
Effectiveness
Efficiency
Compliance
Reliability

6. CobiT’s IT Governance Management Guideline
Identifies critical success factors, key goal and performance indicators, and an IT governance maturity model.
IT governance framework begins with setting IT objectives and measures and compares performance against them

7. Systems development life cycle (SDLC)
Provides overall framework for managing system development process
All projects use some variation of SDLC
Phases are sequential but may include some overlap
May even include iterations of some or all of the phases

8. Phases of the Systems Development Lifecycle (SDLC)
Project planning: initiate, ensure feasibility, plan schedule, obtain approval for project
Analysis: understand business needs and processing requirements
Design: define solution system based on requirements and analysis decisions
Implementation: construction, testing, user training, and installation of new system
Support: keep system running and improve

9. Systems development life cycle (SDLC)
In COBIT, these phases (domains) are:
Plan and Organize (PO)
Acquire and Implement (AI)
Deliver and Support (DS)
Monitor and Evaluate (ME)

10. Types of Information Systems

11. Message Transmission Example

12. Types of Information Systems
Information Systems include not only hardware and software but…
People
Procedures*
Data
In Cobit, these “assets” include
Applications (like software)
Technology (like hardware)
Facilities
* Note: Procedures (processes) are “subsets” of the domains in CobiT

13. IT and Transaction (Tx) Processing
The IS collects transaction data
The IS turns data into information
Computerized Tx systems increase some risks and decrease others

14. What do IT auditors do?
Ensure IT governance by assessing risks and monitoring controls over those risks
Works as either internal or external auditor
Works on many kind of audit engagements

15. Financial vs IT Audits
IT auditors may work on financial audit engagements
IT auditors may work on every step of the financial audit engagement
Standards, such as SAS No. 94, guide the work of IT auditors on financial audit engagements
IT audit work on financial audit engagements is likely to increase as internal control evaluation becomes more important

16. IT Audit Skills College education – IS, computer science, accounting
Certifications – CPA, CFE, CIA, CISA, CISSP, and special technical certifications
Technical IT audit skills – specialized technologies
General personal and business skills

17. Professional Groups and Certifications – Alphabet Soup
ISACA – CISA/CISM
IIA – CIA
ACFE – CFE
AICPA – CPA and CITP

18. How to Structure an IT Audit
AICPA Standards and Guidelines – GAAS, SAS, and SSAE
IFAC Guidelines – harmonized or common international accounting standards and guidelines
ISACA standards, guidelines, and procedures – includes CobiT and audit standards

19. An Overview of the Book
Section I – an introduction to IT audit, the legal and ethical environment of the IT audit, introduction to risks and controls
Section II – risks over specific processes and technologies – deployment of IS, operation of IS, network systems, and e-business systems
Section III – how to do an It audit – use of CAATTs and a step-by-step IT audit
Appendices – ACL tutorial and IT audit glossary