Chapter 3: Introduction to Information Technology Audit Flashcards
(16 cards)
is the examination and evaluation of an organization’s information technology
infrastructure, policies and operations
IT audit
determine whether IT controls protect corporate assets, ensure data integrity and are aligned with the business’s overall goals
IT Audit
examine not only physical security controls, but also overall business and financial controls
that involve information technology systems
IT Auditors
any audit that encompasses review and evaluation of automated information processing systems, related non-automated processes and the interfaces among them
IT Audit
are used to ensure information-related controls and processes are working properly
IT Audit
primary objectives of an IT audit
-Evaluate the systems and processes in place that secure company data.
-Determine risks to a company’s information assets, and help identify methods to minimize those risks.
-Substantiating that the internal controls exist and are functioning as expected to minimize business risk.
-Ensure information management processes are in compliance with IT-specific laws, policies and standards.
-Determine inefficiencies in IT systems and associated management.
is not about ordinary accounting controls or traditional financial auditing
IT Audit
-introduced a new source of risk associated with accounting processes and information
-introduced the need for those who understand this new “thing” to identify and mitigate the risk
use of computers in accounting systems
is focused on gathering data to ensure to ensure that the company’s financial statements are free from material misstatements
Financial Audit
is the examination and evaluation of an organization’s information technology infrastructure, policies and operations
IT audit
-is just a part of the overarching process of the Financial Audit
-not compliance testing
IT Audit
are examining whether the entity’s relevant systems or business processes for achieving and monitoring compliance are effective
IT Auditors
also assess the design effectiveness of the rules—whether they are suitably designed or sufficient in scope to properly mitigate the target risk or meet the intended objective
IT Auditors
are important to IT auditors, but for reasons beyond the keeping of rules
Compliance failures
can be, and often is, the symptom of a bigger problem related to some risk factor and/or control
Compliance failures
can and does adversely affect business processes or financial data in ways of which management may not be adequately aware
Information Technology
