Information Technology Audit Research Articles

Comparative Study On Trustee Of Third Party Auditor To Provide Integrity And Security In Cloud Computing

One of the storage device in the market are cloud services, there can be some security issues and conflicts between the client and service provider to resolve the third party auditor issues. This comparative analysis ensure reliable data storage providing computing resources in the form of service rather than a product and utilities are provided to users over world wide web. Cloud is a platform where data remotely stores in the server and also protects the data against threats; cloud environment is a domain which comes under the property of users for further development from research scholars. The information technology huge number of clients which is accessing the data and updating the data application and services move to centralized huge data centre and services management trust into cloud environment the computing resources are under control of service provider and the third party auditor ensures the data integrity over the sourced data. Compare Information Technology audit is a manual work our Cloud Third party auditor mechanism in cloud standard audit not only stores or reads the data also updates the data through query.

Information Technology Audit in Georgia

With the development of information technology to carry out effectively their missions the largest part of a variety of organizations, government agencies and services have become dependent on computer systems. For each of the organization’s activities the IT environment must be properly studied and evaluated in which they perform the basic activities. Therefore, in such environment it is necessary to make the information technology audit of IT systems operating reliability and functionality in order to obtain reasonable assurance. IT governance and information systems audit is imperative for successful governance. This paper with a comprehensive literature review defines information technology audit, investigates how IT audit performs in the public sector of Georgia. Also it provides the thorough explanation of the experiences of the Georgian State Audit Office. The study analyses the challenges of the IT audit and point to future development directions of IT audit in the public sector. Although considerable research exists on IT control and on internal auditing, there is limited study that refers to IT evaluation control activities in the public sector auditing. As such, the findings from this research would generate new conclusion to enrich the existing literature on IT related auditing. The findings also may improve the IT evaluation activities in the Georgian public sector.

Competence and Professional Care of External Auditor on Information Technology Audit

The purpose of this study is to determine the influence of competence and professional care of external auditor on information technology audit in the public accounting firm in Bandung. The method used in this research was survey method with descriptive and verification approach, as well as by using primary data. According to the research, competence partially had no effect on information technology audit, while professional care partially affected the information technology audit. On the other words, competence and due professional care simultaneously influenced information technology audit significantly by 54.7%, while 45.3% was influenced by other variables not studied e.g independence, software usage auditing, performance auditing.

Measuring Operational Management Information Technology: COBIT 5.0 and Capability Level

Abstrack—Every system need to be well organized so it can achieve what the company expected. So, very company need to do some measurement to create a well organize system. A type of action that can be used for creating a well organize system is quantify their IT governance PT XYZ is a company that engaged in property business. Their company want to measure their IT governance, to measured their IT governance framework COBIT 5.0 was use and as what the company request process that being measure are Manage Service Agreements, Manage Change, Manage Operations, and Manage Service Request and Incidents. Every process have their own importance and will be measured based on framework COBIT 5.0 capabilitylevel. Capability level have 5 kind of stage. PT XYZ expectation that they can achieved level 4. But, the esult that came out doesn’t match what their company has expected, the result was level 3 and on of their process stop at level 2. So, to attain the level that PT XYZ wanted they need to some improvement based on COBIT 5.0 recommendation.
 Index Terms—Capability Level, COBIT 5.0, Information System, IT Governance.
 REFERENCES
 [1] S. Tata, “Sistem Informasi Manajemen,” Yogyakarta, Andi, 2005.
 [2] R. Weber, “Information System Control and Audit,” Prentice Hall, New Jersey, 1999.
 [3] Kompas. http://tekno.kompas.com. 24 Agustus 2016.
 [4] BCA.http://www.bca.co.id/id/TentangBCA/Korporasi/Siaran-Pers/2016/02/09/04/48/Terapkan-ISO9001-2008. 25 Agustus 2016.
 [5] ISACA, http://www.isaca.org/. 23 August 2016. [6] Gondodiyoto et al., “Pengolahan Fungsi Audit Sistem Informasi,” Penerbit Mitra Wacana Media, Jakarta, 2007. [7] E. J. Hunton, “Core Concept of Information Technology Auditing,” New Jersey, John Willey and Sons Inc, 2004.

Information Technology in an Audit Context: Have the Big 4 Lost Their Advantage?

ABSTRACTAudit firms use information technology (IT) to improve audit quality, effectiveness, and efficiency. While audit IT has evolved over the past decade, limited guidance is available to assist practitioners in determining how IT can be used. Our research objectives are fourfold. First, we examine to what extent auditors use and assess the perceived importance of IT in their audits. Second, we look at different-sized firms to determine whether IT adoption and implementation decisions differ by firm size. Third, we investigate changes in auditors' use and perceived importance of IT over the past decade. Fourth, we examine whether IT has impacted the communication modes used by auditors when reviewing workpapers and fraud brainstorming. Overall, Big 4 auditors were not significantly more likely to use IT than non-Big 4 auditors, suggesting that the dominance of the Big 4 firms' use of IT has lessened. In fact, there are a few applications where non-Big 4 auditors appear to have taken the lead. In addition, our findings indicate that auditors have increased the use of all the IT applications we examined ten years ago. However, we find evidence that auditors may prefer to use even more IT in their audits than they are currently using.Data Availability: Data used in this study are available for download, see Appendix B.

AUDIT TEKNOLOGI INFORMASI PADA DEALER MOBIL XYZ DI BANDAR LAMPUNG DENGAN MENGGUNAKAN PENDEKATAN COBIT 4.1

Information technology is growing rapidly and greatly influences to improving the effieciency and effectiveness of business activities in developing the company. In this case, an information technology audit is needed to ensure the existing information technology, that has been already satisfy the common control standards and has the ability to compete in the business world. The purpose of this research is to evaluate the assessment and to make recommendations based on the analysis maturity level of IT in Car Dealer XYZ in Bandar Lampung according to the framework COBIT 4.1. Standard of COBIT 4.1 has parameters that can aid the assessment of an enterprise using a maturity model. This research finds that the result of maturity level of Car Dealer XYZ in Bandar Lampung is 4.02. This shows that Information Technology has been updated well where the procedures and policies have been done effectively, monitored and there are corrective actions are taken.

IT managers’ vs. IT auditors’ perceptions of risks: An actor–observer asymmetry perspective

With the growing role of information technology (IT), many organizations struggle with IT-related risks. Both IT managers and IT auditors are involved in assessing, monitoring, and reporting IT risks, but this does not necessarily mean that they share the same views. In this study, we draw upon the actor–observer asymmetry perspective to understand differences in IT managers’ vs. IT auditors’ perceptions of risks. Through a quasi-experiment with 76 employees of a financial institution, we found that IT managers and IT auditors showed the expected actor–observer differences. Implications for both research and practice are discussed.

ERP in the Classroom: Three SAP Exercises Focused on Internal Controls

ABSTRACTThree short exercises are presented that introduce certain functional aspects of Enterprise Resource Planning (ERP) software. The objective is to provide students with an introduction to the functionality that is incorporated in a typical ERP software solution that supports an evaluation of internal controls and segregation of duties as part of the Information Technology Audit (IT Audit) function. We have developed three hands-on step-by-step exercises using a widely implemented ERP system (i.e., SAP) and provide access to SAP on the cloud so that students can learn how to verify internal controls embedded in the system and identify control weaknesses such as a lack of segregation of duties.

What Factors Influence Companies’ Successful Implementations of Technology Risk Management Systems?

During the initial literature review on this research question, areas of focus included the following: • Current qualitative and quantitative methodologies for technology risk analysis. • Business applications for expanding the use of qualitative and quantitative technology and security risk models. • Implementation of qualitative and quantitative technology and security risk analysis methodologies models by practitioners. Information Technology (IT) risk analysis has become be an integral part of the enterprise risk management systems in many organizations. However, many companies have struggled to effectively implement these systems. This has become a serious problem in many cases where governmental regulations, industry requirements, and even contractual language for doing business have increasingly included technology risk management obligations that companies must meet. Currently, technology risk management is not as mature a field as those like IT Audit or Information Security, which have had professional certification processes for over 23 years. Technology risk management, on the other hand, has had similar certifications for less than 10 years. As such, many of the current technology risk management practitioners have come from other fields, which has made it difficult to construct a common body of knowledge on which technology risk management systems can be built. In many cases, such factors, as well as others, are making it difficult to implement technology risk management systems. This research will seek to evaluate those factors in more detail to determine common ones that have the most impact on the success of technology risk management projects and make recommendations for overcoming the factors that limit the success of these projects.

IT Governance Measurement Tools and its Application in IT-Business Alignment

ABSTRACT The purpose of this exploratory research paper is to evaluate the deployment and assessment methodology of the information technology governance (ITG) measurement tools, with the purpose of gaining deeper insight into the ITG initiation process, the nature of tools employed, measurement processes, and the implementation methodology, using case studies. Analysis of the available academic and non-academic literature sources showed measurement issues being the most dominant and ironically the most neglected domain in ITG implementations. We view ITG measurement tools and it subsequent deployment through the two theoretical ITG models namely the Integrated IT Governance model, and the Structures, Processes, and Relational ITG model. To validate these findings and to get a deeper insight into the ITG measurement domain, we conducted four case studies of measurement tools usage and processes in commonly used ITG frameworks in four organisations in New Zealand and United Arab Emirates. The results indicate that the IT governance initiatives differ in the manner of positioning in the integrated ITG framework, and objectivity of measurement is more evident and emphasized in UAE than in New Zealand. The result of these findings provides practitioners with guidance on the contextual usage of ITG measurement practices KEYWORDS: IT Governance measurement, IT business alignment, metrics INTRODUCTION Assessing the measurement and value of IT is a complex challenge and a future research direction (De Haes, Van Grembergen, & Debreceny, 2013). Thus, there is an ever-increasing demand for accountability and objectivity in the measurement of information technology auditing, and IT processes performance (Maria, Fibriani, & Wijaya, 2012). Supplemented, with an ever-increasing demand for compliance in the information domain, organizations have witnessed an increase in the adoption of IT governance (ITG) frameworks. In a highly contextually different, but global organizational structure, ITG implementation however, remains an issue where the theory does not or cannot always deliver to the expectations of practitioners. Globally, IT governance is concerned with two things: that IT delivers value to the business and that IT risks are mitigated and both need measurement (Grembergen, Haes, & Guldentops, 2004), but contextually the subsequent practices may differ. This key issue of aligning IT goals with business goals, which overlap two domains namely IT and business is the primary goal of IT governance. However, this continuous alignment of business and IT in a rapidly changing environment has also been the top concern (Kappelman, McLean, Johnson, & Torres, 2016) and a grand challenge for today's enterprises (Hinkelmann et al., 2016). In this respect, the objective of continuous measurement of IT processes/IT controls to ensure alignment, plays a critical role in IT business alignment success through higher-level measurement models (IT maturity model, balance scorecard); and process measurement tools namely heat map, key performance indicators, and key goal indicators. While organizations worldwide embark on adopting ITG frameworks, the subsequent need to select and integrate overlapping ITG frameworks has presented practitioners with challenges in terms of choice and integration of frameworks (Nicho & Muamaar, 2016). While the most prominent IT governance frameworks include ITIL, COBIT, ITCG & COSO (Benaroch & Chernobai, 2012), COBIT and ITIL are commonly used for IT governance implementations (Stevens, 2011). Hence, assessment of the IT processes/IT controls of these frameworks is not only a continuous process for audit and compliance, but also presents challenges in terms of consistency of audit, compliance, and/or measurement. With alignment of IT with the business being the highest management concern for organizations (Kappelman et al., 2016), IT governance become an important issue on the agenda for many enterprises (Simonsson, Johnson, & Wijkstrom, 2007). …

What could possibly go wrong? A multi-panel Delphi study of organizational social media risk

The growth of social media has crossed the boundary from individual to organizational use, bringing with it a set of benefits and risks. To mitigate these risks and ensure the benefits of social media use are realized, organizations have developed a host of new policies, procedures, and hiring practices. However, research to date has yet to provide a comprehensive view on the nature of risk associated with the use of social media by organizations. Using a multi-panel Delphi approach consisting of new entrants to the workforce, certified human resource professionals, and certified Information Technology auditors, this study seeks to understand organizational social media risk. The results of the Delphi panels are compared against a textual analysis of 40 social media policies to provide a comprehensive view of the current state of social media policy development. We conclude with directions for future research that may guide researchers interested in exploring social media risk in organizations.

TheJournal of Information Systems2015 Conference on Information Technology Audit

An introduction to the journal is presented in which the author focuses on the systems research invigorated by the American Accounting Association (AAA), the information technology audit, and improvement of the publication process in accounting.

The effect of auditor IT expertise on internal controls

Material weaknesses in internal controls related to information technology (IT) represent unique threats to organizations. Utilizing the external auditor as an example of an externally observable governance mechanism, we investigate if firms with revealed IT internal control deficiencies employ a strategy of disassociation with their current auditor. Our tests show that prior evidence of disassociation strategies hold in both IT and non-IT contexts. Of particular focus to our study, we document a positive association between firms that report IT material weaknesses and subsequent auditor dismissals or switching. We next investigate the potential internal control benefits of switching to auditors with greater expertise in environments that emphasize the importance of IT. We argue that greater audit firm IT expertise promotes improved internal controls for their clients, especially those controls that are dependent on IT. We find that clients that switch to auditors with greater IT expertise, relative to their former auditor, have a greater likelihood of material weakness remediation within one year of reporting control weaknesses. Complementing these findings, we find that audit IT expertise is negatively associated with both non-IT and IT material weaknesses in an ex ante reporting setting. Prior literature takes a longstanding interest in both the incentive for developing auditor expertise and the effects of that expertise. We contribute to this literature stream by providing additional evidence related to a specific type of expertise.

Contribution of the Information Technology Audit in Achieving the Quality of the Electronic Accounting System: Evidence from the Algerian Banking Sector

The banking sector occupies a central position in the economy. This consideration stems from the roles and the responsibilities assumed by this institution. Therefore, the consolidation of the system comprising the banking and other financial institutions by all kinds of technology and information becomes more than a necessity in an attempt to improve the quality of the services provided in one hand and to strengthen the banking organization per se at the other. The latter objective is ensured by different mechanisms. One of these is the auditing mechanism. The paper sheds light on the impact of the information technology audit in increasing the quality of the bank accounting system. The study shows that the acquisition of the modern technology is not based only on feasibility, but in response to the requirement of the competition and the customers' satisfaction.

The Current State and Future Direction of IT Audit: Challenges and Opportunities

ABSTRACT:Embracing the spirit of the Pathways Commission's focus of enhancing the value of practitioner/educator exchanges, the inaugural Journal of Information Systems Conference (JISC) brought together 30 academic researchers and 15 practitioners to discuss the current state and the future direction of information technology (IT) audit research and practice. Panelists, comprised of practitioners from government, public accounting, and industry, provided insight into current IT audit issues. The first panel discussed the role of IT auditors in helping organizations meet compliance requirements and ensuring that information systems add value to the organization. The second panel addressed the future of IT audit in a world of advanced analytics and emerging technologies. Although the panels addressed separate topics, common themes emerged from the discussions. Issues facing the IT audit profession as a result of the increasing volume of data available, coupled with changing technology and increasing regulatory requirements, underscored much of the discussion. Big Data, compliance, and emerging technology issues were addressed from both internal audit and external audit perspectives. This commentary provides a review and synthesis of the information presented during panel discussions at the conference and suggests potential research questions.

The Association between Information Technology Investments and Audit Risk

ABSTRACTAdvances in information technology (IT) have changed the way that companies conduct business, prepare their financial statements, and have their financial statements audited. On one hand, IT decreases audit risk by improving operation and internal control effectiveness, which may decrease inherent and internal control risk. On the other hand, the complexity of IT introduces unconventional risks for companies and their auditors, especially by creating challenges for auditors when auditing the effectiveness of internal controls and detecting accounting irregularities. Thus, the relationship between clients' IT investments and audit risk deserves research attention. Using IT data of U.S. firms from 2000 to 2009, we find that IT investments are positively related to audit fees (and abnormal audit fees), the probability of auditors' issuance of a going-concern opinion, and the likelihood of auditors' Type II errors. Furthermore, we find that auditor tenure moderates the relationship between IT investments and audit fees due to the learning effect.

Impact of IT Auditors’ Involvement in Financial Audits

Based on the FBI, the majority of corporate fraud cases involve acounting schemes designed to deceive investors, auditors, and analysts about the true financial condition of a corporation. Investigations have determined that companies manipulated their financial systems to fraudulently inflate financial information. Surprisingly, there is limited relevant research requiring the involvement of information technology auditors in financial audits. According to the literature, information technology auditors are underused (or not used at all) in financial audits, allowing for opportunitites of manipulation, abuse, and/or misreport of financial data. It has been argued that information technology auditors are more likely to effectively understand and test organizations' technology environments than financial auditors. This research investigates whether a relationship exists between inclusion of information technology auditors in financial audits and detecting manipulated financial information in organizations. Results suggest a positive correlation between the above variables, and prompt for additional work to extend the results identified herein.

The Effects Of Information Technology Innovativeness On Audit Efficiencies

Information technology (IT) has been identified as an important component of a company’s internal control and general business environment (COSO 2009). This paper examines how IT innovativeness can create value in the accounting domain through its role in improving efficiencies associated with the audit process by reducing overall inherent risks and business risks. To test the relationship between IT innovativeness and audit efficiencies, we use a sample of IT firms recognized by the publication InformationWeek as innovative users of IT and compare those firms with a control group. For the dependent variables measuring audit efficiencies, we focus on audit fees and audit delays. Our research suggests that firms recognized as IT innovators pay lower audit fees and receive their audit reports in a timelier manner than the control firms. Our results are consistent with the idea that investments in IT can provide significant benefits for firms in terms of audit efficiencies.

Do IT audits satisfy senior manager expectations?

Purpose – This paper aims to analyse the relationship between the senior management and the information technology (IT) auditing undertaken in Italian banks, focusing specifically on the internal IT auditing. The purpose of this paper is to investigate senior executives’ expectations regarding IT auditing, the techniques IT auditors apply to meet these expectations, the degree to which senior managers are satisfied with the auditing and the expectation gap. Design/methodology/approach – We conducted 22 interviews with senior managers and IT auditors of seven Italian banks, comprising large and small financial institutions, to gain data for our analysis. Findings – We found that overall, the IT auditors’ contributions satisfy senior managers, even though they still see room for improvement. They expect more support for the IT governance processes, specifically for the alignment between IT investments and business needs and between IT risk management and the value that IT resources provide. In addition, they want IT auditors to focus more strongly on IT security. To meet these expectations, IT auditors would have to improve their technical and non-technical skills. These skills will allow them to expand their activities, to be more proactive and to take on effective roles in IT governance processes. Originality/value – This study contributes to the existing literature by providing insights into the internal audit function’s evolving role and into banks’ IT audit activities. It also provides a valuable insight into senior management’s expectations regarding the role IT audit activities should play to support the profession and the banking policymakers, thus providing a better understanding of IT audit activities and improving these activities’ role.

Philosophical foundations of information technology audit

The scant handful of papers that philosophically analyse auditing principles date from the 1980s. None that we know of addressed information technology audit, a rather new interdisciplinary profession. The aim of this work is to explore the basic design principles that inquiry systems supposedly must fulfil to establish valid auditing procedures. Philosophers have shown that different inquiry approaches utilise a variety of validation ('truth guarantor') mechanisms, and as such, they are also likely to lead to different outcomes. Building on Churchman's classification of inquiry systems along the lines of five Western philosophers - Leibnitz, Locke, Kant, Hegel and Singer - this article presents each philosopher's ideas and applies them to the information technology audit profession. Accordingly, future development of audit legitimacy mechanisms is recommended, and forecasts are made. Thus, understanding the theory should lead to improved practices.