Information Technology Audit Research Articles

The legal side of IT auditing

AbstractInformation technology (IT) audit professionals have traditionally viewed themselves as computer and information systems specialists. However, recent legal and regulatory trends require every IT auditor to be familiar with the rules and regulations for storing, securing, and transmitting digital business information. Companies that fail to store mandated e‐data—or send it to third parties without meeting certain legal conditions—can get into serious legal trouble.So how much do you know about the legal side of IT auditing? What you don't know can hurt your firm and your career. But the information and advice in this article can help protect you . © 2011 Wiley Periodicals, Inc.

The Impact of E-Business on the Audit Process: An Investigation of the Factors Leading to Change

2 University of Aberdeen Business School This study seeks to further understand the implications of e-business for financial audit practice by exploring: the pressures leading to the adoption of new or different audit practices; the specific features of e-business that affect the appropriateness of traditional auditing practices and techniques; and how technical audit work is changing in response to the increasing adoption of e-business models. By using semi-structured interviews and a postal questionnaire survey, the perceptions of financial auditors and information technology (IT) audit practitioners were sought. The findings identify factors affecting, and pressures leading to, audit change in response to e-business as perceived by these auditors. Overall, the most obvious aspect of e-business audit change was felt to be the extensive use of IT-driven practices and techniques, and this change could not only be attributed to technical factors, but they also thought that competitive and professional factors were also important drivers of audit change. SUMMARY

Evaluating Operations and Information Technology Risk in Banks: Opportunities for Auditors to Bring More Value to Institutions

Operational risk, in the post–Basel II sense, is the newest area of risk in financial institutions, following on credit and market risk. As such, it is also relatively new to many auditors. In looking at the information technology (IT)–related aspects of operational risk, these have also been challenging to auditors. Partially, this is because of the complexity of financial institutions' products and process. Partially, this is because of the interaction of business processes with their dependencies on IT requiring general and IT auditors to work together. This article looks at the business and regulatory environment surrounding operational risk, raises key questions around evaluating and auditing operation risk, especially IT and outsourcing aspects, and then looks at what is on the horizon in financing operational risk. At each step, it notes considerations for auditors to mature their work.

IT auditing activities of public sector auditors in Malaysia

Information technology (IT) has become an increasingly important tool for the Malaysian government to improve the delivery of its services. However, advances in information technology continuously render control procedures obsolete. Indispensably audit methodology has to evolve to keep abreast with the change in technology. This study investigates the IT practices of the public sector auditors in Malaysia. We examine IT evaluation based on IT audit objectives, organisational characteristics, competency of auditor and usage of Computer Assisted Audit Tools and techniques (CAATTs). Self-administered questionnaires were mailed to 400 public sector auditors providing a usable sample size of 73. The results show that application processing control and data integrity, privacy and security control were the most frequent evaluations performed by public sector auditors. The most frequent IT audit objective is the evaluation of compliance with policies, procedures and evaluation of internal control and these objectives are performed differently in different divisions. CAATTs have been used most frequently as a problem solving aid. Several appealing patterns emerged from the eight regression models. The findings provide important implications for research on IT and public sector auditing. Key words: IT auditing, public sector auditing, public sector auditors.

Auditing methodology on legal compliance of enterprise information systems

In spite of the scepticism, that information technology (IT) compliance is useless enforcement, which does not contribute to an economic balance of the organisations, IT compliance is a mandatory responsibility of the organisations for their survival enforced by legalised rules. To review and update enterprise information systems to be in compliance with various laws is not an easy work because previous studies on information engineering or security engineering do not provide a specialised methodology for IT compliance. The most critical problem that the organisations are facing is that it is very difficult to identify what they should do for IT compliance. An auditing methodology, which identifies the problems of and provides guides on IT compliance would be the solution for the problems that organisations are facing. This paper provides an auditing methodology, which consists of an auditing target, checklist, process model, evaluation indices and reference model. The methodology proposed in this paper helps IT staffs, managements and auditors to improve the level of IT compliance and manage an auditing project effectively.

Penilaian Diri Praktisi dan Akademisi Akuntansi atas Kemampuan di Bidang Teknologi Informasi

The International Federation of Accountants (IFAC) Education Committee issued IEPS 2, which state that information technology is pervasive in the world of business. Information technology can replace accountant’s role in financial statement preparation. Competence with this technology is imperative for professional accountant. The aim of this research is to examine accounting practitioner’s and educator’s self IT perceived knowledge level, towards the important of PC knowledge, system design and development know-how, accounting package awareness, information technology auditing and language programming knowledge for accountant professionals. Purposive sampling, hence, is employed to determine the number of respondents that will capable to represent public accountant practitioners, management accountant practitioners, public sector accountant practitioner and accountant scholar. Moreover, the respondent will be drawn within the universities and firms located at Jakarta. The data collected, hence will be analyzed using Mann-Whitney U test to examine the difference among practitioners towards academicians. It is shown by the standardize U statistics with 0,05 level of significant, eighteen item expression’s scores are within acceptance region, confirm that there is no different perceived knowledge level among accountant scholar toward accountant professional.

Factors associated with IT audits by the internal audit function

Responses from a large sample of 1029 chief audit executives (CAEs) from Australia, Canada, New Zealand, the UK/Ireland, and the US are used to estimate the proportion of time spent by the internal audit functions (IAFs) on information technology (IT) audits. The sample is also used to investigate explanatory and control variables that are associated with the extent of IT audits by the IAFs. The results show that the proportion of the IAF time spent on IT audits was only 7.97% in 2003, 10.61% in 2006, and was projected to be 13.40% in 2009, indicating an approximately 1% increase per year. Multivariate regression indicates that four variables; the certified information system auditor (CISA) certification, IAF age, training, and the number of organizational employees are significantly and positively associated with IT audits by the IAFs. Other common certifications such as CIA, CPA, and CMA are not positively associated with the proportion of IT audits. Also, while CAE experience, education level, and the country of residence did not affect the results, an IS/CS (information system/computer science) was significant and positive in two of the four models tested. Implications for additional research and practice are discussed.

How IT Can Help Internal Audit

. Information Technology (IT) and Internal Audit departments have the same business mission, but they can face conflicting responsibilities. The solution must enable IT to provide data without losing confidence, while giving Audit enough flexibility to fulfill the “access to all data” mandate in most every audit charter. This paper describes Audit's four key data issues, the role of audit analytics in business assurance, and some best practices that can help both IT and Audit manage the key data issues.

An E-Business Audit Service Model in the B2B Context

This research studies E-business audit as a specialized service rendered in an information technology intensive environment. A service model is used to research the E-business audit context. Here auditing is viewed as a specialized technical service conducted in the context of E-business technologies, business processes, and people involved in E-business transactions. The specialized audit service is provided to the E-Business transacting firms that in most cases involve transactions between customers and suppliers. A field study of information technology auditors showed that both knowledge of the business processes and of the technologies were critical for them to render reliable and accurate E-business audit findings. The results showed the need for higher training levels in advanced IT methods and tools for technology auditors in rendering IT audit judgments for the business-to-business (B2B) context. Thus, these results provided support for the service model that calls for the appropriate knowledge and use of technologies, business processes, and people in providing service.

AUDIT TEKNOLOGIINFORMASIATAS PHYSICAL SECURITY CONTROL DAN LOGICAL SECURITY CONTROL SERTA PENENTUAN KONDISI SECURITY RISK STUDI KASUS: PT TALC INDONESIA

AbstractThe fast growth of technology has an impact to the accounting field. This relates to the term of information technology (17) auditing. One of the risI6 of using information technology in business which can be fatal enough i fignored is security risk Security risk can be reduced by security controls which include physical security control and logical security contra Information technology auditing is the process of collecting and evaluating evidence to determine whether or not a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively, and uses resources. efficiently. Security risk is a potential threat which may endanger the company's assets, especially in the case where it is one of the impacts of IT implementation in a company.Physical security control is a security control designed by an organization or company to protect the physical facility of information technology infrastructure. Logical security control is a security control designed by an organization or company to protect the information technology infrastructure that is invisible in character, such as corporate data and computer software by means of logical function (by using ID password, hand key, fingerprint, and retina scan). The research method is descriptive analysis method, a research method which systematically, actually, and accurately describes concerning facts, characteristics, and also the relation between the phenomenon being studied (that is the application of physical and logical security control at PT Talc Indonesia). Data collecting techniques include observation, interviews, questionnaires, and documentation.Research result shows that environmental control is effective (68.75%), physical security control is not effective (26.92%), and logical security control is categorized as effective enough (42.22%). In conclusion, the condition of security risk in PT Talc Indonesia is at a risky level because according to this research, there is still an ineffective control (that is the practice of physical security control). Meanwhile, the practice of logical security control at PT Talc Indonesia is determined as effective enough.Keyword: audit, information technology, security control, security risk

Information technology and its implications for internal auditing

PurposeThe purpose of this paper is to investigate empirically the impact of emerging information technology (IT) on internal auditors' (IA) activities, and to examine whether the IT evaluations performed in Saudi organizations vary, based on evaluation objectives and organizational characteristics.Design/methodology/approachA survey, using a self‐administered questionnaire, is used to achieve these objectives. About 700 questionnaires were randomly distributed to a sample of Saudi organizations located in five main Saudi cities. In total, 218 valid and usable questionnaires – representing a 30.7 percent response rate – were collected and analyzed using Statistical Package for Social Sciences – SPSS version 15.FindingsThe results of the study reveal that IA need to enhance their knowledge and skills of computerized information systems (CIS) for the purpose of planning, directing, supervising and reviewing the work performed. The results of the study are consistent with Hermanson et al. that IA focus primarily on traditional IT risks and controls, such as IT data integrity, privacy and security, asset safeguarding and application processing. Less attention has been directed to system development and acquisition activities. The IA's performance of IT evaluations is associated with several factors including: the audit objectives, industry type, the number of IT audit specialists on the internal audit staff, and the existence of new CIS.Practical implicationsFrom a practical standpoint, managers, IA, IT auditors, and practitioners alike stand to gain from the findings of this study.Originality/valueThe findings of this study have important implications for managers and IA, enabling them to better understand and evaluate their computerized accounting systems.

Security Patterns for Automated Continuous Auditing

ABSTRACT In the light of recent global corruption scandals (e.g., Enron), the requirement for corporate governance and responsibility has emerged as a management priority. The explicit externalization of this requirement, as expressed through the recent regulatory environment (e.g., Sarbanes-Oxley Act) has made several research topics in the area of audit to emerge. The need for explicitly demonstrated assurance of the financial and accounting information at any time has given interest to emerging concepts and in particular to the one of continuous auditing. Despite the multiple perspectives on continuous auditing, a common understanding that it can be achieved through audit automation is developing among scholars and practitioners alike. Information technology audit is a set of recurring tasks by nature that face challenges repeatedly and hence, the use of design patterns seems a viable proposal for an audit automation substrate, capable of providing for continuous auditing. In this article we use the concept of security patterns to guide the implementation of audit automation mechanisms that are required to support continuous auditing within application systems.

An Examination of Audit Information Technology Use and Perceived Importance

Information technology (IT) use can directly impact audit judgment and ultimately audit effectiveness and efficiency. Although IT has significantly changed the audit process, few studies have examined the perceived importance of IT use across a diverse group of audit firms. Our descriptive study explores audit IT use and its perceived importance across several audit applications. To address regulator concerns about barriers to entry in public accounting and to advance auditing research, we examine whether audit IT use and perceived importance of IT varies by firm size. A field-based questionnaire was used to collect data from 181 auditors representing Big 4, national, regional, and local firms. Our results indicate that auditors extensively use a variety of audit applications including analytical procedures, audit report writing, electronic work papers, Internet search tools, and sampling. Auditors perceive several applications as important (e.g., fraud review), but use them infrequently. In addition, IT specialists use is infrequent, even by auditors who examine clients with complex IT. Finally, findings suggest that audit IT use and perceived importance vary by firm size. These results describe audit IT use, but do not allow us to infer causality.

Information Technology Auditing: A Value-Added IT Governance Partnership between IT Management and Audit

Information Technology Auditing: A Value-Added IT Governance Partnership between IT Management and Audit

Perceived Determinants of E-Commerce Audit Judgment Expertise

A global survey of 203 E-commerce auditors was conducted to investigate the perceived determinants of expertise in E-commerce audits. We hypothesize and find evidence indicating that information technology and communication expertise are positively related to expertise in E-commerce audit judgment. We also find that system change management expertise and information technology audit expertise mediate this relationship.

Empirical Assessment of Effective E-Commerce Audit Judgment

This global survey of 203 B2B E-Commerce auditors examined a model of E-Commerce audit effectiveness using the methods drawn from the information technology auditing and information systems research domain. The findings support the positive and significant relationship of information technology audit expertise and information and communication technology expertise on E-Commerce audit judgment while the system change management impact was indirect via information technology audit expertise. The results of this empirical study furthers our understanding of the role of an accountant in e-commerce audit engagement and the importance of auditor expertise in systems and network change management which has been an under researched area in E-Commerce auditing. The highly technology-centric nature of E-Commerce requires various expertise areas for the E-Commerce auditor to develop a higher level of audit judgment expertise. The most significant contribution made by this study to the accounting literature is the empirical validation of the theoretical observations and the professional opinions on the need of boundary spanning role played by accountants in the e-commerce audit engagements. E-Commerce audit judgment expertise model presented here uses global sampling of forty six countries with financial, information systems and operational auditor respondents. Further, this study provides measurement scales for future empirical studies to not only confirm these scales on independent samples but also to extend the theory developed and tested in this paper. It is hoped that the results of this study can provide a sound theoretical and operational basis for research focused on differentiating the efficacy of varying E-Commerce audit judgment expertise configurations and for future accounting studies that determine the paths of audit expertise system design and redesign for our fast changing technological milieu.

Research Opportunities in Information Technology and Internal Auditing

This paper presents research opportunities in the area of information technology (IT) within the context of the internal audit function. Given the pervasive use of IT in organizations and the new requirements of the Sarbanes-Oxley Act of 2002, internal audit functions must use appropriate technology to increase their efficiency and effectiveness. We develop IT and internal audit research questions for three governance-related activities performed by the internal audit function-risk assessment, control assurance, and compliance assessment of security and privacy.

AlphaCo: A Teaching Case on Information Technology Audit and Security

Recent regulations in the United States (U.S.) such as the Sarbanes-Oxley Act of 2002 require top management of a public firm to provide reasonable assurance that they institute internal controls that minimize risks over the firm’s operations and financial reporting. External auditors are required to attest to the management’s assertions over the effectiveness of those internal controls. As firms rely more on information technology (IT) in conducting business, they also become more vulnerable to IT related risks. IT is critical for initiating, recording, processing, summarizing and reporting accurate financial and non-financial data. Thus, understanding IT related risks and instituting internal control mechanisms that minimize them have become important and created an urgent need for professionals who are equipped with IT audit and security skills and knowledge. However, there is severe shortage of teaching cases that can be used in courses aimed at training such professionals. This teaching case begins to address this gap by fostering classroom discussions around IT audit and security issues. It revolves around a hacking incident that compromised online order processing systems of AlphaCo and led to some fraudulent activity. The hacking incident raises a series of questions about IT security vulnerabilities, internal control deficiencies, integrity of financial statements, and independent auditors’ assessment of fraud in the context of the Sarbanes-Oxley Act. The case places students in the roles of executives, IT managers, and auditors and encourages them to discuss several important questions: how and why did the hacking incident happen; what harm did it cause to the firm; how can the firm prevent such hacking incidents in the future; if they do happen, how can the firm detect hacking incidents and fraud sooner; how do auditors assess the impact of such incidents in the context of a financial statement audit; and whether the management and auditors have responsibility in detecting and publicly reporting fraud? The case also facilitates the teaching of relevant conceptual frameworks such as COSO (Committee of Sponsoring Organizations of the Treadway Commission) and COBIT (Control Objectives for Information and related Technology).

The keys to effective IT auditing

AbstractInformation technology (IT) and systems have become the backbone of almost every organization. So, good IT audits are essential to ensure proper controls, security, and efficient functioning. But it's not easy to implement an IT audit strategy that justifies its cost and promotes effective use of your information systems! What are the keys to doing that? The author of this article has some answers. © 2005 Wiley Periodicals, Inc.

Are Financial Auditors Overconfident in Their Ability to Assess Risks Associated with Enterprise Resource Planning Systems? (Retracted)

The first objective of the current study is to examine the extent to which financial auditors recognize heightened risks associated with an enterprise resource planning (ERP) system, as compared to a non-ERP (legacy) system, in the presence of a control weakness over access privileges. The second objective is to assess the propensity of financial auditors to consult with information technology (IT) audit specialists within their firm when assessing ERP and non-ERP system risks during the planning stage of an audit. One hundred sixty-five auditors participated in an experiment in which we manipulated system type (ERP versus non-ERP) and measured auditor type (IT audit specialists versus financial auditors). Both auditor types indicate significantly higher business interruption, process interdependency, and overall control risks with the ERP, as compared to the non-ERP, system. Additionally, while IT audit specialists assess significantly higher network, database, and application security risks with the ERP system, financial audits do not recognize higher security risks in these areas. Perceived risk differentials from the non-ERP to the ERP system across all risk categories are significantly greater for IT audit specialists than financial auditors. Finally, financial auditors do not indicate a greater need to consult with IT audit specialists when auditing an ERP versus a non-ERP system and they are equally highly confident in the ability of financial audit teams to assess risks in both computing environments. Overall, evidence from this study suggests that financial auditors may be overconfident in their ability to assess ERP system risks.