IT Audit
An information technology audit, or information systems audit, is an examination of the management controls within an Information technology (IT) infrastructure. The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives. These reviews may be performed in conjunction with a financial statement audit, internal audit, or other form of attestation engagement.
IT audits are also known as automated data processing audits (ADP audits) and computer audits. They were formerly called electronic data processing audits (EDP audits).
An IT audit is different from a financial statement audit. While a financial audit's purpose is to evaluate whether the financial statements present fairly, in all material respects, an entity's financial position, results of operations, and cash flows in conformity to standard accounting practices, the purposes of an IT audit is to evaluate the system's internal control design and effectiveness. This includes, but is not limited to, efficiency and security protocols, development processes, and IT governance or oversight. Installing controls are necessary but not sufficient to provide adequate security. People responsible for security must consider if the controls are installed as intended, if they are effective, or if any breach in security has occurred and if so, what actions can be done to prevent future breaches. These inquiries must be answered by independent and unbiased observers. These observers are performing the task of information systems auditing. In an Information Systems (IS) environment, an audit is an examination of information systems, their inputs, outputs, and processing.
The primary functions of an IT audit are to evaluate the systems that are in place to guard an organization's information. Specifically, information technology audits are used to evaluate the organization's ability to protect its information assets and to properly dispense information to authorized parties. The IT audit aims to evaluate the following:
Will the organization's computer systems be available for the business at all times when required? (known as availability) Will the information in the systems be disclosed only to authorized users? (known as security and confidentiality) Will the information provided by the system always be accurate, reliable, and timely? (measures the integrity) In this way, the audit hopes to assess the risk to the company's valuable asset (its information) and establish methods of minimizing those risks.
The most popular products in category IT Audit All category products
Suppliers IT Audit
Vendors IT Audit
F.A.Q. about IT Audit
What Is an IT Audit?
In the typical software audit, your system administrators will be asked to show that software is not illegally loaded onto machines it shouldn’t be on, that the number of licenses matches up with the number of users or, if you purchased a bulk license, that you don’t exceed the bounds of that license. One thing you definitely don’t want to happen is for an auditor to find that an employee has brought a home version of a software package and installed it on his or her work computer.
What Do Auditors Want?
In short, software auditors want to know that companies are following the rules with regard to software licenses. How much slack they’ll give you if they find a minor violation depends on several factors. If you can show your company makes a good-faith effort to stay on top of all software license requirements, it could act in your favor.
What Should We Do to Prepare for an IT Audit?
If you have a strong IT asset management program in place, preparation for an audit is far less stressful. When you can easily create reports showing the number of copies installed, the number of licenses, license expiration dates, and hardware where the software is installed, you can create those reports in advance and look for potential problems. If you notice discrepancies, you can take steps to correct them before the auditors arrive.
How Can We Do a Self-Audit Beforehand?
Performing periodic self-audits is not just busywork, but could potentially save your company a lot of money and embarrassment. The three main steps in a self-audit are: reading the vendor’s contract, gathering purchase information, and getting an accurate count of how many licenses are deployed:
- Read the Contract – Understand license types and models, including maintenance requirements. Learn if there are limitations on where the software can or cannot be used. For example, are you allowed to use it on laptops that travel outside the US?
- Gather Purchase Information – Know where to get your hands on purchase data. If you purchased from a reseller, make sure that the reseller passed on your purchase information to the vendor.
- Get an Accurate License Deployment Count – If your company has a solid IT asset management program, this shouldn’t be a challenge. Otherwise, you’ll need to manually locate receipts and serial numbers and match them up to the machines where the software is deployed.
The self-audit is much easier to do when you don’t have an actual audit staring you in the face.
Materials
Frequently Asked Questions About IT Audits
Laura Miller
https://blog.samanage.com/it-asset-management/frequently-asked-questions-about-it-audits/