Information Technology Control and Audit, Fifth Edition

Angel R. Otero

• Publisher: Auerbach Publications
• Year: 2018
• Print ISBN: 9780367657154
• eBook ISBN: 9780429877322
• Edition: 5
• Topic: Business
• Subtopic: Information Management
• Index: Business

The new fifth edition of Information Technology Control and Audit has been significantly revised to include a comprehensive overview of the IT environment, including revolutionizing technologies, legislation, audit process, governance, strategy, and outsourcing, among others. This new edition also outlines common IT audit risks, procedures, and involvement associated with major IT audit areas. It further provides cases featuring practical IT audit scenarios, as well as sample documentation to design and perform actual IT audit work. Filled with up-to-date audit concepts, tools, techniques, and references for further reading, this revised edition promotes the mastery of concepts, as well as the effective implementation and assessment of IT controls by organizations and auditors.

For instructors and lecturers there are an instructor's manual, sample syllabi and course schedules, PowerPoint lecture slides, and test questions. For students there are flashcards to test their knowledge of key terms and recommended further readings. Go to http://routledgetextbooks.com/textbooks/9781498752282/ for more information.

Appendix 1: IT Planning Memo

Memo

Date:	[Date]
To:	The Financial Statement Audit File
From:	[IT Auditor Representative], [Office Location]
Subject:	IT Audit Planning

Purpose

The purpose of this memo is to outline the procedures associated with the involvement of the Information Technology Auditors (“IT Auditors”) in connection with the financial statement audit (“financial audit”) of [company name] ([“company abbreviated name” or “the Company”]) for the year [ending or ended] [Month XX, 20XX]. The approach for the IT audit outlined herein serves as a supplement to the financial audit planning memorandum and should be reviewed in conjunction with such working paper.

Planning Discussions

(The planning meeting between the financial audit team and the IT audit team should be documented in this planning memo. Modify the sections below as applicable.)

As detailed in the working paper [working paper reference number], a discussion with the financial audit Partner, Principal, or Director was held to determine the level of IT audit involvement. (If an IT auditor has already been involved in the audit, describe previous involvement and/or any relevant planning discussions herein.) During this planning meeting, risk assessments of areas to be addressed were also discussed along with the nature, extent, and timing of planned tests of controls described further in this planning memo.

IT Audit Team

The IT audit team will consist of the following:

Role	Name
Partner, Principal, or Director
Manager or Senior Manager
Senior
Staff

Timing

Timing of the IT audit work is scheduled as follows:

1. Planning (starting [MM/DD/YY], ending [MM/DD/YY])
2. Interim (starting [MM/DD/YY], ending [MM/DD/YY])
3. Year end (starting [MM/DD/YY], ending [MM/DD/YY])
4. Sign-off date ([MM/DD/YY])

Hours

Hours and costs are based on the estimated time required to complete the IT audit procedures and the level of experience required. Detailed IT audit procedures have been planned with the financial audit team, including discussions regarding the necessary documentation and assistance to be provided by the Company to facilitate the effective and efficient performance of the procedures.

It is estimated that the IT audit procedures will take [##] hours to complete.

The hours incurred are to be charged to: [Company charge code/number].

During the course of the IT audit, circumstances encountered that could significantly affect the performance of such audit procedures will be promptly notified to the financial audit team and Company personnel, as appropriate, including any additional hours resulting from such circumstances.

Understand the IT Environment

Meetings with Company personnel will take place in order to gather or update the existing understanding of the IT environment, including significant changes from the prior year. This understanding will be considered as part of the planning process and documented in working paper [working paper reference number].

Relevant Applications and Technology Elements

As agreed with the financial audit team, applications are classified as relevant to the audit when they:

• are used to support a critical business process (e.g., revenues, expenditures, payroll, etc.)
• have information generated by the organization (IGO) that is significant for a financial audit test procedure or in the context of any internal controls, such as information used to test a relevant control activity or information used by the Company to perform the control activity
• include application or automated control activities that have been identifying as addressing significant financial audit risks

Relevant applications and their related technology elements have been identified on the following table or documented at [working paper r...

Table of contents

• Cover
• Title Page
• Copyright Page
• Dedication
• Contents
• Preface
• Acknowledgments
• Author
• Section I Foundation for It Audit
• Section II Planning and Organization
• Section III Auditing It Environment
• Appendix 1: IT Planning Memo
• Appendix 2: Understanding the IT Environment
• Appendix 3: Sample IT Audit Programs for General Control IT Areas
• Appendix 4: ACL Best Practice Procedures for Testing Accounting Journal Entries
• Appendix 5: IT Risk Assessment Example Using NIST SP 800-30
• Appendix 6: Sample Change Control Management Policy
• Appendix 7: Sample Information Systems Operations Policy
• Appendix 8: Auditing End-User Computing Groups
• Appendix 9: Recommended Control Areas for Auditing Software Acquisitions
• Appendix 10: Glossary
• Index