Introduction
The constructs of compliance and auditing may vary depending upon industry and application. To begin this chapter on common ground, we will first take a brief look at exactly what compliance and auditing is, from a broad, more global perspective. In many instances throughout this book, the reader will encounter terms such as examiner and investigator. While auditing involves both the process of examination and investigation, there is both an operational as well as functional difference between the two processes.
Let’s start with some definitions of compliance and auditing.
- The definition of compliance is: ‘the action of complying with a command,” or “the state of meeting rules or standards.’ In the corporate world, it’s defined as the process of making sure your company and employees follow all laws, regulations, standards, and ethical practices that apply to your organization and industry 1
The definition of an audit is the process of evaluation or analysis of something to determine its accuracy. In the business world, auditing can be focused on financial, operational, or information technology:
There are also two main categories of auditing: internal and external.
The audit work performed by an auditor is different from the investigation work performed by cyber forensic professionals (see Table 1.1).
The remainder of this chapter will focus the reader’s attention on a review and examination of auditing and compliance and the rapidly growing field of cyber forensics.
As defined by UpGuard, Cyber forensics is a branch of forensic science focused on the recovery and investigation of material found in digital devices and cybercrimes. Throughout this book, cyber forensics, digital forensics, and computer forensics are used interchangeably.
As society increases reliance on computer systems and cloud computing, cyber forensics becomes a crucial aspect of law enforcement agencies and businesses. The reader interested in a deeper review of cyber forensics and cloud computer is directed to Chapter 4 and Ronald L. Krutz’s examination of the subject.
Table 1.1 Auditing vs. investigation comparison7| Basis for comparison | Auditing | Investigation |
|---|
| Meaning | The process of inspecting the books of accounts of an entity and reporting on it is known as Auditing. | An inquiry conducted for establishing a specific fact or truth is known as Investigation. |
| Nature | General Examination | Critical and in-depth examination |
| Evidences | The evidences are persuasive in nature. | The evidences are unquestionable; therefore, its nature is decisive. |
| Time Horizon | Annually | As per requirement |
| Performed by | Certified Public Accountant or Chartered Accountant | Experts |
| Reporting | General Purpose | Confidential |
| Obligatory | Yes | No |
| Appointment | An auditor is appointed by the shareholders of the company. | The management or shareholders or a third party can appoint investigator. |
| Scope | Seeks to form an opinion on financial statements. | Seeks to answer the questions that are asked in the engagement letter. |
Cyber forensics is concerned with the identification, preservation, examination, and analysis of digital evidence, using scientifically accepted and validated processes to be used in and outside of a court of law.
While its roots stretch back to the personal computing revolution in the late 1970s, cyber forensics began to take shape in the 1990s, and it wasn't until the early 21st century that countries like the United States began rolling out nation-wide policies.8
Addressed throughout this chapter will be a discussion of a cyber forensics event timeline, relevant laws, and regulations along with applicable cyber forensic policies and procedures. Equally important will be a review and discussion of best practices for cyber forensics compliance, along with cyber forensic certifications.
By the end of this chapter, we will examine the role of audit in cyber forensics and using cyber forensics proactively to mitigate fraud.
