Information Technology (IT) Audit & Advisory Services

Why this topic matters

Certified public accountants (CPAs) increasingly deliver information technology (IT) audit and advisory services — supporting financial statement audits, testing internal control, assessing cybersecurity, and reviewing system implementations. Information Systems and Controls (ISC) tests the types of engagements, how IT is audited, how data used as evidence is validated, and the independence limits on advisory work.

Types of IT engagements

Engagement	Purpose	Standards and output
IT audit in support of a financial statement audit	Understand the IT environment; test IT general controls (ITGCs) and automated controls the audit relies on	Generally accepted auditing standards (GAAS) or Public Company Accounting Oversight Board (PCAOB) standards; supports the audit opinion
Integrated audit of internal control over financial reporting (ICFR)	Test IT controls as part of the opinion on ICFR for public companies	PCAOB Auditing Standard 2201
System and Organization Controls (SOC) examinations	Report on a service organization's controls	Attestation standards; SOC 1, 2, 3 reports
Cybersecurity risk assessment or program review	Evaluate security posture against a framework	Consulting standards, or a SOC for Cybersecurity examination if assurance is needed
Pre- and post-implementation reviews	Assess controls, data conversion, and project governance for a new system	Consulting
Data analytics and forensic technology	Analyze full populations, investigate fraud	Consulting or part of an audit
Agreed-upon procedures on IT matters	Report findings on specific procedures	Attestation standards (findings only)

Planning an IT audit

1. Understand the business and how technology supports it: key applications, databases, operating systems, networks, cloud services, interfaces, and service providers.
2. Identify risks arising from the use of IT — unauthorized access, unauthorized changes, inappropriate manual overrides, data loss, interface failures.
3. Identify the relevant controls — ITGCs and application controls — and decide which to test based on reliance and risk.
4. Determine the use of IT specialists and data analytics, and coordinate with the financial audit team.

Auditing approaches

• Auditing around the computer: compare inputs with outputs without testing the processing — acceptable only for simple, well-documented systems.
• Auditing through the computer: test the processing itself — test data, integrated test facilities, parallel simulation, and review of program logic and configurations.
• Auditing with the computer: using data analytics and generalized audit software to analyze whole populations.

Testing controls

• ITGCs: sample user provisioning, terminations, access reviews, changes, and backup jobs across the period (see the IT General Controls topic).
• Automated application controls: inspect the configuration and perform a test of one (or a few) transactions, supported by effective ITGCs; later years may use benchmarking.
• IT-dependent manual controls: a manual review of a system report depends on the report being complete and accurate — test both the manual review and the report.

Validating data used as evidence

Information produced by the entity (IPE) — system reports and data extracts — must be tested for completeness and accuracy before relying on it:

• Test the report logic (parameters, queries) or obtain assurance through ITGCs over the report.
• Reconcile totals to the general ledger; check record counts to the source.
• Observe the extraction, or extract data independently.
• For data analytics, document data sources, transformations, and how the data set was validated.

Frameworks and professional standards

• Control Objectives for Information and Related Technologies (COBIT) 2019 — governance and management objectives for enterprise IT.
• The Information Systems Audit and Control Association (ISACA) IT Audit Framework — standards and guidance for IT audit professionals.
• National Institute of Standards and Technology (NIST) Cybersecurity Framework and Special Publication 800-53 for security assessments.
• The American Institute of Certified Public Accountants (AICPA) Statement on Standards for Consulting Services governs advisory engagements: competence, due care, planning and supervision, sufficient relevant data, a client understanding, and communicating significant reservations.

Independence and advisory services

• For attest clients, the AICPA independence rules allow many IT advisory services if the client makes all management decisions, designates a competent overseer, and the understanding is documented. But designing, developing, or implementing a financial information system for an attest client, or operating its network or controls, generally impairs independence (a self-review threat and management participation).
• For issuer audit clients, the Sarbanes-Oxley Act prohibits financial information systems design and implementation services outright.
• The auditor may evaluate and recommend improvements to controls without impairing independence — as long as management decides and implements.

Reporting results

• IT audit findings are communicated with the condition, criteria, cause, effect (risk), and recommendation.
• In a financial audit, deficiencies are evaluated for severity (deficiency, significant deficiency, material weakness) and communicated appropriately.
• Advisory reports go to the client for management's decisions and are usually restricted.

How it is tested

• Match an objective to an IT engagement type and standard.
• Choose between auditing around, through, and with the computer.
• Identify how to test the completeness and accuracy of IPE.
• Decide whether an IT service impairs independence.