Information Technology (IT) Audit & Advisory Services

Engagements

Information technology (IT) audit for financial statements · integrated audit of internal control · System and Organization Controls (SOC) examinations · cybersecurity assessments · implementation reviews · analytics and forensics · agreed-upon procedures.

Approaches

Around the computer (inputs vs outputs) · through (test processing: test data, integrated test facility, parallel simulation) · with (analytics on full populations).

Testing

• IT general controls (ITGCs): sample across period.
• Automated controls: test one + ITGCs; benchmarking later.
• IT-dependent manual controls: test the review and the report.
• Information produced by the entity (IPE): completeness and accuracy — logic, reconciliations, record counts.

Independence

Designing or implementing an attest client's financial system → impaired. Issuers: prohibited by the Sarbanes-Oxley Act (SOX). Recommending is fine; management decides.

Frameworks

Control Objectives for Information and Related Technologies (COBIT) 2019 · National Institute of Standards and Technology (NIST) · consulting standards.

Exam traps

• Auditing "around the computer" ignores processing — acceptable only for simple systems with a clear audit trail.
• When running test data through the client's program, confirm it's the version actually used in production.
• Benchmarking an automated control relies on change management having been effective all year.