Glossary term
IT Audit
Subject: Governance, Internal Control and Audit
Also known as: Information Systems Audit, IS Audit
An IT audit is an independent review of an entity's information systems, infrastructure and related processes, to judge whether technology risks are controlled and systems support accurate, secure and reliable operations.
Explanation
IT auditors look at how technology is governed and run. Common areas are access management, change control, backup and recovery, system operations, cyber security, third-party and cloud services, and the controls built into applications. Their work falls into two broad types: general controls, which apply across systems, and application controls, which sit inside a particular application such as payroll or a payments engine. Auditors review policies, test configurations, sample access and change records and sometimes use software to analyse whole data sets. A financial statement audit also draws on IT work, because reported numbers depend on the systems that produce them. Findings are rated and tracked like any other audit finding. Frameworks such as COBIT guide scope and criteria. Because nearly every business process now runs on systems, a weak technology control can undo controls elsewhere.
Example
A hospital group audits its patient billing system. The IT audit team finds that former staff accounts remain active, that developers can push changes straight into the live system, and that backups have never been test-restored. It rates the findings and agrees dates with the technology head for each fix.
Not to be confused with
- Penetration testing
- A penetration test tries to break into systems to find weaknesses. An IT audit assesses whether controls and governance are designed and working.