IT Governance, Risk, and Compliance


March 25, 2010  8:25 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part V



Posted by: Robert Davis
AICPA, American Institute of Certified Public Accountants, Assurance Service, Attestation, Audit Report, Evidence, Follow-up Procedures, IFAC, Information Systems Audit and Control Association, International Federation of Accountants, ISACA, IT Audit, Procedures, Project Management, The IIA, The IIC, The Institute for Internal Controls, The Institute of Internal Auditors

IT audit area follow-up takes into account the materiality of reported findings and the impact if corrective action is not taken. As particulars, follow-up nature, timing and extent are dependent on audit materiality and control criticality. IT audit follow-up nature represents the type of procedures that will be performed considering predetermined risk associated with an auditable unit. IT audit follow-up timing confers when a procedure will be performed. Whereby, IT audit follow-up extent conveys the amount and/or range to be assessed. In relation to these defined considerations, audit materiality typically reflects monetary magnitude relative to other assets; while control activity criticality infers the assessed item impact magnitude relative to other risks.

View Part I of the IT Audit Follow-up: Assessing Recommendation Resolution series here

March 22, 2010  6:29 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part IV



Posted by: Robert Davis
AA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement Letter, Evidence, Finding Form, Follow-up Activities, Information Technology, IT Audit, Project Management, Reporting

Depending on the ambit and terms of the engagement, external IT auditors may rely on an entity’s internal IT audit function to follow-up on their agreed-upon recommendations. Hence, a follow-up process should be established by the entity’s internal IT audit function to monitor, and ensure, managerial actions have been effectively implemented or senior management has accepted the risk of not taking action. Responsibility for these follow-up activities should be defined in the audit charter and/or engagement letter to enable proper consideration by clients.

View Part I of the IT Audit Follow-up: Assessing Recommendation Resolution series here


March 18, 2010  5:33 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part III



Posted by: Robert Davis
AICPA, American Institute of Certified Public Accountants, Assurance Service, Attestation, Audit Report, CA, CIA, CICA, CISA, CITP, CPA, Evidence, Follow-up Procedures, IFAC, Information Systems Audit and Control Association, International Federation of Accountants, ISACA, IT Audit, Management Response, Project Management, The IIA, The IIC, The Institute for Internal Controls, The Institute of Internal Auditors

IT auditor follow-up activities has been defined “as a process by which they determine the adequacy, effectiveness and timeliness of actions taken by management on reported engagement observations and recommendations, including those made by external auditors and others“. Therefore, a follow-up process is established to enable reasonable assurance that each audit conducted by an IT auditor provides optimal benefit to the entity; through requiring that approved suggestions arising from audits are implemented in accordance with management’s intentions for the undertakings or that management recognizes and acknowledges the risks inherent in delaying, or not implementing, proposed solutions.

View Part I of the IT Audit Follow-up: Assessing Recommendation Resolution series here


March 15, 2010  4:40 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part II



Posted by: Robert Davis
AICPA, American Institute of Certified Public Accountants, Assurance Service, Attestation, Audit Report, Evidence, Follow-up Procedures, IFAC, Information Systems Audit and Control Association, International Federation of Accountants, ISACA, IT Audit, Procedures, Project Management, The IIA, The IIC, The Institute for Internal Controls, The Institute of Internal Auditors

If management’s proposed actions to implement or otherwise address reported recommendations have been discussed with, or provided to, an IT auditor; designed remedial actions should be recorded as a management response in a final IT audit report. Whether an IT auditor is engaged in external or internal reporting; after formal audit results communication, follow-up is commonly the next IT audit process phase. Procedurally, after distributing the final audit report — with findings, recommendations and client responses — the IT auditor should request and evaluate relevant information to conclude whether appropriate actions have been taken by management in a timely manner for all documented findings included in the final audit report. However, IT audit follow-up activities can be an extension of an engagement or a separate engagement, and may only include agreed-upon procedures.

View Part I of the IT Audit Follow-up: Assessing Recommendation Resolution series here


March 11, 2010  7:41 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part I



Posted by: Robert Davis
AICPA, American Institute of Certified Public Accountants, Assurance Service, Attestation, Evidence, Follow-up Procedures, IFAC, Information Systems Audit and Control Association, International Federation of Accountants, ISACA, IT Audit, Procedures, Project Management, The IIA, The IIC, The Institute for Internal Controls, The Institute of Internal Auditors

While management is responsible for addressing assurance engagement findings and recommendations as well as tracking resolution status; audit is responsible for establishing policies, procedures, standards and rules for follow-up to determine whether previous findings and recommendations are adequately addressed as well as considered in planning future engagements. In this matter, IT auditors should comply with generally accepted audit follow-up procedures addressing the risks ordinarily associated with the audit area. Contextually, an appropriate amount of follow-up is necessary to assure the effectiveness of the corrective action process and to reestablish confidence in the item or service assessed. Therefore, the audit follow-up process normally includes carrying out sufficient, timely follow-up procedures to verify that management actions address weaknesses promptly.


March 8, 2010  9:40 PM

IT Audit Reporting: Communicating Results – Part VIII



Posted by: Robert Davis
AA, AICPA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Evidence, IFAC, Information Criteria, ISACA, Project Management, Reporting, The IIA, The IIC

IT auditors, like all auditors, are responsible for ‘communicating results to interested individuals.’ Interested individuals can include other members of the audit team, who must integrate the IT auditor’s findings with other aspects of the audit, as well as the client. Commonly, the audit purpose for reporting results is providing constructive feedback to management. However, in many cases, management personnel reviewing the audit report are not completely knowledgeable of the audit area’s IT services and associated terminology. For this reason, IT audit reports should be written to accommodate the lowest expected expertise level. Where readability risk is marginalized, IT audit reports will typically be readily received when they create managerial awareness regarding generally accepted information criteria (effectiveness, efficiency, confidentiality, integrity, availability, reliability and/or compliance) and induce corrective actions for detected control system weaknesses.

View Part I of the IT Audit Reporting: Communicating Results series here


March 4, 2010  6:48 PM

IT Audit Reporting: Communicating Results – Part VII



Posted by: Robert Davis
AA, AICPA, Assurance Service, Attestation, Audit Assurance, Audit Charter, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement Letter, Evidence, IFAC, ISACA, IT, IT Audit, PM, Project Management, Reporting, The IIA, The IIC

Upon acknowledgement of final audit report delivery to identified recipients, the IT auditor should await responses from key audit area personnel, as stipulated in the entity’s audit charter or engagement letter. Once all client responses have been received or the stated response deadline has been reached, the IT auditor should distribute the final audit report to appropriate personnel, thus concluding the IT audit reporting phase.

View Part I of the IT Audit Reporting: Communicating Results series here


March 1, 2010  6:41 PM

IT Audit Reporting: Communicating Results – Part VI



Posted by: Robert Davis
AA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement, Evidence, IFAC, Information Technology, ISACA, IT, IT Audit, PM, Project Management, Reporting, The IIA, The IIC

The final audit report should clearly identify ‘gaps’ in controls and the source of the vulnerabilities. Of the potential vulnerabilities documented in the audit report, it is importance to identify any significant, or material, risks. It must also include recommendations to address the issues identified. Lastly, the executive summary of the final audit report must elaborate on the ‘state of controls’ within the audit area. In particular, weaknesses need to be clearly communicated to enable management by exception.

View Part I of the IT Audit Reporting: Communicating Results series here


February 25, 2010  7:56 PM

IT Audit Reporting: Communicating Results – Part V



Posted by: Robert Davis
Assurance Service, Attestation, Audit Assurance, Audit Opinion, Engagement, Evidence, IT Audit, Project Management, Reporting

Once the draft audit report is generated, it must be reviewed by key IT managers as well as key business managers. To facilitate this essential audit activity, the IT auditor can contact selected key audit area personnel for scheduling a ‘closing conference.’ This conference provides an opportunity to review the audit process, discuss concerns, and modify audit report responses. Thus, conference attendees adjourn with a collective understanding of the final audit report’s content.

View Part I of the IT Audit Reporting: Communicating Results series here


February 22, 2010  6:13 PM

IT Audit Reporting: Communicating Results – Part IV



Posted by: Robert Davis
AA, AICPA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement, Evidence, Finding Form, IFAC, IS Audit, ISACA, IT Audit, PM, Project Management, Reporting, The IIA, The IIC

Generally, following audit area findings assessment completion and ensuring appropriate working papers retention, an IT auditor documents the draft audit report based on auditing standards and guidelines. Subsequently, the draft audit report is typically submitted for approval by the next higher audit management level. Specific organization, intended recipients, and any circulation restrictions should be identified in this draft audit report.

View Part I of the IT Audit Reporting: Communicating Results series here


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: