IT - Information Systems Auditing

Information systems auditing
Outlook - December 31, 2000

Larry Russell
The AICPA has established information technology credentials for CPAs. This
accreditation will be granted to CPAs involved in information technology strategic
planning, implementation, management and business strategies. Information
systems audits are designed to discover where a system may fail and have a
material effect on the company's operations. There are 5 distinct audit areas:
1. hardware
2. software
3. documentation
4. system environment, and
5. security.
Information system audit skills do not require a computer science degree.

Anyone with network management experience and auditing experience can
perform these tasks. Most CPA firms, with in-house network systems, already
have the talent available.
Turn Potential System Failures Into Success
Y2K taught us a valuable lesson about preparing for technology related problems
because companies that didn't prepare for the millennium calendar change were
subject to a variety of business snafus. Yet Y2K was easy because we knew
what the problem was and when it would hit. This doesn't really compare to other
potential devastating failures in any given information system. Hardware failures,
bad software, viruses, natural disasters, theft or vandalism can cause a
company's financial ruin. It is not just system failures that cause damage,
undetected bad data can have the same effect. Financial statement reporting is
more dependent on technology than ever before and this dependency will
continue to grow. E-commerce, electronic trading, virtual private networking and
telecommunications are opening new portals for financial information, and at the
same time are increasing the risk of disseminating inaccurate financial
information and security breaches. Our profession will be called upon more and
more to provide independent appraisals on the internal controls related to these
new paradigms. We can either hide from this responsibility or embrace a new
market for our services.
Information system auditors
The AICPA recognizes this new product potential and has established
information technology credentials for CPAs. The accreditation will be granted to
CPAs involved in information technology strategic planning, implementation,
management and business strategies. It is a broad-based credential available to
CPAs with a wide range of skill levels in all disciplines. It is a program for CPAs
who act as the bridge between an organization's management and technology
experts.
Currently we are required to evaluate a client's information system within the

contexts of the study and evaluation of internal controls (SAS 55). Practically,
most auditors sidestep the client's computers and audit around the systems. Not
only are auditors closing their eyes to potentially devastating contingent liabilities,
they also are missing an opportunity to offer value-added services that provide
feedback on information systems. Our clients have nowhere to turn to get a third-
party evaluation of their information system operations that is fair and
independent.
Procedures for information audits are not that technical. The primary skill set is
the same as the basics of financial audit requirements: discovering information,
evaluating the data and drawing conclusions based on experience. All auditors
have these skills, but they may not yet have the confidence in evaluating non-
financial data.
The audit
Information system audits are designed to discover where a system may fain and
have a material effect on the company's operations. There are five distinct audit
areas: hardware, software, documentation, system environment, and security.
A hardware review evaluates the structure of the system fileservers,

workstations, network hubs, wiring, communication devices, laptops, printers and
peripherals. Software evaluations cover operating systems, critical applications,
licensing, upgrade policies, user training, standardization and more.
Documentation covers the details of system components, log files, disaster
recovery plans and user policies. A system environment review entails critical
system functions, management attitudes, training policies, key technology
personnel, information system budgeting and other system requirements.
Security examines access controls, passwords, internal controls on key
applications and backup systems.
Example of issues regarding hardware include: fileserver integrity, hard drive

space, amount of RAM, processor speed, drive partition information and
operating system versions. The auditor also must assess the risk of the server
going down, as well as: Does the server have enough capacity? Is the
performance adequate for the environment? Should the operating system be
upgraded to the latest service release? Are there any incompatible elements
embedded in the system? Is data storage optimized for access speed and end-
user ease of use?
Software examination explores: critical applications; number of licensed
concurrent users; version levels; interaction with other applications; where and
how applications are executed; input and output controls; database structure;
and level and type of support by the software vendor. Conclusions the auditor wil
make regarding software may include whether or not: users are adequately
segregated by functions within accounting and operation applications; there are
an appropriate number of software licenses; for multiple installed applications,
such as Microsoft Office, are the versions consistent; data is stored in a logical,
secure and easy access format; and application service patches are up-to-date?
Documentation auditing validates that the client is proactively planning for

contingencies. System documentation and disaster recovery plans are critical in
case of disasters where portions or even all of an information system needs to be
rebuilt. Log tiles record information about system errors, intruder access
attempts, nightly backup status and e-mail glitches. These logs are early warning
systems and should be reviewed regularly. Written policies, far computer users,
provide a defensible position against employee wrongdoing. It is a simple
procedure to verify that a client has adequate up-to-date documentation.
System environment review is, of course, one of the first steps in an information
system audit. The auditor needs to understand managements' attitude toward
their information system. Examples of questions to ask are: How much do they
depend on their system? What is the current technology budget? What is the
information system personnel's experience and educational background? Does
the company have adequate third-party tech support? Does the company
encourage continuing technologv education?
Security issues may be the most critical to a information system audit. Security
breaches can lead to severe damage. One disgruntled employee can go home,
dial into a system and completely destroy it with very little trace. In one situation,
an employee who was terminated deleted the password file on the Domain Name
Server and locked the company out of more than 800 PCs for a week. Are all
passwords changed regularly, especially the system administrator's? An auditor's
checklist would have uncovered this weak point and could have averted the
disaster, saving the company approximately 100 times the cost of the audit
engagement..
Experience required?
Information system audit requirements are fairly straightforward and can be

managed by running through an audit checklist. But technology experience is
needed to examine annlications on a system, check the integrity of a database or
review the network wiring diagram for communication bottlenecks. Still, these
skills do not require a computer science degree. Anyone with network
management experience and auditing experience can perform these tasks. Most
CPA firms, with in-house network systems, already have the talent available.
New people entering the profession are equipped with IT skills that can be
tapped for this type of work. And there are many old-timers among us who have
skills in accounting and technology.
Clients need information system audits. The demand will grow indefinitely The
accounting profession is looking for dif ferent revenue sources, and technology
already is an integral part of our practices-so why not combine the two? The next
generation of CPAs is looking for something more challenging than ticking and
tying. Why are you not doing information system audits?
Larry Russell, CPA, is the founder of AccounTec, an integrated accounting and

technology farm in Valencia, focusing on technology issues. He is a member of
the state Board of Directors and Technology Committee, and is also a director of
the Los Angeles Chapter.
Citation Details
Title: Information systems auditing

Author: Larry Russell
Publication: Outlook (Feature)
Date: December 31, 2000
Publisher: California Society of Certified Public Accountants
Page: 6-8

IT - Information Systems Auditing

Uploaded by

Copyright:

Available Formats

IT - Information Systems Auditing

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IT - Information Systems Auditing

Uploaded by

Copyright:

Available Formats

Information systems auditing

Outlook - December 31, 2000

Information system audit skills do not require a computer science degree.

Turn Potential System Failures Into Success

Information system auditors

Currently we are required to evaluate a client's information system within the

A hardware review evaluates the structure of the system fileservers,

Example of issues regarding hardware include: fileserver integrity, hard drive

Documentation auditing validates that the client is proactively planning for

Information system audit requirements are fairly straightforward and can be

Larry Russell, CPA, is the founder of AccounTec, an integrated accounting and

Title: Information systems auditing

You might also like