TIAPS Module 1 Audit and Assurance workbook

Risk management techniques can be applied to IT risks although specialist frameworks and
standards have been developed to define best practices and reflecting the complexity of the
area. IT is subject to rapid development and service users (including staff to operate
systems supported by IT) are likely to have high expectations. Customer online experiences
of companies like Amazon reduce our tolerance of anything less effective or user-friendly.
Internal auditors are expected to account for IT risks in every engagement.
Standard 2110 – Governance
2110.A2 The internal audit activity must assess whether the information technology
governance of the organization supports the organization’s strategies and objectives.
Standard 2120 – Risk Management
2120.A1 The internal audit activity must evaluate risk exposures relating to the
organization’s governance, operations, and information systems.
Standard 2130 – Control
2130.A1 The internal audit activity must evaluate the adequacy and effectiveness of
controls in responding to risks within the organization’s governance, operations, and
information systems. 64
Internal auditors should identify IT risks within audits and evaluate the effectiveness of
management responses to them. There should be appropriate expertise to enable the
internal audit function to consider all IT risks, although not all auditors need to be specialists.
Where the expertise is lacking within the team, the head of the function will need to draw on
other sources to provide the desired level of assurance to senior management and the
governing body. A risk management framework such as COSO Internal Control – Integrated
Framework may be used to support auditors in developing audit objectives and plans,
undertaking testing and analysis, and formulating conclusions. Specialist standards may also
be used to guide the work of internal audit and serve as a benchmark for expected practice.
There are two main classes of IT controls namely general controls and application controls.
General controls operate at the most fundamental level and work to ensure the integrity of IT
outputs. Application controls are fully automated and are designed to ensure correctness of
processing throughout the system.
64
The International Professional Practice Framework, The Institute of Internal Auditors, 2016
65