Information Systems Audit

1
Information Systems Audit
George Korah, FCA, DISA
2
Impact of Technology

• Any sufficiently advanced technology is
  indistinguishable from magic.
• -Arthur C. Clarke

3
Impact of Technology
Technology has affected each one of us in some
way or the other Debit Cards, Smart Cards, PDAs,
Online Banking, E-Commerce
4
Impact of Technology

• Internet has raised challenges like viruses,
  security and privacy that were never perceived
  earlier.
• Newer ways of business have evolved, yet the
  mechanism to effectively control or track these
  is yet to evolve.
• Some newer challenges are coming up because of
  technology taxation of e-commerce transaction
  to cite an example

5
Impact of Technology
Recent accounting scams in the US has confirmed
the belief of the skeptics of technology that
technology can help people commit irregularities
of massive proportions.
6
Whats the Future

• The trouble with our times is that the future is
  not what it used to be.
• -Paul Valery

7
Characteristics of Computerisation

• Nearly all companies that use computers soon
  become wholly dependent on them.
• Computers provide a vast range of opportunities
  for managements to develop and transform their
  businesses.

8
Characteristics of Computerisation

• The trouble is, these changes are non-reversible.
  There is no effective route back to an older way
  of doing things.
• Evidence in computers is very fragile.
  Admissibility in courts could be problematic if
  not handled correctly

9
Characteristics of Computerisation

• Newer hardware / software developments ensure
  that information technology remains a moving
  target
• Obsolescence ensures that people keep on
  investing in hardware / software

10
Characteristics of Computerisation

• Legal framework is yet to evolve to a mature
  level and is unable to keep pace with the speed
  of technology
• The challenge before auditors is how the
  electronic aspects of the information can be used
  as an advantage

11
Typical Characteristics of Computerisation

• Technology is dominated by two types of people
  those who understand what they do not manage, and
  those who manage what they do not understand.
• - Putt's Law

12
About ISA

• Our Age of Anxiety is, in great part, the result
  of trying to do today's jobs with yesterday's
  tools.
• - Marshall McLuhan

13
What is ISA?
Defined as the process of collecting evaluating
evidence to determine whether a computer system

• safeguards assets
• maintains data integrity
• allows organisational goals to be achieved
  effectively
• and uses Resources effectively

14
Consultancy Areas

• Environmental Physical Security
• Logical Access Security
• IT Enterprise Relationships
• Application Software Data Security

15
Consultancy Areas

• Identifying Automated Solutions
• Acquisition Maintenance Of Application Software
• Business Continuity Planning
• IT Strategic Planning

16
I. S. Assets at Risk

• Facilities
• Equipment
• Software
• Records Files
• Data Information

17
Threats to the Information System

• Power Loss
• Communication Loss
• Data Integrity Loss
• Accidental Errors
• Computer Virus

18
Threats to the Information System

• Abuse of access privileges by employees
• Attempted unauthorised system access by outsiders
• Theft or destruction of computing resource

19
Threats to the Information System

• Non Disaster downtime
• Natural Disasters
• Fire
• Earthquake
• Floods

20
A Change in the Auditors perspective
21
Possibility of Detection

• The important thing is not to stop questioning.
• -Albert Einstein

22
ISA Audit Procedures

• Obtain an understanding of existing Controls
• Testing the Controls
• Substantive tests of Transactions
• Substantive tests of balances or overall results

23
Control Defined

• A Control is a System that
• Prevents
• Detects
• Or Controls unlawful events

24
Types of Control

• Preventive Controls
• Detective Controls
• Corrective Controls

25
Knowledge

• Real knowledge is to know the extent of one's
  ignorance.
• -Confucius

26
Opportunities as an Information Systems Auditor

• Banks
• Major MNCs
• Large Consultancy Firms

27
Courses Available
Certified Information Systems Auditor(CISA)
www.isaca.org Information Systems Auditor
(DISA) www.icai.org
28
Thank You!