IT Internal Audit Service

IT Internal Audit is a practice governed by the Board of Directors Committee to ensure that the information systems environment safeguards information system assets while maintaining data integrity, availability, and confidentiality.

These measures ultimately support business resilience, the achievement of objectives, and the quality of financial statements concerning shareholders and stakeholders.

What is an IT Audit?

IT Internal Audit can be defined as a systematic function used to examine a business entity’s information systems environment independently. This includes reviewing and evaluating data and information related to implemented information systems, practices, and operations against international IT standards and approved policies and procedures. On a test basis, the aim is to provide reasonable assurance regarding the effectiveness of the controls used over these resources, safeguarding assets, and maintaining data availability, integrity, and confidentiality.

What are the standards that govern internal audits of information technology?

While internal audit activity is governed by standards issued by the Institute of Internal Auditors (IIA), the IIA also refers to specialized standards for IT Internal Audit published and governed by the Information Systems Audit and Control Association (ISACA).

ISACA has published information system audit standards, along with a set of guidelines, which include:

• COBIT® 2019: A business framework to govern enterprise technology.
• The Cybersecurity Nexus (CSX): A holistic cybersecurity resource.
• Tools and Techniques: Resources that assist in creating relevant IT audit programs.

Who are the best specialists for performing an internal IT audit?

IT internal auditors are best positioned to perform the IT internal audit function. They are generally responsible for providing reasonable assurance and consulting activities on internal controls and risk management associated with a business entity’s IT environment. This includes identifying weaknesses in the existing IT systems and providing recommendations and findings to help prevent security breaches.

What are the Relevant Certifications for IT Auditors?

There are several certifications for IT internal auditors; a few examples would be:

• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)

What is The Audit Procedure Like for the IT Internal Audit Process?

According to the Information Systems Audit and Control Association (ISACA), the typical audit process for an internal IT audit consists of three major phases: Planning, fieldwork/documentation, and reporting/follow-up. Each phase in the IT internal audit process is further divided into key steps to plan, define, perform, and report the results of the engagement in accordance with IT audit standards. However, business entities may choose to break down the main phases into multiple stages and activities based on their perspectives.

What is the Scope of an IT Internal Audit?

The scope of an IT internal audit consists of five main activities:

1. Understand and confirm the information systems control environment under audit.
2. Perform interviews, walkthroughs, and documentation reviews.
3. Assess the appropriateness of the existing information systems control environment.
4. Validate existing information systems controls and assess their effectiveness.
5. Develop and deliver IT audit reports to management.

What are the Domains Under the Scope of the IT Audit?

Five main domains are reviewed in IT internal audit:

1. Governance and Management of IT
2. Information Systems Acquisition, Development, and Implementation
3. Information Systems Operations and Business Resilience
4. Protection of Information Assets
5. Emerging Technological risks

What are the key IT controls considered by internal IT auditors?

Governance and Management of IT:

• Governance of Enterprise IT
• Information Systems Strategy
• Maturity and Process Improvement Models
• IT Investment and Allocation Practices
• Policies and Procedures
• Risk Management
• Information Technology Management Practices
• IT Organizational Structure and Responsibilities
• Business Continuity Planning

Information Systems Acquisition, Development, and Implementation:

• Project Management Structure
• Project Management Practices
• Business Application Development
• Virtualization and Cloud Computing Environments
• Business Application Systems
• Development Methods
• Infrastructure Development/Acquisition Practices
• Information Systems Maintenance Practices
• System Development Tools and Productivity Aids
• Process Improvement Practices
• Application Controls

Information Systems Operations and Business Resilience:

• Information Systems Operations
• IT Asset Management
• Information System Hardware
• Information Systems Architecture and Software
• Information Systems Network Infrastructure
• Disaster Recovery Planning

Protection of Information Assets:

• Information Security Management
• Logical Access
• Network Infrastructure Security
• Environmental Exposures and Controls
• Physical Access Exposures and Controls
• Mobile Computing
• Peer-to-Peer Computing
• Instant Messaging
• Social Media
• Cloud Computing
• Data Leakage
• End-user Computing Security Risks and Controls

How Can an IT Audit Help Your Business Entity?

• Ensure compliance with standards and applicable regulatory requirements.
• Enhance stakeholders’ confidence in the reliability of IT systems, ensuring continuity of services.
• Proactively manage risks associated with existing information systems.
• Improve overall business performance and provide a competitive advantage.

Why Baker Tilly?

Its specialized professional experience distinguishes Baker Tilly Kuwait and offers the following characteristics that provide added value to our clients:

• A global consulting firm operating in the State of Kuwait.
• World-class laboratories equipped with state-of-the-art tools for IT risk assessment.
• Updated databases of automated systems, enabling IT internal audits for any technology environment adopted by clients.
• Local experience supported by a global network of highly qualified IT internal audit experts.