5.3System Audit and Internal Control

A system audit is the activity of evaluating, from an independent third-party standpoint, whether an information system is properly controlled in line with an organization's objectives. On the AP exam, the role of each stage of the audit process, internal control (especially the distinction between IT general controls and application controls, and segregation of duties), and auditor independence (the prohibition on self-audits) are recurring topics tested for understanding.

5.3.1The audit process and audit evidence/techniques

• The system audit process proceeds through four stages: audit planning (defining scope, audit items, and schedule) -> execution (gathering and evaluating evidence) -> reporting (reporting findings and improvement recommendations to management) -> follow-up (confirming afterward whether findings were corrected). The key point is that the audit cycle is only complete once follow-up is included.
• Audit evidence must satisfy both sufficiency (quantity--an adequate volume of support) and appropriateness (quality--high quality as evidence, meaning relevance and reliability). A large volume of low-quality evidence alone is not adequate grounds for an audit opinion. Audit techniques--interviews (questioning people), document review (examining regulations and records), on-site inspection (physical inspection of the site), and CAAT (Computer-Assisted Audit Techniques) (mechanically analyzing logs/data with tools or software)--are combined as fits the purpose.