5.5System Auditing

System auditing is the activity of verifying, from a standpoint distinct from those who build and operate a system, whether an information system is properly established and operated in line with the organization's goals. The focus here is the audit's pattern of "who verifies what, based on what evidence, and how," together with the concepts of internal control and independence that make an audit meaningful in the first place.

5.5.1The audit process, audit evidence, and audit techniques

• The system audit process proceeds as: audit planning (defining scope, audit items, and schedule) -> execution (collecting and evaluating evidence) -> reporting (reporting the results to management and others as an audit report) -> follow-up (confirming afterward whether the findings have been corrected).
• Audit evidence is the objective supporting material an auditor uses to reach a conclusion (meeting minutes, logs, forms, configuration files, and so on). Because the auditor forms an audit opinion based on this evidence, both sufficiency (quantity) and appropriateness (quality) of the evidence are required.
• Audit techniques are the concrete methods for gathering evidence. Interviews question the people responsible. Document review (checklist method) examines regulations, manuals, and similar documents. On-site inspection (observation) visits the actual work site to confirm conditions. Computer-assisted audit techniques (CAAT) use tools and software to analyze logs and data. Multiple techniques are combined depending on the purpose and target.

5.5.2Internal control, auditability, and auditor independence

• Internal control refers broadly to the mechanisms an organization establishes and operates to achieve goals such as the propriety and effectiveness of operations, the reliability of financial reporting, and compliance with laws and regulations. IT controls are the portion of internal control relating to IT (information systems), broadly divided into general controls (controls common to the whole system, such as access management and change management) and application controls (controls built into individual business systems, such as input checks).
• Segregation of duties is a representative internal control mechanism that splits work across multiple people or roles so that authority and tasks do not concentrate in a single person. For example, making the "requester" of a transaction and its "approver" different people ensures that fraud or error cannot be completed by one person alone. Because concentrated authority raises the risk of fraud, segregation of duties is broadly required across both IT controls and business controls.
• Auditability is the property of how easily a system supports being audited (evidence collection and verification). A system is considered more auditable the more thoroughly its logs are recorded and the more traceable its processing is. Independence of the auditor refers to the auditor being in a position independent from the operations/organization under audit, able to evaluate objectively without being tied to a conflicting interest. An auditor auditing something they themselves developed or operate (self-audit) undermines independence and should be avoided.

Take a system audit of a company's expense reimbursement system as an example of how the process flows. At the audit planning stage, the auditor sets "whether fraud-prevention controls function in the expense approval process" as an audit item and decides the scope and schedule. What matters here is who is selected as auditor: if the very engineer who developed this system became the auditor, that would be a self-audit, undermining independence, so a different person uninvolved in development or operations is chosen as auditor instead. At the execution stage, multiple audit techniques are combined to gather evidence. First, the expense approval regulations are checked via document review to confirm the rule "the requester and approver must be different people" is actually written into the regulations as an instance of segregation of duties. Next, an interview with expense-accounting staff asks whether actual operations follow the regulations as written. Further, computer-assisted audit techniques (CAAT) are used to analyze the system's logs, mechanically detecting "any transaction where the same person served as both requester and approver." If the investigation turns up a number of transactions, during one particular period, that were processed with the approver field left blank, that becomes a serious finding: the segregation-of-duties control had become hollowed out in practice. In this case, the problem could be detected precisely because the log accurately recorded and made traceable the requester, approver, and timestamp of every transaction--a reflection of the system's high auditability. At the reporting stage, this finding and an improvement recommendation (such as a system change making the approver field mandatory) are compiled into an audit report and reported to management, and at the subsequent follow-up stage, whether the system change was actually made and segregation of duties restored to functioning is reconfirmed, completing the audit cycle.

5.5.3Section summary

• System audit process = planning -> execution -> reporting -> follow-up. Audit evidence needs both sufficiency (quantity) and appropriateness (quality)
• Audit techniques = interviews, document review, on-site inspection, and CAAT (mechanical log/data analysis), combined as fits the purpose
• Segregation of duties = splitting authority/tasks to prevent fraud/error (a representative example of IT control). Auditor independence = an objective standpoint independent from the audited target (self-audit is not allowed)