Information systems audit: IT risks, protection and the audit process

A Lagos retailer's online orders vanish for six hours when its internet link fails. A cashier at another firm uses a colleague's password to change a supplier's bank details. A third company's accounts are encrypted by a virus and the ransom demand arrives by e-mail. Every one of these is an information technology (IT) risk.

Almost all businesses now depend on IT, so auditors must know the kinds of system, the threats to them, how organisations protect them and how an information systems (IS) audit is carried out.

This topic covers business systems and their link to IT, the main kinds of information system, the principal IT risks, ways of protecting systems, what an IS audit is and the steps in it. The earlier topics covered IT controls in the financial audit. The next topic covers business continuity, vulnerability, data centre and banking audits.

Key terms in plain English

Syllabus check

This topic is in syllabus area F, technology in audit, assurance and forensics (5% of marks). It covers:

• business systems and associated IT risks
• types of information systems and ways to protect them
• the systems audit process

CAMA 2020 and IT systems

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Business systems and information technology

A business system is the set of interrelated activities through which value is exchanged between parties, arising from the exchange of goods and services. It cuts across sales and marketing, human resources, finance and administration, product development, corporate services, data centre operations and more.

Large organisations use many IT applications to improve speed and value for customers, but these systems are prone to IT risks which, if unchecked, can cause devastating damage to the entity and related parties.

Automation in auditing is not about making auditors redundant. It is about improving their skills with the right tools, and removing monotonous work so that decisions can be made faster. This works only if the technology is properly adopted. Technologies with the potential to disrupt auditing include cloud-based accounting systems, big data and analytics, social media, blockchain and artificial intelligence and robotics.

Some professions will vanish, some will grow, and new ones will appear. A later topic looks at these tools in more detail.

Almost every business uses some information system, because IT makes many operations simpler. Owners who use IT, such as microcomputers and networks, are responsible for identifying and managing the risks to their systems and data.

Types of information system

Management information systems (MIS)

Before computers, records were created, stored, retrieved and archived by hand, in paper files in cabinets. Searching was cumbersome, and a fire could destroy the records beyond recovery. With computers, information is created, stored and moved as electronic codes, written in computer languages such as COBOL, C, C++ and Java, and made simple for users through graphical interfaces.

The computerisation of this movement and management of information is a management information system (MIS). The main purpose of an MIS is to give management feedback on its own performance and to monitor the company as a whole. An MIS has these parts: hardware, software, databases, media and messages, procedures, input and output channels and operating personnel.

Transaction processing systems (TPS)

These are applications that process daily business transactions. A TPS is a branch of the MIS. Examples are payroll, sales orders, purchases and payments, airline reservations, hotel bookings and manufacturing and inventory scheduling.

Executive information systems (EIS)

A tool for reporting enterprise-wide data to senior management. It is a kind of MIS and a decision support system, giving quick, easy-to-use reports on visual screens that make comparison easy.

Decision support systems (DSS)

Also called decision assistance systems, these help decision-making. Examples are medical diagnosis and treatment in clinics, project planning and support, manufacturing scheduling and inventory planning.

Information technology risks

Risks are events that can harm the objectives of a business. They come from inside or outside and may be man-made or natural. IT risks are threats to IT systems and include:

• Hackers: people who break into computer systems illegally, for money (extortion) or for pride.
• Insider fraud: a staff member who uses the employer's system to alter sensitive data for unlawful gain.
• Password theft: by a malicious hacker or a disgruntled employee.
• Denial-of-service attack: an online attack that prevents authorised users from reaching the website or other IT resources.
• Hardware and software failure: through targeted attacks, loss of power or corrupted data. Even a short internet outage can lose purchase orders.
• Malware: malicious software designed to disrupt computer operation, which can cripple an organisation.
• Viruses: programs that copy themselves and spread from computer to computer, often disrupting operation.
• Spam and phishing: unsolicited e-mail that fools people into giving personal details or buying fraudulent goods.
• Natural disasters: flood and fire.
• Human error: a major threat, for example accidental deletion of data or failure to follow security procedures.

Managing IT risk should be deliberate and structured: identify the risks, assess them, mitigate them, develop response plans and review the risk management procedures. An effective assessment picks out the key risks by the probability that the risk will occur and the cost of its impact on the business and of recovery.

Other risks include ransomware, which locks data until a payment is made, unauthorised changes to programs, loss of data from poor back-up, dependence on a single supplier or cloud provider, and regulatory risk from misuse of personal data, which in Nigeria is regulated by the Nigeria Data Protection Act 2023.

Ways to protect information systems

• Update software regularly to the latest versions.
• Train staff regularly in IT policies and procedures.
• Secure computers, servers and wireless networks with physical and logical access controls.
• Use anti-virus and anti-malware protection, including firewalls and intrusion prevention.
• Back up data regularly to off-site or remote storage.
• Have a password protection policy.
• Keep the legal and operating environment for online business under review.
• Take out insurance for risks that may still crystallise.

Other measures include encrypting sensitive data, limiting administrator rights, separating test and live systems, logging and monitoring user activity, reviewing user access rights when staff move or leave, and testing the recovery of back-ups.

The information systems audit

Because IT is now pervasive, business owners and stakeholders look for assurance on the use of systems through an information systems (IS) audit. It is common in medium and large companies, especially where applications are developed in-house. An IS audit is an examination of internal controls within the business applications and IT environment to decide whether the information systems are operating effectively to achieve the organisation's objectives.

The IS auditor aims to give assurance on the confidentiality, integrity and availability of the information systems: confidentiality means that only authorised persons see data, integrity that data is accurate and complete and not changed without authority, and availability that systems and data are there when needed. It usually covers:

• IT governance;
• networks and telecom services;
• systems development;
• the information processing facility and infrastructure; and
• IT service management.

It is effective only if done by professionals who understand complex information systems issues and can relate them to the business. An IS audit differs from the statutory audit. The statutory audit looks at the financial statements and uses IT knowledge to assess risks that affect them. The IS audit looks at the systems themselves, whether or not they affect the financial statements directly.

It is often done by internal auditors or specialist firms, and follows frameworks such as COBIT and the ISO 27001 standard on information security.

The systems audit process

1. Planning the audit: understand the purpose, identify risks and allocate resources to meet the objectives.
2. Map the systems and data flow: scope the other systems that affect or are affected by the application. Mapping helps the auditor understand the technologies, processes, data and controls, and how they fit together, and improves every later step from planning to reporting and follow-up.
3. Identify controls: identify and document the computer controls in the IT infrastructure, so that their adequacy against computer abuse and related risks can be judged.
4. Test and evaluate controls: evaluate the documented controls in detail to decide whether they operate effectively. A good knowledge of the system and its vulnerabilities is needed.
5. Report: write a formal report of findings that draws management's attention to the key issues and gives reasonable assurance on the design and effectiveness of the systems.
6. Follow up: once the report is approved, the recommendations should be put in place. A follow-up audit checks after some time that approved recommendations were implemented and are operating as intended.

Evidence in an IS audit

The IS auditor uses enquiry of IT staff, inspection of policies, configuration settings, user lists and logs, observation of procedures such as back-up, and re-performance with software tools.

Typical tests include comparing the list of current employees with the list of system users to find leavers still with access, reviewing the log of changes to programs and checking each was authorised and tested, testing that passwords meet policy, checking that back-ups are made and can be restored, and looking at firewall rules and the log of attempted intrusions.

The auditor also considers third-party and cloud providers, and asks for an independent assurance report on their controls, such as a service organisation report.

An IS audit finding should state the condition found, the criteria it was compared with, the cause, the effect or risk, and the recommendation, ranked by priority. This is the same structure used in a management letter, so the point flows into the audit committee's review.

Worked examples

1. This is a transaction processing system.
2. Its totals feed the MIS reports to management.

1. Risk: password theft and unauthorised use.
2. Controls: a password policy, training, multi-factor authentication and automatic screen locking.

1. Former staff could access and change data.
2. The control is a leaver process that removes access on the last day, and a periodic review of user lists.

1. The recommendation was not implemented.
2. The follow-up audit reports it, and management must act or accept the risk.

How to score full marks

• Name the risk, then the effect, then the control.
• Use confidentiality, integrity and availability as the aim of an IS audit.
• List the six steps of the process in order.
• Tie the answer to the facts of the scenario.

Common mistakes in the exam

• Listing risks without controls.
• Confusing an IS audit with a statutory audit.
• Forgetting the follow-up stage.
• Ignoring human error and insiders.

Quick revision

• MIS, TPS, EIS, DSS.
• Ten IT risks; five steps in risk management.
• Eight protection measures.
• Six steps in an IS audit; confidentiality, integrity, availability.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.