p. 385 · PDF 392

(4) System audit evaluation

In the system audit evaluation, the auditor evaluates the validity of the results of the system audit. For example, concerning the findings, the auditor clearly defines what exactly the problems are and checks with the audited department that there are no factual errors. In addition, the auditor checks with the audited department whether or not recommendations that are made by him/her for the findings are feasible. · 1 question

The system auditor puts in place the appropriate organizational structure for managing all audit activities from the creation of the system audit plans to system audit reporting up to giving improvement suggestions. Here, when it is found necessary and appropriate for achieving the purpose of system audits, the system auditor at his/her discretion may consider getting support from other professionals (e.g., network specialists, database specialists, system analysts, attorneys, certified public accountants). In addition, for obtaining audit evidence, an audit trail may also be used. An audit trail is a mechanism that allows tracking and validating whether the information system or the respective control function is useful for ensuring rightfulness and soundness of an information system. It includes a transaction trail that can track the process from input to output of an information system, an access trail that can track causal relationships related to access to various resources of the information system, and their records. It is possible to get audit evidence in time sequence from the audit trail.