p. 380 · PDF 387

1-2-2 Implementation Procedure of System Audits

The following is the implementation procedure of system audits based on the “System Audit Standards.” In order to effectively and efficiently conduct a system audit, it is necessary to make implementation preparation for obtaining support and active cooperation of the subject to be audited before the audit is conducted.

p. 381 · PDF 388

[Implementation procedure of system audits] 1) Preparation of system audit plans 2) System audit implementation (i.e., preliminary audit, main audit, evaluation, and conclusion) 3) System audit reporting 4) System audit evaluation

View original source box · p. 381

Enlarge original source box

Four numbered stages appear in source order: preparation of system audit plans; system audit implementation, including preliminary audit, main audit, evaluation and conclusion; system audit reporting; system audit evaluation.

(1) Preparation of system audit plans

In the preparation of system audit plans, in order to effectively and efficiently achieve the purpose of system audits to be conducted, the system auditor prepares appropriate system audit plans concerning contents, timing, and scope of audit procedure, and documents them as the system audit plans. The following three plans are prepared as system audit plans.

• Medium- and long-term plan It is a medium-to-long-term (3 to 5 years) audit plan with consistency between medium-to-long-term management plan and information systems plan of the subject (i.e., organization) to be audited. • Basic plan It is an annual audit plan with consistency between the annual management plan and information system plan of the subject (i.e., organization) to be audited. • Individual plan It is an audit plan for each audit target (i.e., business operations to be audited).

View original source box · p. 381

Enlarge original source box

The bordered list describes a medium- and long-term plan of 3 to 5 years, an annual basic plan, and an individual plan for each audit target.

It is ideal to prepare the system audit plans in the sequence of a medium- and long-term plan, a basic plan, and an individual plan. However, for practical purposes, most of the time the basic plan is prepared first, and then the medium- and long-term plan is prepared by consolidating the basic plans of several years. After that, the individual plan is prepared by defining the basic plan in detail for each audit target. In the preparation of system audit plans, on the basis of the results (e.g., frequency of risk occurrence, extent of impact) of risk assessment related to information systems, audit targets and important audit topics are selected. After that, audit scope and audit procedures are defined, and the corresponding audit implementation framework and audit schedule are decided. The system audit plans that are prepared in this manner are released after the approval is obtained from the head of the organization of the department to be audited. However, in the event that the fulfillment of audit purpose possibly may be blocked (e.g., “New facts are

p. 382 · PDF 389

found during the audit process,” “Environment of the subject to be audited has changed”), flexible operation is required so that the plans can be modified on a case-by-case basis such as by changing the audit procedure.