p. 379 · PDF 386

1 - 2 Purpose and Implementation Procedure of System Audits

System audit verifies whether or not risk management pertaining to an information system is effectively implemented. A system audit is conducted in accordance with the System Audit Standards, from the viewpoint of whether or not the information system to be audited is compliant with the System Management Standards. · 3 questions

1-2-1 Purpose of System Audits

In the “System Audit Standards,” the purpose of system audits is described as shown below. Here, some supplementary explanation is provided for making it a little easier to understand.

[Excerpt from System Audit Standards “II. Purpose of system audits”] From an independent and professional standpoint, the system auditor verifies and evaluates whether risk control related to the information systems of the organization is appropriately developed and operated on the basis of risk assessment (i.e., identification, analysis, and evaluation of risk), and the auditor gives assurance (assurance-based audit) or gives advice (consulting-based audit), and thereby contributes to achieving IT governance (i.e., organizational capability to control the formation and execution of IT strategy, and lead in the desired direction for the purpose of building competitive superiority).

View original source box · p. 379

Enlarge original source box

The bordered excerpt from System Audit Standards II links the independent and professional system auditor, risk assessment and control, assurance or advice, and IT governance.

p. 380 · PDF 387

The purpose and scope (or business operations) to be audited in the system audit, and the authority and responsibility of the system auditor are clearly defined in documented regulations (e.g., system audit regulations, internal audit regulations), or in a contract, and then approval of the management is obtained. The business operations to be audited in the system audit encompass the entire life cycle (i.e., planning, development, operation, maintenance) of information systems, and information resources involved in information systems are also covered in the system audit. For smoothly conducting the system audit, it is desired that information systems should be developed and maintained with being aware of auditability. Information system auditability means it should be possible to effectively audit or review the validity of a process, and it includes mechanisms such as collecting and tracing logs. The system auditor must verify and evaluate the information systems to be audited from an objective standpoint. Therefore, in the “System Audit Standards,” the following items are set forth as qualifications for the system auditor.

• Apparent independence: For objectively conducting the system audit, the system auditor should be independent from the audit target. (Depending on the purpose, there should not be any conflict of interest owing to his/her position.) • Psychological independence: The system auditor should overcome bias and always make a fair and objective audit judgment. • Professional ethics and honesty: The system auditor should honestly conduct the work in accordance with the principle of professional ethics. • Professional skills: Through appropriate education and work experience, the system auditor should maintain knowledge (e.g., audit, information system, information security, related laws and standards) and specialized skills as a professional. • Practical obligations: The system auditor should adhere to the duty of care, the duty of nondisclosure, and so on. • Quality management: The system auditor should conduct appropriate quality management for ensuring the correctness of audit results.

View original source box · p. 380

Enlarge original source box

Six qualifications appear in source order: apparent independence; psychological independence; professional ethics and honesty; professional skills; practical obligations; quality management.