Benefits of internal IT auditing

In contrast to the compliance focus of many types of external audits, internal audits are driven in large part by an organization’s desire to find operational weaknesses, discover any deviations from established policies or standards, assess effective- ness, and identify opportunities to improve operational processes and capabilities where possible. As emphasized in Chapter 2, IT audits differ from other types of assessments or analyses in that an audit compares what the organization does to an explicitly defined set of criteria, whether those criteria represent internal policies and procedures, externally defined standards or certification requirements, or legis- lated rules and regulations. Beyond mandatory internal audit requirements applica- ble to many publicly traded companies, the rationale for establishing and operating internal IT audit capabilities commonly includes objectives such as:

supporting corporate IT governance, risk management, and compliance programs;

verifying adherence to organizationally defined policies, procedures, and standards;

satisfying requirements to achieve or maintain process maturity, quality management, or internal control certification;

adding formality to or increasing the rigor of self-assessment processes and activities; and

preparing for or “shadowing” anticipated external audits. Although internal IT auditing often requires a substantial investment of

resources, in many organizations the potential benefits to be realized from conduct- ing effective, well managed IT audits justify the resource commitment. Establishing an internal audit program is required for some organizations, in which case the desire to comply with legal or regulatory requirements may provide sufficient moti- vation. Where internal IT auditing is discretionary rather than mandatory, organizations are more likely to realize the potential benefits from audit activities if they have committed to enterprise management functions such as IT governance or risk management, both of which make use of IT auditing and audit results to inform the selection and operation of internal controls. Maintaining an effective internal auditing program also helps organizations demonstrate adherence to the principle of due care by showing that they are acting in a competent and diligent manner with respect to operating and maintaining their internal controls. Providing evidence of due care offers information of potential importance to investors and business partners and may also offer legal protection in disputes over liability or business practices.

Compared to external auditing, organizations have more flexibility to structure their internal IT audit programs to suit the needs of the organization. In IT auditing contexts where both internal and external audits apply, some organizations may pre- fer to forego internal auditing and instead rely on the work of external auditors to provide information about their IT operations, controls, or compliance. Even where both types of auditing address the same subject matter, there are several potential

Internal Audit Challenges

advantages to using internal audits, in combination with or (where feasible) instead of external audits. These advantages include the ability to leverage auditors and other personnel who are familiar with the organization, its mission and business objectives, and its operations. External auditors—even those who conduct audits of an organization on a repeated basis—rarely develop an understanding of the organization’s processes and controls that can match the knowledge and organization- specific experience of internal auditors. Another beneficial aspect is that internal auditing allows organizations to review audit results (positive or negative) and plan necessary responses without the outside scrutiny or publicity that might accompany external audits. Similarly, performing an internal IT audit to help prepare for an anticipated external audit often gives organizations the opportunity to implement corrective action to remedy weaknesses or deficiencies that would presumably have been identified by external auditors.

Benefits of internal IT auditing