On the trail to a successful audit

What do you think of IT auditing and what it can achieve for your business? Is it a handicap to business performance, a necessary evil or a valuable service?

Few non-auditors choose the valuable service option. Yet an IT audit can ensure your IT environment is adequately secure and ready to provide a reasonable return on investment.

At a recent North London branch event of the BCS, presenters from Barclays, Ernst & Young, Gotham Digital Science, Isaca, KPMG and PricewaterhouseCoopers provided insights into IT auditing and how firms can benefit.

Increasingly, organisations need assurance about the reliability and security of their IT-dependent work environments.

To provide that assurance, auditors need to understand and validate the design and performance of IT-related processes and controls.

IT audits can help ­ – but to get the most out of the process, you will need to understand and work with your auditors.

Like you, the auditor is a professional who wants to make sure your company is well planned, managed and controlled.

Remember that an audit is not something that is done to you, but with you. It is effectively a business review that can help tighten your organisation.

Treat auditors as critical friends, rather than a hindrance, and consider audits as adding value to your firm.

The more you prepare, the less painful audits will be. Start planning and preparation for audits as early as possible or ­ – even better ­ – on an ongoing basis.

Get as closely involved in planning as possible and aim to get benefits to help you do your job better.

Identify high-risk areas and the controls needed to mitigate exposure, such as IT-related processes and functions with limited controls.

If you have been through a similar audit before, refer to the test results and the people involved. Collate the data so it is ready for easy reference.

Then ensure your follow-up actions address all outstanding issues. Where you know there are limited or inadequate controls, discuss them with your management team and address the issues.

Before the audit, understand who the auditors are ­ – their scope, objectives and deliverables.

Explain your own risks and issues to the auditors and agree on the outstanding areas that you think should be covered.

After working through a schedule, appoint a central point of contact, confirm logistical arrangements and prepare physical storage to hold the audit results.

During the process, you should maintain regular contact with your auditors. Your central contact will have a key role, co-ordinating information flow, arranging catch-up meetings and notifying your company of significant findings.

Review audit findings at the draft report stage and do not take the outcome as personal criticism.

Prepare a plan to address any issues identified, making sure the plan is published and implemented.

Finally, publish lessons from the audit and categorise the results so they are available for future reference.

Dalim Basu is chairman of the BCS North London branch and director of a project management and IT audit consultancy