VideoThese days, audits are rarely a source of solace, but finance executives who find IT daunting may actually be relieved to know that IT audits are suddenly in vogue, and provide exactly the sort of big-picture view that most CFOs need. IT audits are not, as you may have guessed, a matter of pure accounting. The term covers a lot of ground, but in general it can be thought of as the processes by which organizations evaluate virtually any aspect of their technology controls, capabilities, and performance. While IT audits have been conducted by some companies for years, they're moving into the mainstream as regulatory compliance, risk management, and information security become higher corporate priorities.
If done properly, experts say, IT audits not only reveal weaknesses in compliance, security, and other areas but also help companies save money by finding ways to use IT hardware and software more efficiently and get a better handle on technology assets. Organizations can use IT audits to ensure that their technology initiatives are in sync with business goals and practices.
"These audits provide our CIO with an independent and objective review of his areas to ensure data resources are protected, appropriate internal controls are in place, systems are designed and developed to meet our business needs, and internal system resources are used effectively and efficiently," says Ken Askelson, IT audit manager at retailer J.C. Penney Co. in Plano, Texas.
There are many types of IT audits that cover a broad range of technologies and processes. One type assesses IT governance, determining how well the IT department is managed and staffed, and how efficiently it supports business operations. Information-security audits examine security policies and such technologies as firewalls, as well as analyze the integrity of networks, databases, operating systems, Web servers, and applications.
Audits can focus on such major IT assets as ERP systems or on individual applications like payroll and accounts payable. Some audits evaluate the effectiveness of business-continuity and disaster-recovery programs, and others make sure that organizations have adequate and up-to-date software licensing in place. Still others are dedicated to ensuring that organizations are in compliance with such regulations as the Sarbanes-Oxley Act of 2002 and the Health Insurance Portability and Accountability Act.
IT audits frequently begin with a risk assessment, in which an organization obtains an overview of the major systems and applications used to support critical business processes. The intent is to identify existing or potential areas of risk that should be addressed in future IT audits, says Paul Rozek, director of technology services at Jefferson Wells International, a Brookfield, Wisconsin, consulting firm that has seen its IT-audit work increase by 40 percent between 2002 and 2003. Organizations can then prioritize the audits based on the level of risk. That initial assessment can also give executives a good sense of the systems the organization has in place, and whether the company has sufficient expertise and staff resources to conduct subsequent, more-focused audits. If not, the organization will have to consider getting help from an outside expert (see "Deciding Who Does What," at the end of this article).
The actual audits of individual aspects of IT, which can last a few weeks or several months, involve testing the technologies and controls that are in place, to make sure they are meeting corporate expectations. Once audits are complete, reports are sent to the appropriate managers so they can address specific needs.
For example, an information-security audit report would go to the CIO or other senior IT executive, as well as to the chief information security executive. Rozek says many IT-audit reports include an executive summary for higher-level officers and more detailed information for the people who will actually be putting necessary fixes in place.
"As with a financial audit, always think of who the audit audience is," says Rozek. "Make sure the report has insights that executive management will understand, and also give sufficient information from a process-control and technology-control perspective."
Experts say CFOs should be copied on most or all IT-audit reports. "The CFO should absolutely rely on IT audits that affect the programs or operations for which they are responsible to provide assurance that the proper data security and controls" are in place, says Paul Hoshall, principal of Hoshall Associates, an IT-audit training and consulting firm in Fairfax, Virginia. "Without audits, I don't know how you can do this."
Michael Cangemi, president and CEO (and former CFO) of consumer leather goods designer Etienne Aigner Group in Edison, New Jersey, agrees that finance chiefs should push for IT audits and always be briefed on their findings. "When you do audits, you gain a basic control over the entire IT environment and systems. What better way is there for a CFO to verify that the company's investment in IT is working the way the board and management expect it to?" asks Cangemi.
Cangemi has a special appreciation for the audit function. He began his career in the 1970s working in IT auditing before advancing to high-level positions in finance, and authored the book Managing the Audit Function (Wiley & Sons), a new edition of which came out in 2003.
Reader Comments» Post a comment