VideoEtienne Aigner relies on an auditing firm to examine its critical business systems, such as those used for an electronic trading network with major retailers, a sales force automation program, and its growing Internet business. Cangemi says the audits make sure that systems are meeting standards for performance.
At J.C. Penney, the internal auditing department, which includes an IT auditing group, reports to the executive vice president, secretary, and general counsel, and works closely with the CFO and other members of senior management to develop annual audit plans and coordinate audits of key areas within the organization. The IT audit group audits such areas as telecommunications systems, business applications, network architecture, data-center operations, change management, disaster recovery/business continuity, electronic commerce, information security, and database security. And, of course, Sarbanes-Oxley.
IT audits do more than provide peace of mind or point out room for improvement: they can also zero in on potentially serious problems. The 15-member IT audit team at Depository Trust & Clearing Corp., for example, might conduct a weekend test of a backup system to simulate an abrupt shutdown, to ensure that it switches operations to an alternate site within seconds, as it is supposed to do. Since auditors look at communications and overall responsibilities across functional departments, they help pinpoint any breakdowns that could have an adverse impact on the organization, according to senior IT auditor Fredric Greene.
How frequently IT audits should be conducted depends on the type of audit and the individual needs of the organization, says Fred Heller, an IT-audit expert at Jefferson Wells. Certain IT assets, such as key business systems and applications, should be audited at least once a year. Others, such as data centers, can be audited every three years or so. "Companies can do multiple audits at the same time or on a cycle basis," says Heller. "Sometimes they need to do specific audits [at a certain time] because of a high risk, and the next year they have a different cycle."
A growing number of companies are conducting audits of extensive IT projects — such as an infrastructure overhaul or a rollout of mobile computing devices — to ensure that initiatives are running on time and on budget. "An IT audit can provide an assessment of how a project is being managed, how the systems and applications are working, and whether you can move to the next phase," says Heller. Many involved in IT audits stress that they are now a fundamental part of overall IT management.
Bob Violino is a freelance writer in Massapequa Park, New York.
Deciding Who Does What
There's no shortage of companies that provide IT-auditing services, from traditional accounting firms to small, specialized consultancies.
Small and midsize companies are more likely to hire out IT-auditing jobs than larger organizations because they lack internal expertise or resources, experts say. Larger organizations often have an internal auditing staff, equipped with the know-how to conduct a range of audits. But staff reductions, and increasingly complex and rapidly changing technologies, have forced even bigger companies to look outside for help in certain areas, says Paul Hoshall, principal of Hoshall Associates, an IT-audit training and consulting firm in Fairfax, Virginia.
Some companies mix and match, doing their own IT audits while occasionally turning to service providers for help. Financial-services firm Fidelity Investments in Boston conducts audits of IT-management processes, general controls, infrastructure, and applications.
"If the internal audit staff is properly objective, has management's support, is adequately resourced, and has the requisite technology and audit skills, I think they are better positioned to do the work" than an outside firm, says Jay Stott, vice president of IT audit at Fidelity. "They usually will have greater knowledge of the business, organization, and operating environment, and therefore are better able to evaluate the full range of risks and controls that are important to the organization."
In some situations, Stott says, specialized technology knowledge that's beyond the staff's capability is needed. For example, Fidelity used a networking specialist to audit its voice networks when it lacked internal expertise.
Sometimes companies gain knowledge from service providers that they can use later on. Retailer J.C. Penney Co. does most of its own audits, but several years ago it "co-sourced" an audit of its ERP system. Based on what it learned, it now handles that job itself. —B.V.
Peering Inside the Box
When it comes to conducting IT audits, organizations can turn to a familiar resource for help: IT. There are dozens of software products on the market that provide all kinds of help with the auditing process. A quick sampling of functions addressed by these tools includes risk analysis and simulation, remote network auditing, audit planning and budgeting, databases for audit findings, customized reports and graphs, work-tracking systems, data mining and analysis, computer forensics, asset and software management, business intelligence, inventory management, configuration management, and security.
Reader Comments» Post a comment