English
Menu

What is Systems audit?

An activity in which specialist auditors independent of the audited area (systems auditors) inspect and evaluate whether controls over the risks associated with information systems are properly designed and operated, and report the results to management and others as assurance or as advice for improvement. It proceeds through audit planning, a preliminary survey, the main audit, evaluation and conclusion, audit reporting and follow-up. In Japan, the Ministry of Economy, Trade and Industry publishes the System Audit Standards and the System Management Standards.

Japanese name: システム監査

Systems audit appears in 6 practice questions across 1 topic, including IT Service Management and Systems Audit.

Field: IT Service Management and Systems Audit

How an audit proceeds

A systems audit begins with an audit plan that sets the objectives, scope and timing. In the preliminary survey, the auditor reviews documents and interviews people to understand the actual state and risks of the audited area, and then defines concretely the audit procedures for the main audit. In the main audit, audit evidence is gathered through procedures such as matching records, observation and testing, and recorded in the audit working papers. A conclusion is reached by evaluating the evidence, findings and improvement recommendations are reported in the audit report, and the status of improvements is checked in the follow-up.

Independence and expertise

Systems auditors are required to be independent of what they audit. If they are involved in developing or operating the audited system, they would be evaluating their own work or their own department's work, so they could not judge objectively and would not appear fair to others. Auditors do not carry out improvements themselves; they recommend them, and the audited department (and the management directing it) is responsible for carrying them out. Specialist knowledge of information systems, risks and controls is also needed.

Audit techniques

In addition to reviewing documents, interviewing, observing operations and matching records, auditors also use computer-based techniques. These include the test data method, in which a program processes data prepared by the auditor and the results are checked; the ITF method, which sets up fictitious audit accounts in the production system; the snapshot method, which writes out data midway through processing; and analysis of all records with generalized audit software. Together they are called CAAT (computer-assisted audit techniques).

Try it: questions about Systems audit

Which of the following describes the purpose of a systems audit appropriately?

  1. AFrom an independent, professional standpoint, to inspect and evaluate whether controls over the risks associated with information systems are properly designed and operated, and to communicate the results to the parties concerned as assurance or advice
  2. BTo join an information system development project, write and test programs personally, and speed up development
  3. CTo direct the recovery work when a failure occurs in an information system and personally carry out measures to prevent recurrence
Show answer and explanation

Answer: A. From an independent, professional standpoint, to inspect and evaluate whether controls over the risks associated with information systems are properly designed and operated, and to communicate the results to the parties concerned as assurance or advice

A systems audit is an activity in which specialist auditors independent of the audited area inspect and evaluate whether controls (management mechanisms) over the risks of information systems are properly designed and operated. The results are reported to management and other parties as assurance that there are no problems or as advice for improvement (improvement recommendations). If auditors carried out development or operations work themselves, they would be evaluating their own work and their independence would be impaired.

Among the steps of a systems audit, which of the following is appropriately done in the preliminary survey?

  1. ASummarizing the audit conclusions and preparing and submitting the audit report together with improvement recommendations
  2. BReviewing documents and interviewing the people concerned to understand the actual state of the audited area, and deciding concretely on the audit procedures to be carried out in the main audit
  3. CCarrying out audit procedures to gather sufficient audit evidence and to firm up the basis for findings
Show answer and explanation

Answer: B. Reviewing documents and interviewing the people concerned to understand the actual state of the audited area, and deciding concretely on the audit procedures to be carried out in the main audit

A systems audit generally proceeds in the order of audit planning, preliminary survey, main audit, evaluation and conclusion, audit reporting and follow-up. In the preliminary survey, the auditor reviews documents such as rules, procedures and system configuration diagrams and interviews the people concerned to understand the actual state and risks of the audited area, and decides concretely on the audit procedures for the main audit. In the main audit, those procedures are carried out to gather audit evidence, which is then evaluated to reach a conclusion.

FAQ

How does a systems audit differ from an information security audit?

A systems audit covers the full range of risks associated with information systems, such as effectiveness, efficiency, reliability and security. An information security audit focuses on information security among these. Because the scopes overlap, some organizations carry them out together.

Can an employee of the internal audit department be a systems auditor?

Yes. An internal audit by employees of the organization's internal audit department can be carried out as a systems audit as long as they are independent of the audited business and systems. There are also external audits commissioned from outside specialists, and the two are used according to the purpose.

Systems audit in the explanations

Questions that mention Systems audit (6)

  1. Which of the following describes the purpose of a systems audit appropriately?
  2. Among the steps of a systems audit, which of the following is appropriately done in the preliminary survey?
  3. A systems auditor made improvement recommendations in an audit report. Which of the following is an appropriate follow-up afterward?
  4. A systems auditor is gathering audit evidence on whether the records of payments to business partners are correct. Which of the following is generally considered the audit evidence with the highest probative value?
  5. A systems auditor used generalized audit software to extract duplicated invoice numbers and transactions over the approval limit from a year's worth of transaction data (several million records) in a sales system. Which of the following is an appropriate advantage of using computer-assisted audit techniques (CAAT) in this way?
  6. In a systems audit, which of the following does the systems auditor mainly use as the yardstick for judging whether an organization's management of its information systems is appropriate?

Books on IT Service Management and Systems Audit Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

CAAT (computer-assisted audit techniques) Audit trail BCP (business continuity plan) Change management Configuration management Escalation Incident management Internal control IT governance ITIL

Back to the glossary