QUESTION 1

Application of Information Technology (IT) presents risk to the company entities such as systems, business processes and financial/accounting processing. That risk is unique to IT and without IT being present, that risk would not exist, at least not to the same level. It takes a professional, such as an IT auditor, to identify and assess the inherent risk associated with IT. Those risk factors include systems-related issues, such as systems development, change management and vulnerabilities, and other technology-specific factors. Given that almost all entities employ IT, IT auditors are needed to identify the nature and risk of IT technologies and systems.

Recognising these significants, you as an IT auditor have been asked to establish an IT audit team in your company. Among the establishment objectives is to review critical systems used in the company. Due to that, your team need to develop auditing control of application system and operating system in order to determine if it is appropriately designed and effectively operated.

Within this context, you are required to prepare a report which contains the following items:

The need for internal audit department and IT audit team

Discussion on how to form and maintain an effective IT audit team

Description of Internal controls

Discussion on auditing application system control

Discussion on auditing operating system control

Discussion on stages when performing an audit

Discussion on how to conduct audit testing and to record the test result

Note: You need to state all the assumptions made in the discussion

(Total 50 marks)