Information System Audit Information System Audit Function

Article Study Case Information System Audit Information System Audit Function Amelia Rose Smith Carnegie Mellon University, 5000 Forbes Avenue, Pittsburgh, PA 15213, USA ameliaroses2019@gmail.com Abstract Information system audit or Information System Audit also called EDP Audit (Electronc Data Processing Audit) / Computer audit is a process of collecting data and evaluating butki to determine whether a computerized application system has been implemented and implementing a control system, internal control systems that are commensurate, all assets are properly protected or misused and also guaranteed data integrity, reliability and also the effectiveness and efficiency of organizing computer-based information. efficiency of organizing computer-based information. Information system audit itself is a system information auditing is the process of collecting and evaluating evidence to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively and uses resources efficiently. effectively and uses resources efficiently. This means that an information system audit is process of collecting and evaluating facts to decide whether a computer system that is a company asset is protected, maintained data integrity, allows organizational goals to be achieved effectively and uses resources efficiently. computer system which is a company asset is protected, data integrity is maintained, in accordance with organizational goals to achieve effectiveness and efficiency in the use of resources. use of resources. Keywords: Information Systems Technology Audit INTRODUCTION Along with the times, many companies rely on rely on information systems to support the company's operations. To support the achievement of the company's vision and mission, information management is needed to achieve the vision and mission of a company. The more information technology develops, the more threats there will be from inside and outside the company. For example on computer processing. It will be very worrying if there is an error in processing in the computer. in the computer. Losses AMELIA ROSE SMITH 1 Amelia Rose Smith ranging from the unreliability of mathematical calculations to the dependence of human life. To prevent these threats, companies establish internal controls and to check that these controls are achieving their objectives. to check whether these controls have achieved their or not, it is necessary to audit information systems in a company or organization. company or organization. DISCUSSION / STUDY CASE An information systems (IS) audit is a form of monitoring and control of the information technology infrastructure as a whole. These information technology audits may run in tandem with financial and internal audits, or with other similar monitoring and evaluation activities. internal audits, or with other similar monitoring and evaluation activities. Originally known as electronic data processing audits, information technology audits are now generally the process of collecting and evaluating all information system activities within the organization. Another term for an information technology audit is a computer audit which is widely used to determine whether the company's information system assets are working effectively and integratively in achieving its organizational targets. Information system audits are needed by companies in achieving company goals, therefore companies must create control procedures in maintaining company assets and checking these controls by testing controls. Testing controls is used to evaluate whether it has been running in accordance with the procedure or not. A. Objectives and Scope of Information System Audits Information System Audit objectives can be grouped into two main aspects, namely: 1. Conformance In this group of objectives, information system audits are focused on obtaining conclusions on aspects of conformity, namely Confidentiality, Integrity, Availability and Compliance. 2. Performance this group of objectives information system audit is focused to obtain conclusions on performance aspects, namely: Effectiveness, Efficiency, Reliability AMELIA ROSE SMITH 2 Article Study Case B. Information System Audit Objectives The purpose of an information system audit is to review and evaluate the internal controls that protect the system. When conducting an information system audit, auditors should ensure the following objectives are met: 1. Security equipment protects computer equipment, programs, communications, and data from unauthorized access, modification, or destruction. 2. Program development and acquisition are carried out in accordance with specific and general authorizations from management. 3. Program modifications are carried out with management authorization and approval. 4. Processing of transactions, files, reports, and other computer records is accurate and complete. 5. Inaccurate source data or those without proper authorization are identified and handled in accordance with established managerial policies. 6. Computer data files are accurate, complete, and maintained confidentialit C. Audit Type Audits conducted according to company type are operational, compliance, system development, internal control, financial and fraud audits. The four types of auditors involved in organizing audits listed are: 1. Internal auditors are company employees, who generally carry out compliance, operational, system development, internal control & fraud audits. 2. External auditors are independent public accountants commissioned by the company, specifically to carry out financial audits. In various kinds of financial audits, external auditors are assisted by internal AMELIA ROSE SMITH 3 Amelia Rose Smith auditors. however, it is the external auditor who is responsible for confirming the fairness of the financial statements. 3. Goverment auditors, carry out audit / test fulfillment company reports on supervision concerning government employees. example: government bank examiners carry out bank audits, auditors assigned by state auditors who generally carry out regional audits and government employees. 4. Fraud auditors, specializing in investigating fraud & working behind closed doors with internal auditors & lawyers, fraud examiners, for example: FBI fraud investigation unit, large public accounting firms, IRS, insurance companies. D. Types of Audits Operational audit, concentrates on the efficiency and effectiveness of resources used to carry out tasks, including conformity of practices & procedures with regulations. Compliance audits concentrate on the scope of laws, government regulations, controls and obligations of other external bodies that have been followed. Project management & change control audit, (formerly known as a system development audit) is concentrated by efficiency & effectiveness at various stages of the system development life cycle being carried out. Internal control audits concentrate on evaluating the internal control structure. Financial audit concentrates on the fairness of financial statements that show financial position, cash flow and performance results of the company. Fraud audit is nonrecurring audit that conducted to gather evidence to determine whether fraud is occurring, has occurred or will fraud is occurring. And resolving matters in accordance with assignment of responsibility. AMELIA ROSE SMITH 4 Article Study Case E. Audit Stages 1. Planning Includes the main activities, namely: a. Establishing the scope and objectives of the audit b. Organizing the audit team c. Understanding the client's business operations d. Review previous audit results e. previous audit f. Prepare the audit program 2. Field Work At this stage, what is done is collecting information which is done by collecting data with related parties. This can be done by applying a data collection method namely by means of interviews, questionnaires or conducting survey. 3. Reporting After data collection, then data will be obtained that will be processed to be calculated according to the calculation of maturity level. At this stage will information will be provided in the form of audit results. 4. Follow Up This stage is carried out by by providing a report on the results of the audit results in the form of recommendations for corrective action recommendations to the management of the object under study. Then the authority improvement becomes the responsibility responsibility. F. IT Audit Tools Tools that can be used to assist the implementation of Information Technology Audits. It cannot be denied that the use of these tools is indeed very helpful for Information Technology Auditors in carrying out their profession, both in terms of speed and accuracy. Here are some software that can be used as tools in conducting information technology audits: AMELIA ROSE SMITH 5 Amelia Rose Smith 1. ACL ACL (Audit Command Language) is a CAAT (Computer Assisted Audit Techniques) software that has been very popular for analyzing data from various sources. ACL for Windows (often called ACL) is a TABK (COMPUTER-BASED AUDIT TECHNIQUE) software to assist auditors in conducting examinations in a computer-based information system or Electronic Data Processing environment. 2. Picalo Picalo is a CAAT (Computer Assisted Audit Techniques) software like ACL that can be used to analyze data from various sources. Picalo works using a Front end GUI, and has many features for ETL as the main process in extracting and opening data, the main advantages are flexibility and a good front end to the numerical Python Library. Here are some of its uses: • Analyze financial data, employee data • Import Excel, CSV and TSV files into the database • Analyze interactive network events interactive network events, site server logs, and system login records • Import emails into relational and text-based databases • Embed fraud control and test fraud routines into the system production system. 3. Powertech Compliance Assessment Powertech Compliance Assessment is an automated audit tool that can be used to audit and benchmark user access to data, public authority to libraries, user security, system security, system auditing and administrator rights (special administrator rights (special authority) of a AS/400 server. AMELIA ROSE SMITH 6 Article Study Case 4. Nipper Nipper is an audit automation software that can be used to audit and benchmark the configuration of a router. Nipper (Network Infrastructure Parser) is an open source-based tool to assist IT professionals in auditing, configuring and managing computer networks and network infrastructure devices. 5. Nessus Nessus is a vulnerability assessment software, which is a software used to check the level of vulnerability of a system within the scope of security used in a company. 6. Metasploit Metasploit Framework is a penetration testing tool, which is software used to find security holes 7. NMAP NMAP is an open source utility for performing security auditing. NMAP or Network Mapper, is software for exploring networks, many system and network administrators who use this application find many functions in network inventory, managing service upgrade schedules, and monitoring host or service time. Nmap classically uses a commandline interface, and the NMAP suite includes the best GUI display and result display (Zenmap), flexible data transfer, redirection and debugging tools (NCAT), a tool for comparing scan results (NDIFF) and a package of analysis tools for generating and responding (NPING). 8. Wireshark Wireshark is the most used netwrok protocol analysis application in the world, Wireshark can capture data and interactively browse traffic running on computer networks, de facto standardized in many industries and educational institutions. AMELIA ROSE SMITH 7 Amelia Rose Smith CONCLUSION Audit is the process of gathering and evaluating facts to decide whether computer systems that are assets to the Company are protected, data integrity is maintained, in accordance with organizational objectives to achieve effectiveness, and efficiency in the use of resources. Computer-based information system is a set of software & software designed to transform data into useful information, can be adequately used to: 1. Protect assets 2. Maintain system and data integrity and availability 3. Provide relevant and reliable information 4. Achieving organizational goals effectively 5. Use resources efficiently DISCUSSION My friend ALEX and I discussed the Information Systems Technology Audit that it is very important if an auditor has computer expertise. Because, the task of an auditor is to examine, in a broad sense means evaluation of an organization, system, process, or product. For this reason, an Auditor is carried out by a competent, objective, and impartial party. The goal is to verify that the subject of the audit has been completed or is running in accordance with approved and accepted standards, regulations, and practices. In addition, an auditor must understand the management control system in the company, so that he can assess whether the controls in the company are adequate or not AMELIA ROSE SMITH 8 Article Study Case References AMELIA ROSE SMITH 9 Amelia Rose Smith AMELIA ROSE SMITH 10 Article Study Case AMELIA ROSE SMITH 11 Amelia Rose Smith AMELIA ROSE SMITH 12 Article Study Case AMELIA ROSE SMITH 13