IS Audit Basics: Successful Audits Do Not Just Happen

An online search for “audit success criteria” reveals few articles or books specific enough to be useful. Several reflected an audit function perspective and did not discuss the views of other stakeholders.

Let us assume here that organizations have a unique environment defined by their corporate culture, their choices of technical and audit standards and guidelines, their governance processes, the criticality of their information systems and data to their business, supply chains, vendors, and so much more. Thus, a one-size-fits-all approach to audit will not automatically lead to success.

Part 1: How to Ensure Your Audit is a Failure

First, there are five key ways to waste your organization’s time and money:

1. Poor audit planning—It should go without saying: Fail to plan sufficiently and you have already planned to fail!
2. Ignoring changing risk¹—This is the easiest way to fail—both internally (e.g., a significant business change) and externally (e.g., a key vendor discontinuing support for a product critical to your organization, an attack with weapons-strength malware)—and, instead, repeat past audits. Thereby, you potentially fail to focus on the most important current technology risk factors.
3. Not thinking in terms of value added—Avoid the mindless pursuit of perfection (MPP), i.e., pushing the auditee to do things simply because the standards, guidelines and good practices state these are good things to do. Audits that do not focus on risk having significant impact to the organization, its customers or stakeholders will be certain to have missed opportunities, represent poor value and reflect adversely on the internal audit function.
4. Auditor bias—We all have biases. The key is to be aware that they exist and appropriately manage them. Two commonly found biases are:
   • Negativity bias, which gives more weight or attention to negative observations and findings than to positive results
   • Overconfidence bias, which is based on the belief that one’s knowledge and answers to questions are always correct
5. Not working with the auditees—It is important not to forget that an audit is not the objective in itself, but a process that has as one of its objectives adding value to the work of IS/IT providers, so that IS/IT operates securely and effectively and supports the organization’s business and operations.

Part 2: What Does Success Look Like to the Various Stakeholders?

To answer this question, let us consider this from the different perspectives.

The Internal Audit Perspective
The internal audit perspective is almost certain to be based on six essential criteria. The audit:

• Adheres to audit standards and quality assurance guidelines²
• Is conducted in an impartial manner and supported by evidence
• Addresses critical and high-risk areas pertinent to the individual organization
• Answers the objectives set out in a clearly defined and agreed scope
• Provides timely findings and actionable recommendations
• Is completed on time and on budget

In turn, these six criteria depend on:

• The availability of sufficiently up-to-date and of good-enough-quality business risk assessments and related prioritized and resourced mitigation plans
• The availability of any self-assessments already conducted by the appropriate functions, including metrics to support them
• The availability of competent auditors with a mix of audit skills, experience and soft skills leading to effective interactions with auditees
• The agreement of the auditees to the scope, timing and timescales proposed
• The process for validating the accuracy of the audit findings and the value added by the report
• The process for quantifying the estimated cost of any recommendations and the value added by implementing them

The Audited Party Perspective
Those being audited would be expected to support the previously noted criteria and add the following:

• The audit identifies domains of significant risk not previously recognized by the auditees or their management.
• The audit identifies areas of cost-effective improvements not previously identified by the auditees or their management.
• The audit report gives credit for initiatives and actions identified and initiated by the auditees.
• The schedule for the audit and its related activities does not result in significant disruption to the day-to-day work.
• There is adequate coordination with other oversight bodies’ plans to avoid back-to-back audits without a suitable break between them.
• The scope of the audit is maintained throughout the process—no scope creep.
• The entry meeting sets out clear audit objectives, a well defined scope and a method of work.
• The auditors keep the auditees informed of their progress and ensure that their findings are accurate as the audit progresses.

The Audit Committee Perspective
An audit committee can be expected to support all the previously noted criteria and possibly add:

• An audit strategy focusing on information assurance and information security that describes the specific objectives for a multiyear audit plan in which the audit universe is segmented into several areas, ranked by impact and risk
• Inclusion of root-cause analysis (RCA)³ that supports the recommendations
• Confirmation from management that the audit includes analyses that were not previously available and descriptions of actions and options that had not yet been considered
• A statement of the standards, guidelines, tools and metrics used in conducting the audit
• An inventory or list of risk domains that cannot be audited for contractual or legal reasons (e.g., a cloud service provider or Internet service provider)
• Clear understanding of the status of past audit recommendations, including those that have been implemented and validated as effective by further audit and those that have not been implemented and whether the reasons why are valid and justified

The Management Perspective
Management, from the functional managers of the entities being audited to the executive suite, need to be satisfied that audits meet three criteria:

1. The audits planned and conducted are aligned with the needs of the business/organization.
2. The actions recommended by the auditors represent a good return on expenditure.
3. The results of audits over time lead to a demonstrable reduction in business risk.

Conclusion

Everybody wants an audit to be successful. Given that success may mean different things to the parties involved, due attention needs to be given to their criteria.

Future columns will explore the many factors that may conspire to make success harder than it need be.

Endnotes

¹ ISACA, IS Audit and Assurance Guideline 2202, Risk Assessment in Planning, September 2014, 1q3y.39680a.com/standards
² ISACA, ITAF, 3^rd Edition, September 2014
³ Mind Tools, “Root Cause Analysis: Tracing a Problem to Its Origin,” www.mindtools.com/pages/article/newTMC_80.htm

Ed Gelbstein, Ph.D., has worked in IS/IT in the private and public sectors in various countries for more than 50 years. He did analog and digital development in the 1960s, incorporated digital computers in the control systems for continuous process in the late 60s and early 70s, and managed projects of increasing size and complexity until the early 1990s. In the 90s, he became an executive at the preprivatized British Railways and then the United Nations global computing and data communications provider. Following his (semi)retirement from the UN, he joined the audit teams of the UN Board of Auditors and the French National Audit Office. He also teaches postgraduate courses on business management of information systems.