A few years ago, a financial services company formed an internal audit group to assist management with the evaluation of internal control. Within two years, the Internal Audit Director realized that information systems auditing was an important part missing from the current internal audit function.
Information systems is an important part of their business, and yet there was no audit coverage.
The Internal Audit Director decided to develop a long range IS audit planning project that included an update to the audit universe and a risk model to define the annual IS audit schedule. The company already had an audit universe and risk model for audit topics other than information systems audits. The project had to develop an effective system for IS audits that could be integrated with the existing process. Understanding the business. Identifying the significant business risks related to information systems topics.