What is IT audit - and why does it matter now more than ever?

Everyone knows what a financial audit is - the detailed inspection of a company’s financial records to check that the numbers add up, that transactions are properly recorded, and that financial statements reflect reality. Auditors look at receipts, ledgers, and internal controls to make sure everything is accurate, transparent, and in line with the rules.

But what many don’t realize is that those numbers don’t just appear on their own. They come from complex IT environments that collect, process, and report data every second of every day. That’s where IT audit comes in. While financial audit checks the output, IT audit examines the systems behind the scenes — making sure the data is reliable, the processes secure, and the technology trustworthy.

In this edition of the Risky Business Magazine, we will perform a deep dive into IT audit. 

Before we explore how KPMG can support your IT audit journey, let’s first take a moment to understand what IT audit actually entails. An IT audit is an examination of an organization’s information systems to assess whether they are well-designed, secure, and functioning as intended. The goal is to evaluate whether systems can be relied upon to produce accurate, complete, and timely information, and whether technology-related risks are properly controlled.

IT auditors mainly focus on systems that handle business-critical and financially relevant data. This includes evaluating whether key processes and applications are operating correctly and whether there are sufficient controls in place to prevent errors, fraud, or data loss.

Importantly, IT audits are often performed in line with specific regulatory or industry standards, which vary depending on the organization’s location, industry, and compliance requirements. These standards define the scope, depth, and focus of the audit. For example, SOX (Sarbanes-Oxley) is a U.S. regulation, while JSOX is its Japanese counterpart. In the financial sector, audits are often guided by regulatory requirements set by financial supervisory authorities, such as the Financial Services Authority (FSA). Each of these frameworks brings its own expectations for how technology risks and controls should be assessed, and understanding these nuances is critical for a successful and compliant audit approach. At KPMG, we tailor our IT audit approach to align with the relevant frameworks and your unique business context, ensuring that your systems are not only compliant, but also truly supporting your operational and strategic objectives.

External IT audit

External IT audits are typically performed as part of the financial audit process. The main objective is to support the financial audit team by determining whether they can rely on the organization’s IT systems and data. In the past, financial auditors worked primarily with paper records. Today, however, nearly all financial data is generated, processed, and stored in IT systems. This shift has made IT audit an essential part of the financial audit.

Internal IT audit

Internal IT audits, on the other hand, are conducted at the request of the organization itself. The goal is to proactively assess risks, improve internal controls, and support IT governance and compliance. The internal controls may also be related to cyber.

The scope of the IT audit can differ based on the organization. The scope of an IT audit typically includes several parts: Understanding of IT (UoIT), General IT Controls (GITCs), IT Application Controls (ITACs), and information testing.

Understanding the IT environment

Each IT audit starts with developing a clear understanding of IT environment. As the name suggests, this phase involves gaining insight into how the organization uses technology as part of financial reporting and business processes. More specifically, auditors take a look at the structure of the IT department, the systems in use, and any significant changes, incidents, or ongoing projects that may have occurred. Auditors assess factors that could impact the reliability, security, or integrity of IT operations and data. This understanding is not a one-time exercise: it must be refreshed with every audit to ensure that the understanding remains accurate and reflects the organization’s current IT environment.

General IT Controls

General IT controls are controls that are generally the same for each client. These types of controls are divided into four domains: access management, program changes, computer operations, and project development.

Access management focuses on regulating who can access the IT systems and data. It includes controls over user authentication (like passwords and multi-factor authentication), the assignment of user roles and permissions, and regular reviews of user access.

Program changes relate to how changes to software applications and systems are requested, tested, approved, and implemented. Proper change management ensures that updates or modifications to programs do not disrupt business processes or introduce new risks.

Computer operations deal with the day-to-day running of IT systems and services. This includes procedures for data backups, job scheduling, system monitoring, problem management, and incident response. Controls in this domain ensure the stability, continuity, and efficiency of IT operations.

Lastly, program development covers the controls applied during the development and implementation of new IT systems or major upgrades. It ensures that new systems are properly designed, tested, and aligned with business requirements before they are put into use. Program development is not tested during every audit, only when major changes occur.

IT application controls

These are automated controls built into specific systems and applications. They ensure that data is processed correctly; for example, ensuring that transactions are approved by the right people, data transfers between systems are accurate, or system calculations follow the correct logic. These controls are very specific for each client.

Information testing

Information testing is a focused part of the IT audit, during which the completeness and accuracy of specific reports are assessed. It involves checking whether the data presented in key reports is correctly extracted, processed, and presented from the underlying systems.

The scope of an external IT audit is typically defined in coordination with the financial audit team. It is shaped by their planned testing approach and the areas in which reliance on IT is needed. The scope can also vary based on the maturity of the client’s IT environment. For instance, if the client's systems and controls are not yet sufficiently developed, the IT audit may be limited to performing an IT understanding only, without further testing of controls.