GUIDELINES FOR ESTABLISHING AN INFORMATION SYSTEMS AUDIT FUNCTION
Organisations wishing to set up an IS audit function may consider the following
guide:
(a) The Information Systems Audit Charter
This is a key element in the development of the IS audit function. The
charter should specify among other issues:
(i) Objectives;
(ii) Scope; and
(iii) Reporting level of the IS audit function.
In developing the IS audit charter, consideration should be given to the
internal audit charter, where it exists.
(b) Organisation and Management Issues
This has to be addressed to offer structure to the IS audit function and
the following issues are considered:
(i) Identifying the staff skill level required and ways to obtain such
expertise;
(ii) Establishing salary guidelines which conform to organisation’s
policies and provide competitive and fair compensation;
(iii) Identify the activities required to support the organisation’s
external auditors;
(iv) Formulating the audit schedule to plan for IS audit activities;
and
(v) Developing standards and procedures to support the IS audit
function.
(c) Staff Skills Level
This will generally depend on the complexity of the computer systems
and environment. The lowest level of skilled staff should be able to use
IS audit tools, techniques and control concepts in computerised systems.
They should also possess good interpersonal skills and solid understanding
of management concepts. A Certified Information Systems Auditors’
(CISA) qualification will surely be imperative and non-negotiable for a
very complex IS environment.
(d) Finally, the organisation must procure the necessary IS audit resources
such as computer laptops; a close ration of one-to-one to each IS audit
personnel is recommended, and the CAAT software of choice.
(e) Necessary training and retraining of the IS audit personnel is also a
non-negotiable consideration.
0 komentar:
Post a Comment