Auditing information systems : A practical approach

Amit M. Mehta’s Auditing Information Systems: A Practical Approach develops the reasoning behind risk-based audits of information technology and applications. This guide follows its seven chapters and three appendices, connecting planning, evidence, controls, reporting, and follow-up through original learning exercises.

How to study this book

Use a fictional organization and document its objectives, systems, data, users, and key dependencies. For each audit issue, connect a risk to a control objective, an existing control, a test, and the evidence needed to support a conclusion. Separate control design from evidence that the control operated throughout the relevant period.

Chapter-wise explanations and study tasks

1. Introduction to IS Auditing

IS auditing examines how systems and their controls support organizational objectives, protect resources, and maintain reliable information. Different audit types and scopes address different questions. Professional judgment involves understanding the business context as well as the technology under review.

Study task: Define an audit objective and scope for a fictional online retailer, stating two questions the engagement will address and one it will exclude.

2. Standards, Ethics, and Continuous Frameworks

Professional standards and ethical principles establish expectations for audit work. Computer-assisted techniques can expand testing, while continuous auditing and management monitoring have different responsibilities. Quality assurance considers whether the process consistently produces supportable work rather than simply whether tools were used.

Study task: Compare auditor-led continuous auditing with management monitoring, then identify an ethical issue that a data-analysis tool cannot resolve on its own.

3. Planning an IS Audit

A risk-based plan links organizational exposure and materiality to objectives, procedures, evidence, sampling, and resources. An audit program translates broad aims into executable work. Test design must specify what a result can establish and the limits created by the selected population or sample.

Study task: Create a risk–control–test matrix for three risks and specify the population, evidence source, and limitation for one sample-based test.

4. Governance, Risk Management, and Controls

Governance sets direction and accountability, while management and controls address delivery and risk within that framework. Control evaluation should connect with organizational objectives rather than becoming a checklist of technologies. Compare framework concepts in relation to actual responsibilities and decisions.

Study task: Draw an accountability map for a fictional technology project and identify one risk, its owner, the relevant control, and an oversight question.

5. IT General Controls

General controls include development, change management, access, security, operations, continuity, data, projects, and outsourced or mobile environments. They shape the reliability of systems supporting many transactions. An apparently correct application result may still be questionable if changes or privileged access are uncontrolled.

Study task: Select access administration and change management, then design a test for each that distinguishes documented policy from evidence of operation.

6. Application Controls

Application controls address information entering, passing through, and leaving a particular process. Completeness, accuracy, authorization, and integrity require different tests. Trace the flow of a transaction and consider exception handling as well as normal processing.

Study task: Map a fictional order-to-invoice application, identify an input, processing, and output control, and propose a test of each control’s effectiveness.

7. Communicating and Reporting

An audit finding must connect a supported condition with the relevant criteria, cause, consequence, and practical response. Clear reporting distinguishes evidence from interpretation and prioritizes issues meaningfully. Follow-up assesses what changed rather than merely recording management’s promise to act.

Study task: Write a fictional finding with condition, criteria, cause, effect, recommendation, and follow-up evidence, avoiding claims not established by the test.

Appendix A. Emerging Trends

New technologies alter risk patterns and the evidence available to auditors. Emerging terminology alone does not determine whether a control is adequate. Begin with what the system does, its dependencies, and the relevant accountability before deciding which audit procedures are useful.

Study task: Select a technology discussed in the appendix and explain how it changes one existing risk and creates one new audit-evidence question.

Appendix B. Tools and Technologies

Audit tools support collection, analysis, and documentation but do not replace a sound test objective. Data quality, reproducibility, access, and interpretation affect the reliability of tool-assisted work. Match a tool capability to the evidence required rather than choosing it for convenience alone.

Study task: Design a simple data-analysis test with stated inputs, validation checks, expected output, and a rule for investigating exceptions.

Appendix C. Ethics in IS Auditing

Confidentiality, objectivity, competence, and professional responsibilities influence the choices auditors make throughout an engagement. Ethical issues can persist even when a procedure is technically possible. Consider pressure, conflicts, and appropriate escalation before interpreting silence as permission.

Study task: Analyse a scenario in which management asks an auditor to soften a supported finding, identifying the conflict and a reasoned response.

Applied assignment

Prepare a miniature audit file for a fictional system: background, scope, risk assessment, audit program, one general-control test, one application-control test, a supported finding, and a follow-up plan. Use synthetic data and state what each test does and does not establish.

Suggested reading plan

Study chapters 1–2 for role and professional foundations, 3–4 for planning and governance, 5–6 for control evaluation, and 7 for reporting and follow-up. Consult appendices A–C during the relevant stages and revise the audit file after each block.

Questions for reflection

• What evidence distinguishes a well-designed control from an effectively operating one?
• How does a finding connect to a business objective?
• When does the available data fail to support the proposed conclusion?

Edition and source notes

Based on the linked 2024 Conestoga College source by Amit M. Mehta, containing seven chapters and appendices A–C. This independently written study guide does not reproduce the restricted instructor manual or its answer key. Verify current professional standards separately when carrying out a real engagement.

Consult the official source and full text.