Auditing Information Systems

Amit M. Mehta’s Auditing Information Systems connects technology risk with governance, controls and evidence-based assurance. Seven chapters move from the audit role and professional expectations to planning, IT general controls, application controls, reporting and follow-up, with three supporting appendices.

How to study this book

Build a fictional audit file that separates objectives, risks, controls, tests, evidence and findings. Identify the system boundary and relevant data before choosing a tool. Distinguish management’s monitoring from independent assurance, and authorised testing from unrestricted access. Check current professional requirements before applying the source’s standards discussion in real work.

Chapter-wise explanations and study tasks

Chapter 1 — Introduction to IS Auditing

IS auditing assesses how systems support objectives, protect resources and maintain dependable information. The chapter distinguishes scope, audit types and the skills required for the role. A technically interesting issue is not automatically material to every engagement. Start with the business purpose and the assurance question before deciding which systems and controls to examine.

Study task: Define a fictional IS audit objective and identify what would remain outside its scope.

Chapter 2 — Standards and Continuous Frameworks

Professional standards, ethics, computer-assisted techniques, continuous approaches and quality improvement support reliable audit practice. Tools can expand testing but do not supply judgement or independence. Keep framework requirements separate from a particular software capability, and identify what evidence would demonstrate conformity with the source’s expectations.

Study task: Assess a fictional audit-tool proposal for evidence quality, objectivity, authorisation and review requirements.

Chapter 3 — Planning an IS Audit

Risk-based planning connects organisational priorities with scope, materiality, procedures and sampling. A plan should explain why the proposed work answers the audit objective and which uncertainty will remain. The case study helps link an overall plan with a detailed programme. Avoid choosing tests merely because the data are convenient.

Study task: Design a short audit programme linking each risk to a control, test and expected evidence.

Chapter 4 — Enterprise Governance, Risk Management and Controls

Governance sets direction and accountability, while risk management and controls help support objectives. The chapter introduces frameworks without making them substitutes for understanding the organisation. A policy’s existence is distinct from its effective operation. Trace who decides, who implements and who receives assurance before evaluating the arrangement.

Study task: Map responsibility for a fictional system change across governance, management and independent assurance.

Chapter 5 — IT General Controls

Development, change, access, security, operations, continuity and data practices shape the environment in which applications work. The chapter also considers projects, cloud and mobile contexts. A control’s label does not prove its design or operation is effective. Evidence must fit the period, population and risk being examined.

Study task: Compare design and operating-effectiveness tests for one authorised access-management control.

Chapter 6 — Application Controls

Application controls address processing at a more specific level, including how information enters, is handled and is reported. Their effectiveness can depend on the wider technology environment. The chapter’s case encourages readers to connect a stated rule with actual evidence. A successful test case alone may not establish dependable operation across the relevant population.

Study task: Design an authorised test of a fictional input-validation control and explain the limits of the sample.

Chapter 7 — Communicating and Reporting

Findings need a traceable connection between evidence, criteria, significance and a practical response. Quality assurance and stakeholder communication improve clarity without weakening the conclusion’s limits. Follow-up should verify whether the underlying issue has been addressed rather than merely whether an action was closed administratively.

Study task: Draft a fictional finding and specify evidence needed to verify an effective corrective action.

Appendix A — Emerging Trends

Emerging technologies create new arrangements and risks but still require clear objectives and evidence. The appendix is a source-edition view of developments, not a current inventory of all relevant threats or tools. Examine what changes in the risk mechanism rather than assuming novelty automatically requires a wholly new audit method.

Study task: Choose a trend and identify which existing control objective remains relevant and which new question it raises.

Appendix B — Tools and Technologies

Audit tools support collection, analysis and documentation under defined conditions. Their outputs depend on configuration, data quality and authorised access. Select a tool because it helps answer an audit question, and plan validation of its results. More data is not automatically stronger evidence.

Study task: Create a tool-selection checklist covering purpose, permissions, data integrity, reproducibility and review.

Appendix C — Ethics

Ethical conduct concerns how information and authority are used throughout an engagement. Confidentiality, competence and objectivity are practical requirements, particularly when an auditor can access sensitive systems or records. A useful result does not justify an unauthorised method. Consider the people affected as well as the technical objective.

Study task: Analyse a fictional request for unnecessary sensitive data and propose a proportionate, authorised alternative.

Applied assignment

Prepare a fictional IS audit file with a risk assessment, programme, evidence plan, finding and follow-up procedure. Explain the boundary between management responsibilities and assurance and identify permissions required before any real testing.

Suggested reading plan

Read Chapters 1–2 for role and expectations, 3–4 for planning and context, 5–6 for controls and 7 for reporting. Use the appendices to assess tools, developments and ethics throughout the file.

Questions for reflection

• What assurance question does the evidence answer?
• Does the test address design, operation or both?
• Which conclusion would exceed the scope or quality of the evidence?

Edition and source notes

Based on Mehta’s 2024 Conestoga resource, covering seven chapters and three appendices. These original tasks are academic scenarios, not copied instructor-manual answers. Professional frameworks, technologies and standards require current verification for real engagements.

Consult the official source and full text.