Activity: Review of the IT Audit Responses

Introduction

In some circumstances, the IT audit engagement is not complete upon report issuance (Davis, 2005, 2011) because the IT audit team members have a responsibility to determine the taking of appropriate actions concerning findings and recommendations (Cascarino, 2012; Davis, 2011). If the audit function has responsibility for performing follow-up activities, the assigned IT auditors must apply audit follow-up procedures addressing the audit area risks (Davis, 2011). Contextually, appropriate follow-up is necessary to assure the effectiveness of the corrective actions and to establish or re-establish confidence in the items or services found inadequate during the engagement (Davis, 2011). Therefore, the audit follow-up process includes carrying out sufficient, timely follow-up procedures to verify that managerial actions addressed weaknesses promptly (Davis, 2011; ISACA, 2014a).

Findings are IT auditor fact acquisitions that directly support and evidence conclusions as well as recommendations (Davis, 2011). Findings are also the product of all previous audit work related to the audit area under examination (Davis, 2011). Usually, an audit finding represents the difference between expected and actual audit area conditions during the current engagement period (Davis, 2011). Findings are the primary source from which opinions flow to the IT audit report (Davis, 2011).

IT audit team members draw IT audit area recommendations from finding scenario extrapolation (Davis, 2011). Notably, IT audit recommendations represent a solution regarding an existing condition as corrective action or operational improvement (Davis, 2011). In a consulting capacity, recommendations can guide audit area management in achieving objectives (Davis, 2011).

After reporting findings and recommendations, the assigned IT auditor must request and assess relevant information to conclude whether appropriate actions were taken by management as expected (Cascarino, 2012; Davis, 2011). The resolution of audit comments resides with audit area management (Davis, 2011). If the proposed auditee corrective actions for implementing or otherwise addressing recommendations were discussed with or provided to the assigned IT auditor, designed corrective actions inscription occurs in the final IT audit report and the engagement tracking system as management responses (Davis, 2011).

Within the engagement tracking system, information concerning IT audit follow-up items necessitates capturing in an audit findings database. The audit findings database is a collection of IT audit area issues. Sustaining the audit findings database assists in ensuring that the audit area issue treatment occurs as inscribed in the IT audit report response. The audit findings database needs to capture the:

• •

  audit report number,

• •

  comment description,

• •

  auditee response,

• •

  corrective action implementer,

• •

  criticality ranking,

• •

  completion status, and

• •

  completion date (Davis, 2011).