Understanding Information System Audits: Processes, Content, and Challenges

Information System Audit Process

Determine audit scope Identify the specific systems, functions and organizational units that will be examined.

Define audit objectives Collect evidence to confirm that internal controls exist and effectively reduce business risk. Typical objectives include confidentiality, integrity, availability and regulatory compliance.

Specify audit standards Adopt a written methodology of audit procedures approved by the audit organization to ensure consistency.

Execute audit procedures Follow a planned strategy to obtain sufficient, relevant and reliable evidence. Activities include gaining an understanding of the auditee, detailed planning, testing (compliance and substantive) and documentation.

Examine and evaluate audit evidence Evidence may consist of observations, interview records, supplied documents and test results.

Communicate audit results Discuss findings with management, describe the significance of each finding, the risks of not correcting control deficiencies and propose remediation.

Form audit conclusions and opinions Produce an audit report and implement a follow‑up program to verify that remediation actions have been implemented effectively.

Audit Content

IT Governance and Management

Assess alignment of IT functions with the organization’s mission, the control environment and the value derived from IT investments.

Information System Development

Audit project management, development methodologies (incremental, iterative) and maintenance. Key focus areas include portfolio management, organizational forms, communication, lifecycle phases (initiation, planning, control, closure) and configuration management.

Information System Operations

Cover service management, incident, problem, change and release management, quality assurance and infrastructure management (hardware, software, network). Evaluate disaster‑recovery and business‑continuity planning, including responsibility, scope, documentation and testing of recovery procedures.

Information Asset Protection

Evaluate policies, standards, processes and controls that ensure confidentiality, integrity and availability. Examine security management, logical‑access policies, security baselines, off‑boarding access controls and security‑awareness training.

Significance of Information System Audits

Enhance security posture Audits identify and eliminate vulnerabilities, providing a more robust security framework.

Ensure compliance Audits verify that information systems meet applicable laws, regulations and industry standards.

Improve business efficiency Audits uncover inefficient resource use and recommend optimizations that streamline operations.

Challenges Facing Audits

Technology evolution Cloud computing blurs system boundaries, making scope definition difficult. Big‑data volumes overwhelm traditional analysis methods. IoT introduces heterogeneous devices with weak security, increasing overall risk. AI’s data‑centric, autonomous nature creates opacity and new threat vectors.

Regulatory and standard changes New or revised regulations require auditors to revise audit plans, redesign procedures and expand content to maintain comprehensive coverage.

Rapidly evolving threats Advances in attack techniques demand continuous learning so auditors can assess emerging risks effectively.

References

北京谷安天下科技有限公司. 国际注册信息系统审计师（CISA）培训讲义.

李峥, 张岚舒. 直面人工智能伦理挑战. 瞭望, 2023‑52.