Internal auditing covers a broad range of areas that includes a lot of regulation. Even more focus is on information technology. “As the demands of traditional audits responsibilities and the growing burden of information security evolve, the industry is beginning to see emerging trends in internal auditing departments across many organizations” (Hirth, 2012). Information technology controls continue to increase in importance to today’s organizations as reliance on technology and compliance requirements increase. Deficiencies in information technology controls can have a significant impact on the organization. According to a 2011 presentation by public accounting firm Deloitte & Touche, the following are some of the top emerging information technology emerging issues. Social networking and social media technologies is expanding into new areas, including user communities, business collaboration, and commerce. The risks in this area include brand protection, unauthorized access to confidential data, and regulatory or legal violations. Historical audits are not sufficient to determine risks in this area as the medium is constantly changing. The audit plans should be updated every year based on a review of social media usage within the company with an eye on emerging risks. Mobile devices, including cell phones and tablets have become common workplace tools. These devices do not maintain the same level of data security as the organizations stationary network. There is a risk of loss of business data through the loss or theft of the phone or tablet or a breach of security with a virus. The mobile devices are also not as secure to the user access as the network. Again, historical audits are not sufficient to determine risks in this area. The organization would need to determine what devices are currently being used, the company’s current policies and procedures, the ability of the information technology department to “push down” controls to the selected devices, etc. For example, the ability to wipe sensitive information from a device remotely should the device be lost, stolen, or otherwise compromised. Malware, or malicious software, increases in sophistication daily. It also has more ways to access the organizations data, such as mobile devices and tablets. Along with this, most computers are setup with local admin access so that employees can work from home. The risks include the loss or theft of critical information, hardware impacts, and cash impacts. The internal audit department should understand the organizations approach to malware identification, isolation, and remediation. They should also consider the impacts to mobile devices and update schedules and monitoring.
The economic downturn has forced some organizations to cut back on critical information technology investments. As these organizations resume these projects, even with reduced staffing levels, there is the risk of project delays or even failures, completed projects that do not have the necessary security and controls, insufficient vendor management, and a failure to meet business objectives. These projects should be included in the organization’s annual audit plan so that a proper risk assessment can be completed along with providing the needed guidance on necessary security and controls. If it is not done until after the project is complete it creates additional risks. External computing solutions, also known as The Cloud, have grown in popularity. These solutions are provided by another organization to yours as a service over a network, such as the internet. With these services, provided by a third party, the internal audit department would not necessarily have administrative access. There are also risks regarding data management, such as the location of the network, compliance with regulations, recovery of data, and data security. The internal audit department would need to identify the cloud strategies in use or planned and determine what data is impacted. They would then need to perform a risk assessment of that data. They would then have to identify controls that could be put into place to mitigate those risks. It would be best if these things could be done prior to the implementation of the solution so that the mitigation controls could be included within the agreement with the service provider. Electronic Records Management, or paperless records, is an increasing area of information technology. This provides for risk with loss of data in the conversion process, regulatory violations if there are inadequate controls, and storage, retention, and forensic issues. The internal audit department will need to determine the extent of the electronic records management deployment; identify the impacted data and processes; and ensure that the data is mapped against existing data management policies, procedures, and legal requirements. Finally, they will need to evaluate the storage controls and monitoring and test these controls as they deem necessary. Information technology is constantly evolving and internal audit must evolve with it. If the auditors are not current with these and other emerging issues they will not be prepared to determine a risk involved when auditing an area of the organization that employs them and it will leave that organization open to possibly significant risk. References
Hirth, R. (2012). Emerging issues in internal auditing. RB Publishing Inc. Retrieved from http://documentmedia.com/ME2/dirmod.asp?sid=&nm=&type=Publishing&mod=PublicPublic
Deloitte (2011). Top 10 emerging it audit issues. Deloitte. Retrieved from http://www.nyiia.org/events/Top_10_2011_Emerging_IT_Audit_Issues.pdf