Information technology auditing is one of the elements of good corporate governance. These audits evaluate functions and systems from different perspectives, such as security, quality, service, efficiency, reliability, confidentiality and capacity.
An information system is not just a computer. The information systems within the University of Saskatchewan are complex and have many components that are pieced together to make up business processing solutions. Assurances can be obtained only if all of the componets of the information system are evaluated, secured, and have the appropriate controls in place. Depending on the type of audit or department, the control objectives that may be focused on include:
Governance, strategy and direction;
General organization and management;
Access to data and programs;
Systems development methodologies;
Data processing operations and quality assurance procedures;
Systems programming and technical support functions;
Disaster recovery planning;
Database administration;
Network administration; and,
Physical access controls.
The Division of Audit Services currently uses the risk-based audit approach in carrying out information system audits. Characteristics of this approach include:
Identification of the highest risks to the University’s critical information systems;
Examination of information based on the risk ranking from the risk assessment;
Observation of new information system projects and monitoring the implementation phase of new systems; and,
Provision that internal controls provide reasonable assurance that the information systems and related resources:
