IT audit
An IT auditor checks that systems are reliable and secure and that controls actually work, not just on paper. Financial auditors rely on this: the numbers come from the ERP, so the ERP itself must be trustworthy.
The core of the work: IT general controls (ITGCs), in four groups:
| Access management | Is access approved? Are leavers disabled? Are rights reviewed regularly? |
| Change management | Was every system change tested and approved before release? Can developers deploy their own code unreviewed? |
| Operations | Are backups taken and tested? Scheduled jobs monitored? Incidents logged? |
| System development | Do new systems go through requirements, testing and sign-off before launch? |
Sampling and evidence: auditors don't check everything. They take a sample (say 25 of 300 changes) and ask for evidence for each: an approval email, a ticket, a screenshot, a system log. The rule: “no evidence, it didn't happen”.
Watch outSQL makes a big difference in audit: instead of sampling, you can analyse every transaction and find, say, every invoice approved by the person who created it.