I
n the vol. 1, 2006, issue of this Journal, the IT Audit Basics
column focused on the pervasive usefulness of Control
Objectives for Information and related Technology (COBIT)
in performing the various duties of the information technology
(IT) auditor, especially in light of the scandals of the last 10
years. In recent years, the Committee of Sponsoring
Organizations of the Treadway Commission (COSO) model of
internal controls has not only received attention, but has also
been applied in the auditing profession with increasing
frequency. This article focuses on how the IT auditor can
effectively apply the COSO model to help fulfill obligations of
recent standards, especially those included in the Risk Suite1
auditing standards from the American Institute of Certified
Public Accountants