Lastly, the auditor needs to be aware of system stoppages, downtimes and
the process to analyze root causes. Many organizations invest a significant
amount of time and resources to resolve problems and perhaps not enough
time to identify their root causes. An auditor can help provide an objective
assessment to senior management as to whether or not the balance
between incident management and problem solving is reasonable. System
logs will help in these determinations.
It is important not to underestimate the value and importance of staying
up-to-date on the IT world. If these three areas are not operating effectively
and as designed, running any kind of CAATs will be challenging as the data
and routine integrity come into question.