The Role of IT Auditors
Statement on Auditing Standards (SAS) 108 suggests that in complex IT settings auditors should consider assigning one or more computer assurance specialists (i.e., IT auditors) to the engagement in order to determine the effect of IT on the audit, gain an understanding of controls, and design and perform tests of it controls. In addition, SAS 109 notes the importance of IT with with respect to auditor’s assessments of control risk. For publicly traded corporations, Public Company Accounting Oversight Board (PCAOB) Auditing Standard 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an audit of Financial Statements, requires auditors to gain an understanding and test IT system controls in order to provide an opinion on the effectiveness of internal controls over financial reporting. These auditing standards, as well as companies’ adoptions of complex IT systems, have substantially enhanced the role of IT auditors on audit engagements.
A 2000 Study estimated that the number of IT auditors employed by one Big Five firm would grow from 100 to 5,000 between 1990 and 2005 (N.A. Bagranoff and V.P. Vendrzyk, “The Changing Role of IS Audit Among the Big five US-Based Accounting Firms,” Information Systems and Control Journal, vol. 5) and IT auditor testing can now represent a substantial portion of the financial statement audit work. IT auditors have become a chief source of audit evidence. For example, IT auditors’s tests of system access controls are relied upon by auditors when making control risk assessments. As technological developments continue, the use of IT auditors on financial audits will continue to grow, and auditors will need to expand their AIS knowledge and skills in order to perform effective and efficient audits.
The enhanced role of IT auditors on financial audits brings up three questions.
First, What do auditors think of IT auditors as a source of audit evidence? Second, how do these two professions interact on audit engagements? And third, under what conditions can this relationship be most productive?