The complexity of the technology architectures typically in place across financial services may cause significant challenges for IT management, particularly post integration with other environments or where there is a high reliance on legacy systems. Legacy systems can pose a number of risks, such as security vulnerabilities, shortage of skills to manage and externally support the systems effectively, increased complexity caused by add-on interfaces to core systems and limited interoperability. Given these risks, there are clear linkages and cross-overs with the, previously highlighted, cyber-security and resilience hot topics which have increased the level of focus
internal audit functions are placing on technology architecture. It is imperative that internal audit work closely
with stakeholders in IT to understand the technology architecture and ensure they can achieve sufficient audit
coverage of legacy platforms, interfaces and information flows. We are also seeing internal audit functions
participate in programmes related to changes in the technology operating model allowing them to provide an
early view and independent opinion on the suitability and viability of the target state.