Business Skills for the IT Audit and Assurance Professional

摘要

A survey conducted in 2008 among audit committee members and auditors reporting to audit committees indicated that information technology, in itself, was not a key-issue that audit committees could address. What was key was business, the uses business made of technology, the threats and risks associated with those uses, and the steps taken to mitigate those risks. The survey indicated that audit committees focused on business issues and treated technology as an enabler in business processes. A common theme was, "Do not tell me what controls are not effective; tell me what business process may be compromised, what business processes I cannot rely on, and their potential impacts if I do not address the risk." In other words, the IT audit and assurance professional must become more business-focused.