Premium
Information Systems Risk and Audit Planning
Author(s) -
Bedard Jean C.,
Graham Lynford,
Jackson Cynthia
Publication year - 2005
Publication title -
international journal of auditing
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.583
H-Index - 21
eISSN - 1099-1123
pISSN - 1090-6738
DOI - 10.1111/j.1099-1123.2005.00267.x
Subject(s) - it risk management , audit risk , business , factor analysis of information risk , risk management , audit plan , audit , internal audit , risk management information systems , information technology audit , competence (human resources) , risk analysis (engineering) , control environment , accounting , information security management , risk assessment , control (management) , quality audit , it risk , information quality , joint audit , information system , computer science , management information systems , computer security , psychology , finance , security information and event management , engineering , cloud computing , artificial intelligence , cloud computing security , operating system , social psychology , electrical engineering
Auditing standard setters worldwide are focusing greater attention on the importance of corporate controls in general, and on information systems in particular. However, there is relatively little research on the nature of specific control risks in actual companies, and on the auditor's response to those risks. In this study, we examine client characteristics identified by external auditors for actual audit clients, which are relevant to two important areas of systems risk: system security and management information quality. To perform the study, we describe the types of client characteristics identified by the auditors as being relevant to planning, and relate those characteristics to systems risk assessments and testing plans. We find that auditors identify both systems risk factors (risk‐increasing characteristics) and positive factors (risk‐decreasing characteristics), although risk factors predominate. Systems risk factors are identified for a high proportion of clients, even those with relatively low risk assessments. Most frequently identified risk factors relate to system security, management style and competence, and outdated systems. We find that risk assessments increase with the number of identified risk factors for management information quality, but not for EDP security. Categorizing risk factors into COSO categories, we find that audit procedure planning for EDP security is associated with risk factors relating to control activities but not to control environment. For management information quality, audit procedure planning is associated with control environment and information/communication risk factors. The implications of these findings for audit research and practice are discussed.