GTAGs 14 and 15 tackle spreadsheets, databases, and information security governance

The IIA is releasing two new issues of its ongoing Global Technology Audit Guide (GTAG) series – both aimed at helping internal auditors and their management learn about and assess technology related risks.

Almost every organization uses some form of User Developed Applications (UDAs) such as spreadsheets and databases. They can be easily developed, cost effective to produce, and changed with relative ease. However, risks such as data integrity, availability, and confidentiality can pose threats to an organization and internal auditors may consider auditing UDAs. New GTAG 14, Auditing User-developed Applications, explores, among other topics, how best to risk rate and scope a UDA audit. The 32-page GTAG also proffers a sample audit program, best practices for implementing controls over UDAs, and advice on how internal auditors can work in a consulting role to help management develop an effective UDA control framework

“In most organizations, selected staff members are permitted as a matter of business necessity to extract, manipulate, analyze, and report on enterprise data using spreadsheets, databases, or other user-developed applications (UDAs). This practice gives rise to risks concerning data integrity, availability, and confidentiality,” said IIA Director of Standards and Guidance Lisa Hirtzinger, CIA.

Standard 2110.A2 of The IIA’s International Standards for the Professional Practice of Internal Auditing requires the internal audit activity to assess whether the organization’s information systems sustains and supports agreed-upon strategies and objectives. New28-page GTAG 15, Information Security Governance (ISG), explores internal auditing’s roles in and responsibilities for overseeing IT security. It assists organizations in incorporating an audit of ISG into the audit plan, focusing on whether the organization’s ISG activity delivers the correct behaviors, practices, and execution of information services.

“IT failures, especially information security (IS) breaches, can place the organization at risk for reputation damage, diminished competitiveness, noncompliance with laws and regulations, and other adverse consequences,” added Hirtzinger. “These impacts should not be underestimated.”

GTAGs, which are written in straightforward business language to address timely issues in IT management, control, and security, are strongly recommended, but not mandatory, guidance under The IIA’s International Professional Practices Framework. They are available from The IIA at www.theiia.org/guidance/standards-and-guidance/ippf/practice-guides/gtag/.