Inside and Out

According to John Pavlakis, a principal with Ernst & Young, a good IT auditor has a sound understanding and appreciation of the business and its risks. The role of internal IT audit, he says, is to review the IT department and IT projects on a day-to-day basis, and as such internal auditors tend to look at aspects of compliance and design.

Then organisations tend to bring in external people when there are more specialised aspects of control that need to be looked at, such as in high-risk applications of technology, where the necessary skills may not reside in-house full time due to need and cost. On high-risk projects, directors often want a second and independent assessment as well, Pavlakis says. In addition, as part of an annual external audit, a very general assessment is made of the IT systems but the focus of that assessment is on the financial recording systems and the integrity of the financial information therein, not the operational systems, he adds.

Pavlakis admits that some CIOs and their departments do see auditors as a necessary evil. While they see the value of an audit, they also see it as a cost, but his advice is to view it as something you want to happen with you, not to you. For although a lot of organisations may say and think they are best practice, there is always room for continuous improvement. So rather than take the "don't throw any stones at my house" attitude towards auditors, he advocates the "open the door, come in" approach.

"Good auditors try to interact and engage," Pavlakis says. "They will come with an agenda and through that will ask CIOs for information, to provide access to people, share insights on where they see the risk, and be engaged to have that challenged. I think that is the way [CIOs] can get a lot more value out of the process and feedback on how they are doing. The biggest issue for IT auditors is understanding the business and the type of technologies it uses, and the quicker they can engage and do that, the more time they can spend auditing and giving feedback."

Withnall, though, remains somewhat sceptical. He believes auditors like to point out ways to improve things so they look as if they're adding value. However, he personally thinks they add less value than they think they do, or in the case of external auditors, for the fee they charge, but says they do provide true value in that they reinforce people's confidence in systems.

"If you're a $1 billion company you want to know the accounts are kept on a system that's reliable and that the data is available and will still be available seven years from now," Withnall says. "However, from a CIO level, as you have to do more with less and you get lean and mean, auditors tend to come in and want Rolls-Royce type systems and hence make management recommendations that way. So I view them as an expense and I view them almost as an inventors' club rather than being on my side and truly evaluating whether the business has the right balance between cost and delivery."

Despite the current emphasis on corporate governance and accountability, Withnall thinks less auditing of IT is occurring because systems such as ERP or known-brand systems are now much stronger, and consequently so is the confidence in them. But even he admits that he once benefited from an audit.

"It was within the first 10 days of my arrival at the organisation that the chief internal auditor from the parent company came to see me and presented me with a report done by Deloitte. His answer was this external audit means your systems are marked "F" for failed. I looked at him and said with joy in my heart: 'That's fantastic', on the grounds that I could do nothing but improve and achieve," Withnall says.

"It still took 10 minutes to get a smile."