IT Audit Techniques - Inquiry, Observation, Inspection

When to use Inquiry: It is best to use inquiry to gain a basic understanding of complex processes and is always used in combination with observations and inspections. Strengthen Inquiry with: Corroboration- inquire with multiple people when possible or use it to supplement another form of testing or evidence. Avoid relying on inquiry alone when possible. Common Pitfalls to Avoid: Verify the person you are inquiring with has appropriate expertise, job title and authority to speak on the record concerning the control/process being verified. Always note the time of inquire and job title of the people inquired with and obtain written inquiries when possible

When to use Observation: It is best to use observations for controls related to physical security, logical security automated controls, data center hardware and for many process controls (this may overlap with re-performance). Examples may include:

• Verifying that various data center safe guards such as fire suppression systems, UPS devices and HVAC systems are in place.
• Verifying that keycard and biometric access systems, security cameras and locked server cages are in place and operating effectively.
• Verifying that certain processes and automated controls in software exist and operate as described (this may overlap with re-performance).

Strengthen Observations with: Pictures of physical facilities if possible and screenshots of systems and processes in place- with system generated timestamps included on all pictures/screenshots collected. Common Pitfalls to Avoid: Be sure to address all details of the control during observations the first time. Observations virtually always require the assistance of the client and sometimes travel, so carefully read each control and observe all aspects of the control, document sufficiently, and get it right the first time.

When to use Inspection: Inspection is appropriate when having to verify controls that pertain to entire populations are in place, such as those related to logical access and change management systems. Inspection is also applicable to reviewing company policies and verifying that proper segregation of duties is in place. Examples may include:

• Verify that users with access to corporate IT systems are all current employees and that access is appropriate based on job title and responsibilities by assessing/testing a sample of users from a system-generating population.
• Verifying samples of change management tickets and testing for appropriate segregation of duties, management approvals, rollback procedures, etc.
• Reviewing Master Service Agreements, organization policies, and organization charts for various attributes.

Strengthen Inspections with: Thorough documentation that allows for recreation of the testing process during the review phase and through pairing with Inquiry and Observation when possible. Common Pitfalls to Avoid: Pay attention to the timing of population creation to avoid sampling outside the audit period. Take appropriate measures to ensure that populations are complete (through inquiry, inspection of query parameters, and research of the systems in place). Always insist on system generated populations that include system date and time, also observe the queries and parameters used to generate any populations/reports.

When to use Re-performance: Re-performance is best used to verify automated IS processes are in place and operating effectively. Strengthen Re-performance with: Complete documentation of the Re-performance process from start to finish, to help the reviewer gain assurance that the process was accurately re-performed. Include sample input values, query parameters or files used during the process and their output, in the documentation. Common Pitfalls to Avoid: According to ISACA, a re-performance of a control is technically supposed to be independently performed by the auditor. Be aware of how client interactions might interfere or impact the re-performance process. For example, in cases where you must rely on the client to re-perform a control or process, abstain from leading the client or dictating the control to them. Focus on re-creating the process as it operates in day-to-day operations, then verify that it conforms to the official process and control description.