Information Technology Audit

Technological integrity is important for any organization, but it is vital for public companies, financial institutions and insurance companies – three of the types of organizations in which we specialize. Critical financial and customer data flows through interconnected data centers and networks – tools that by their very nature constantly evolve. Unless you continually monitor, assess and upgrade your technology environment, it can begin to work against you – quickly. As such, IT auditors must constantly expand their knowledge and understanding of IT systems to help ensure your security and functionality. This function, however, is often not readily available in-house and requires an outsourced IT auditor. PKM has developed such a resource in recent years.

An information technology audit (also known as an information systems or electronic data processing [EDP] audit), is an examination of the controls within an organization’s information technology infrastructure. PKM’s information technology audit is performed as a standalone engagement or as part of another attest engagement, such as a financial statement audit, outsourced internal audit or Sarbanes-Oxley Section 404 (SOX) documentation and testing procedure. During the information technology audit, PKM’s certified IT professionals collect and evaluate evidence of an organization’s technology systems, practices and operations. The result is a summary of how the organization’s technology environment operates and an assessment of how well the organization safeguards its assets, maintains data integrity and operates effectively and efficiently to achieve its goals or objectives.

PKM’s outsourced IT internal audit services are typically provided to clients who have established internal audit departments, but are without internal IT audit resources. Unlike the IT general controls review, we are typically in the position of assisting clients in the execution of their internal audit plan based on an internally developed risk assessment. In some cases, we even assist management in the development of this risk assessment. This process can be structured to encompass the testing requirements under Sarbanes Oxley Section 404 (SOX).