Computer Auditing Quality Assessment Based on Human, Technical and Contextual Factors

Abstract

Computer auditing quality has been defined by results obtained in the process. Meanwhile, multiple studies have been done to enhance it therefore, it continues to be a topic interest and research so it is worth mentioning that its quality relies on trained competent auditors and experts able to develop a process correctly, adapting to clients and to manage auditing inherent risks. According to results from the computer audit, low quality and security levels have been identified in terms of the human, technical and contextual factors, affecting audit quality. The objective of this investigation is to identify metrics and to determine their own corresponding factor applying an exploratory type of research. To achieve such aim, a targeted survey was designed and implemented at the Institute of Internal Auditors of Ecuador since they have the knowledge and expertise in the field. A factor analysis statistics technique was applied to data gathered to verify that it relates to the identified factors as dimensions are reduced, thus the most impacting metrics may assess the quality of computer audits. Analysis results yielded a mean score for each one of the assessed metrics, concluding that the technical factor is the most significative since it relates roles and task performance during the auditing process as well as control procedures. Finally, most auditing quality-related issues are mainly the outcome of an inferior management auditing process, therefore it is crucial that collegiate groups and professionals in the field validate the auditing process.

Appendix A. Computer Auditing Quality Metrics

Code	Metric	Source
M1	Auditing team leader or individual possesses leadership skills	[9, 28]
M2	The (auditee)organization’s representative possesses leadership skills	[9, 28]
M3	Personnel performing the audit has ample auditor experience	[2, 3, 10, 11, 13, 14, 16, 18, 26]
M4	Auditing team members demonstrate honesty and respect when doing their job	[3, 9, 16]
M5	Members of the auditing team perform their audit ethically and transparently	[3, 9, 16]
M6	Auditor team keeps a cordial and verbal and written respectful relationship with the auditee	[10, 11, 18]
M7	Auditing team fulfills client requirements	[10, 11, 18]
M8	Auditor knows how to listen and is receptive to the client	[10, 11, 18]
M9	Auditing team makes sure the client takes part in the entire auditing process	[10, 11, 18]
M10	Auditing team has client approval of the tasks developed	[10, 11, 18]
M11	Auditing team and client direct efforts to a common goal	[10, 11, 18]
M12	Personnel performing the audit the required competence to perform their job	[4, 9, 11, 16, 28]
M13	Auditing personnel has the ability to deal with sensitive situations	[4, 9, 11, 16, 28]
M14	Auditing personnel exhibits assertiveness in problem solving and demanding situations	[4, 9, 11, 16, 28]
M15	Auditor possesses soft skills personal characteristics and competencies that demonstrate the auditor gets along with others	[4, 9, 11, 16, 28]
M16	Auditing personnel effective suggestions to the institution to be audited	[4, 9, 11, 16, 28]
M17	Auditing personnel has observation skills	[4, 9, 11, 16, 28]
M18	Auditor respects client information and confidentiality	[3, 9]
M19	Auditor keeps an open mind when new ideas are suggested	[3, 9]
M20	Auditor is confident of himself and his job	[3, 9]
M21	Auditing team continues being independent in appearance and action	[18, 28, 29]
M22	Auditing team does not get involved in activities that compromise their independence	[18, 28, 29]
M23	Auditor reports to the person in charge events that may affect his independence	[18, 28, 29]
M24	Auditing team focuses on facts	[12, 16, 29]
M25	Auditing team demonstrates objectivity and integrity	[12, 16, 29]
M26	Auditing team executes the audit impartially and with no prejudice	[12, 16, 29]
M27	Auditing team is supported to reach their goals	[16]
M28	Auditing team demonstrates a great deal of effort to perform the audit	[30]
M29	The auditor is concerned for his training and continuing training	[26]
M30	Auditor has national and international certifications in the auditing and computer auditing field	[26]
M31	Auditor exhibits skepticism during the entire auditing process	[3, 4]
M32	Auditing team expertise add value to the auditee –the organization	[3, 14, 18]
M33	Members of auditing team demonstrate confidence regarding information security and data processing	[3, 14, 18]
M34	Clients disputes are dealt with appropriately and objectively	[3, 11]
M35	Auditing team is available to attend to clients inquiries	[3, 11]
M36	Those involved in the audit keep frequent communication	[3, 11]
M37	Auditing team hold regular formal indelible meetings for analyses progress and results	[13]
M38	Auditors link up with experts as a support in the auditing process to obtain client recommendations and results	[11]
M39	Auditing team appropriately selects consultants and experts	[11]
M40	Auditor follows policies and procedures that regulate ethical and professional compliance	[27, 31]
M41	Auditing team uses templates and forms to document the process	[9]
M42	Auditing team has approval procedures for completed auditing tasks	[9]
M43	Auditor and those responsible for the organization auditee- follow up on auditing previous computer auditing issues	[9, 28]
M44	Audit findings and conclusions are an exact reflection of the audited process real facts	[12, 29]
M45	Auditing results are totally supported and documented by auditing gathered evidence	[12, 29]
M46	Members of the auditing team and those responsible for the institution protect at all times information used in the process	[29]
M47	Auditing team achieves objectives planned in the auditing	[12, 29]
M48	Findings, conclusions, and recommendations were positively approved by the client	[12, 29]
M49	Auditing assigned resources go accordingly to audit relevance and complexity	[12, 29]
M50	System, process, and audited subject is important to the organization	[12]
M51	Client understands the process and purpose of the computer auditing	[12]
M52	In the scope, all required elements for a successful audit are addressed	[12, 17, 18]
M53	Audit execution complies with the elements agreed in the scope	[12, 17, 18]
M54	Results are delivered in the appropriate and established time	[12]
M55	Risk evaluating model is comprehensive	[4, 10, 11]
M56	Auditing plan takes into account client-related risks	[4, 10, 11]
M57	Auditing team is committed to the auditing completion deadline	[2, 3, 11]
M58	Auditing process is developed accurately	[3]
M59	Results from the auditing report are clean and concise	[3, 9, 10, 12]
M60	Scope, findings, and recommendations are understandable for anyone that makes use of the audit report	[3, 9, 10, 12]
M61	Reports presentation is done under policies, standards, manuals, practice, and computer guidelines	[3, 9, 10, 12]
M62	Auditing team performs fieldwork adequately	[3, 17, 18]
M63	Auditing is executed under computer auditing policies, standards, manuals, guidelines, and practice	[3, 17, 18]
M64	Auditing team is having ample knowledge of auditing evidence gathering techniques	[3, 17, 18]
M65	All tasks are developed according to planned	[3, 17, 18]
M66	Verification lists are completed, approved, and documented	[3, 17, 18]
M67	Work field is checked by an expert	[3, 17, 18]
M68	Client or those responsible for the organization provide data gathering support	[17, 18]
M69	Information and results from previous audits are available for revision	[17, 18]
M70	Auditing plan is developed according to computer auditing policies, standards, manuals, guidelines, and practice	[17, 18]
M71	Objectives and auditing scope are appropriately specified	[17, 18]
M72	Auditing tasks and tools are clearly described	[17, 18]
M73	Auditing team members have a clear and coherent understanding of the auditing plan	[17, 18]
M74	Budget and audit schedule are set up adequately	[17, 18]
M75	Required resources to perform the auditing are evaluated	[17, 18]
M76	Personnel and equipment required assigned by the auditing are evaluated	[17, 18]
M77	Auditing plan is addressed, made, checked, and approved by supervisors and those responsible for the organization and auditing team members	[17, 18]
M78	Auditing team uses computer auditing methodology to plan, manage and develop audits	[11, 18]
M79	Auditing team uses technological tools and updated methodologies to perform their job	[11, 18]
M80	An institution organizational structure is reflected on the auditing plan	[3, 9, 11, 18]
M81	Auditor promotes through an organizational culture based on computer security good practice	[3, 9, 11, 18]
M82	Auditing team follows strict quality procedures	[3, 4, 10]
M83	The auditing team leader is committed to quality control systems	[3, 4, 10]
M84	Norms and regulations issued by control organisms are reflected on auditing plans	[3, 11]
M85	Auditing team presents recommendations that the organization should follow because of international standard updates, local regulation, strategic objectives and change in the auditing environment	[3, 11]
M86	Auditing team is knowledgeable in terms of relevant information of the laws and regulations that may have a significant impact on audit objectives	[3, 11]
M87	Auditing team has the required permits to develop and auditing process	[3, 11]
M88	Disciplinary measures are applied in case of auditing plan or current regulatory legal standards non-compliance	[3, 11]
M89	Auditing team es fully prepared before the risk of litigation	[3, 28]
M90	Auditing team has access to technical and human resources for a specialized audit	[17]
M91	Auditing team has access to required resources to comply with the scope and auditing calendar	[17]
M92	Audit cost commensurate with tasks developed and complexity	[10, 14, 28]
M93	Auditing team is aware of internal controls	[28]
M94	Auditing team identify client internal control system key elements	[28]