Memahami dan Melakukan Audit Teknologi Informasi. Empower Your Auditor

Ukuran: px

Mulai penontonan dengan halaman:

Download "Memahami dan Melakukan Audit Teknologi Informasi. Empower Your Auditor"

Liani Yulia Budiono
6 tahun lalu
Tontonan:

1 Memahami dan Melakukan Audit Teknologi Informasi Empower Your Auditor

2 Memahami Audit T 2 Pengendalian dan audit TI Apakah diperlukan? Mengapa diperlukan? Bagaimana hubungan antara pengendalian audit?

3 Memahami Audit T 3 Cost of Data Loss Error in Decision Making Computer Abuse Cost of H/W, S/W & B/W Cost of Computer Errors Privacy Evolution Use of Computer Controls Audit

4 Memahami Audit T 4 TI dan Pengendalian Intern Apa dan bagaimana dampak TI pada pengendalian intern (internal control)? o Pemisahan fungsi o Sistem otorisasi o Dokumentasi dan pencatatan o Delegasi wewenang dan tanggung jawab o Pengendalian phisik atas aset dan dokumen o Akuntabilitas pencatatan o Sumber daya yang kompeten o Supervisi oleh manajemen

5 Memahami Audit T 5 TI dan Auditing Apa dan bagaimana dampak TI pada auditing? o Pengumpulan bukti o Penilaian bukti

6 Memahami Audit T 6 Audit dan Audit TI Level 1 The Generalist The `ordinary auditor, who is familiar with the issues and methods of IT audit, can undertake simple IT audit tasks, and can use IT audit specialists to serve general audit objectives. Level 2 The IT Auditor The auditor who has chosen to specialise in IT audit, skilled at undertaking most IT audits, except those in highly specialised areas of IT. Level 3 The IT Control & Security Specialist The auditor who, through length of experience, has become very familiar with IT and IT audit issues, and can undertake or supervise audit tasks including highly specialised ones.

7 Memahami Audit T 7 Definisi Audit TI atau Audit SI: 1. Ron Weber, Information System Control & Audit 1999 The process of collecting and evaluating evidence to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively, and uses resources efficiently 2. ISACA, CISA Review Manual 2005 The process of collecting and evaluating evidence to determine whether information systems and IT environments adequately safeguard assets, maintain data and system integrity, provide relevant and reliable information, achieve organizational goals effectively, consume resources efficiently, and have in effect internal controls that provide reasonable assurance that operational and control objectives will be met

8 Memahami Audit T 8 Sejumlah kata kunci: o Pengumpulan dan penilaian bukti o Keyakinan memadai o Tujuan operasional & tujuan pengendalian o Tujuan audit Pengamanan aset - menjamin confidentiality & availability Integritas Data - menjamin completeness, accuracy & consistency Efektifitas relevan, akurat, tepat waktu, lengkap Efisien - menggunaan sumber daya secara optimal

9 Memahami Audit T 9 Auditing Tradisional Manajemen Teknologi Informasi AUDIT TEKNOLOGI INFORMASI Ilmu Komputer Ilmu Perilaku

10 1 Bagaimana tahapan audit? o Pekerjaan pendahuluan o Perencanaan audit o Pengujian pengendalian (control testing) o Pengujian substantif (substantive testing) Bagaimana tahapan audit TI

11 1 Preliminary PRELIMINARY Assess Obtaining REVIEW Rely on Control Audit Work Understanding Control? Risk No Yes Test of Control Reassess Control Risk Still rely on Control? CONTROL TESTING Yes No Limited Extended SUBSTANTIVE Form Audit Opinion & TESTING Substantive Substantive Issue Audit Report Test Test SUBSTANTIVE TESTING

12 1 Faktorisasi Sistem (System Factoring) Sistem Level 0 Subsistem Subsistem Level 1 Subsistem Subsistem Subsistem Subsistem Subsistem Level 2

13 1 Faktorisasi Fungsi (Function Factoring) Fungsi-fungsi TI Sistem Manajemen Siklus Akuntansi Subsistem Manajemen Sistem Aplikasi Subsistem Aplikasi

14 1 Pendekatan Audit TI Audit around the Computer Audit through the Computer Audit with the Computer

15 1 Audit around the Computer INPUT OUTPUT PROSES Pertimbangan: Risiko bawaan rendah; logika aplikasi straightforward ; transaksi input adalah batched; pengendalian dilakukan melalui metode tradisional; pemrosesan hanyalah men-sorting input data dan meng-update master file sequentially ; jejak audit ada dan jelas; lingkungan relatif konstan; sistem jarang dimodifikasi

16 1 Audit Through the Computer INPUT OUTPUT PROSES Pertimbangan: Risiko bawaan tinggi; aplikasi memproses input & output dalam jumlah yang besar; pengendalian intern yang signifikan melekat dalam sistem; logika prosesnya kompleks; terdapat kesenjangan yang signifikan dalam jejak audit

17 1 Standar Audit TI Information Systems Audit & Control Association (ISACA) o Standards o Guidelines o Procedures

18 1 o 010 Audit Charter Responsibility, Authority and Accountability The responsibility, authority and accountability of the information systems audit function are to be appropriately documented in an audit charter or engagement letter. o 020 Independence Professional Independence In all matters related to auditing, the information systems auditor is to be independent of the auditee in attitude and appearance Organizational Relationship The information systems audit function is to be sufficiently independent of the area being audited to permit objective completion of the audit.

19 1 o 030 Professional Ethics and Standards Code of Professional Ethics The information systems auditor is to adhere to the Code of Professional Ethics of the Information Systems Audit and Control Association Due Professional Care Due professional care and observance of applicable professional auditing standards are to be exercised in all aspects of the information systems auditor's work. o 040 Competence Skills and Knowledge The information systems auditor is to be technically competent, having the skills and knowledge necessary to perform the auditor's work Continuing Professional Education The information systems auditor is to maintain technical competence through appropriate continuing professional education.

20 2 o 050 Planning Audit Planning The information systems auditor is to plan the information systems audit work to address the audit objectives and to comply with applicable professional auditing standards. o 060 Performance of Audit Work Supervision Information systems audit staff are to be appropriately supervised to provide assurance that audit objectives are accomplished and applicable professional auditing standards are met Evidence During the course of the audit, the information systems auditor is to obtain sufficient, reliable, relevant and useful evidence to achieve the audit objectives effectively. The audit findings and conclusions are to be supported by appropriate analysis and interpretation of this evidence.

21 2 o 070 Reporting Report Content and Form The information systems auditor is to provide a report, in an appropriate form, to intended recipients upon the completion of audit work. The audit report is to state the scope, objectives, period of coverage and the nature and extent of the audit work performed. The report is to identify the organization, the intended recipients and any restrictions on circulation. The report is to state the findings, conclusions and recommendations and any reservations or qualifications that the auditor has with respect to the audit. o 080 Follow-Up Activities Follow-Up The information systems auditor is to request and evaluate appropriate information on previous relevant findings, conclusions and recommendations to determine whether appropriate actions have been implemented in a timely manner.

22 2 Code of Professional Ethics: 1. Support the implementation of, and encourage compliance with, appropriate standards, procedures and controls for information systems. 2. Perform their duties with due diligence and professional care, in accordance with professional standards and best practices 3. Serve in the interest of stakeholders in a lawful and honest manner, while maintaining high standards of conduct and character, and not engage in acts discreditable to the profession. 4. Maintain the privacy and confidentiality of information obtained in the course of their duties unless disclosure is required by legal authority. Such information shall not be used for personal benefit or released to inappropriate parties. 5. Maintain competency in their respective fields and agree to undertake only those activities, which they can reasonably expect to complete with professional competence 6. Inform appropriate parties of the results of work performed; revealing all significant facts known to them 7. Support the professional education of stakeholders in enhancing their understanding of information systems security and control.

dokumen-dokumen yang mirip

Risiko-risiko Umum TI

Konsep Audit TI Risiko-risiko Umum TI Organizational Costs of Data Loss Costs of Incorrect Decision Making Costs of Computer Abuse Value of H/W, S/W & B/W Maintenance of Privacy ORGANIZATIONS High Costs