Veronika Macháčková-Koch
Director - Audit
|
Purpose: Prepare your team to provide complete, reliable, and traceable IT audit evidence in accordance with ISA 315, Appendix 6 over ITGCs Guidance. Early coordination, clear ownership, and high-quality IPE reduce follow-up questions and support a smooth audit. |
Auditor defines in-scope systems, processes, locations, audit period, key contacts, timelines and secure evidence exchange. Overall alignment between auditor and auditee. Initial documentation may be requested to gain an understanding of the IT environment and determine the areas requiring further assessment.
Process owners explain how IT controls operate and how evidence is created, reviewed and retained. The objective is to understand how controls operate in practice, identify relevant risks, and determine the evidence required for subsequent testing.
Provide control evidence for design & implementation, and/or operating effectiveness across the audit period. This may include user access listings, access reviews, change management records, system configurations, and other relevant evidence. The auditor also evaluates the completeness and accuracy of Information Produced by the Entity (IPE) (See section 3 for details on IPE).
Respond to clarifications, ensure completeness and consistency of evidence (if applicable), provide screenshots/exports where needed. This phase may involve obtaining additional screenshots, system exports, explanations from control owners, or replacement evidence where initial submissions are insufficient.
Auditor organises findings and provides them to the auditee. Audit findings are typically discussed via a closing meeting. Findings are generally communicated through an audit report or closing meeting, including recommendations to strengthen the IT control environment.
Audit documentation widely varies and will depend on the Audit Scope as well as the IT internal controls in place.
The most important aspect is that an auditee maintains documentation of their internal IT controls in place. Some examples of areas reviewed can be:
Access ManagementJoiners/Leavers & Authentication |
Change ManagementChange logs & documentation |
Data Processing ManagementBatch job logs & monitoring |
Network Security ManagementNetwork diagram & incident management documentation |
*Please note that not all areas are always required to be audited, this will depend on the scope of the audit, which is determined on a yearly basis. Only provide evidence directly requested by the auditor.
Complete & AccurateCovers the full audit period and all relevant records/populations. Extracted from the source system which is clearly represented. (e.g. January 1, 2026 – December 31, 2026 for Entities in Scope) |
Readable & OriginalUse searchable PDF, Excel, CSV or native exports; screenshots must show full context of the data extracted. Evidence is not overwritten or obscured; redactions are explained and key fields remain visible. |
Recorded & Traceable**Include screenshots and steps showing how the report was generated. Include the system timestamp in every screenshot. (e.g. Extraction screen showing qualities of the report: number of lines, report parameters, etc.) |
How to keep the audit efficient:
|
|
||||
|
|
||||
|
|
The following example illustrates how an audit team reviews the process for granting new employees access to System X, from understanding the process to communicating any findings.
During our kick-off meeting we identified that your entity provisions access to System X through HR creating tickets for individuals at onboarding.
Based on this information, we will request the following documentation:
We will verify that the sample(s) ticket(s) align with your defined processes and coordinate follow-up.
Any relevant deviation or suggested improvements will be communicated during the closing meeting.
Veronika Macháčková-Koch