The Institute of Internal Auditors Issues Series of Reports Establishing IT-Audit Best Practices and Organization Workflow; Global Technology Audit Guides Provide Guidance for IT-audit Preparedness and Compliance Management

Business Wire, May 25, 2005

ALTAMONTE SPRINGS, Fla. -- The Institute of Internal Auditors (IIA) has released Global Technology Audit Guide (GTAG), a series of reports for chief internal audit executives (CAEs) and their staffs intended to provide governance-level guidance and thought leadership for specific technology areas. Particular emphasis is placed on technologies and processes likely to be of concern to senior management and audit committees.

Available free-of-charge electronically, the GTAG series will be a ready resource for CAEs to use in the assessment of technology-associated risks, the implementation of recommended best practices, and the education of members of the board and audit committee, management, process owners and others who drive governance of IT resources. The series takes a pragmatic approach by transforming the mass of information, including many of the numerous control frameworks organizations are confronted with today, into valuable guidance for analyzing IT controls. It also provides guidance for discussing IT risk management strategies across the enterprise with senior management and audit committees.

"The role of the CAE has changed dramatically over the past decade, influenced significantly by the increased complexity of IT and the frequency and severity of corporate frauds, compliance mandates, and cyber attacks," says IIA President Dave Richards. "Today's internal auditors offer the essential controls expertise necessary to protect critical organizational infrastructure -- from technology to management workflow. The GTAG series provides practitioners tools that enable process improvement, enhanced challenge resolution, and compliance attestation."

"What's lacking is good, non-technical guidance including practices for assessing and maintaining internal controls that meet effectiveness, efficiency, and regulatory and best-practice requirements of any organization," said Jay R. Taylor, general director of Information Technology Audit at General Motors Corporation. "GTAG helps by cutting through the jargon associated with IT audits and explaining the risks and key controls in business language. I feel this is really something that has not been available to CAEs and audit committees in the past -- good, solid IT material in management's language."

The first GTAG, Information Technology Controls, provides an overview of the key components of IT control assessment with an emphasis on the roles and responsibilities for key constituents. It provides a framework for assessing IT controls and explains the importance of incorporating audit best practices into IT controls in a way that allows CAEs to more effectively communicate the need to their colleagues.

Future editions of the GTAG series will address topics such as assessing controls for change and patch management, continuous monitoring, and privacy. The next guide, Change and Patch Management Controls: Critical for Organizational Success, will be available this summer and will provide guidance for evaluating and mitigating change-management risks, as well as complying with constantly changing regulatory requirements.

The material provided in the global series includes input from a wide range of sources including audit and security experts, board members, chief executives, financial executives, technology providers, and IT and security executives. To ensure the guides written to date are accurate from legal, insurance, regulatory, and standards perspectives, several GTAG partners were involved in the review process including the American Institute of Certified Public Accountants (AICPA), Center for Internet Security (CIS), Canadian Institute of Chartered Accountants (CICA), Carnegie Melon University Software Engineering Institute (CMU SEI), Information Systems Security Association (ISSA), National Association of Corporate Directors (NACD), and SANS Institute.

The IT Controls GTAG and a pre-release draft of Change and Patch Management Controls GTAG are currently available in electronic format (PDF) at www.theiia.org. Hard copies soon will be available for purchase from The IIA Bookstore.

About The IIA

Established in 1941, The IIA has more than 100,000 members worldwide. It serves as the internal audit profession's global voice, recognized authority, acknowledged leader, principal educator, and chief advocate. The Institute monitors legislation, regulations, and pronouncements of other professional organizations throughout the world on matters that directly or indirectly impact the practice of internal auditing It provides the International Standards for the Professional Practice of Internal Auditing, and offers a variety of leading-edge professional development opportunities, a comprehensive certification program, thorough quality assessment services, benchmarking surveys, and valuable research reports and educational products through The IIA Research Foundation.