Day 4 (20 Oct 2022)

Today, my mentor, Thao showed me a powerpoint slide (as picture below), she told me it is the flow for us to conduct the ITGC works and Computer-aided audit tools (CAATs) work. It is a guideline for the new joiners so they will know the steps they can follow in completing their tasks. The flow starting with manager will assign the tasks to all the executives, colleagus from the engagement department will then email the respective executive with the planning document, this document will state clearly the company name, the subsidiaries company having, the financial period company having, the expected time that audit will commence and end. This info is important for an information system auditor as he can plan the duration to complete the task and send to engagement department. After that, we should know whether the company is first year client or recurring client, if it is first year client, we need to conduct an assessment to see how complex is this company, it is because for some company especially small company, it is of no need to conduct the ITGC audit, so for this case, we can prepare an ITGC exclusion memo to indicate there is no necessary to perform any ITGC work on that company. For those that require ITGC company, we can proceed to contact last year PIC or to get last year’s working papers for reference. Then we can arrange and conduct a so called ‘kick off meeting’ with the client, normally it will be the representative from the company’s IT department. In the meeting,we will present the ‘ITGC/ CAATs request list’ with client, this is for us to explain what are the required materials we need for us to conduct the task. After getting all the required materials, somehow if we are unable to receive it from client, we might need to follow up with client so that there is no delay for us to complete the task on time. Afte receiving the materials, then we can start to prepare the audit working paper or report to document all our audit findings. When it is done, we will send the report for our senior or manager to review following with Director and Partner. At the end we can perform the exist meeting with client to present what are the key finding we have found out during the audit.

After briefing me with the flow, Thao then showed me the ITGC request document list and IT environment questionnaire, these two documents are the things we need to present with client during kick off meeting as both of it contains the materials we need to take from client. In the ITGC document request list, it is separated into 13 areas which are: information security & user awareness, configuration of access rules, access administration, identification & authentication, monitoring, super users, program change management, program development management & product acquisition, job processing management, backup & other IT operations, patch management & antivirus, helpdesk management, additional areas.

Below table show the documents we should take from client for the respective areas.

---

Main things that have learnt

• Being briefed about the workflow for IT audit and CAATs work

• Go through ITGC request document list

• Go through IT environment questionnaire

---

Comment/idea/opinion

Today lesson give me a overall picture of what are the tasks I will be doing in this six month internship and the steps I should follow in order to complete my task. The study of the ITGC request document list and IT environment questionnaire also gave me some ideas on what I should inquiry the clients during the kick off meeting and along the audit process. There are a lot of unfamiliar terms I came through in the document request list and IT environment questionnaire, but I believe when the time I start to conduct my task, I will have a better understanding on these terms.