IT Auditors Need to Come Out of the Black Box

Abstract

IT auditors are uniquely positioned to consider not only the IT controls and risks, but also opportunities to improve information systems to help address senior management concerns over risks to operational objectives. To do this, many IT auditors are “coming out of the black box”—taking an enterprise view of IT and IT controls and merging IT and business risks. This article describes how IT auditors can play a lead role in improving both the value-added proposition of the audit function and in streamlining business processes and improving efficiency and effectiveness of operations, while maintaining a focus on IT controls.