Explain key steps involved in conducting Information System Audit.

The following are the steps in information systems audit: The preliminary review phase The first step in an IS audit is the preliminary review of the computer installation. The main objective of this step is to obtain the information necessary for the auditor to make a decision on how to proceed with the audit. This stage includes a review of the management and application controls existing in the company. During the review, the auditor tries to understand the management practices used at different levels of the computer hierarchy. The detailed review phase The objective of this phase is to obtain the information necessary for the auditor to have an in-depth understanding of the controls used in a computer installation. Upon review, the auditor reviews both the management and application controls. The management controls are reviewed first, as major weaknesses in these controls enables the auditor to abandon the review of application controls. In this phase, the auditor must also identify the causes of loss existing within the installation and the controls established to reduce the effects of these causes of loss. The compliance testing phase The objective of this phase is to determine whether or not the system of internal controls operates as it is supposed to operate. The auditor checks whether all internal controls exist and are working reliably. The auditor makes use of both manual sources of information mentioned above and computer assisted evidence collection techniques to gather inputs for evaluation. At the conclusion of this phase, the auditor must evaluate the internal control system in the light of the evidence collected on the reliability of individual controls. The substantive testing phase The objective of this phase is to obtain sufficient evidence to enable the auditor make a final judgement on whether or not material losses have occurred during computer data processing. The following are the five types of substantive tests that can be used within a data processing installation: Tests to identify erroneous processing. Tests to assess the quality of data. Tests to identify inconsistent data. Tests to compare data with physical counts. Confirmation of data with outside sources. Overall evaluation Upon substantive testing, the auditor once again has an overall view of the control systems existing within the company. Documentation On completing the audit process, the auditor prepares a comprehensive audit report giving details of all the phases of review and testing conducted. The audit report also consists of the recommendations of the auditor for improvement in control systems.