Analysis of IT Governance and Cyber Security in NSW City Council

This report presents an analysis of an IT audit conducted for the NSW City Council, focusing on various aspects of IT governance and cyber security. The report begins by defining the audit's focus and scope, followed by an identification of high-risk IT issues within the council. The main body of the report examines audit findings related to IT governance, IT general controls, and cyber security management. It also highlights the professional, legal, and ethical responsibilities of IT auditors. The analysis covers deficiencies in IT controls, the absence of cybersecurity frameworks in many councils, and the need for improved cyber security management. The report concludes with a synthesis of the findings and recommendations for improvement. The report is structured around key areas like audit focus, high-risk issues, and the responsibilities of IT auditors.

Assessment 2 report

Table of Contents
INTRODUCTION...........................................................................................................................1
MAIN BODY...................................................................................................................................1
1. Identify the audit focus and scope...........................................................................................1
2. Describe high risk IT issues in NSW City Council.................................................................2
3. Audit findings related to IT governance.................................................................................3
4. Analysis of audit findings related to IT general control in the NSW city councils. ..............3
5. Analysis of audit findings related to cyber security management in the NSW city councils.
.....................................................................................................................................................5
6. Highlight the professional, legal and ethical responsibilities of an IT auditors. ....................5
CONCLUSION................................................................................................................................6
REFERENCES................................................................................................................................7

INTRODUCTION
The term auditing can be defined as a process of evaluating financial records of a
company in an effective manner so that investors can make trust. Each company is bounded to
conduct auditing process in their operations (Raji and Buolamwini, 2019). The report is based on
making proper assessment of audit report of IT governance including different kinds of aspects
like issues, findings etc. In detailed sense, this can be stated that under report information about
objective and scope of audit, higher risk IT issues and cyber security management is explained.
Apart from this, under the report legal, ethical liabilities of an auditor are mentioned in detailed
manner at the end of project report.
MAIN BODY
1. Identify the audit focus and scope
Audit is inspection or examination of several books of accounts through an auditor which
followed by physical checking of inventory for ensuring that each and every division are
following documented system related to transactions (Stašová, 2019). In addition to this, audit is
done for ascertaining the accuracy of financial statements which provided by an business firm.
Along with this, audit can be done through employees internally or by head of particular
department. On the other hand, external audit done outside the business firm or through
independent auditors. Furthermore, the idea of checking as well as verifying the accounts by
independent authority for ensuring that all the accounts books are done within fair manner as
well as there should not an misrepresentation or fraud conducted by organisation. If there any
misrepresentation or fraud conducted in company's books of accounts then legal action will be
take in against of business firm or accountant division employees.
Audit focus – For planning a performance audit which integrate efficiency
considerations auditors require to decide focus related to the audit. In addition to this, Audit
focus relates to degree or level of attention which are given to efficiency within performance
audit (Kouznetsov, Kim and Wright, 2019). There are several ways in that performance audit can
integrate efficiency considerations. Moreover , some audit have focus on efficiency while others
will covers efficiency as an secondary topic. Spectrum audit focus have different categories from
marginal or no focus to exclusive focus. Explanation of these are as follows :-
1

 Marginal or no focus – There is no formal plan which will help in audit within effective
manner but the problem which come up while conducting audit.
 Non-specific focus – There are several audit steps out of which some touch on efficiency
even by there no specific skilfulness criterion.
 Specific focus – Structured audit work on efficiency which is part of larger audit.
 Exclusive focus – It is efficiency focused audit.
Audit Scope – It is explained as amount of time as well as documents that are included in
audit which is essential factor within auditing. In addition to this, scope of audit are established
ultimately that how deep audit can be performed (Inayattulloh and Siswantoro, 2019). Audit
scope may be the range from simple to complete which includes documents of business firm.
Along with this, audit scope means depth related to audit performance which can be for various
reasons such as regular checking records of company for determining internal errors for finding
fraud which are taking inside company behind which motive is to find fraud in another
organisation.
2. Describe high risk IT issues in NSW City Council
NSW Council auditor is called for Office of Local government for developing cyber
security policy for ensuring consistent response with council after finding 80% who don't have
framework related to cyber security. In addition to this, The Office of Local Government in the
Department of Planning, Industry as well as environment must have to develop policy related to
cyber security by 30th June 2021 for making sure continuous response to cyber security risk
within councils which recommend by Auditor General Margaret Crawford. Along with this, This
report provide detailing results of 2018-19 financial audit related to 125 councils, ten country
councils as well as 11 Joint companies in NSW (NSW Councils score poorly on Cyber security,
2020).
Furthermore, by this it has been noted that ongoing deficiencies within controls related to
IT which is mainly around utilisers who access managements. There are several councils which
may founds as well as don't have Information technology policies and process and others who
don't determine, monitor or report risk related to information technology. In addition to this,
management related to cyber security needs improvement which have some basic elements
related to governance which is not yet in place for several councils. Information technology
2

governance was determines leading high-risk issues which are related with cyber security as
disaster recovery planning.
3