Analysis of IT Audit Report Findings: NSW City Council Assessment 2

This report presents an analysis of an IT audit conducted on the NSW City Council. The report begins with an introduction to auditing, defining its purpose and scope. The main body of the report delves into the audit's focus and scope, high-risk IT issues within the council, and detailed audit findings related to IT governance. It examines IT general controls, including user access management, privileged user access restriction, system software management, and disaster recovery planning. The report also analyzes cyber security management, highlighting key findings and areas needing improvement. Furthermore, it explores the professional, legal, and ethical responsibilities of IT auditors. The report concludes with a summary of the key findings and recommendations for improvement, emphasizing the importance of robust IT governance and cyber security practices within the council to mitigate risks and ensure the integrity and security of its systems and data.

Assessment 2 report

Table of Contents
INTRODUCTION...........................................................................................................................1
MAIN BODY...................................................................................................................................1
1. Identify the audit focus and scope...........................................................................................1
2. Describe high risk IT issues in NSW City Council.................................................................2
3. Audit findings related to IT governance.................................................................................3
4. Analysis of audit findings related to IT general control in the NSW city councils. ..............3
5. Analysis of audit findings related to cyber security management in the NSW city councils.
.....................................................................................................................................................5
6. Highlight the professional, legal and ethical responsibilities of an IT auditors. ....................5
CONCLUSION................................................................................................................................6
REFERENCES................................................................................................................................7

INTRODUCTION
The term auditing can be defined as a process of evaluating financial records of a
company in an effective manner so that investors can make trust. Each company is bounded to
conduct auditing process in their operations (Zhaokai and Moffitt, 2019). The report is based on
making proper assessment of audit report of IT governance including different kinds of aspects
like issues, findings etc. In detailed sense, this can be stated that under report information about
objective and scope of audit, higher risk IT issues and cyber security management is explained.
Apart from this, under the report legal, ethical liabilities of an auditor are mentioned in detailed
manner at the end of project report.
MAIN BODY
1. Identify the audit focus and scope
Audit is inspection or examination of several books of accounts through an auditor which
followed by physical checking of inventory for ensuring that each and every division are
following documented system related to transactions (Saha and Goswami, 2019). In addition to
this, audit is done for ascertaining the accuracy of financial statements which provided by a
business firm. Along with this, audit can be done through employees internally or by head of
particular department. On the other hand, external audit done outside the business firm or
through independent auditors. Furthermore, the idea of checking as well as verifying the
accounts by independent authority for ensuring that all the accounts books are done within fair
manner as well as there should not an misrepresentation or fraud conducted by organisation. If
there any misrepresentation or fraud conducted in company's books of accounts then legal action
will be take in against of business firm or accountant division employees.
Audit focus – Auditors need to settle on the focus relevant to the audit in order to prepare
a value proposition that incorporates quality factors. In contrast to this the audit emphasis refers
to the degree or amount of consideration paid to reliability audit effectiveness. In this audit
reports, there are so many ways to implement quality requirements. In addition, some audits
concentrate on performance, while others discuss productivity as a significant problem. From
minimal or no emphasis with exclusive emphasis, the range review focus has specific kinds.
Explanation of these is as follows:-
1

 Marginal or no concentrate: There is no structured strategy that can assist in a successful
audit, however the issue that occurs during the review.
 Non-technical concentrate are multiple audit measures, some of that focus on efficacy,
even though there is no clear requirements of ability.
 Relevant focus: formal performance audit research that is part of the broader audit.
 Unique Concentrate is an evaluation based on efficacy.
Audit Scope – It is explained as amount of time as well as documents that are included in
audit which is essential factor within auditing. In addition to this, scopes of audit are established
ultimately that how deep audit can be performed (Yanisky-Ravid and Hallisey, 2019). Audit
scope may be the range from simple to complete which includes documents of business firm.
Along with this, audit scope means depth related to audit performance which can be for various
reasons such as regular checking records of company for determining internal errors for finding
fraud which are taking inside company behind which motive is to find fraud in another
organisation.
2. Describe high risk IT issues in NSW City Council
The investigator of the NSW Councils is relied upon by the Local Government
Department to establish information security strategies to ensure effective government responses
after discovering 80% that do not have a strategic plan. In particular, by 30 June 2021, the City
Council Service in the Ministry of Transport, Business and Environment shall implement cyber
protection policies to ensure continuing answer to network security hazard inside communities
suggested by Investigating Officer Margaret Crawford. Along with this, This report provide
detailing results of 2018-19 financial audit related to 125 councils, ten country councils as well
as 11 Joint companies in NSW (NSW Councils score poorly on Cyber security, 2020).
Furthermore, by this it has been noted that ongoing deficiencies within controls related to
IT which is mainly around utilises who access managements. There are several councils which
may found as well as don't have Information technology policies and process and others who
don't determine, monitor or report risk related to information technology. In addition to this,
management related to cyber security needs improvement which has some basic elements related
to governance which is not yet in place for several councils. IT management has identified
highest rated concerns related to cyber protection managers and senior IT regulations, including
active directory managing, user requirements disaster preparedness recovery preparation.
2

3. Audit findings related to IT governance.
In accordance of given audit report, below key findings are mentioned related to IT
governance:
IT system providing councils with a framework for handling their IT risks successfully insuring
that relevant practices are implemented to achieve their goals.
IT policies are not formalized- In accordance of annual report this can be find out that IT policies
are not formalized in an effective manner. Due to which there are a range of complexity in
achieving overall goals and objectives. It is necessary to formulate and regularly monitor Main
IT policy to guarantee awareness of new challenges and reflection of trends in the IT
environment through regulators (Pimentel, Boulianne and Clark, 2019). Inaccurate and improper
activities and increased IT policy and procedures can result in a lack of official IT processes and
regulations and probability of unauthorised access to main schemes. There has been little change
in councils codifying their IT skills and practices that they are carefully considered.
More council are identifying, monitoring and reporting IT risks- The audit report infers that there
are a number of councils which are offering information related to IT risks which may occur in
upcoming time period. This is a positive thing for IT governance as they have more number of
alternatives who are giving information about upcoming threats and way to overcome.
Councillors should understand and communicate the risks arising from the use of IT to those
who are in secure detention, so that they really are mindful of the implications but can effectively
respond under a fair timeframe.
4. Analysis of audit findings related to IT general control in the NSW city councils.
IT general control: IT regulations are clear principles and procedures aimed at
maintaining the protection and integrity of systems and documents. These monitors support the
consistency of financial reports. IT basic restrictions (ITGC) are the particular protections which
can be applied to IT structures like applications, software platforms, databases, and sustaining IT
facilities. ITGC strive to ensure the accuracy of the data and procedures enabled by the
programmes.
The financial audits involved a study of particular IT regulations pertaining to core
financial procedures, allowing the planning of the Authority's accounting records, discussing:
3

User access management: On the grounds of available information in audit report, this can be
found out that they are using access management system for controlling. User Access
Management (UAM), also referred to as authentication and authorization (IAM), is the control of
providing particular users access to the resources they require at the right time within a system.
This typically requires access to external software, licences, and compliance standards for
organisations.
Privileged user access restriction and monitoring: Another control system which has been
used by IT general control is related to restricting the usage of key information from those users
is who not the part of organization is. The key benefit of this approach is that by help of these
companies become able to hide their key information and data is not misused. User Access
Management (UAM), also referred to as authentication and authorization (IAM), is the control of
providing particular users access to the resources they require at the right time within a system.
This typically requires access to external software, licences, and compliance standards for
organisations.
System software acquisition, change and management- In accordance of audit report this
can be stated that it is also a key tool for controlling the IT aspects. In the procurement of a
software care management system, the approach as IT normally goes through. The process starts
after the system has been acquired by the company and lasts into the early stages after the go-live
date. Under this approach, software of different kinds of companies and departments is aligned
so that a combined software can be produced which is more secured and safe for users. Along
with, this process of software acquisition is changed and managed on a regular basis so that
hackers cannot miss use the key information of any company.
Disaster recovery planning- Under the IT general controls; it is also considered as a key
aspect for managing key aspects. A disaster recovery plan ( DRP) is a recorded mechanism or
collection of protocols to conduct the disaster response processes of an entity and, in the case of
a catastrophe, restore and secure a company IT facilities. It is "a detailed declaration of
consistent steps to be taken until, after and after a catastrophe." Auditing of records covering the
corporate management and catastrophe recovery activities of a company provides customers with
a third party assurance that the report is accurate and does not include content misstatements
(Appelbaum and Nehmer, 2020).
4

The audit findings state that disaster recovery planning needs to be improved as there is
lack of advancements. Incident Response Team enables councils to reduce downtime for
activities in the event of a significant service collapse or other catastrophe. Until comprehensive
analysis and planning, Governments could not anticipate the consequences of disruption, identify
optimal sustainable shutdowns or quickly restore essential infrastructure in the case of a
problem..
5. Analysis of audit findings related to cyber security management in the NSW city councils.
At the amount of state governments, the NSW Information Security Strategy shows that
effective information security is an integral part of digital policy system for NSW (Ruban and
Rydén, 2019). Both tools used to defend data security are included in the term cyber defence
shield, against breach of secrecy, credibility and availability, networks and knowledge processed,
maintained or exchanged on these systems.' Although there is presently no necessity for
authorities to conform to the security plan of the national government, authorities could find it
beneficial for more guideline to allude to the legislation. In accordance of audit findings, this can
be stated that poor cyber security may lead to different kinds of issues which are as follows:
Theft of money
Destruction of information
Cost of repairing of system
Risk of theft of financial information
Audit findings: The cyber security management of public bodies needs to be improved, because
most authorities have yet to framework for effective policymaking aspects, such as a legislation
or structure for cyber security. It will appear to be a point of study, with an ongoing cyber
security content measuring performance scheduled.
6. Highlight the professional, legal and ethical responsibilities of IT auditors.
It auditors is responsible for analysing as well as assessing technologies infrastructure of
an business firm for determining issues or problems with efficiency, risk management as well as
compliance. In addition to this, IT auditor also determines IT issues which fall within audit
mainly those which are related with security as well as risk management (Singh, Singh and
Sodhi, 2019). Moreover, when issues are determined then Information technology auditor are
liable for communicating results to other employees within organisation and providing solution
5

for improving process or system which result in ensuring security and compliance.
Responsibility of IT auditors is classified in professional, legal and ethical.
Along with this, IT auditor is responsible for running various audits of company's
technology as well as procedures. IT audits are also related as an automated data processing
audits as well as computer audit (Ayres, Nea and Shipman, 2019). Moreover, in past Information
Technology related audit is labelled as electronic data processing audits. A business firm can run
information security audit for evaluating organisational security procedure as well as risk
management. Moreover, respective procedure generally utilise for assessing data integrity,
security, development and IT governance.
 Professional responsibilities – In professional responsibility rules as well as principles
related to appropriate behaviour of an inspector in his work is also recognized as ethical
conduct, and is important for gaining the respect and trust of the public, achieving order
in the practice and having ways of personality the practice.
 Legal responsibilities – In involve responsibilities of It auditor to accept risk in court of
law while practicing public accounting. Moreover, legal risk involves those which arise
from failing to utilise due care for conducting audit.
 Ethical responsibilities – It includes general ethics i.e., spirit or principles as well as
professional ethics which are rules (Fan and Zhang, 2019). Moreover, ethical
responsibilities says that IT auditor have to ensure that each and every data should be
recorded as well as checked in proper manner for conducting operations of company in
better manner and result in accomplishing desired goals and objectives.
Thus, these are major responsibilities of an IT auditor which they have to follow for conduct
work in better manner. Each and every responsibility has their own importance while working
within an business firm.
CONCLUSION
On the basis of above project report, this can be concluded that auditing is an essential
aspect for all kinds of sectors. It is so because auditing will not only provides information about
financial data but also this will recommend that what needs to do. In the context of above report,
findings of IT governance is explained in terms of risk, cyber securities etc. The report concludes
about some recommendations which need to be applied for better outcome.
6

REFERENCES
Books and Journals
Zhaokai, Y. and Moffitt, K.C., 2019. Contract analytics in auditing. Accounting Horizons, 33(3),
pp.111-126.
Saha, S. and Goswami, R., 2019. Auditing the efficacy and safety of alfacalcidol and calcium
therapy in idiopathic hypoparathyroidism. The Journal of Clinical Endocrinology &
Metabolism, 104(4), pp.1325-1335.
Yanisky-Ravid, S. and Hallisey, S.K., 2019. Equality and Privacy by Design: A New Model of
Artificial Intelligence Data Transparency Via Auditing, Certification, and Safe Harbor
Regimes. Fordham Urb. LJ, 46, p.428.
Pimentel, E., Boulianne, E., Eskandari, S. and Clark, J., 2019. Systemizing the challenges of
auditing blockchain-based assets. Available at SSRN 3359985.
Appelbaum, D. and Nehmer, R.A., 2020. Auditing Cloud-based Blockchain Accounting
Systems. Journal of Information Systems, 34(2), pp.5-21.
Singh, P., Singh, G. and Sodhi, G.P.S., 2019. Energy auditing and optimization approach for
improving energy efficiency of rice cultivation in south-western Punjab,
India. Energy, 174, pp.269-279.
Ayres, D.R., Neal, T.L., Reid, L.C. and Shipman, J.E., 2019. Auditing goodwill in the post‐
amortization era: Challenges for auditors. Contemporary Accounting Research, 36(1),
pp.82-107.
Fan, Y., Liao, Y., Li, F., Zhou, S. and Zhang, G., 2019. Identity-based auditing for shared cloud
data with efficient and secure sensitive information hiding. IEEE Access, 7, pp.114246-
114260.
Ruban, A. and Rydén, L., 2019. Introducing environmental auditing as a tool of environmental
governance in Ukraine. Journal of Cleaner Production, 212, pp.505-514.
Online
NSW Councils score poorly on Cyber security, 2020.[Online].Available
through<https://idm.net.au/article/0012816-nsw-councils-score-poorly-cyber-security>
7