An evaluation of the internal IT audit function within local banks

Abstract

This dissertation studies the impact of IT on internal auditing within local banks. It identifies the key challenges in establishing and running an effective and efficient internal IT audit function. This study uses semi-structured interviews to research banks running an internal audit department locally. This is complemented by online questionnaires which investigate local banks that depend on their overseas parent company for internal auditing. Furthermore, this study evaluates the relationship of the internal IT audit function with the banking regulator. This study concludes that whilst there are still areas for improvement, the majority of local banks are exploiting internal IT audit to add business value. They are employing different organisation structures, diverse IT risk management methodologies and rigorous security controls. The recommendations for further improvement include: better use of CAATTs, increased use of continuous auditing and implementation of a holistic framework. The study also identifies those banks that are using strategic alliances to take advantage of expertise in certain areas of IT auditing. There is a potential to exploit alliances further by using them as a learning and personal development experience for the internal IT auditors. The IT element in internal auditing is critical in banks because of the high dependency on IT. Local banks are ably coordinating the internal IT audit function by blending it effectively with general auditing and creating synergy through collaboration with the IT department. Furthermore, all local banks are appreciating that being pro-active is central in today's dynamic environment and they are also achieving this by exploiting the consultancy services in internal IT auditing.