Best practice in auditing requires that an audit team include skills and expertise that cover the area to be audited. The breadth of audit testing to be covered during the audit makes it unlikely to find all the required expertise in single individual. Good combination of skills (operational, technical, analytical, investigative, interpersonal, etc.) allows for more effective and efficient coverage of the different functions, situations and workings within an organization. The mixture of skills of several persons in the team helps minimize ambiguity and therefore improves the consistency of audit conclusions. IT audit team are largely composed of the audit team leader and at least two other auditors who are chosen for specific skills and expertise that they will bring to the fore during the audit. The number of the audit team will depend on the scope of work to be done and the timeframe allocated for the audit activity.
The following should be considered when assembling an audit team:
- 1. The audit scope, that is, extent of work to be done during the audit.
- 2. The objectives of the audit, that is, what the audit is meant to achieve, which will determine the approach to be adopted.
- 3. The area of the organization to be audited, which will help in deciding what skills or expertise are required to conduct the audit.
- 4. The availability and suitability of the audit team members.
Competence of IT Audit Team
IT Auditors should possess one or more of the following qualifications/certifications/credentials.
- 1. Background in Computing or engineering related degrees (computer science, information technology, IT Assurance, Cybersecurity Assurance, Electrical/Electronics Engineering, Computer Engineering). Other analytical professionals such as accounting are acceptable.
IT Auditors in addition to possessing the requisite technical and analytic skills are expected to also have the personal attributes such as:
- 2. Certifications such as CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CISSP (Certified Information Systems Security Professional), CRISC (Certified in Risk and Information Systems Control), CGEIT (Certified in Governance of Enterprise IT), COBIT 5 Foundation or Assessor and other related certifications
- a) High ethical standards, i.e. objectivity, fair, independent, honesty and discreet.
- b) Open-minded, i.e. willing to consider alternative or divergent ideas or views.
- c) Diplomatic, i.e. tactful in dealing with people.
- d) Drive, i.e. alert, decisive, self-awareness, persistent, focused on achieving objective.