Information systems auditing – going beyond compliance. (1st January 2013)

• Record Type: Journal Article
• Authors: Namuduri, Kamesh
• Is Part Of: International journal of auditing technology. Volume 1:Number 1(2013)
• Page Start: 45
• Page End: 51
• Publication Date: 2013-01-01
• Subjects: continuous auditing -- compliance -- payment card industry -- PCI -- data security standards -- DSS; Information storage and retrieval systems -- Accounting -- Periodicals; Computer security -- Management -- Periodicals; Information technology -- Auditing -- Periodicals; 657.450285
• Languages: English
• ISSNs: 1757-8752

Abstract

Compliance to industry standards is just the minimum requirement for auditing. A critical analysis of the requirements of compliance reveals that auditing for compliance purposes should not be viewed as a onetime or an ad hoc effort. It needs to be done on a periodic basis. This paper argues that a comprehensive framework that goes above and beyond auditing is important and necessary for protecting information which is the most valuable asset of an organisation. Continuous auditing allows us to monitor the organisational processes that are in place for information protection and take appropriate actions to rectify them in the most efficient manner. Information security management team needs to view compliance requirements from the organisational strategy towards information assurance, and risk management perspectives in order to appreciate the benefits of compliance. This comprehensive view is important for every organisation that strives to improve its auditing process.