IT Audit is one of the checks needed to identify the optimization, compliance, security, and effectiveness of IT systems in a company.
This is because now many companies have relied on technology and information systems to continue to compete in this growing era.
To better understand what an IT audit is and everything related to this audit process, see the explanation of the article below.
What Is an IT Audit?
IT Audit is an examination and evaluation carried out by a company to ensure that IT systems, infrastructure, policies, and procedures run optimally as a whole.
In this case, aspects of the company will be identified operational optimization, system security, compliance with regulations and policies, as well as efficiency in use.
The examination of some of these aspects allows the company to review more deeply the potential dangers to security, system weaknesses, and non-compliance with regulations that pose a bad risk to the company.
For example, a weak IT system will be fatal to the occurrence of cybercrime that threatens data and the company itself.
From the audit process It is also the management of the company will get recommendations to minimize the risk of hazards, identify aspects that need to be improved, and improve the security of IT systems.
What Is the Difference Between an IT Audit and an Information Systems Audit?
The two terms are often used interchangeably and there is no agreed standard distinction. In practice, the division below helps define the focus of an engagement.
| Aspect | An IT Audit | Information Systems Audit |
|---|---|---|
| Focus | The technology layer and its governance: infrastructure, access, change, backup, vendors, and security | Controls over data and transactions within the information system |
| Typical question | Is our technology secure, reliable, and compliant with policies and regulations? | Are the data and transactions in the system complete, accurate, and valid? |
See also:
What Are the Types of IT Audit?
In practice, there are several types of it audits that need to be known to be used as needed. Here is the explanation:
1. Software Audit
The Auditor will identify an audit software used by companies to ensure efficiency, security, and compliance with access control regulations in application systems.
This allows the application system will be reviewed from the aspect of security and usability.
2. Infrastructure Audit
This Audit will refer to the evaluation of technology infrastructure that includes hardware and networks used in the company's operations.
The technology infrastructure will be identified to ensure its performance, security, reliability and manageability remain stable, secure and optimally used.
3. Security Audit
It audits in this case are used to ensure that the company's Security runs effectively and complies with policies and regulations that have been set by the industry.
This is useful for protecting corporate data and systems that contain various important information from cybercrime threats.
4. Compliance Audit
Seamless and Improved a compliance audit it will review the technology and information systems used by a company.
Ensure company compliance in using qualified IT systems and complying with policies or laws related to data management and security.
Read Also: Familiar with Information Systems Audit along with examples and stages
5. Risk Management Audit
In this case, the IT audit will evaluate the use of IT systems based on their effectiveness, so that the auditor can provide suggestions for future improvements to the company, such as risk reduction strategies and system updates.
Read Also: Audit Risk: definition, types, examples, and how to determine
6. Operational Audit
Operational Audit it focuses on the implementation and processes of IT systems within a company to review their efficiency and effectiveness,
It is useful for finding the scope to be developed, maximizing the distribution of resources, and optimizing operational efficiency with a simple workflow.
7. Vulnerability Audit and Penetration Testing
According to security vendor practice, a vulnerability audit (vulnerability assessment) identifies weaknesses in hardware, software, networks, or applications, while penetration testing simulates an attack to prove whether those weaknesses can be exploited. Both are technical testing tools within an IT audit, and their scope needs to be agreed before they are carried out.
See also:
- The Complete Guide to Enterprise Cloud and SaaS Security Audits
- System Access Rights Audit: Identity & Access Management
What Is ITGC and What Is Tested in an IT Audit?
IT general controls (ITGC) are policies, procedures, and practices that help ensure systems are reliable, secure, and support data integrity, including financial data. Weak ITGC raise the risk of errors or data manipulation and affect the risk-based audit approach.
| Category | What is controlled | Example test |
|---|---|---|
| Access control | Who can log in and do what | Comparing the list of active accounts with the employee list |
| Change management | Changes to systems and programs | Tracing approval evidence for a sample of changes |
| System development | Building or procuring new systems | Reviewing testing documentation before the system goes live |
| Physical control and recovery | Access to facilities and the ability to recover | Testing recovery from data backups |
See also:
- Audit Trail: Definition, Functions, Examples, and Benefits
- Understanding IT Infrastructure and Its 7 Tasks
What Standards and Regulations Guide IT Audits in Indonesia?
The following are commonly used references. Their validity can change, so check the latest text (information as of October 2026).
| Reference | Applies to | Relevant point |
|---|---|---|
| ISO/IEC 27001:2022 | Any organization | The standard for information security management systems, third edition published October 2022 |
| COBIT 2019 | Any organization | ISACA's IT governance and management framework |
| ITAF 5th edition | IT auditors | ISACA's IT audit practice framework, launched February 2026 |
| POJK Number 11/POJK.03/2022 | Commercial banks | Requires an IT internal control system, audit trails, and an IT internal audit at least once a year (Articles 53 to 55) |
| Government Regulation Number 71 of 2019 | Electronic system operators | Sets out periodic audit mechanisms (Article 13) and the obligation to provide audit trails (Article 22) |
| Communication and Informatics Ministerial Regulation Number 16 of 2022 | Government agencies | General policy on ICT audits, including audits of SPBE infrastructure, applications, and security |
See also:
What Is the Purpose of IT Audit?
In general, the purpose of it audits in companies is to identify information technology systems as a whole which in this case are as follows:
- Evaluating IT system performance, where this audit allows the auditor to review the suitability of performance against the objectives and plans put in place,
- Identify potential risks, where the auditor will review the opportunities for hazards in IT systems that threaten the company from compliance, security, and operational aspects.
- Optimize efficiency, where this audit process allows auditors to review IT operations and find ways to maximize its efficiency.
- Improve quality, where from the IT audit identification process, the auditor can recommend improvements and improvements to the IT system in the company.
What Is the Procedure for Conducting IT Audit?
After knowing what the objectives and benefits of an IT audit are, you will be directed to the stage of its implementation.
In this case, the audit process will start from the planning step and end at the monitoring stage after the audit and the implementation of recommended improvements.
Here is a full explanation of audit implementation procedure IT:
1. Planning
It starts with identifying the purpose of the IT audit, its scope, potential associated risks, and the specific targets for which the audit is conducted.
At this stage also carried out the formation of an audit team that includes auditors and a team of experienced professionals as well as management plans that include methods, schedules, and resources needed for it audits.
2. Gather Informations
This stage allows the auditor to review data relating to the information technology system under review.
The Auditor will collect data in the form of documents, conduct interviews with relevant parties, and make direct observations on IT systems and related matters to improve understanding of the technology used.
3. Evaluation and control test
This stage allows the auditor to test the controls over the security and procedures that have been implemented, based on the system's functionality, security, and availability.
In addition to identifying its effectiveness, the review is also used to ensure compliance of security controls and procedures with established policies.
After that, the auditor will review the nonconformities and potential risks found in the security controls and procedures that have been implemented.
4. Identification Of Audit Results
The Auditor will identify the findings obtained to evaluate the risk so that it can determine its level based on the possibility of the risk occurring and its impact.
This is the basis for recommendations to improve control, improve system weaknesses,and reduce risk.
Once the identification of the audit results and recommendations is complete, you can begin to compile them into a report.
5. Preparation Of Reports
The Auditor will prepare an audit report containing findings, recommendations, improvement plans, conclusions, and additional information.
The audit report will present a clear, detailed, structured, and understandable explanation so that it is effectively used by the company's management.
So that in this case the company can carry out the next plan based on the stages, budget, resources, and improvement targets in each recommendation that has been enclosed in the report as a strategic guide.
6. Follow-Up
In this stage, the company will implement improvements starting with the highest level recommended by the auditor.
In the process, the company will establish an implementation plan by forming a responsible team and effectively directing improvements.
In this case, the auditor will constantly monitor the implementation of changes to his system and make sure that any actions taken are in accordance with the plan.
Not only does it ensure the objectives of the IT audit are achieved with improvements, but this stage also allows the auditor to further review the scope that needs to be improved or other actions that need to be taken after the improvement.
Review is not enough to get there, because the auditor will monitor the system periodically while preparing improvement reports and continue to plan for necessary updates.
Each stage produces the following working documents.
| Stage | Output |
|---|---|
| Planning | Scope and audit work program |
| Information gathering | Document request list and interview results |
| Evaluation and control testing | Test working papers with evidence |
| Identifying audit results | List of findings with risk ratings |
| Report preparation | Audit report and improvement plan |
| Follow-up | Improvement monitoring matrix |
See also:
- Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One
- Audit Working Papers: Definition, Function, Purpose, and Types
- Audit Report: Definition, Functions, Types, & Examples
How Often Must an IT Audit Be Carried Out?
- Commercial banks: an internal audit of IT operations at least once a year, and a review of the IT internal audit function by an independent external party at least once every 3 years (OJK Regulation 11/POJK.03/2022 Article 54 paragraph 4 and Article 55 paragraph 2).
- Other electronic system operators: Government Regulation 71/2019 only refers to audit mechanisms carried out periodically, without a stated frequency.
What Does an IT Audit Look Like in Banking?
An example of a company that carries out IT audits regularly is Bank Mandiri. According to the Data Security and Customer Protection page on Bank Mandiri's website, the bank conducts an internal audit once a year and an external audit once a year, involving a reputable independent external consultant of international scale.
This practice is in line with banks' obligations under OJK Regulation 11/POJK.03/2022. The example does not mean all banks use the same consultant, because the choice depends on each bank's needs and regulations.
See also:
What Is a Short Checklist for an IT Audit?
| Area | Test question | Proof |
|---|---|---|
| User access | Have accounts of departed employees been deactivated? | Account list and HR data |
| Privileged access | Who has administrator access and is it approved? | Administrator list and approvals |
| Change management | Are changes tested and approved before being applied? | Change tickets |
| Backup and recovery | Has recovery from backup ever been tested? | Recovery test report |
| Vulnerabilities and patches | Are discovered vulnerabilities closed on time? | Scan reports and patch status |
| Logs and audit trails | Are important activities recorded and traceable? | System logs |
| Third parties | Are IT vendors risk-assessed? | Vendor assessments and contracts |
| Personal data | Is personal data handled in line with policy and regulations? | Policies and processing records |
| Business continuity | Is the disaster recovery plan tested periodically? | Plan and test results |
| Incidents | Are incidents recorded, analyzed, and followed up? | Incident register and analysis reports |
See also:
FAQ About IT Audits
What is an IT audit?
An IT audit is an examination and evaluation to ensure a company's IT systems, infrastructure, policies, and procedures run optimally as a whole, covering operational optimization, system security, regulatory compliance, and efficiency of use.
What is the purpose of an IT audit?
Evaluating IT system performance against set objectives, identifying potential risks in compliance, security, and operations, optimizing IT operational efficiency, and improving system quality through improvement recommendations.
What are the types of IT audits?
Software audit, infrastructure audit, security audit, compliance audit, risk management audit, operational audit, and vulnerability audit and penetration testing as technical testing tools.
What is the procedure for an IT audit?
Six stages: planning including forming the audit team, gathering information through documents, interviews, and direct observation, evaluation and control testing, identifying audit results with their risk levels, preparing the report, then follow-up.
What is ITGC?
ITGC, or IT general controls, are policies, procedures, and practices that help ensure systems are reliable, secure, and support data integrity. The usual categories are access control, change management, system development, and physical control and recovery.
How Often Must an IT Audit Be Carried Out?
For commercial banks, an IT internal audit at least once a year under OJK Regulation 11/POJK.03/2022 Article 54 paragraph 4. For other electronic system operators, Government Regulation 71/2019 only refers to periodic audits without a figure.
What are the risks if a company skips IT audits?
Security hazards, system weaknesses, and non-compliance with regulations can go undetected. A weak IT system, for example, opens the door to cyber crime that threatens both the data and the company itself.
What Is the Difference Between an IT Audit and an Information Systems Audit?
The two are often used interchangeably. An IT audit tends to focus on the technology layer and its governance, while an information systems audit focuses on controls over data and transactions within the system.
Conclusion
Thus is the explanation of IT audit which is an important procedure in ensuring the reliability of a company in IT systems.
An IT audit can be carried out by an internal audit team or by an independent external auditor. When choosing an external auditor, consider their expertise and experience.
Audithink is internal audit management software that can be customized, not an IT audit service provider. Audit teams can use it for risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. To manage planning, work programs, and follow-up for IT audits in your team, please schedule a demo.
