{"id":3770,"date":"2025-01-31T09:26:19","date_gmt":"2025-01-31T02:26:19","guid":{"rendered":"https:\/\/audithink.com\/?p=3770"},"modified":"2026-10-13T06:38:05","modified_gmt":"2026-10-12T23:38:05","slug":"it-audit","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/audit-it\/","title":{"rendered":"Get to know what an IT Audit is and its types, objectives, procedures, and examples"},"content":{"rendered":"<p class=\"wp-block-paragraph\">IT Audit is one of the checks needed to identify the optimization, compliance, security, and effectiveness of IT systems in a company.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is because now many companies have relied on technology and information systems to continue to compete in this growing era.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To better understand what an IT audit is and everything related to this audit process, see the explanation of the article below.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is an IT Audit?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IT Audit is an examination and evaluation carried out by a company to ensure that IT systems, infrastructure, policies, and procedures run optimally as a whole.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, aspects of the company will be identified operational optimization, system security, compliance with regulations and policies, as well as efficiency in use.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The examination of some of these aspects allows the company to review more deeply the potential dangers to security, system weaknesses, and non-compliance with regulations that pose a bad risk to the company.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a weak IT system will be fatal to the occurrence of cybercrime that threatens data and the company itself.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From<a href=\"https:\/\/audithink.com\/en\/article\/audit-process\/\"> the audit process<\/a> It is also the management of the company will get recommendations to minimize the risk of hazards, identify aspects that need to be improved, and improve the security of IT systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is the Difference Between an IT Audit and an Information Systems Audit?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The two terms are often used interchangeably and there is no agreed standard distinction. In practice, the division below helps define the focus of an engagement.<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Aspect<\/th><th>An IT Audit<\/th><th>Information Systems Audit<\/th><\/tr><\/thead><tbody><tr><td>Focus<\/td><td>The technology layer and its governance: infrastructure, access, change, backup, vendors, and security<\/td><td>Controls over data and transactions within the information system<\/td><\/tr><tr><td>Typical question<\/td><td>Is our technology secure, reliable, and compliant with policies and regulations?<\/td><td>Are the data and transactions in the system complete, accurate, and valid?<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/information-systems-audit\/\">Familiar with Information Systems Audit along with examples and stages<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Types of IT Audit?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"2560\" height=\"1357\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-scaled.webp\" alt=\"types of IT infrastructure audits \" class=\"wp-image-3772\" title=\"\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-scaled.webp 2560w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-300x159.webp 300w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-1024x543.webp 1024w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-768x407.webp 768w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-1536x814.webp 1536w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-2048x1085.webp 2048w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/audit-infrastruktur-freepik-18x10.webp 18w\" sizes=\"(max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\">Illustration Of Infrastructure Audit Type (Source: Freepik)<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, there are several types of it audits that need to be known to be used as needed. Here is the explanation:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Software Audit <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditor will identify <em>an audit software <\/em>used by companies to ensure efficiency, security, and compliance with access control regulations in application systems.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This allows the application system will be reviewed from the aspect of security and usability.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Infrastructure Audit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This Audit will refer to the evaluation of technology infrastructure that includes <em>hardware<\/em> and networks used in the company's operations.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The technology infrastructure will be identified to ensure its performance, security, reliability and manageability remain stable, secure and optimally used.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Security Audit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It audits in this case are used to ensure that the company's Security runs effectively and complies with policies and regulations that have been set by the industry.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is useful for protecting corporate data and systems that contain various important information from cybercrime threats.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Compliance Audit <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Seamless and Improved <a href=\"https:\/\/audithink.com\/en\/article\/compliance-audit\/\">a compliance audit<\/a> it will review the technology and information systems used by a company.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure company compliance in using qualified IT systems and complying with policies or laws related to data management and security.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Read Also: <\/strong><a href=\"https:\/\/audithink.com\/en\/article\/information-systems-audit\/\"><strong>Familiar with Information Systems Audit along with examples and stages<\/strong><\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Risk Management Audit <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, the IT audit will evaluate the use of IT systems based on their effectiveness, so that the auditor can provide suggestions for future improvements to the company, such as risk reduction strategies and system updates.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Read Also: <\/strong><a href=\"https:\/\/audithink.com\/en\/article\/audit-risk\/\"><strong>Audit Risk: definition, types, examples, and how to determine<\/strong><\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Operational Audit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/audithink.com\/en\/article\/operational-audit\/\">Operational Audit<\/a> it focuses on the implementation and processes of IT systems within a company to review their efficiency and effectiveness,&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is useful for finding the scope to be developed, maximizing the distribution of resources, and optimizing operational efficiency with a simple workflow.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Vulnerability Audit and Penetration Testing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">According to security vendor practice, a vulnerability audit (vulnerability assessment) identifies weaknesses in hardware, software, networks, or applications, while penetration testing simulates an attack to prove whether those weaknesses can be exploited. Both are technical testing tools within an IT audit, and their scope needs to be agreed before they are carried out.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/enterprise-cloud-and-saas-security-audit\/\">The Complete Guide to Enterprise Cloud and SaaS Security Audits<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/system-access-rights-audit\/\">System Access Rights Audit: Identity &amp; Access Management<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Is ITGC and What Is Tested in an IT Audit?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IT general controls (ITGC) are policies, procedures, and practices that help ensure systems are reliable, secure, and support data integrity, including financial data. Weak ITGC raise the risk of errors or data manipulation and affect the risk-based audit approach.<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Category<\/th><th>What is controlled<\/th><th>Example test<\/th><\/tr><\/thead><tbody><tr><td>Access control<\/td><td>Who can log in and do what<\/td><td>Comparing the list of active accounts with the employee list<\/td><\/tr><tr><td>Change management<\/td><td>Changes to systems and programs<\/td><td>Tracing approval evidence for a sample of changes<\/td><\/tr><tr><td>System development<\/td><td>Building or procuring new systems<\/td><td>Reviewing testing documentation before the system goes live<\/td><\/tr><tr><td>Physical control and recovery<\/td><td>Access to facilities and the ability to recover<\/td><td>Testing recovery from data backups<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/what-is-audit-trail\/\">Audit Trail: Definition, Functions, Examples, and Benefits<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/it-infrastructure\/\">Understanding IT Infrastructure and Its 7 Tasks<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Standards and Regulations Guide IT Audits in Indonesia?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The following are commonly used references. Their validity can change, so check the latest text (information as of October 2026).<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Reference<\/th><th>Applies to<\/th><th>Relevant point<\/th><\/tr><\/thead><tbody><tr><td>ISO\/IEC 27001:2022<\/td><td>Any organization<\/td><td>The standard for information security management systems, third edition published October 2022<\/td><\/tr><tr><td>COBIT 2019<\/td><td>Any organization<\/td><td>ISACA's IT governance and management framework<\/td><\/tr><tr><td>ITAF 5th edition<\/td><td>IT auditors<\/td><td>ISACA's IT audit practice framework, launched February 2026<\/td><\/tr><tr><td>POJK Number 11\/POJK.03\/2022<\/td><td>Commercial banks<\/td><td>Requires an IT internal control system, audit trails, and an IT internal audit at least once a year (Articles 53 to 55)<\/td><\/tr><tr><td>Government Regulation Number 71 of 2019<\/td><td>Electronic system operators<\/td><td>Sets out periodic audit mechanisms (Article 13) and the obligation to provide audit trails (Article 22)<\/td><\/tr><tr><td>Communication and Informatics Ministerial Regulation Number 16 of 2022<\/td><td>Government agencies<\/td><td>General policy on ICT audits, including audits of SPBE infrastructure, applications, and security<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/it-compliance\/\">IT Compliance in Internal Audits for Data Regulation and Security<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Is the Purpose of IT Audit?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In general, the purpose of it audits in companies is to identify information technology systems as a whole which in this case are as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Evaluating IT system performance<\/strong>, where this audit allows the auditor to review the suitability of performance against the objectives and plans put in place,&nbsp;<\/li>\n\n\n\n<li><strong>Identify potential risks<\/strong>, where the auditor will review the opportunities for hazards in IT systems that threaten the company from compliance, security, and operational aspects.<\/li>\n\n\n\n<li><strong>Optimize efficiency<\/strong>, where this audit process allows auditors to review IT operations and find ways to maximize its efficiency.<\/li>\n\n\n\n<li><strong>Improve quality<\/strong>, where from the IT audit identification process, the auditor can recommend improvements and improvements to the IT system in the company.<\/li>\n<\/ul>\n\n\n\t\t<div data-elementor-type=\"section\" data-elementor-id=\"5427\" class=\"elementor elementor-5427\" data-elementor-post-type=\"elementor_library\">\n\t\t\t<div class=\"elementor-element elementor-element-c693698 e-flex e-con-boxed e-con e-parent\" data-id=\"c693698\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f131bf4 cta-banner-article elementor-widget elementor-widget-image\" data-id=\"f131bf4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/audithink.com\/en\/demo\/\" data-at-cta=\"banner-artikel\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"2400\" height=\"800\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo.webp\" class=\"attachment-full size-full wp-image-5428\" alt=\"cta banner campaign\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo.webp 2400w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-300x100.webp 300w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-1024x341.webp 1024w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-768x256.webp 768w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-1536x512.webp 1536w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-2048x683.webp 2048w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-18x6.webp 18w\" sizes=\"(max-width: 2400px) 100vw, 2400px\" title=\"\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n\n\n\n<h2 class=\"wp-block-heading\">What Is the Procedure for Conducting IT Audit?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-1024x683.webp\" alt=\"the audit team carries out IT audit procedures \" class=\"wp-image-3773\" title=\"\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-1024x683.webp 1024w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-300x200.webp 300w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-768x512.webp 768w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-1536x1024.webp 1536w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-2048x1365.webp 2048w, https:\/\/audithink.com\/wp-content\/uploads\/2025\/01\/tim-audit-pexels-18x12.webp 18w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Ilustrasi Prosedur Pelaksanaan Audit IT (Sumber: Pexels)<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">After knowing what the objectives and benefits of an IT audit are, you will be directed to the stage of its implementation.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, the audit process will start from the planning step and end at the monitoring stage after the audit and the implementation of recommended improvements.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is a full explanation of <a href=\"https:\/\/audithink.com\/en\/article\/audit-procedures\/\">audit implementation procedure<\/a> IT:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Planning <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It starts with identifying the purpose of the IT audit, its scope, potential associated risks, and the specific targets for which the audit is conducted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At this stage also carried out the formation of an audit team that includes auditors and a team of experienced professionals as well as management plans that include methods, schedules, and resources needed for it audits.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Gather Informations <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This stage allows the auditor to review data relating to the information technology system under review.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditor will collect data in the form of documents, conduct interviews with relevant parties, and make direct observations on IT systems and related matters to improve understanding of the technology used.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Evaluation and control test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This stage allows the auditor to test the controls over the security and procedures that have been implemented, based on the system's functionality, security, and availability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to identifying its effectiveness, the review is also used to ensure compliance of security controls and procedures with established policies.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After that, the auditor will review the nonconformities and potential risks found in the security controls and procedures that have been implemented.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Identification Of Audit Results <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditor will identify the findings obtained to evaluate the risk so that it can determine its level based on the possibility of the risk occurring and its impact.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the basis for recommendations to improve control, improve system weaknesses,and reduce risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once the identification of the audit results and recommendations is complete, you can begin to compile them into a report.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Preparation Of Reports <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditor will prepare an audit report containing findings, recommendations, improvement plans, conclusions, and additional information.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The audit report will present a clear, detailed, structured, and understandable explanation so that it is effectively used by the company's management.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So that in this case the company can carry out the next plan based on the stages, budget, resources, and improvement targets in each recommendation that has been enclosed in the report as a strategic guide.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Follow-Up <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In this stage, the company will implement improvements starting with the highest level recommended by the auditor.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the process, the company will establish an implementation plan by forming a responsible team and effectively directing improvements.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, the auditor will constantly monitor the implementation of changes to his system and make sure that any actions taken are in accordance with the plan.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Not only does it ensure the objectives of the IT audit are achieved with improvements, but this stage also allows the auditor to further review the scope that needs to be improved or other actions that need to be taken after the improvement.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review is not enough to get there, because the auditor will monitor the system periodically while preparing improvement reports and continue to plan for necessary updates.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each stage produces the following working documents.<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Stage<\/th><th>Output<\/th><\/tr><\/thead><tbody><tr><td>Planning<\/td><td>Scope and audit work program<\/td><\/tr><tr><td>Information gathering<\/td><td>Document request list and interview results<\/td><\/tr><tr><td>Evaluation and control testing<\/td><td>Test working papers with evidence<\/td><\/tr><tr><td>Identifying audit results<\/td><td>List of findings with risk ratings<\/td><\/tr><tr><td>Report preparation<\/td><td>Audit report and improvement plan<\/td><\/tr><tr><td>Follow-up<\/td><td>Improvement monitoring matrix<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit-work-program\/\">Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/audit-working-papers\/\">Audit Working Papers: Definition, Function, Purpose, and Types<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/report-audit\/\">Audit Report: Definition, Functions, Types, &amp; Examples<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How Often Must an IT Audit Be Carried Out?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Commercial banks: an internal audit of IT operations at least once a year, and a review of the IT internal audit function by an independent external party at least once every 3 years (OJK Regulation 11\/POJK.03\/2022 Article 54 paragraph 4 and Article 55 paragraph 2).<\/li>\n\n\n\n<li>Other electronic system operators: Government Regulation 71\/2019 only refers to audit mechanisms carried out periodically, without a stated frequency.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Does an IT Audit Look Like in Banking?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An example of a company that carries out IT audits regularly is Bank Mandiri. According to the Data Security and Customer Protection page on Bank Mandiri's website, the bank conducts an internal audit once a year and an external audit once a year, involving a reputable independent external consultant of international scale.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This practice is in line with banks' obligations under OJK Regulation 11\/POJK.03\/2022. The example does not mean all banks use the same consultant, because the choice depends on each bank's needs and regulations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/digital-banking-audit\/\">Digital Banking Audit: Risks, Compliance, and Evaluation Methods<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Is a Short Checklist for an IT Audit?<\/h2>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Area<\/th><th>Test question<\/th><th>Proof<\/th><\/tr><\/thead><tbody><tr><td>User access<\/td><td>Have accounts of departed employees been deactivated?<\/td><td>Account list and HR data<\/td><\/tr><tr><td>Privileged access<\/td><td>Who has administrator access and is it approved?<\/td><td>Administrator list and approvals<\/td><\/tr><tr><td>Change management<\/td><td>Are changes tested and approved before being applied?<\/td><td>Change tickets<\/td><\/tr><tr><td>Backup and recovery<\/td><td>Has recovery from backup ever been tested?<\/td><td>Recovery test report<\/td><\/tr><tr><td>Vulnerabilities and patches<\/td><td>Are discovered vulnerabilities closed on time?<\/td><td>Scan reports and patch status<\/td><\/tr><tr><td>Logs and audit trails<\/td><td>Are important activities recorded and traceable?<\/td><td>System logs<\/td><\/tr><tr><td>Third parties<\/td><td>Are IT vendors risk-assessed?<\/td><td>Vendor assessments and contracts<\/td><\/tr><tr><td>Personal data<\/td><td>Is personal data handled in line with policy and regulations?<\/td><td>Policies and processing records<\/td><\/tr><tr><td>Business continuity<\/td><td>Is the disaster recovery plan tested periodically?<\/td><td>Plan and test results<\/td><\/tr><tr><td>Incidents<\/td><td>Are incidents recorded, analyzed, and followed up?<\/td><td>Incident register and analysis reports<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/examples-of-internal-audit-checklist\/\">10 examples of Internal Audit Checklist and its explanation<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ About IT Audits<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is an IT audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">An IT audit is an examination and evaluation to ensure a company's IT systems, infrastructure, policies, and procedures run optimally as a whole, covering operational optimization, system security, regulatory compliance, and efficiency of use.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is the purpose of an IT audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Evaluating IT system performance against set objectives, identifying potential risks in compliance, security, and operations, optimizing IT operational efficiency, and improving system quality through improvement recommendations.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What are the types of IT audits?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Software audit, infrastructure audit, security audit, compliance audit, risk management audit, operational audit, and vulnerability audit and penetration testing as technical testing tools.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is the procedure for an IT audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Six stages: planning including forming the audit team, gathering information through documents, interviews, and direct observation, evaluation and control testing, identifying audit results with their risk levels, preparing the report, then follow-up.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is ITGC?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">ITGC, or IT general controls, are policies, procedures, and practices that help ensure systems are reliable, secure, and support data integrity. The usual categories are access control, change management, system development, and physical control and recovery.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>How Often Must an IT Audit Be Carried Out?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">For commercial banks, an IT internal audit at least once a year under OJK Regulation 11\/POJK.03\/2022 Article 54 paragraph 4. For other electronic system operators, Government Regulation 71\/2019 only refers to periodic audits without a figure.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What are the risks if a company skips IT audits?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Security hazards, system weaknesses, and non-compliance with regulations can go undetected. A weak IT system, for example, opens the door to cyber crime that threatens both the data and the company itself.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What Is the Difference Between an IT Audit and an Information Systems Audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">The two are often used interchangeably. An IT audit tends to focus on the technology layer and its governance, while an information systems audit focuses on controls over data and transactions within the system.<\/p>\n<\/details>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Thus is the explanation of IT audit which is an important procedure in ensuring the reliability of a company in IT systems.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An IT audit can be carried out by an internal audit team or by an independent external auditor. When choosing an external auditor, consider their expertise and experience.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Audithink is internal audit management software that can be customized, not an IT audit service provider. Audit teams can use it for risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. To manage planning, work programs, and follow-up for IT audits in your team, please schedule a demo.<\/p>","protected":false},"excerpt":{"rendered":"<p>An IT audit examines the optimization, compliance, security, and effectiveness of a company's information technology systems. Learn the types, objectives, procedures, and examples.<\/p>","protected":false},"author":14,"featured_media":3771,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","rank_math_title":"Audit IT: Definisi, Jenis, Prosedur, ITGC, dan Contohnya","rank_math_description":"Audit IT adalah pemeriksaan kontrol, keamanan, dan kepatuhan sistem TI. Kenali jenis, tujuan, prosedur, ITGC, ISO 27001, COBIT, dan contohnya.","rank_math_canonical_url":"","rank_math_focus_keyword":"audit it","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_twitter_title":"","rank_math_twitter_description":"","_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_canonical":"","_yoast_wpseo_focuskw":"","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","rank_math_robots":[]},"categories":[15],"tags":[30],"class_list":["post-3770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-kebijakan-audit"],"acf":[],"_links":{"self":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/comments?post=3770"}],"version-history":[{"count":5,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3770\/revisions"}],"predecessor-version":[{"id":7262,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3770\/revisions\/7262"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media\/3771"}],"wp:attachment":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media?parent=3770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/categories?post=3770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/tags?post=3770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}