How does IT audit fit with governance, risk management and information security?
Governance is a genuine solid-gold buzzword, essentially meaning systems of control. Governance can be considered at various levels such as broad pan-organizational controls (corporate governance) or controls over individual projects or systems (project and systems governance). Similarly in respect of risk management, the scope can apply across the whole organization (taking in commercial, operational, market, financial, regulatory and other risks) or just to specific projects and systems. For a rather formal perspective on the relationship between auditing and governance, read the Public Company Accounting Oversight Board (PCAOB)’s Auditing Standards. The PCAOB was established by the U.S. Securities and Exchange Commission – the SEC – as (yet another) independent oversight board to regulate/guide professionals involved in auditing companies, this time specifically regarding compliance with the Sarbanes Oxley Act of 2002 (SOX). Whether PCAOB was actually needed or not you can maybe jud
Governance is a genuine solid-gold buzzword, essentially meaning systems of control. Governance can be considered at various levels such as broad pan-organizational controls (corporate governance) or controls over individual projects or systems (project and systems governance). Similarly in respect of risk management, the scope can apply across the whole organization (taking in commercial, operational, market, financial, regulatory and other risks) or just to specific projects and systems. The governor on a steam engine uses two brass spheres spinning around a central valve. The quicker the engine runs, the wider spheres swing, thereby closing the steam valve. In other words, governance takes balls. For a rather formal perspective on the relationship between auditing and governance, read the Public Company Accounting Oversight Board (PCAOB)’s Auditing Standards. The PCAOB was established by the U.S. Securities and Exchange Commission – the SEC – as (yet another) independent oversight b
