Are You Falling for These Audit Misconceptions?

• The primary goal of an audit is to uncover facts, not faults. Auditors identify issues, recognize areas of strength, and suggest improvements.
• Another misconception is that audits are just about ticking boxes. In fact, audits are more comprehensive, ensuring that systems comply with regulations and internal controls.
• Kulkarni emphasizes that the audit process doesn’t end with reporting; continuous monitoring and follow-up are crucial for tracking progress on recommended actions.

Chinmay Kulkarni, a Technology Risk Assurance Consultant at EY US, addresses common misconceptions about auditing. He highlights that audits are often misunderstood, leading to several myths he aims to debunk.

One major myth Kulkarni dispels is that auditors focus solely on finding faults. Contrary to this belief, he clarifies that the primary goal of an audit is to uncover facts, not faults. Auditors identify issues, recognize areas of strength, and suggest improvements. Another misconception is that audits are just about ticking boxes. In fact, audits are more comprehensive, ensuring that systems comply with regulations and internal controls.

Kulkarni also corrects the misconception that audit work is non-technical and thus unsuitable for technology professionals. He explains that IT audits require a blend of understanding both business processes and technology. These audits examine an organization’s IT infrastructure, data management, policies, and operational procedures against recognized standards. This means that individuals with a technology background can indeed work in audits.

Furthermore, Kulkarni addresses misconceptions about IT audit planning and outcomes. Audit planning is not just about listing requirements and testing controls; it involves a thorough understanding of the organization, risk assessments, and blending business and technology knowledge. It also includes managing time and resources and considering legal, regulatory, and compliance aspects. He also clarifies that IT audits do not guarantee 100% security but improve an organization’s security posture by helping mitigate, not eliminate risks. Moreover, IT audits are ongoing processes for continuous improvement, not one-time events. While IT auditors identify current threats and suggest strategies for future threats, they cannot predict them. Finally, Kulkarni emphasizes that the audit process doesn’t end with reporting; continuous monitoring and follow-up are crucial for tracking progress on recommended actions.

Read the full article