Bridging the Gap Between IT and Financial Audit Presentation to NSAA IT Conference September 24, 2015 Michael Spivey, CISA & Luis Toledo, MPA, CISA

Bridging the Gap Between IT and Financial Audit North Carolina OSA’s efforts Table Discussions Results of Discussions

North Carolina OSA’s Efforts Introduction & recognition of a gap between IT and financial audit Challenges encountered Efforts to overcome challenges Results of our efforts

Introduction & Recognition of the gap between IT & Financial NC OSA Organization –IS Audit –Financial Audit 2009: Financial Audit division management recognized need for more IT knowledge on audits 2010: Beginning of the “Partnership” project

Challenges Encountered Lack of understanding of each other’s perspective Resistance to change from prior year Establishing accountability and realistic budgets

Efforts to Overcome Challenges Challenge: Lack of Understanding of each other’s perspective Efforts made to overcome challenge: –IS auditors being integrated into the financial planning meetings –Pairing Financial and IS auditors together in the field –Training for Financial auditors on auditing ITGCs –Office-wide resource sharing policy

Efforts to Overcome Challenges (cont.) Challenge: Resistance to change from prior year. Efforts made to overcome challenge: –Office Charter with emphasis on Efficiency and Effectiveness –Introduction of a “Why?” person in planning meetings –Mini planning sessions between IS Audit and Financial division management

Efforts to Overcome Challenges (Cont.) Challenge: Establishing accountability and realistic budgets. Efforts to overcome challenge: –Surveys sent to Financial Audit supervisors for feedback on IS Audit’s work to support their audits –Memorandum of Understanding defining roles and responsibilities of each division –Improved communication efforts between the divisions.

Results of our Efforts Seeds planted beginning to bear fruit –Staff rotations yielding good results –Financial audits are embracing IT rather than looking to audit around it. Budget and timelines are being met. –Result of greater understanding of each other and effectiveness and efficiency efforts. Reduced negative feedback. –Result of the MOU and communication efforts

Questions?

Table Discussion What is the biggest gap you see between Financial and IT audit? Has your office experienced reluctance to change “old ways” of testing around systems? –If so, what efforts have you made to overcome this challenge? Does your office find it easier to hire staff with IT backgrounds and teach them audit or staff with audit backgrounds to teach them IT?

Thank you! Michael Spivey, CISA –IS Audit Supervisor at NC OSA Luis Toledo, MPA, CISA –IS Audit Supervisor at NC OSA