1. IT Internal Audit Survey Overview of survey findings May 2009 IT ADVISORY ADVISORY

2. © 2009 KPMG LLP, the UK member firm of KPMG International, a Swiss cooperative. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International, a Swiss cooperative. 1 2009 IT Internal Audit Survey Background Reasons for the survey IT systems are increasing in complexity Organisations are becoming more dependent on IT – competitive edge/survival in business IT systems often the most valuable asset Increasing pressure on IT Internal Audit Survey methodology 52 questions in online survey Responses from 297 major EMA organisations Covered all major industry groups Represented over 20 different countries Topics included Organization & functions of the IS audit Types of project and methodology Project planning Communication and follow-up Assessment and quality control Use of tools Professional skills & progress Training and evaluation Industry groups represented included: Industrial manufacturing Consumer goods / distribution Banking Insurance Energy and utilities Services Telecommunication Leisure Public Sector / education

3. © 2009 KPMG LLP, the UK member firm of KPMG International, a Swiss cooperative. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International, a Swiss cooperative. 2 2009 IT Internal Audit Survey Organisation & planning Plus points Many using planning framework - COBIT most popular Increasing integration with other governance areas 38% involved in verifying new IT systems 63% audit plans approved by Audit Committee Minus points Some still do not use a standard framework 26% not integrated with other governance areas 10% audit plans approved by IT Only 16% have rolling or quarterly planning Key recommendations Integrate with other audit areas and get close to the business Retain independence Provide proactive value-add audit Review audit plans frequently to react to rapid change Standard frameworks/methodologies used Coordination of IT internal audit with wider governance activities

4. © 2009 KPMG LLP, the UK member firm of KPMG International, a Swiss cooperative. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International, a Swiss cooperative. 3 2009 IT Internal Audit Survey Staffing & skills Plus points Many cover skills gaps with outsourcing 57% require formal qualifications (CISA) Minus points Security knowledge in high demand and short supply 55% recruit – no in-house development 29% get less than a week training per year Training focus is just on qualifications Key recommendations: Develop existing staff to improve retention Closely manage external consultants Train for business skills and understanding Conduct end of engagement assessments Skills most in demand Training focus

5. © 2009 KPMG LLP, the UK member firm of KPMG International, a Swiss cooperative. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International, a Swiss cooperative. 4 2009 IT Internal Audit Survey Tools Plus points Tools used across many areas of audit process Substantial use for data analysis Minus points 33% don’t use data analysis/sampling tools Heavy emphasis on end user computing tools Key recommendations: IT Audit should lead the way in tool use Specialist audit tools can increase quality and scope Use of automated tools across the IT audit process Data analysis tools used

6. © 2009 KPMG LLP, the UK member firm of KPMG International, a Swiss cooperative. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International, a Swiss cooperative. 5 2009 IT Internal Audit Survey Reporting & quality Plus points 97% have formal reports 80% use a standard report format 72% report to audit committee Minus points 80%don’t use executive summary Only 6% do a presentation to management 55% don’t include management comments 41% do no or only informal assessment of quality Key recommendations: Measure quality against success criteria Report in a manner that is clearly understood Do not devalue good work through poor reporting Who gets an audit report?