I.T. Auditing for Operational Auditors

Training Introduction

Background

As business processes become increasingly reliant on information technology, operational auditors must be equipped to understand and evaluate IT risks and controls—even if they are not IT specialists. From procurement systems and inventory platforms to HR management and cloud services, technology is embedded in nearly every operational process.

While operational auditors may not perform deep technical audits, their ability to recognize IT risks, assess automated controls, and collaborate with IT auditors is crucial for delivering meaningful assurance.

 

Purpose of the Training

To provide non-technical auditors and operational audit teams with a practical understanding of key IT concepts, risks, and controls, so they can incorporate IT considerations into their operational audits effectively.

 

Learning Objectives

By the end of this course, participants will be able to:

• Understand core IT concepts and their relevance to operational audits
• Identify IT-related risks and assess general and application controls
• Evaluate the effectiveness of technology-enabled processes
• Collaborate with IT specialists and ask the right questions during audits

 

Target Audience

• Operational and performance auditors
• Internal audit team members without an IT background
• Audit supervisors and managers overseeing tech-integrated processes
• Compliance and risk officers

 

Training Format

• Modules: 4 interactive modules
• Delivery: In-person, online, or blended
• Methodology: Real-world examples, case studies, short demos, and group activities

 

Course Content:

Module 1: IT Concepts Every Operational Auditor Should Know

Objective:

To build familiarity with essential IT components that impact operational audits

Topics Covered:

• Key IT components: hardware, software, networks, databases
• Common business applications: ERP, HRM, inventory, procurement systems
• Cloud computing, mobile tech, and digital transformation
• How technology enables and transforms business operations
• Common audit challenges involving IT

Activity:

• Group exercise: Map an operational process and highlight where IT is involved

Module 2: Understanding IT Risks in Operational Processes

Objective:

To identify and assess IT-related risks that can affect process effectiveness, efficiency, or compliance

Topics Covered:

• IT risks relevant to operations:
• Data integrity
• Availability of systems
• Access and segregation of duties
• Unauthorized changes
• Operational red flags indicating potential IT weaknesses
• How IT risks can impact audit objectives
• Using a risk-based approach to focus audit efforts

Activity:

• Scenario analysis: Identify IT risks in a procurement-to-pay or inventory process

Module 3: IT General and Application Controls – What Operational Auditors Need to Know

Objective:

To understand and assess basic IT control concepts during operational audits

Topics Covered:

• IT General Controls (ITGCs):
• Access controls
• Change management
• Backup and recovery
• Application controls:
• Input, processing, output controls
• Automated approval workflows
• Testing techniques: observation, inquiry, walkthroughs, data review
• Working with IT auditors to validate technical controls

Activity:

• Walkthrough: Identifying control gaps in an IT-enabled operational process

Module 4: Integrating IT into Operational Audits

Objective:

To plan and execute operational audits with integrated IT considerations

Topics Covered:

• Planning operational audits with IT in mind
• Writing audit programs that include IT-related control objectives
• Asking the right questions in interviews with process and system owners
• Documenting and reporting IT-related findings clearly
• When and how to involve IT audit specialists

Activity:

• Audit planning simulation: Build an audit plan for a tech-enabled process (e.g., procurement, inventory)

 

Conclusion and Certificate

• Recap of key IT concepts for operational auditors
• Tools and templates to take back to your audit work
• Final Q&A and next steps
• Certificate of Completion awarded

 

Optional Takeaways

• IT Risk and Control Checklist for Operational Auditors
• Key IT Questions to Ask During Audits
• Sample Audit Program with IT-Integrated Steps
• Glossary of Common IT Terms for Non-IT Auditors