Information Technology
& Systems Audit

An IT audit takes a governance and control perspective — it examines whether the controls over your IT environment are designed and operating effectively, focusing on the risks to financial reporting, data integrity, and operational continuity. A cybersecurity assessment takes a technical threat perspective — it examines how well your systems can withstand attack, often including penetration testing, vulnerability scanning, and threat modelling. The two are complementary: cybersecurity assessments test the strength of your defences against external attack; IT audits test the quality of your internal controls over how systems are managed, accessed, and changed. Finerio conducts IT audits from the controls and governance perspective — and recommends specialist cybersecurity firms for penetration testing where required.

Under ISA 315, every financial statements auditor is required to understand and evaluate the IT environment as part of assessing the risks of material misstatement. If your IT general controls (ITGC) are strong — well-controlled access, robust change management, reliable backups — your financial auditors can place greater reliance on system-generated reports and data, reducing the amount of manual transaction testing they need to perform. If ITGCs are weak, auditors must compensate by performing more extensive (and more time-consuming) manual testing, which increases your audit cost and duration. A strong ITGC environment, documented through an IT audit, can materially reduce your financial audit cost and accelerate sign-off.

A superuser (also called a privileged account or administrator account) is a system login with unrestricted access — the ability to create users, change configurations, view all data, override controls, and delete records without the usual approval workflows applying. In most organisations, these accounts are necessary — your IT team needs them for system maintenance. The risk arises when: too many people have them; they are shared between multiple staff; they are used for routine work instead of reserved for specific administrative tasks; or no one is monitoring what actions are taken under those accounts. An IT audit reviews every privileged account — confirming who has them, whether they are justified, and whether their use is being independently monitored.

Timeline depends on the scope — the number of systems in scope, the complexity of your IT environment, and how many domains are being reviewed. A focused ITGC review of one or two financial systems typically takes 2 to 3 weeks from commencement of fieldwork to draft report. A comprehensive IT audit covering multiple systems, application controls, cybersecurity, and governance typically takes 4 to 8 weeks. For large, complex organisations with multiple ERP systems, the engagement can take 2 to 3 months. We agree a clear timeline and deliverable schedule at engagement inception — and manage our workload to meet it.

No — it means you have a different kind of IT control environment, but one that is just as important to audit. When IT is managed by an external provider, your controls shift to: vendor management (do you have a proper contract? do you receive and review their security and performance reports?); access management (what access does the provider have to your systems and data, and is it appropriately restricted and monitored?); and service continuity (what are the provider's backup and recovery commitments, and have they been tested?). If your provider has a SOC 2 Type II report, we review it as part of your IT audit — evaluating whether the controls described in the report are relevant to your use of their services and whether any gaps in their coverage need to be addressed on your side.

The most common findings across UAE businesses, regardless of size, include: excessive user access — staff with system rights far beyond what their role requires; inactive accounts — former employees still with active logins; shared passwords — particularly for admin or finance system accounts; no formal change management — system changes made without documentation or approval; untested backups — backup processes running but never tested for restorability; no IT security policy — or a policy that is years out of date and not being followed; and IT SoD conflicts — single users able to perform conflicting actions in financial systems without oversight. None of these are unusual — they are the norm in businesses that have grown without investing in IT governance. The good news is that all of them are fixable.