International Journal of Accounting Information Systems 11 (2010) 155156

Contents lists available at ScienceDirect

International Journal of Accounting

Information Systems

Discussion

Discussion of 'Factors Associated with IT Audits by the Internal

Audit Function'
Doug Tsang
KPMG, Canada

1. Introduction
This research paper examined the statistical relationship between the proportions of time that Internal
Audit Functions (IAFs) spent on IT audits (level of IT audits) and factors such as internal audit staff's
training (qualications), experience and the size of the organization.
2. Comments
The research approach to the topic is quantitative as it examined the statistical relationship between
the level of IT audits and various variables noted above. The authors have not incorporated other
qualitative factors into the research. For example, the analysis did not include risk as a variable factor.
This will be discussed in more detail below:
a) Denition of IT audits
The proportion of IAF's time spent on IT audit may depend on how IT audits are dened. IT audits
would typically include the following areas:
IT general controls
IT application controls
Computer Assisted Audit Techniques (CAATs).
However, auditing IT application controls or using CAATs normally forms an integral part of
operational or nancial audits. It is not clear in the research whether the time spent in these areas was
captured as IT audits in the CBOK (2006) survey. If these are not classied as IT audits, the proportion
of time spent on IT audits reported in the paper may not provide a complete picture.
Additionally auditing IT application controls or using CAATs form an integral part of operational or
nancial audits. These are often performed by the operational or nancial auditors rather than IT
auditors. Thus, it is not clear whether this will have any impact on the model.
b) Other variable factors risk
The authors have not included risk to either an Explanatory Variable or a Control Variable. It is common
for the IA function to spend more time auditing high risk areas, regardless whether or not there is an IT
component in the area.
c) Other variable factors complexity of IT systems
The authors have not included the complexity of IT systems used in the organization as an Explanatory
Variable or a Control Variable. It seems plausible that IAFs in organizations using more complex IT
1467-0895/$ see front matter 2010 Elsevier Inc. All rights reserved.
doi:10.1016/j.accinf.2010.07.006

156

D. Tsang / International Journal of Accounting Information Systems 11 (2010) 155156

systems will spend more time on IT audits. It would be interesting to see whether the size of the
organization (as measured by the number of full-time employees) can be used as a proxy for the
complexity of organization's IT systems.