IT risk - closing the gap

September 2007

The risks related to the use of information and communication technology are high on the boardâ??s agenda. We conducted some research in this area on behalf of the Institute of Internal Auditors, focusing on the views of senior managers and Heads of Internal Audit, with the aim of establishing their perception of IT risk and the level of assurance that Internal Audit provides.

A major emphasis of the research was to identify the gaps and disconnects between different parts of an organisation in terms of understanding IT risk. The insight that this generated has allowed us to create a clearer picture of how organisations can identify their IT risks more accurately and therefore take positive steps to address them.

We specifically focused on answering three questions:

• Does the Board fully understand the impact that IT risk can have on the business and the need for assurance?
• Does Internal Audit provide assurance in the areas that the board needs?
• Does Internal Audit have the credibility and capabilities to deliver assurance to the board?