Why Information Technology Audits Matter Amid Indonesia’s Digital Advancement

Information Technology (IT) has become an inseparable part of various sectors in Indonesia, ranging from finance and government to small and medium-sized enterprises (SMEs). IT drives efficiency and innovation; however, it also increases security risks and the potential for data breaches. Therefore, stronger IT oversight and auditing are critically needed to ensure the security of information and the reliability of services delivered by organizations.

As IT adoption continues to grow in Indonesia, incidents of data breaches and cyberattacks have become increasingly frequent. Data breaches involving major corporations and the recent incident at the Temporary National Data Center (PDNS) within the government highlight the vulnerability of Indonesia’s IT governance. These cases underscore the importance of systematic, periodic, and comprehensive IT audits to identify weaknesses and ensure the effectiveness of risk controls.

Similar to financial statements that require periodic audits, both internally and by independent parties, IT systems demand the same level of scrutiny. IT audits are necessary to ensure that IT systems and infrastructure operate efficiently, securely, and in compliance with applicable regulations. Structured and regular IT audits enable organizations to identify potential risks, security vulnerabilities, and compliance gaps. As such, IT audits constitute a critical component of organizational governance.

The Importance of IT Audits from Multiple Perspectives

The importance of IT audits can be viewed from several perspectives.

First, from a security standpoint, IT audits help detect and prevent cyberattacks that may cause significant harm to organizations. Frequent data breaches and cyber incidents demonstrate that IT systems remain vulnerable to threats. Through systematic audits, organizations can assess the effectiveness of existing security controls and implement necessary corrective actions to strengthen cyber resilience. This also enables organizations to provide assurance to the public and stakeholders regarding the reliability of their information systems.

Second, from a compliance perspective, various regulations issued by the government, regulators, and internal organizational policies require IT systems to comply with specific security standards. IT audits help ensure organizational compliance with these regulations and reduce the risk of sanctions arising from non-compliance.

Third, from an operational efficiency perspective, IT audits can identify areas where technology can be utilized more effectively. This includes evaluating IT-supported business processes, the use of IT resources, and IT infrastructure management. Through effective audits, organizations can reduce operational costs and improve productivity by optimizing technology utilization.

IT Audits in an Increasingly Connected Digital Era

IT audits are a critical response to the digital era, where system and infrastructure interconnectivity occurs in real time. In an increasingly connected environment, any security gap can be exploited by irresponsible parties to launch attacks. IT audits ensure that all technological components within an organization function properly, securely, and in compliance with applicable regulations.

In addition, IT audits play a vital role in personal data protection. In an era where data has become a highly valuable asset, ensuring that personal data is properly managed and protected is essential. IT audits assist in identifying and assessing risks related to personal data management and provide recommendations to strengthen data security controls.

For all organizational levels, from top management to operational staff, understanding the importance of IT audits is key to maintaining the integrity and security of information systems. Senior management must ensure that IT audits receive adequate support and that audit findings are properly implemented, while operational staff must understand and comply with policies and procedures resulting from the audit process. In this way, the entire organization can collaborate to create a secure and efficient IT environment.

IT Audits as a Critical Element of Effective IT Governance

IT audits are a critical component of effective information technology management. Through structured and periodic audits, organizations can ensure that their IT systems are secure, compliant with regulations, and operationally efficient. With serious attention and appropriate action, IT audits help organizations reduce risk, avoid regulatory sanctions, and enhance overall business performance.

Regulatory and Policy Developments

The Government of Indonesia has issued a number of regulations to strengthen cyber resilience and security. Regulations issued by the Financial Services Authority (OJK), Bank Indonesia (BI), and the Ministry of State-Owned Enterprises concerning IT governance, IT risk management, and cybersecurity require financial institutions and state-owned enterprises to establish robust protection systems.

These regulations emphasize the importance of effective cyber risk management, technical and procedural requirements that must be met, and the obligation to conduct periodic independent audits. IT audits serve as a crucial tool to ensure regulatory compliance, identify risks, and provide improvement recommendations.

The increasing adoption of cloud computing further adds complexity to IT audits. Dynamic and distributed cloud infrastructures require more specific audit approaches. IT auditors must be able to evaluate the security of data stored in the cloud, identify risks, and ensure that cloud services comply with applicable regulations. Cloud audits involve reviewing security configurations, identity and access management, as well as data backup and recovery policies.

Personal Data Protection and Emerging Technologies

With the enactment of the Personal Data Protection Law (UU PDP), protecting personal data has become a top priority for all organizations handling sensitive information. IT audits play a critical role in ensuring that personal data is managed and protected in accordance with regulatory requirements. The audit process includes assessments of privacy policies, encryption mechanisms, and access controls. IT auditors are responsible for identifying potential violations and providing recommendations for corrective actions. Through structured audits, organizations can ensure compliance and reduce the risk of data breaches.

In addition, the use of Artificial Intelligence (AI) in business continues to increase, introducing new challenges and risks. AI technologies can enhance operational efficiency and decision-making, but they may also introduce risks such as algorithmic bias and non-transparent automated decisions.

IT audits of AI systems involve reviewing algorithms, validating the data used as the basis for decision-making, and assessing monitoring and control mechanisms. IT auditors must ensure that AI usage aligns with ethical principles and regulatory compliance, and that AI systems are auditable and accountable. ISACA highlights the importance of auditing AI systems, including the use of the COBIT framework to assess and manage AI-related risks.

The Importance of Audit Standards and Competent IT Auditors

Audit standards provide essential guidance to ensure that audits are conducted with consistency, reliability, and high integrity. In the context of IT audits, audit standards establish the framework required to evaluate the effectiveness of controls and information system security. One widely recognized IT audit standard is the IT Audit Framework (ITAF) issued by ISACA.

ISACA’s ITAF provides comprehensive guidance for IT auditors in conducting effective IT audits and assessments. This framework encompasses principles and best practices designed to ensure that audit processes are systematic and thorough. ITAF supports auditors in planning, executing, and reporting IT audits in accordance with high professional standards.

Key elements of ITAF include:

• Principles and Ethics, emphasizing integrity, objectivity, and independence in IT audit execution.

• Performance Standards, governing procedures and methodologies that IT auditors must follow to ensure audits are conducted effectively and efficiently.

• Reporting Standards, providing guidance on preparing audit reports that are clear, accurate, and value-adding for organizations.

Effective IT audit execution depends not only on the standards applied but also on the competence of the individuals performing the audits. Competent IT auditors possess deep knowledge of information technology, cyber risks, and applicable regulations. Certifications such as Certified Information Systems Auditor (CISA) issued by ISACA are widely recognized indicators of IT auditor competence.

CISA certification demonstrates that its holders possess the knowledge and skills required to audit, control, and monitor information systems. The certification covers essential IT audit domains, including the audit process, IT governance and management, information systems acquisition and implementation, information systems operations and protection, and information asset protection.

Conducting IT audits through competent auditors is critical to ensuring that audits deliver tangible value to organizations. Competent auditors not only identify risks and system weaknesses but also provide practical and implementable recommendations for improvement. This ensures that IT audits function not merely as compliance activities, but as strategic tools to enhance IT security and organizational performance.

The Importance of Periodic IT Audits

Data breach incidents in Indonesia indicate that information security risks remain a major challenge. Many of these cases could have been detected earlier if IT audits had been conducted periodically and whenever significant changes occurred in an organization’s IT infrastructure.

Regular IT audits help identify security weaknesses, assess the effectiveness of controls, and provide recommendations for improvement. As a result, organizations can reduce the risk of data breaches and ensure that their IT systems remain in optimal condition.

To address these challenges and risks, organizations must promptly establish strong IT audit units and engage experienced and highly competent IT auditors. An effective IT audit function can support organizations in managing cyber risks, ensuring regulatory compliance, and improving operational efficiency.

Competent IT auditors must possess a deep understanding of current technologies, applicable regulations, and best practices in cyber risk management. They must also be able to collaborate with various organizational stakeholders to identify and mitigate potential risks.

This article was published in our quarterly newsletter Valoka Vol. 2, 2024.