In information systems auditing, which statement best describes the core capability expected of an Electronic Data Processing (EDP) auditor in modern organizations?
-
AThey must demonstrate strong computer and information-systems control expertise in addition to auditing skills.
-
BThey focus only on traditional financial tests and will soon be replaced by non-IT auditors.
-
CThey should avoid technical knowledge to remain independent from IT staff.
-
DMarket demand for EDP auditors is declining because personal computers reduced risk.
-
ENone of the above
Answer
Correct Answer: They must demonstrate strong computer and information-systems control expertise in addition to auditing skills.
Explanation
Introduction / Context:Electronic Data Processing (EDP) auditing evaluates controls over information systems, including security, availability, integrity, and compliance. The role blends classic audit techniques with technical knowledge of operating systems, databases, networks, and application controls. Understanding what makes an EDP auditor effective helps organizations reduce risk and strengthen governance.
Given Data / Assumptions:
- The environment includes automated business processes and digital records.
- Controls span general IT controls (access, change management, operations) and application controls (input, processing, output).
- The question asks for the most accurate capability statement for EDP auditors.
Concept / Approach:Modern auditors must evaluate how data is captured, processed, stored, protected, and reported. This requires fluency in IT risks, control frameworks, and tools (e.g., log analysis, data extraction). Therefore, the correct characterization emphasizes combined auditing and computer expertise.
Step-by-Step Solution:
Identify key competencies: audit methodology + IT control knowledge.Map to audit scope: general IT controls, application controls, and data integrity testing.Select the option that explicitly requires both skill sets.Verification / Alternative check:Job descriptions and assurance standards consistently require technology proficiency (e.g., understanding authentication, encryption, logging, and change control) alongside traditional sampling and reporting.
Why Other Options Are Wrong:
- Only financial tests or avoidance of technical knowledge cannot assess automated control environments.
- Declining demand is incorrect; risk and compliance requirements keep demand high.
- ‘‘None of the above’’ is wrong because one option captures the role precisely.
Common Pitfalls:Assuming IT audits are just checklist exercises; effective EDP auditing requires evaluating the design and operating effectiveness of controls in complex systems.
Final Answer:They must demonstrate strong computer and information-systems control expertise in addition to auditing skills.