IS audits that connect IT controls to your accounts
In short: An information systems audit reviews whether a business's IT systems, data and controls are secure, reliable and support accurate financial reporting. It covers IT general controls such as user access, change management, backups and security, and application controls inside ERP and accounting systems. A. George & Associates in Kochi carries out IS audits for companies, NBFCs, co-operative banks and IT-enabled businesses across Kerala, either on their own or alongside the statutory audit.
Almost every transaction now runs through software: ERP, billing, payroll, core banking and payment systems. If access is not controlled, changes are not approved or data is not backed up, errors and fraud can pass straight into the accounts.
Our IS audits test the controls around your systems the way an auditor and a regulator would, and give you a clear, prioritised list of fixes. We review ERP and accounting systems such as SAP, Oracle, Microsoft Dynamics, Zoho and Tally, along with servers, cloud services and user access.
We also use data analytics to test full populations of transactions rather than samples. Read more in our article on why IS audit matters for Kerala businesses.
What does our IS audit cover?
IT general controls (ITGC)
User access, privileged access and periodic access reviews; Change management for software and configurations; Backup, recovery and job scheduling; IT operations and incident management.
ERP and application controls
Approval workflows and segregation of duties; Master data controls for vendors, customers and prices; Interface and data migration checks; Reports used in financial statements.
Cyber security review
Password, MFA and endpoint security; Firewall, network and remote access; Email security and phishing exposure; Security policies and awareness.
Regulatory IS audits
IS audits for NBFCs and co-operative banks under RBI requirements; Support for SOX and internal financial controls (IFC) testing; Data protection and privacy compliance reviews.
Data analytics and integrity
Full-population testing of transactions; Duplicate payment and unusual entry detection; Audit trail (edit log) checks in accounting software; Exception reports for management.
Cloud and outsourcing
Controls over cloud services and SaaS vendors; Review of service provider reports such as SOC 2; Contract and data-handling reviews.
How does an IS audit work?
- Scoping: We map your systems, data flows and the risks that matter, and agree the scope and criteria.
- Walk-throughs: We meet IT and business owners to understand how controls work in practice.
- Testing: Controls are tested with system reports, configurations, logs and data analytics.
- Report: Findings are rated by risk with practical recommendations and owners.
- Follow-up: We re-test fixes and confirm that issues are closed.
The scope of regulatory IS audits depends on the applicable RBI, SEBI or other sector requirements for your entity.
Related: Audit & Assurance, Forensic Audit, SOC 2 Readiness, Internal & Stock Audits, IT & Software Company Audit, Business Intelligence.
Who needs an information systems audit?
NBFCs and co-operative banks
Regulated entities required to have periodic IS audits of their IT systems and controls.
Listed and large companies
Companies testing internal financial controls, and groups with SOX reporting to a foreign parent.
IT and software companies
Technology firms in Infopark, SmartCity and Technopark serving overseas clients.
Hospitals and healthcare
Hospitals handling patient data, billing systems and insurance claims.
Hotels and retail chains
Businesses running PMS, POS and inventory systems across many locations.
Manufacturers and distributors
Businesses relying on ERP for inventory, costing and dealer billing.
We work with businesses in Kochi, Ernakulam and across Kerala, combining remote reviews with on-site testing.
Why choose A. George & Associates for IS audit?
- Chartered Accountancy firm in Vyttila, Kochi since 1987
- IS audit linked to financial audit, so findings map to real accounting risks
- Data analytics on full transaction populations
- Experience with ERP, Tally, core banking and hospitality systems
- Practical, prioritised recommendations rather than generic checklists
Frequently asked questions
What is an information systems (IS) audit?
An information systems audit reviews whether a business's IT systems, data and controls are secure, reliable and support accurate financial reporting. It covers IT general controls such as user access, change management, backups and security, and application controls inside ERP and accounting systems. A. George & Associates in Kochi carries out IS audits for companies, NBFCs, co-operative banks and IT-enabled businesses across Kerala, either on their own or alongside the statutory audit.
What is the difference between an IS audit and a financial audit?
A financial audit gives an opinion on the financial statements. An IS audit focuses on the IT systems and controls that produce those numbers, such as access, changes, backups and application controls. The two work best together, because weak IT controls increase the risk of errors in the accounts.
Is an IS audit mandatory?
It is mandatory for some regulated entities, such as NBFCs and co-operative banks under RBI requirements, and expected for companies reporting on internal financial controls or to foreign parents under SOX. For other businesses it is a good practice, especially where most transactions run through ERP or online systems.
Do you audit Tally and Zoho users?
Yes. Many small and mid-sized businesses use Tally or Zoho. We review user rights, audit trail (edit log) settings, backups and the controls around them.
How long does an IS audit take?
A focused ITGC review for a mid-sized business usually takes a few weeks, depending on the number of systems and locations in scope.
Can an IS audit help prevent fraud?
Yes. Weak access controls, shared passwords and missing audit trails are common causes of fraud. An IS audit identifies these gaps, and our forensic team can investigate where fraud is suspected.