(P) IT audits – a contributing factor to the commercial success of your business

IT has become crucial to most of the business models today. Complexity of and dependence on IT are growing rapidly. Taking retail as an example we will demonstrate to what extent IT audits may contribute to the business success of your company. Popularity of e-commerce has started a process of radical change in classic retail trade. Traditional and digital marketing and sales channels are becoming more and more intertwined. In modern English: "Omni-channel” or "bricks & clicks". Traditional retail will only survive, if marketing, physical sale through a chain store network, website, shop and social media presence are integrated into a single "shopping event". This means e.g. that a customer becomes aware of a product through print advertisement, can get detailed product information on the company website and thanks to positive rating in social media they order the product online. They pay per PayPal and select delivery to their local store. When picking up the order, they decide to buy also other products and pay by EC card at the register. In the future, all business processes in such multi-channel retail will depend on IT. This entails, in particular, the following three types of risks. Business process related IT risks The complexity of IT-supported ordering, delivery and billing processes renders traditional controls ineffective. Just think about new customer setups, creditworthiness checks, product returns to your local store and by post, refunds to your credit card, cancellation of orders, cash refunds, accounting transactions between chain stores etc. If a company has in place only basic controls in this complex area, this can be a breeding ground for fraudulent actions. Therefore the internal control system should be adjusted and, where needed, fully restructured. Established processes and system settings may not cause management misinformation or accounting errors. IT-supported controls should make it possible to assess correctness – in real time, ideally. IT system risks Reliable IT system operation must be ensured at all times. In the worst-case scenario, any system downtime and/or irregular operation in emergency mode will make your company look incompetent at IT security. Since transactions involve submitting of sensitive information, this can cause a substantial loss of customer confidence. Keeping IT system risks in check requires, among others, the following elements:

• effective concept of access rights with appropriate separation of functions;
• ensuring integrity and availability of databases at all times;
• standardised system hardening and maintenance process for all systems involved;
• standardised development, test and production environments with appropriate sign-off procedures;
• adequate IT security and data protection management.