The Internal Auditor's Role in MIS Development

The internal auditor's role during the design phase of an EDP application is unclear in many organizations. This article integrates recent literature with the authors' survey in an attempt to explain more precisely the potential role(s) of the internal auditor in the systems development process. In practice, four roles appear to exist. In the order of their importance, they are: (1) audit of control adequacy; (2) audit of design process; (3) auditor as a user of the application; and (4) auditor participant in the design process. The rank ordering of these roles in practice is explainable in terms of three constraints upon internal audit involvement during the design phase. The identified constraints are those of audit approach, audit independence, and management objectives. Although EDP manager reaction to internal audit involvement is generally favorable, it could be stronger. Upgrading of internal auditor expertise in EDP systems appears to be the key to improved acceptance. Finally, the potential contribution to the MIS manager of internal audit involvement is noted, and means of constructive interation are suggested.