Which of the following steps should an internal auditor complete when conducting a review of an electronic data interchange application provided by a…

When an organization outsources a critical function like Electronic Data Interchange (EDI), the internal auditor's focus shifts to third-party risk management. The auditor cannot directly test the service provider's internal controls. Therefore, the most effective audit procedures involve gaining assurance through indirect methods. Reviewing independent, third-party audit reports (e.g., SOC 2 reports) provides objective assurance about the provider's control environment. Additionally, examining the legal contract is crucial to ensure it includes necessary clauses covering service levels, security responsibilities, data ownership, and the right to audit. These two steps are fundamental to assessing the governance and control over the outsourced service.

1. Ensure encryption keys meet ISO standards. This is an overly specific technical verification. An auditor's primary role is to confirm that an appropriate encryption policy exists and is followed, rather than testing the technical compliance of keys.
4. Verify that only public-switched data networks are used by the service provider. This is incorrect from a security perspective. Private networks or Value-Added Networks (VANs) are often considered more secure for sensitive EDI transactions than public networks. The focus should be on the network's security, not its public nature.

1. The Institute of Internal Auditors (IIA), Global Technology Audit Guide (GTAG) 7, Information Technology Outsourcing, 2nd Edition, 2012.

Page 15, Section 4.2 The Contract: "The contract is the foundation of the outsourcing relationship... The internal auditor should review the contract to determine whether it adequately protects the organization." This supports option 3.

Page 17, Section 4.4 Monitoring: "Organizations can obtain independent assessments of the service provider’s controls through third-party audit reports... Internal auditors should review these reports to determine whether the service provider’s controls are operating effectively." This directly supports option 2.

2. Sawyer, L. B., Dittenhofer, M. A., & Scheiner, J. H. Sawyer's Internal Auditing: The Practice of Modern Internal Auditing, 5th Edition. The Institute of Internal Auditors Research Foundation, 2003.

Chapter 25, Auditing Procurements and Contracts: This chapter emphasizes the auditor's role in reviewing contracts to ensure they contain protective clauses, including performance standards, rights of access, and compliance requirements, which aligns with option 3. It also discusses verifying vendor performance, for which independent reviews (option 2) are a key source of evidence.

3. Hall, J. A. Information Technology Auditing, 4th Edition. Cengage Learning, 2015.

Chapter 4, Auditing IT Governance Controls, Section on Auditing Outsourced IT Services: The text explains that when auditing outsourced services, the auditor's primary procedures include reviewing the service level agreement (SLA) within the contract and evaluating third-party assurance reports (e.g., SOC reports) to attest to the adequacy of the vendor's controls. This directly supports options 2 and 3.