According to the Standards, in today's technology and business environments, how much computer and information systems-related knowledge and skills must an internal auditor have to be effective in fulfilling his job responsibilities?

According to The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), internal auditors must possess the necessary knowledge and skills for their roles. Standard 1210.A3 specifically requires internal auditors to have sufficient knowledge of key information technology risks and controls to perform their work. This requirement is best encapsulated by the need to understand the organization's IT governance, risk, and control processes. This foundational understanding allows auditors to assess how IT supports business objectives, manage associated risks, and ensure controls are effective, which is central to the internal audit function as described in Standards 2110 (Governance), 2120 (Risk Management), and 2130 (Control).

A. This is incorrect. Standard 1210.A3 explicitly states that not all internal auditors are expected to have the expertise of an IT auditor, negating the need for a specialty in a key system.
B. While proficiency in data analysis and CAATs is valuable, the Standards require "sufficient knowledge" of available techniques, not universal proficiency for every auditor in the specific tools used by their organization.
C. This is too specific. Integrated test facilities and generalized audit software are examples of technology-based audit techniques, but the Standards do not mandate understanding these particular tools for all auditors.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing.

Standard 1210.A3: "Internal auditors must have sufficient knowledge of key information technology risks and controls and available technology-based audit techniques to perform their assigned work. However, not all internal auditors are expected to have the expertise of an internal auditor whose primary responsibility is information technology auditing."

Standard 2110, 2120, 2130: These standards require the internal audit activity to evaluate and contribute to the improvement of the organization's governance, risk management, and control processes, which inherently include the IT environment.

2. Gramling, A. A., & Myers, P. M. (2018). Internal Auditing: Assurance & Advisory Services (4th ed.). The IIA Research Foundation.

Chapter 4, "Proficiency and Due Professional Care": This chapter discusses the competencies required by the Standards, explaining that while all auditors need a baseline understanding of IT risks and controls, the internal audit function can use specialists for deep technical reviews. This supports the idea that a general understanding of IT GRC is the universal requirement, not specialized skills.

3. Soh, D. S. B., & Martinov-Bennie, N. (2011). The internal audit function: Perceptions of internal audit roles, effectiveness and evaluation. Managerial Auditing Journal, 26(7), 605-622. https://doi.org/10.1108/02686901111153353

This academic article discusses the evolving role of internal audit, highlighting the increasing importance of understanding IT governance and risks as technology becomes more integrated with business processes, reinforcing the principle behind Standard 1210.A3.