Development of an IT review methodology for evaluating the internal control system

The article examines the role of the IT review in assessing the internal control system (ICS) during external audit. The necessity of its application is justified due to the high dependence of financial statements on information systems (IS). Based on ISA 315, ISA 330, and international IT frameworks (COBIT 2019, ITIL 4, ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST SP 800-53 Rev.5), a methodological approach to conducting the IT review is proposed, including four stages and three possible types of conclusions. The proposed approach enhances the auditor’s professional judgment and helps optimize the scope of substantive procedures.