Mobile Technology Auditing: Risks, Controls, and Trends
This paper examines the current state of mobile technology auditing, addressing the unique risks organizations face as mobile devices become central to modern business operations. It identifies and categorizes key risk areas — including information security, physical security, and compliance — and outlines audit planning approaches such as objective-setting, scope definition, and resource allocation. The paper also surveys future trends, including the growing role of biometric authentication, remote wipe capabilities, and data encryption. Additionally, it discusses the role of both internal and external auditors, the standards issued by the Institute of Internal Auditors, and the regulatory compliance challenges posed by evolving data privacy requirements across multiple jurisdictions.
- Introduction: Mobile devices, BYOD policies, and auditing relevance
- Technology and Risk Categories: Information security, physical, and compliance risks
- Audit Planning and Engagement: Objectives, scope, resources, and work program
- Future Trends in Mobile Security Controls: Authentication, encryption, remote wipe, and evolving threats
- Companies and Internal Audit Standards: Big Four firms and IIA standards for mobile auditing
- Regulatory Issues and Compliance: Privacy regulations, data protection, and jurisdictional variation
- Conclusion: Adaptive risk management and innovation balance
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- The paper organizes a broad topic into clearly defined risk categories (information security, physical security, and compliance), making a complex subject easy to follow.
- It integrates multiple authoritative sources — including practitioner-oriented texts, Big Four audit guidance, and IIA standards — to support each claim, lending credibility to the analysis.
- The forward-looking section on future trends connects current audit practices to emerging threats, demonstrating awareness of the field's dynamic nature.
Key academic technique demonstrated
The paper demonstrates effective synthesis of professional and academic sources. Rather than simply summarizing individual references, the author weaves together practitioner guidance (KPMG, IIA), academic texts (Senft et al., Kim & Solomon), and journal sources (Khan, Tysiac) to build a coherent, multi-layered argument about the scope and direction of mobile technology auditing.
Structure breakdown
The paper follows a logical progression: it opens with an introduction to mobile technology's organizational role, moves through risk categorization and audit planning, examines future trends in security controls, discusses the role of audit firms and IIA standards, addresses regulatory compliance, and closes with a conclusion emphasizing the need for adaptive risk management. This structure mirrors the typical audit engagement cycle, reinforcing the paper's applied focus.
Introduction
Smart devices such as tablets and smartphones have effectively revolutionized organizational processes and functionalities. A mobile device can be thought of as a "small computing device used for the assistance and convenience of certain aspects of a conventional computer in environments where carrying a computer would not be practical" (Institute of Internal Auditors, 2017). Today, thanks to mobile technology, organizations benefit from a truly mobile workforce. With the computing power of modern mobile devices, employees can function remotely as effectively as they would in a centralized physical office setting.
It follows that business can be conducted in a genuinely mobile fashion through the utilization of a wide range of applications (apps) designed for various functionalities. While some organizations provide employees with mobile devices for carrying out organizational duties, others permit or encourage employees to use their own devices — an arrangement commonly referred to as bring your own device (BYOD). Regardless of which policy an organization has in place, mobile technology remains an expanding field, meaning its use still presents a wide range of challenges and risks. This effectively warrants the adoption of a well-defined risk assessment, management, and control plan.
The relevance of mobile technology auditing cannot be overstated — particularly when it comes to ensuring that an organization has in place strengthened security controls to address the various risks associated with the active utilization of mobile devices.
References
Antonucci, D. (2017). The Cyber Risk Handbook: Creating and Measuring Effective Cyber Security Capabilities. Hoboken, NJ: John Wiley & Sons.
Institute of Internal Auditors (2017). Auditing Your Company's Mobile Devices — Institute of Internal Auditors Raleigh-Durham Chapter. Retrieved from https://chapters.theiia.org/raleigh-durham/News/ChapterDocuments/Auditing%20Mobile%20Devices.pdf
KPMG (2017). Top 10 Internal Audit Focus Areas for Technology Companies. Retrieved from https://assets.kpmg.com/content/dam/kpmg/us/pdf/2017/03/kpmg-top-10-internal-audit-tech-2017.pdf
Khan, M. J. (2016). Mobile app security — audit framework. Retrieved from https://www.isaca.org/Journal/archives/2016/volume-4/Pages/mobile-app-security-audit-framework.aspx
Kim, D. & Solomon, M. G. (2016). Fundamentals of Information Systems Security (3rd ed.). Burlington, MA: Jones & Bartlett Publishers.
Senft, S., Gallegos, F. & Davis, A. (2012). Information Technology Control and Audit (4th ed.). New York, NY: CRC Press.
Tallez, J. & Zeadally, S. (2017). Mobile Payment Systems: Secure Network Architectures and Protocols. New York, NY: Springer.
Tysiac, K. (2015). How internal audit can help manage 10 top technology risks. Retrieved from https://www.journalofaccountancy.com/news/2015/aug/internal-audit-technology-risks-201512911.html
Create your account
Always verify citation format against your institution’s current style guide requirements.