Which arrangement is associated with independence from IT security?

• A. IT security within the IT department
• B. IT auditing in an existing auditing department
• C. Outsourcing IT security
• D. Merging IT with financial auditing

Answer: (B)

Independence in assurance work comes from keeping those who assess controls separate from those who implement and operate them. Having IT auditing located within an existing auditing department preserves objectivity because the auditors are not part of the IT security team and can evaluate risk, controls, and compliance without management’s day-to-day influence. They report to the audit committee or senior governance, which strengthens their authority to raise issues and provide unbiased findings. This separation is essential for credible assurance and independent oversight.

When IT security sits within the IT department, there’s a natural risk of management influence shaping how issues are presented or prioritized. Outsourcing IT security can also complicate independence, since a third party’s interests and contractual obligations may subtly affect how security risks are identified and reported. Merging IT with financial auditing blends two domains, which can blur responsibilities and undermine clear, independent scrutiny of IT security controls.