About information systems risk assessments
The integrity of information systems you use to support your business affects the accuracy and completeness of your reporting and lodgment activities.
We use an information systems risk assessment (ISRA) to gain a high-level overview of your information systems. Using a standardised questionnaire, we can develop a risk rating for key elements of your business operations. We usually undertake an ISRA as part of a larger review or audit. It contributes to our compliance activities by giving us confidence about integrity of your business systems, processes and controls by measuring their accuracy and completeness.
We have developed a process that provides a structured approach for assessing your information systems risks. It is based on the guidelines and assurance frameworks set out by the Information Systems Control Association and the IT Governance Institute.
The process includes:
- a standardised questionnaire
- an interview where we work together to complete the questionnaire
- a final report that details our findings
- a final interview to discuss the report.
Benefits of an ISRA
Using an ISRA in audits and other compliance activities can help you by:
- providing an efficient way to help you understand your business, its systems and processes
- highlighting any compliance risks and providing recommendation to mitigate them.
When we do an ISRA
When we consider whether to use an ISRA, we generally start by talking with you and gaining an understanding of your business activities. We look at whether your business:
- has experienced mergers and acquisitions
- has had rapid growth
- has disparate, multiple systems that are loosely integrated
- has had a high turnover of IT staff or relies heavily on temporary IT contractors for systems development and support
- uses out-dated or unsupported software
- uses in-house developed systems
- has a history of IT project overruns and other difficulties
- has a history of BAS amendments due to systems issues
- has a history of voluntary disclosures caused by systems issues.
What you need to do
The steps in an ISRA involve:
Preparing for your ISRA
We start with an interview, conducted by a compliance officer and systems specialist from our office.
Make sure the right staff are available to answer questions about your business systems – these may include system accountants, tax managers, system architects and support staff, external IT service providers or IT project managers.
We will be asking questions that focus on the history of your business, including planning, support, change management and other systems management functions.
Before the interview, we will:
- establish with you who will be involved in the interview
- negotiate an interview date that suits all participants
- negotiate with you to obtain systems architecture diagrams and other supporting documents – ideally you will provide this information well ahead of the interview.
ISRA questionnaire
An ISRA questionnaire is a standardised questionnaire focused on those aspects of your information technology (IT) systems that relate to tax and regulatory compliance. The questionnaire has the five auditable units with a series of questions weighted according to a predetermined risk rating:
- systems inventory to assess the size and complexity of your IT environment
- interface inventory to understand the extent of data manipulation and the complexity of data mapping
- customisation inventory to assess the level of customisation across all systems to determine the risk level
- IT projects and methodologies to assess the maturity level of your IT systems and the business processes they support
- IT governance to gauge the adequacy of your internal policies, procedures and methodologies for effective and productive management of the IT function within your business.
ISRA interview
In the interview, we will identify and record responses for each question. By discussing these questions and your business systems and process, we can understand your business systems, processes and controls.
We record your ISRA responses in the taxpayer version of the questionnaire and seek your agreement that the responses are correct. When the questionnaire is complete, we use the questionnaire responses to generate a risk rating profile with low, medium or high risk ratings. These ratings will be included in the report.
ISRA report
We prepare a final report that:
- incorporates your feedback
- details our findings including recommendations to address the issues we identified that may impact on the accuracy and completeness of your reporting.
Final interview
We have a final meeting with you to discuss the final report, where you will have the opportunity to work through the findings and offer any comment.
Computer systems and security
The ISRA process means you supply information about your information systems and if required, supporting documents. Our officers will not operate your computer system.
Electronic and paper records you provide are protected by law. This information is kept in accordance with:
- secrecy provisions of the Taxation Administration Act 1953 and Income Tax Assessment Act 1936
- (for personal information) information privacy principles of the Privacy Act 1988.
For more information, see Access, accountability and reporting.
More information
Contact us if you need to speak to an ATO customer service representative.
Specialist phone services available include:
- the Indigenous Helpline, which is a service for Aboriginal and Torres Strait Islander peoples
- call services for hearing or speech/communication difficulties
- the Translating and Interpreting Service to speak with us in a language other than English
- an overseas enquiries line if you are phoning from outside Australia.