Management of IT Auditing

1
Management of IT Auditing

• John Schultz

2

• Define IT
• What areas should be considered for inclusion
  in an IT audit plan?
• Evaluate IT-related Risk
• Doing so will help ensure that IT audit
  procedures and resources are focused on the areas
  that represent the most risk to the organization.
• Define the IT Audit Universe
• defining the IT audit universe will help
  effectively balances IT audit needs with resource
  constraints.
• Execute IT Audits
• how to execute IT audit procedures and how to
  understand what standards and frameworks exist in
  the marketplace that can support required
  procedures.
• Manage the IT Audit Function
• techniques for maximizing the effectiveness of
  the IT audit function and managing IT audit
  resources.
• Address Emerging Issues
• IT evolves rapidly. This evolution can
  introduce significant new risks into an
  organization.

3
IT Environment
4
IT related Risks

• Availability when the system is unavailable
  for use.
• Security when unauthorized access to systems
  occurs.
• Integrity when the data is incomplete or
  inaccurate.
• Confidentiality when information is not kept
  secret.
• Effectiveness when the system does not
  deliver an
• intended or expected function.
• Efficiency when the systems cause a
  sub-optimal use
• of resources.

5
IT Audit Universe

• Using overly broad definitions for IT audits
  (e.g. IT general controls) will almost ensure
  that there will be scope creep in audit
  procedures.
• The audit universe for the year should touch on
  all the layers in the IT environment.
• IT audits should be structured in such a way as
  to provide for effective and logical reporting.
• IT audits should cover the appropriate risks.

6
Executing IT Audits
7
Managing the IT Audit Function

• Audit Facilitators
• -Electronic Work papers
• -Project Management Software
• -Flowcharting Software
• -Open Issue Tracking Software
• -Audit Department Web Site
• Audit Accelerators
• -Data Analysis Software
• -Security Analysis Tools
• -Network Analysis Tools
• -Hacking Tools
• -Application Security Analysis Tools

8
Emerging Issues

• Wireless Networks
• Mobile Devices
• Interfaces
• Data Management
• Privacy
• Segregation of Duties
• Administrative Access
• Configurable Controls
• Piracy

9
Management of IT Auditing

• John Schultz