Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 177 views

    Information Technology Audit Methodology:: Planning Phase

    Uploaded by

    shakawath
    The document outlines the methodology for conducting an information technology audit with 3 key phases: 1) Planning which includes determining the audit subject, objectives, and scope. 2) Fieldwork and documentation which involves acquiring data, testing controls, and documenting results. 3) Reporting which includes gathering requirements, drafting the report, and following up. The planning phase establishes the foundation for the audit with steps like risk assessment, interviews, and identifying necessary resources. Procedures are then determined to systematically gather and evaluate data during fieldwork. Finally, results are communicated through the audit report.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Information Technology Audit Methodology:: Planning Phase

    Uploaded by

    shakawath
    177 views4 pages
    The document outlines the methodology for conducting an information technology audit with 3 key phases: 1) Planning which includes determining the audit subject, objectives, and scope. 2) Fieldwork and documentation which involves acquiring data, testing controls, and documenting results. 3) Reporting which includes gathering requirements, drafting the report, and following up. The planning phase establishes the foundation for the audit with steps like risk assessment, interviews, and identifying necessary resources. Procedures are then determined to systematically gather and evaluate data during fieldwork. Finally, results are communicated through the audit report.

    Original Description:

    Information System Audit methodology

    Original Title

    IS_Audit_Methodology

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document outlines the methodology for conducting an information technology audit with 3 key phases: 1) Planning which includes determining the audit subject, objectives, and scope. 2) Fieldwork and documentation which involves acquiring data, testing controls, and documenting results. 3) Reporting which includes gathering requirements, drafting the report, and following up. The planning phase establishes the foundation for the audit with steps like risk assessment, interviews, and identifying necessary resources. Procedures are then determined to systematically gather and evaluate data during fieldwork. Finally, results are communicated through the audit report.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    177 views4 pages

    Information Technology Audit Methodology:: Planning Phase

    Uploaded by

    shakawath
    The document outlines the methodology for conducting an information technology audit with 3 key phases: 1) Planning which includes determining the audit subject, objectives, and scope. 2) Fieldwork and documentation which involves acquiring data, testing controls, and documenting results. 3) Reporting which includes gathering requirements, drafting the report, and following up. The planning phase establishes the foundation for the audit with steps like risk assessment, interviews, and identifying necessary resources. Procedures are then determined to systematically gather and evaluate data during fieldwork. Finally, results are communicated through the audit report.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    Information Technology Audit Methodology:

    Planning Phase

    Determine Define Audit Set Audit Perform Pre Determine


    Audit Subject Objective Scope audit Planning Procedures

    Fieldwork and Documentation Phase

    Acquire Data Test Existing Issue Discovery Document Results


    Controls and Validation

    Reporting Phase

    Gather Report Draft Report Issue Report Follow-up


    Requirements

    1. Determine audit subject: Identify the area to be audited (e.g., business function, system,
    physical location).

    2. Define audit objective: Identify the purpose of the audit. For example, an objective might be
    to determine whether program source code changes occur in a well-defined and controlled
    environment.

    3. Set audit scope: Identify the specific systems, function or unit of the organization to be
    included in the review. For example, in the previous example (program changes), the scope
    statement might limit the review to a single application, system or a limited period of time.

    This step is very important because the IS auditor will need to understand the IT environment
    and its components to identify the resources that will be required to conduct a comprehensive
    evaluation.

    A clear scope will help the IS auditor define a set of testing points that is relevant to the audit and
    further determine the technical skills and resources necessary to evaluate different technologies
    and their components

    4. Perform pre-audit planning:

    Sami Tech Ltd


    • Conduct a risk assessment, which is critical in setting the final scope of a risk-based audit. For
    other types of audits (e.g., compliance), conducting a risk assessment is a good practice because
    the results can help the IS audit team to justify the engagement and further refine the scope and
    preplanning focus.
    • Interview the auditee to inquire about activities or areas of concern that should be included in
    the scope of the engagement.
    • Identify regulatory compliance requirements.
    • Once the subject, objective and scope are defined, the audit team can identify the resources
    that will be needed to perform the audit work. Some of the resources that need to be defined
    follow:
    – Technical skills and resources needed
    – Budget and effort needed to complete the engagement
    – Locations or facilities to be audited
    – Roles and responsibilities among the audit team
    – Time frame for the various stages of the audit
    – Sources of information for test or review, such as functional flowcharts, policies, standards,
    procedures and prior audit work papers
    – Points of contact for administrative and logistics arrangements
    – A communication plan that describes to whom to communicate, when, how often and for what
    purposes

    5. Determine audit procedures and steps for data gathering:


    At this stage of the audit process, the audit team should have enough information to identify and
    select the audit approach or strategy and start developing the audit program.

    Some of the specific activities in this step are:


    • Identify and obtain departmental policies, standards and guidelines for review.
    • Identify any regulatory compliance requirements.
    • Identify a list of individuals to interview.
    • Identify methods (including tools) to perform the evaluation.
    • Develop audit tools and methodology to test and verify controls.
    • Develop test scripts.
    • Identify criteria for evaluating the test.
    • Define a methodology to evaluate that the test and its results are accurate (and repeatable if
    necessary).

    Sami Tech Ltd


    Scope of Work:
    Sr No. Scope of Services
    1 Governance and Management of IT
    2 Information Systems Acquisition, Development and Implementation
    3 Information Systems Operations, Maintenance & Support
    4 Protection of Information Assets
    5 Change Management
    6 Logical and Physical Access
    7 Backup and Recovery of Data
    8 Scheduling Jobs
    9 Incident and Problem Management
    10 Virus Protection
    11 Network Communications Security
    12 Data Centre
    13 IT business continuity and disaster recovery
    14 Platform review of the relevant OS and databases
    15 ICT Security Policy
    16 Segregation of Duties (SoD)

    Sami Tech Ltd


    List of Reviewed Documents
    SL# Documents
    1 ''ICT Security Policy''.
    2 Organogram chart of ICT department including job description, segregation of duties and fallback plan.
    3 Branch organogram with ICT support unit.
    4 Scheduled roster for ICT personnel
    5 Internal and/or external IS audit report for last year, audited branch list, copy of profile of IS auditor.
    6 Information Security Training documents for last period, copy of yearly training plan, List of participants.
    7 Problem management log for a specific period of time, Problem management system or related
    software information.
    8a Assessment of the risk
    8b Identification of mitigation control
    8c Remedial plan to reduce the risk
    9 Approval of the risk acknowledgement from the owner of the risk
    10 IT based/enabled product list [marked recently launched (if any) product], list of upcoming products.
    11 List of software (in house and purchased).
    12 Document of change procedure for IS (Documentation about –Necessary change details in production
    environment, Audit log of changes)
    13 User Acceptance Test (UAT) for changes
    14 Inventory list of all ICT assets
    15 Software licenses (OS, DB, Anti-Virus, MS Office, etc.)
    16 Operating procedure (Operating procedure for the users, Scheduling process, system start-up, close
    down, restart, recovery process.)
    17 Handling of exception condition.
    18 Secure disposal policy
    19 Active Directory and password control policy
    20 Approval procedure/authorization matrix/delegation of authority for CBS
    21 Audit trail report including user ID, authorizer ID and date-time stamp for CBS for a particular period of
    time
    22 Network design document (should contain protocols and security features)
    23 Email and internet usage policy
    24 Technical document of Mobile Banking, Mobile banking policy (if applicable).
    25 Outsourced software documentation (any one related to banking application)
    26 Business Continuity Plan
    27 Backup and restore log
    28 Disaster Recovery test report, list of available software in DR site.
    29 SLA with software vendor and connectivity provider
    30 Documentation about—Total Bandwidth used, No of Fiber communication link with vendor name,
    Network security devices
    31 Annual fire testing report
    32 Copy of self-assessment of Anti-Fraud Internal Control.

    Sami Tech Ltd

    You might also like