IT Audit Program

IT Audit Program

1. used to document the specific procedures and steps that will be used to test and verify control effectiveness

2. Audit Planning Steps

   • 1.) Determine audit subject.
     • Identify the area to be audited
   • 2. Define audit objective
     • Identify the purpose of the audit.
   • 3. Set audit scope
     • Identify the specific systems, function or unit of the organization to be included in the review
   • 4. Perform preaudit planning
     • Conduct a risk assessment
     • Interview the auditee to inquire about activities or areas of concern that should be included in the scope of the engagement
     • Identify regulatory compliance requirements
     • identify the resources that will be needed to perform the audit work
   • 5. Determine audit procedures and steps for data gathering
     • audit team should have enough information to identify and select the audit approach or strategy and start developing the audit program

3. AUDIT AND ASSURANCE PROGRAMS

   • the term “audit and assurance program” refers to the outcome of the planning phase that deals with the audit approach and procedures
     • Assurance refers to a number of related activities designed to provide the reader or user of the report with a level of assurance or comfort over the subject matter.
     • Audit is a formal inspection and verification to check whether a standard or set of guidelines is being followed, records are accurate, or efficiency and effectiveness targets are being met
   • Objectives
     • Formally document audit procedures and sequential steps
     • Create procedures that are repeatable and easy to use by internal or external auditors who need to perform similar audits
     • Document the type of testing that will be used
     • Meet general accepted audit standards that relate to the planning phase in the audit process
   • Minimum Skills to Develop an Audit and Assurance Program
     • Good understanding of the nature of the enterprise and its industry to identify and categorize the types of risk and threat
     • Good understanding of the IT space and its components and sufficient knowledge of the technologies that affect them
     • Understanding of the relationship between business risk and IT risk
   • product of the audit planning phase
     • Step 4 is an important part of the audit planning phase because it is during this step that resources are estimated based on the engagement objective and scope.
     • activities under step 5 of the audit planning phase
       • Identify and obtain departmental policies, standards and guidelines for review
       • Identify a list of individuals to interview.
       • Identify methods (including tools) to perform the evaluation.
       • Develop audit tools and methodology to test and verify controls.
       • Identify criteria for evaluating the test (similar to a test script for the auditor to use in conducting the evaluation
       • Define a methodology to evaluate that the testing and its results are accurate (and repeatable if necessary

4. activities to improve the IS auditor’s abilities to develop audit and assurance programs

   • Define and record the audit approach/strategy
   • Identify sources of information to expand the understanding of the audit area/subject
   • Identify and request documentation related to the audit subject
   • Identify and document risk and internal controls