IT Audit Types

The following are some IT audit types in descending from strategic to tactical. Strategy

Biz Continuity / Contingency

System/Project Development

Security

Application/Software Controls

IT Audit Planning

At the highest level IT audit planning would involve the following generic steps.

Define the risk universe - auditable entities and risk assessment Consider results of previous audits or other similar information Consider upcoming plans/projects with senior and middle management Develop a plan typically for the coming year At the detailed level, the following steps are taken Identify the risks Identify the scope Identify audit objectives Design a test strategy (see file interrogations) Estimate resources required

Information System Auditing

The problem with hard and fast rules about information system auditing is that each IT environment itself is unique (the snowflake theory). For example, each system will have the following ingredients.

• Centralisation
• Hardware
• Empowerment of users
• Software
• Size
• Customisation
• Operating System
• Managed In House

Another thing about IT risk is that the risks are both dynamic and overlapping.

When deciding what and how to audit the following should be considered

• Security, Effectiveness & Efficiency
• Whether issues are pervasive or system specific
• Whether to plan separately or as part of the overall internal audit plan

At the following links we describe an IT audit plan and some types of IT audit.