A Substantial Investment

The modern business enterprise can’t exist without the benefit of up-to-date information technology (IT), at least not as a competitive concern. To enhance productivity, IT encompasses computers (hardware), technical applications, software and computerized communication. When used efficiently, IT can contribute to all of the following areas and more:

• Revenue growth (by improving the business process)
• Generating new business
• Maintaining established clients
• Ensuring data accuracy and reliability
• Internal and external communication
• Data storage and utilization

Regardless of the industry you’re in or the product or service you offer, IT can be a boon to your bottom line. But IT is not an insignificant investment. On the contrary, securing the hardware, software and applications along with a top-quality team of IT professionals is a very expensive endeavor. On top of the monetary costs, there are significant risks that come with an increasing dependency on information technology. Cybersecurity threats and information security risks are on the rise, so it’s important to keep in mind that the threats can be internal as well as external.

Protect Your Investment With IT Audit Best Practices

Like all large investments and significant business risks, your investment in IT needs to be protected. One of the best and most obvious ways to protect yourself is with a vigorous set of IT audit controls that involve periodic examinations (testing) and well-defined IT risk management processes that entail a process for reporting findings.

What Is an IT Audit?

IT audit involves the development and implementation of solid IT audit procedures that facilitate the collection and evaluation of management controls over a company’s IT systems, policies, practices, operations and risks. The results of an IT audit will help determine if IT systems and the data they generate, along with other valuable institutional assets, are being appropriately safeguarded.

Further, an IT audit should test data integrity and point out shortfalls. In general, IT audit best practices (including audit and risk functions) should be designed to make sure an organization’s investment in IT and IT personnel are operating efficiently and contributing to the achievement of company goals.

The overriding goal of all IT best practices is to be sure that IT systems are secure and confidential and that sensitive and valuable information inside the systems is safe, up to date and accurate.

Ideally, every aspect of IT should be included in the IT audit risk management process, but that’s a difficult task considering that almost every aspect of modern business is high-tech today. At a minimum, any IT risk assessment should include the following:

• In-house hardware
• Servers
• Computers
• Voice systems (mobile and landline phones)
• Software
• Communication networks
• Internal
• External
• Systems and applications
• Internal
• Client facing
• IT and data processing facilities (this refers to processes, not physical facilities)
• Enterprise architecture
• IT management

The IT Audit Process

Planning

The first step in the process is advanced IT audit planning. This mostly involves assembling a team, deciding the scope of the exam and gathering relevant information. The planning process should start with a comprehensive review of the following:

• Inventory of hardware and software currently in use
• Basic structure of overall IT system
• List of IT-specific employees
• Latest IT budget figures

Define Objectives

Not every IT audit needs to be a comprehensive, top-to-bottom examination of all things tech, but some audits should be more involved than others. After the initial planning stages, it’s important to strictly define the size and scope of the audit you’re about to conduct.

Almost all IT audits, however, should include a close look at the following:

• Password and user rights security
• Strength of firewalls
• Physical security of IT assets

In addition, the duration and the various locations of the audit should be established.

Conduct the Audit

Now it’s time to get down to the business of auditing, which is collecting, analyzing and documenting evidence that either supports IT audit controls best practices or shows where those practices are lacking and in need of improvement. The possible audit methods that may be used are various, so they should be agreed upon in the planning and goal-setting phases.

Document Findings

The IT audit process ends with the generation of a report that documents the process from start to finish and lays out the findings in a concise manner. The entire audit should be synthesized into a credible and readable document that sets forth the original objectives of the audit, spells out the results, comes to reasonable conclusions and makes actionable recommendations.

IT Audit Risk Management Processes

IT audit risk management is by no means an easy process, even if the concepts behind them are simple. It is, however, a critically important and highly necessary management function.

IT systems are under constant threats that are only growing. If your systems are inefficient or in danger, you will want to know about it sooner rather than later. The IT audit is one of the manager’s most effective and helpful tools.

IT Audit Tools

KnowledgeLeader has published hundreds of tools and publications on IT audit best practices.

Here is some of our most popular IT audit content:

IT Risk and Controls Review Report

This report is designed to (among other things) reduce the unnecessary overlap in IT control policy that often results in an excess volume of controls. When used to its fullest extent, the report will allow auditors to focus on truly “key” risks and maintain consistency in IT risk management.

IT Application Management Self-Assessment Questionnaire

This is a sophisticated, high-level assessment tool. It is designed to be completed by the auditee and used by management and audit professionals to gain a thorough understanding of how controls and processes are being used or if they are being neglected.

IT General Controls Assessment Report

This tool is a sample report that our subscribers customize and edit to their own specific needs. Its objective is to be an IT general framework (ITCG) review, but its scope is quite comprehensive. It touches on logical access, operations, change management and system development life cycle control (SDLC), among other topics.

IT Vendor Management Audit Work Program

We’re very proud of our IT vendor management tool. This tool can be used to evaluate an IT department’s risk policies for managing the outsourcing process, reviewing vendor assessment controls during vendor selection and assessing the viability of due diligence processes of providers. This tool is a must for service providers and vendor relationship management.

Learn More

Explore our IT Audit Topic Page to see our full library of tools, training and professional publications on the subject.