INFORMATION SYSTEM AUDITING PROCESS
Develop and implement a risk-based IT audit strategy
Plan specific audits
Conduct audits in accordance with IT audit standards
Report audit findings and make recommendations to key stakeholders
Conduct follow-ups or prepare status reports
GOVERNANCE AND MANAGEMENT OF IT
Evaluate the effectiveness of the IT governance structure
Evaluate IT organizational structure and human resources (personnel) management
Evaluate the organization’s IT policies, standards, and procedures
Evaluate the adequacy of the quality management system
Evaluate IT management and monitoring of controls
Evaluate IT contracting strategies and policies, and contract management practices
Evaluate risk management practices
Evaluate the organization’s business continuity plan
INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND IMPLEMENTATION
Evaluate the business case for proposed investments in information
Evaluate the project management practices and controls
Conduct reviews to determine whether a project is progressing in accordance with project plans
Evaluate controls for information systems
Evaluate the readiness of information systems for implementation and migration into production
Conduct post implementation reviews of systems
INFORMATION SYSTEMS OPERATIONS AND BUSINESS RESILIENCE
Conduct periodic reviews of information systems
Evaluate service level management practices
Evaluate third-party management practices
Evaluate data administration practices
Evaluate the use of capacity and performance monitoring tools and techniques
Evaluate change, configuration, and release management practices
PROTECTION OF INFORMATION ASSETS
Evaluate the information security policies, standards and procedures
Evaluate the design, implementation, and monitoring of system and logical security
Evaluate the design, implementation, and monitoring of physical access and environmental controls
Evaluate the processes and procedures used to store, retrieve, transport, and dispose of information assets
