IT Audit - Identify and Reduce your Risks

An IT audit is an independent evaluation of an organization's information systems, data, and security controls. The purpose of the audit is to ensure IT controls protect assets and IT related risks are properly aligned with the organization's level of risk tolerance.

IT audits help identify risks and ensure controls are in place to ensure information:

• Availability - systems and data are available when needed
• Confidentiality - information is made available only to authorized parties
• Integrity - information is accurate, complete, and safeguarded from intentional, unauthorized, or accidental modification

IT Audit - Controls Evaluated

IT audits vary in scope and may include one of more of the following to ensure security controls are sufficient and effective:

• External "hacker view" penetration test of network entry points (firewalls, etc.)
• Evaluation of web applications for risks
• Social engineering (phishing) evaluation of staff
• On-site evaluation of information systems and controls

The types of security controls evaluated by an IT audit include:

1) Technical safeguards

• Network infrastructure configurations - firewalls, routers, network segmentation, servers, storage, software applications, etc.
• Security protection systems - authentication (passwords), anti-virus, backups, encryption, logging and monitoring, etc.
• Communications - Internet connectivity, Wi-Fi, etc.

2) Physical safeguards

• Access control systems - card access systems and access logs
• Physical controls - locking cages and restricted access to media
• Logging and monitoring - access logs, cameras, and video retention

3) Administrative safeguards

• Risk assessment - preventive, detective, and corrective security controls
• Security policies - password policy, patch management policy, anti-malware policy, etc.
• Job descriptions - Chief Security Officer and IT staff
• Agreements - service providers and confidentiality
• Security training programs
• Incident response plans
• Business continuity plans

IT Audit Report

Once information gathering is complete, the IT Auditor prepares an IT audit report of findings with prioritized recommendations to reduce risks and enhance security. Since a security breach can compromise systems and data, the organization should perform remediation and corrective action in a timely manner.

Organizations should consider annual IT audits. Annual audits ensure:

• The issues identified in the initial/prior audit were sufficiently addressed
• No new vulnerabilities were created when the organization remediated systems
• No new security issues have been identified

IT Auditor

Select a Certified Information Systems Auditor for your IT audit. The Certified Information Systems Auditor designation is a globally recognized certification for information system audit control, assurance, and security professionals. Certified auditors have audit experience, skills, knowledge, the ability to identify and assess vulnerabilities, report on compliance, and identify remediation/corrective action needed. The independent auditor's reports are impartial, ensuring a completely unbiased approach with recommendations that are in your best interests.