Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the right direction. Specific links to journals and/or templates that are used would be very helpful.

This question was IT Security Question of the Week.
Read the Sep 23, 2011 blog entry for more details or submit your own Question of the Week.

share|improve this question
    
Are you starting a program at a company or striking out as a consultant on your own? – Jeff Ferland Sep 13 '11 at 15:11
1  
Any particular market sector? There are many different standards that apply to many different kinds of IT systems. – MToecker Sep 15 '11 at 21:20
    
Thank you very much for your replies. Yes I have started my CISA examination in one of the chapters they have around the world( Muscat). According to your replies I guess im in the right path. You are right, my knowledge from academia and what I saw in the field was quite different. I failed to make a connection between academia and what I saw in some of sample reports, hence my question here. Thank u again. – skimmer Sep 16 '11 at 0:15
up vote 15 down vote accepted

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents.

From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of specific technologies, and contributed to maybe 50 of those. The time investment is pretty high.

In saying that, I would definitely suggest you join ISACA (the Information Systems Audit and Control Association), which is the definitive body for this industry. A vast amount of information is available through ISACA, including CobIT and audit guidance.

(disclosure - one of my roles is President of the Scottish ISACA chapter)

share|improve this answer

The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations.

I've met good auditors, and I've met poor auditors, and good auditing is more than having the right software, journals, or templates. I don't know what your masters is in, but it likely has not prepared you for being on-the-ground in an audit. Being in front of clients, asking questions, and digging out the answers that they don't even know they have sometimes. (You don't mention your work experience, which may be relevant for all I know).

Just my .02c. Good luck!

share|improve this answer
    
+1 - very good point. The disconnect between academia and practice in this discipline is quite astonishing. Nobody does all the things that best practice would indicate they should. – Rory Alsop Sep 13 '11 at 15:45
1  
Don't forget the conflict between the company hiring you and your attempt to find deficiencies. Managing that issue is a complicated business aspect that few can manage well. – this.josh Sep 15 '11 at 18:36

You could look at PTES - Penetration Testing Execution Standard site - http://www.pentest-standard.org/index.php/Main_Page

It's slowly getting filled out but has a lot of very useful information.

You could also look at the Open Source Security Testing Methodology Manual - http://www.isecom.org/osstmm/

share|improve this answer

As an a practicing IT Auditor, let me provide you an answer from experience. Before I explain, I want to say that Your approach is fundamentally flawed from the question you asked in the question body.

What software tools are required

This form of thinking is misguided. The first step in performing a professional audit is planning and gathering information on the client. Important information you would want to obtain includes, but is not limited to:

  1. Objective of audit - What procedure / process / criteria is being assessed?
  2. What is the scope of the audit - What will the audit cover?
  3. Any material changes within the business since the last audit done
  4. Any findings of these past audits - assuming this audit is not the first

From the above, an auditor would conduct a risk assessment with the end goal being to establish a level of total audit risk. To start, the IT auditor obtains an understanding of the business / control environment to answer the following questions - not exclusive depending on auditee.

  1. What processes are currently in place and how they work?
  2. What controls have been set by management to ensure IT processes work for the business as management intended?
  3. What is the "tune at the top" with regard to risk and compliance with legal regulations / corporate policies?

The techniques an auditor would use at this stage include process walkthrough, inquiry of management and observation. With a understanding of the business and current controls, auditors quantify total risk. Components of total risk would include:

  • Inherent risk - Likelihood of error due to inherent nature of business

  • Control risk - Error / fraud due to poor internal controls

  • Detection risk - Risk that errors / anomalies / fraud won't be found due to tools used used in audit to detect them.

Only after all the above steps is complete would the auditor start thinking about the specific techniques and tools used to complete the audit. Depending on the initial risk assessment, some tools / techniques might not be needed or be inappropriate.

It is not possible to answer what tools is to be used without performing the analysis outlined above without breaching due care or standards of engagement planning given by ISACA.1

The auditor performs the audit by gathering evidence through inspection of documentation, inquiry of management, and independent verification of work done - re-performance. Documentation is meticulously kept of all testing done and any findings / observations found, to be used as the basis of the audit opinion.

After completing the audit, the auditor meets with company management to verify understanding of results and plan for followup testing of any findings during the next audit engagement.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.