I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the right direction. Specific links to journals and/or templates that are used would be very helpful.
This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents.
From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of specific technologies, and contributed to maybe 50 of those. The time investment is pretty high.
In saying that, I would definitely suggest you join ISACA (the Information Systems Audit and Control Association), which is the definitive body for this industry. A vast amount of information is available through ISACA, including CobIT and audit guidance.
(disclosure - one of my roles is President of the Scottish ISACA chapter)
The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations.
I've met good auditors, and I've met poor auditors, and good auditing is more than having the right software, journals, or templates. I don't know what your masters is in, but it likely has not prepared you for being on-the-ground in an audit. Being in front of clients, asking questions, and digging out the answers that they don't even know they have sometimes. (You don't mention your work experience, which may be relevant for all I know).
Just my .02c. Good luck!
You could look at PTES - Penetration Testing Execution Standard site - http://www.pentest-standard.org/index.php/Main_Page
It's slowly getting filled out but has a lot of very useful information.
You could also look at the Open Source Security Testing Methodology Manual - http://www.isecom.org/osstmm/
As an a practicing IT Auditor, let me provide you an answer from experience. Before I explain, I want to say that Your approach is fundamentally flawed from the question you asked in the question body.
What software tools are required
This form of thinking is misguided. The first step in performing a professional audit is planning and gathering information on the client. Important information you would want to obtain includes, but is not limited to:
- Objective of audit - What procedure / process / criteria is being assessed?
- What is the scope of the audit - What will the audit cover?
- Any material changes within the business since the last audit done
- Any findings of these past audits - assuming this audit is not the first
From the above, an auditor would conduct a risk assessment with the end goal being to establish a level of total audit risk. To start, the IT auditor obtains an understanding of the business / control environment to answer the following questions - not exclusive depending on auditee.
- What processes are currently in place and how they work?
- What controls have been set by management to ensure IT processes work for the business as management intended?
- What is the "tune at the top" with regard to risk and compliance with legal regulations / corporate policies?
The techniques an auditor would use at this stage include process walkthrough, inquiry of management and observation. With a understanding of the business and current controls, auditors quantify total risk. Components of total risk would include:
Inherent risk - Likelihood of error due to inherent nature of business
Control risk - Error / fraud due to poor internal controls
Detection risk - Risk that errors / anomalies / fraud won't be found due to tools used used in audit to detect them.
Only after all the above steps is complete would the auditor start thinking about the specific techniques and tools used to complete the audit. Depending on the initial risk assessment, some tools / techniques might not be needed or be inappropriate.
The auditor performs the audit by gathering evidence through inspection of documentation, inquiry of management, and independent verification of work done - re-performance. Documentation is meticulously kept of all testing done and any findings / observations found, to be used as the basis of the audit opinion.
After completing the audit, the auditor meets with company management to verify understanding of results and plan for followup testing of any findings during the next audit engagement.