Information Technology Audit
A practical starting point for assessing whether technology controls protect systems and data while supporting reliable, secure and available business operations.
What are we trying to establish?
Determine whether technology controls protect systems and data while supporting reliable, secure and available business operations.
Risks worth paying attention to
What should you request?
- Information Technology policies and asset inventory
- User access listing and role matrix
- Joiner, mover and leaver records
- Privileged access reports
- Change management records
- Backup and restoration logs
- Incident and service desk reports
- Patch and vulnerability reports
- Business continuity and disaster recovery plans
Understand the process before testing.
- Who initiates, reviews and approves transactions?
- Which duties should be separated?
- What system controls and approval limits apply?
- How are exceptions identified, approved and monitored?
- How does management know key controls actually operated?
Practical tests you can perform
Review user access against job responsibilities
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Test joiner, mover and leaver access changes
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Review privileged accounts and activities
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Test system changes to approval and testing evidence
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Review backup success and restoration tests
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Assess patching and vulnerability remediation
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Review incidents and recurring root causes
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Evaluate disaster recovery testing and recovery objectives
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Things that should make you look deeper
- Transactions or activities outside normal patterns
- Missing or retrospective approvals
- Repeated exceptions without root-cause action
- Manual adjustments with weak supporting evidence
- Key controls dependent on one person
- Management reports that cannot be reconciled to source records
Questions that can open up the process
- What can go wrong in this process?
- Which controls are most important, and who performs them?
- Where does the process depend heavily on manual intervention?
- Which exceptions occur most often, and why?
- What information does management use to know the process is working?
Need a more detailed checklist?
Steal My Checklist contains ready-to-use audit procedures designed to help you structure fieldwork across key business areas.
Get Steal My Checklist