An IT security audit is an independent analysis of a company's IT system controls, policies, and procedures to evaluate their adequacy and ensure compliance. The document discusses the importance of governance, risk management, and compliance for IT security audits. It also outlines the audit process, future trends including a focus on risk and analytics, and regulatory issues concerning frameworks, cybersecurity, and auditing standards.

1. IT Security AuditIT Security Audit
By John IntindoloBy John Intindolo
ISSC471ISSC471
Instructor Jenelle DavisInstructor Jenelle Davis

2. What is an IT Security Audit?What is an IT Security Audit?
An IT security Audit is an independent analysis and inspection ofAn IT security Audit is an independent analysis and inspection of
records and activities to calculate the adequacy of systemrecords and activities to calculate the adequacy of system
controls, certify compliance with company policies and procedures,controls, certify compliance with company policies and procedures,
and to recommend necessary changes in controls, policies, and/orand to recommend necessary changes in controls, policies, and/or
procedures (Goldberg, n.d.).procedures (Goldberg, n.d.).

3. - Governance- Governance
- Risk Management- Risk Management
- Compliance- Compliance
GRC- Responsibility for Corporate
Governance
(“Outline for the,” n.d.)

4. Importance of GovernanceImportance of Governance
 Principles of Corporate Governance:Principles of Corporate Governance:
- Shareholder recognition- Shareholder recognition
- Stakeholder interests- Stakeholder interests
- Board responsibilities must be clearly outlined- Board responsibilities must be clearly outlined
to majority shareholdersto majority shareholders
- Code of conduct for ethical decisions should be- Code of conduct for ethical decisions should be
established for all board membersestablished for all board members
- Business transparency to promote shareholder- Business transparency to promote shareholder
trusttrust
Corporate governance is intended to “increase theCorporate governance is intended to “increase the
accountability of your company and to avoidaccountability of your company and to avoid
massive disasters before they occur” so that amassive disasters before they occur” so that a
company does not cause its employees andcompany does not cause its employees and
shareholders to go bankrupt (Sun, n.d.). i.e. Enron.shareholders to go bankrupt (Sun, n.d.). i.e. Enron.
(“Corporate governance,” n.d.)

5. Importance of RiskImportance of Risk
ManagementManagement
 Reasons Risk Management is Important:Reasons Risk Management is Important:
- Identifying threats and vulnerabilities relevant to- Identifying threats and vulnerabilities relevant to
the organizationthe organization
- Implements controls to minimize risks- Implements controls to minimize risks
- Ensures business survivability- Ensures business survivability
(“Risk management cycle,” n.d.)

6. Importance of ComplianceImportance of Compliance
 Reasons Compliance is Important:Reasons Compliance is Important:
- Risk of sanctions in the event of a- Risk of sanctions in the event of a
breach (criminal, civil, or both)breach (criminal, civil, or both)
- CIA Triad (Confidentiality, Integrity,- CIA Triad (Confidentiality, Integrity,
and Availability) of the organization’sand Availability) of the organization’s
systemsystem
i.e. When Target had many of its customer’si.e. When Target had many of its customer’s
credit card information stolen this pastcredit card information stolen this past
winter, it had a negative effect on theirwinter, it had a negative effect on their
reputation as many people did not want toreputation as many people did not want to
shop there as a result of the incident.shop there as a result of the incident.(“Quiet please compliance,” n.d.)

7. Importance of ComplianceImportance of Compliance
Cont’d.Cont’d.
 ComplianceCompliance
– Privacy practices & policiesPrivacy practices & policies
– Risk assessmentRisk assessment
– Encryption for work-related e-mailsEncryption for work-related e-mails
– Training on privacy practices & policiesTraining on privacy practices & policies
 Maintaining ComplianceMaintaining Compliance
– Periodic security assessmentsPeriodic security assessments
– Annual security compliance auditsAnnual security compliance audits
– Well-defined proper security controlsWell-defined proper security controls
(“Compliance,” n.d.)

8. Audit ProcessAudit Process
 ScopeScope
– The outline of the entire auditThe outline of the entire audit
 IT Infrastructure Audit ReportIT Infrastructure Audit Report
– Must be properly written so management will consider the measuresMust be properly written so management will consider the measures
needed to improve compliance throughout the IT infrastructureneeded to improve compliance throughout the IT infrastructure
– Communicates the resultsCommunicates the results
– Prevents misinterpretation of the resultsPrevents misinterpretation of the results
– Details a list of recommendations to improve complianceDetails a list of recommendations to improve compliance
 Writing the IT Audit ReportWriting the IT Audit Report
– Executive SummaryExecutive Summary
– Summary of FindingsSummary of Findings
– Gap AnalysisGap Analysis
– IT Security AssessmentIT Security Assessment
– Security Controls and CountermeasuresSecurity Controls and Countermeasures
– Compliance AssessmentCompliance Assessment
– Compliance RecommendationsCompliance Recommendations
(“Business and it,” n.d.)

9. Future Trends of IT AuditsFuture Trends of IT Audits
 Focus on RiskFocus on Risk
– Less emphasis on controlsLess emphasis on controls
– More emphasis on Risk Management and GovernanceMore emphasis on Risk Management and Governance
 Reporting StructureReporting Structure
– More reporting to the CEO rather than the CFOMore reporting to the CEO rather than the CFO
– Risk committees will become more common and perhaps represent aRisk committees will become more common and perhaps represent a
majority over Audit committeesmajority over Audit committees
– A hybrid reporting structure in some cases where a chief risk officerA hybrid reporting structure in some cases where a chief risk officer
will be created to handle internal auditswill be created to handle internal audits
 Background SkillsBackground Skills
– People who know businessPeople who know business
– Ability to mitigate riskAbility to mitigate risk
– Ability to distinguish between efficiency and effectivenessAbility to distinguish between efficiency and effectiveness
– Possess Analytical and critical thinking skillsPossess Analytical and critical thinking skills

10. Future Trends of IT AuditsFuture Trends of IT Audits
Cont’d.Cont’d.
 Rise of MillenialsRise of Millenials
– Those born in the last centuryThose born in the last century
– Greater comfort level with using advanced technology to communicateGreater comfort level with using advanced technology to communicate
with audit clients than older colleagueswith audit clients than older colleagues
– Create a more flexible work environmentCreate a more flexible work environment
 Big TechnologyBig Technology
– Analytic tools will be able to analyze vast amounts of data on emergingAnalytic tools will be able to analyze vast amounts of data on emerging
trends and anomaliestrends and anomalies
– Movement towards continuous auditingMovement towards continuous auditing
– Advancements in technology will greatly affect the audit processAdvancements in technology will greatly affect the audit process
 Combined AssuranceCombined Assurance
– Cross-functional AssuranceCross-functional Assurance
– Different assurance activities will combine to become moreDifferent assurance activities will combine to become more
efficient and effectiveefficient and effective

11. IT Audit CompaniesIT Audit Companies
 ProtivitiProtiviti
– Improving internal auditing through technologyImproving internal auditing through technology
 CoalfireCoalfire
– Provides a unique, unbiased perspective into the effectiveness andProvides a unique, unbiased perspective into the effectiveness and
efficiency of IT controlsefficiency of IT controls
 Enterprise Risk ManagementEnterprise Risk Management
– Use customized tools, expert resources, and proven methodologies soUse customized tools, expert resources, and proven methodologies so
that the IT audit service is specifically designed for your companythat the IT audit service is specifically designed for your company
 TrustCCTrustCC
– Modular approach to IT auditing so that clients may choose whichModular approach to IT auditing so that clients may choose which
modules they want and how often they want to audit eachmodules they want and how often they want to audit each

12. Regulatory IssuesRegulatory Issues
 Updated COSO Framework QuestionsUpdated COSO Framework Questions
– Is the framework being used for internal control over reporting only, or for operations andIs the framework being used for internal control over reporting only, or for operations and
regulatory compliance as well?regulatory compliance as well?
– Are company controls mapped to the new framework?Are company controls mapped to the new framework?
– How are possible gaps between current processes, controls, or documentation beingHow are possible gaps between current processes, controls, or documentation being
addressed in the new framework?addressed in the new framework?
– Is the company educating everyone on the content of the updated COSO framework?Is the company educating everyone on the content of the updated COSO framework?
 CybersecurityCybersecurity
– What are the critical assets that need to be secured, how are vulnerabilities identified, andWhat are the critical assets that need to be secured, how are vulnerabilities identified, and
how are risk disclosed?how are risk disclosed?
– What is the overall strategy for protecting against cyber attacks?What is the overall strategy for protecting against cyber attacks?
– How robust are the organization’s incident response and communications plans?How robust are the organization’s incident response and communications plans?
 Proposed Auditor’s Reporting ModelProposed Auditor’s Reporting Model
– Changes could significantly change the external auditor’s report and create a need forChanges could significantly change the external auditor’s report and create a need for
expanded audit proceduresexpanded audit procedures
– Enhanced language in the auditor’s report on the responsibilities of the auditorEnhanced language in the auditor’s report on the responsibilities of the auditor
– New statements in the auditor’s report that will provide additional information on areas likeNew statements in the auditor’s report that will provide additional information on areas like
auditor independence and tenureauditor independence and tenure

13. ReferencesReferences
 Business and it audit [Web Graphic]. Retrieved from
http://www.boundlessllc.com/images/Audit_27.jpg
 Compliance [Web Graphic]. Retrieved from
https://www.atcoresystems.com/sugarcrm-
images/compliance_sugarcrm_atcore_systems.jpg
 Corporate governance [Web Graphic]. Retrieved from
http://www.insecticidesindia.com/images/corporate-
governance.jpg
 Goldberg, M. IT Security Auditing [PowerPoint slides]. Retrieved
from https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=11&cad=rja&uact=8&ve
d=0CKQBEBYwCg&url=https%3A%2F%2Fisis.poly.edu
%2Fcourses%2Fcs996-management-s2005%2FLectures
%2Fsecurity
%2520audit.ppt&ei=LIyTU9_qJNTNsQT_n4CQCg&usg=AFQjCNEw
Yf2W68P7jNw9J6DzJxNirMhLDw&sig2=2JrsyrbmWZ_4s1xhQeOVz
A&bvm=bv.68445247,d.cWc

14. References Cont’d.References Cont’d.
 Jackson, R. (2013). Internal audit in 2020. Retrieved from
http://www.theiia.org/intAuditor/feature-
articles/2013/december/internal-audit-in-2020/
 Outline of the holistic responsibility for corporate governance
[Web Graphic]. Retrieved from
http://www.isaca.org/Images/journal/j0905-complinace-mgt1.gif
 Quiet please compliance person at work [Web Graphic]. Retrieved
from
http://hipaanews.net/files/2010/10/quiet_please_compliance_per
son_at_work_tshirt-p2359222439750942623gdm_400-
300x300.jpg
 Risk management cycle [Web Graphic]. Retrieved from
http://www.pharmadirections.com/images/Headers and
Graphics/riskmanagement.jpg
 Sun, L. (n.d.). Why is corporate governance important. Retrieved
from http://www.businessdictionary.com/article/618/why-is-
corporate-governance-important/

15. References Cont’d.References Cont’d.
 Top issues for audit committees in 2014. (2014). Retrieved from
http://deloitte.wsj.com/riskandcompliance/2014/01/10/top-
issues-for-audit-committees-in-2014/